1 files changed, 78 insertions, 23 deletions

diff --git a/sshd_config.0 b/sshd_config.0
index 0b340ad20..15a6c9004 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -34,6 +34,12 @@ DESCRIPTION
              arguments are ``any'', ``inet'' (use IPv4 only), or ``inet6''
              (use IPv6 only).  The default is ``any''.
 
+     AllowAgentForwarding
+             Specifies whether ssh-agent(1) forwarding is permitted.  The de-
+             fault is ``yes''.  Note that disabling agent forwarding does not
+             improve security unless users are also denied shell access, as
+             they can always install their own forwarders.
+
      AllowGroups
              This keyword can be followed by a list of group name patterns,
              separated by spaces.  If specified, login is allowed only for
@@ -76,10 +82,9 @@ DESCRIPTION
              path or one relative to the user's home directory.  The default
              is ``.ssh/authorized_keys''.
 
-     Banner  In some jurisdictions, sending a warning message before authenti-
-             cation may be relevant for getting legal protection.  The con-
-             tents of the specified file are sent to the remote user before
-             authentication is allowed.  This option is only available for
+     Banner  The contents of the specified file are sent to the remote user
+             before authentication is allowed.  If the argument is ``none''
+             then no banner is displayed.  This option is only available for
              protocol version 2.  By default, no banner is displayed.
 
      ChallengeResponseAuthentication
@@ -87,6 +92,28 @@ DESCRIPTION
              All authentication styles from login.conf(5) are supported.  The
              default is ``yes''.
 
+     ChrootDirectory
+             Specifies a path to chroot(2) to after authentication.  This
+             path, and all its components, must be root-owned directories that
+             are not writable by any other user or group.
+
+             The path may contain the following tokens that are expanded at
+             runtime once the connecting user has been authenticated: %% is
+             replaced by a literal '%', %h is replaced by the home directory
+             of the user being authenticated, and %u is replaced by the user-
+             name of that user.
+
+             The ChrootDirectory must contain the necessary files and directo-
+             ries to support the users' session.  For an interactive session
+             this requires at least a shell, typically sh(1), and basic /dev
+             nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4),
+             arandom(4) and tty(4) devices.  For file transfer sessions using
+             ``sftp'', no additional configuration of the environment is nec-
+             essary if the in-process sftp server is used (see Subsystem for
+             details).
+
+             The default is not to chroot(2).
+
      Ciphers
              Specifies the ciphers allowed for protocol version 2.  Multiple
              ciphers must be comma-separated.  The supported ciphers are
@@ -156,12 +183,15 @@ DESCRIPTION
 
      ForceCommand
              Forces the execution of the command specified by ForceCommand,
-             ignoring any command supplied by the client.  The command is in-
-             voked by using the user's login shell with the -c option.  This
-             applies to shell, command, or subsystem execution.  It is most
-             useful inside a Match block.  The command originally supplied by
-             the client is available in the SSH_ORIGINAL_COMMAND environment
-             variable.
+             ignoring any command supplied by the client and ~/.ssh/rc if pre-
+             sent.  The command is invoked by using the user's login shell
+             with the -c option.  This applies to shell, command, or subsystem
+             execution.  It is most useful inside a Match block.  The command
+             originally supplied by the client is available in the
+             SSH_ORIGINAL_COMMAND environment variable.  Specifying a command
+             of ``internal-sftp'' will force the use of an in-process sftp
+             server that requires no support files when used with
+             ChrootDirectory.
 
      GatewayPorts
              Specifies whether remote hosts are allowed to connect to ports
@@ -290,22 +320,40 @@ DESCRIPTION
      Match   Introduces a conditional block.  If all of the criteria on the
              Match line are satisfied, the keywords on the following lines
              override those set in the global section of the config file, un-
-             til either another Match line or the end of the file.  The argu-
-             ments to Match are one or more criteria-pattern pairs.  The
-             available criteria are User, Group, Host, and Address.  Only a
-             subset of keywords may be used on the lines following a Match
-             keyword.  Available keywords are AllowTcpForwarding, Banner,
-             ForceCommand, GatewayPorts, GSSApiAuthentication,
+             til either another Match line or the end of the file.
+
+             The arguments to Match are one or more criteria-pattern pairs.
+             The available criteria are User, Group, Host, and Address.  The
+             match patterns may consist of single entries or comma-separated
+             lists and may use the wildcard and negation operators described
+             in the PATTERNS section of ssh_config(5).
+
+             The patterns in an Address criteria may additionally contain ad-
+             dresses to match in CIDR address/masklen format, e.g.
+             ``192.0.2.0/24'' or ``3ffe:ffff::/32''.  Note that the mask
+             length provided must be consistent with the address - it is an
+             error to specify a mask length that is too long for the address
+             or one with bits set in this host portion of the address.  For
+             example, ``192.0.2.0/33'' and ``192.0.2.0/8'' respectively.
+
+             Only a subset of keywords may be used on the lines following a
+             Match keyword.  Available keywords are AllowTcpForwarding,
+             Banner, ChrootDirectory, ForceCommand, GatewayPorts,
+             GSSAPIAuthentication, HostbasedAuthentication,
              KbdInteractiveAuthentication, KerberosAuthentication,
-             PasswordAuthentication, PermitOpen, RhostsRSAAuthentication,
-             RSAAuthentication, X11DisplayOffset, X11Forwarding, and
-             X11UseLocalHost.
+             MaxAuthTries, MaxSessions, PasswordAuthentication, PermitOpen,
+             PermitRootLogin, RhostsRSAAuthentication, RSAAuthentication,
+             X11DisplayOffset, X11Forwarding, and X11UseLocalHost.
 
      MaxAuthTries
              Specifies the maximum number of authentication attempts permitted
              per connection.  Once the number of failures reaches half this
              value, additional failures are logged.  The default is 6.
 
+     MaxSessions
+             Specifies the maximum number of open sessions permitted per net-
+             work connection.  The default is 10.
+
      MaxStartups
              Specifies the maximum number of concurrent unauthenticated con-
              nections to the SSH daemon.  Additional connections will be
@@ -416,7 +464,7 @@ DESCRIPTION
 
      ServerKeyBits
              Defines the number of bits in the ephemeral protocol version 1
-             server key.  The minimum value is 512, and the default is 768.
+             server key.  The minimum value is 512, and the default is 1024.
 
      StrictModes
              Specifies whether sshd(8) should check file modes and ownership
@@ -428,8 +476,15 @@ DESCRIPTION
      Subsystem
              Configures an external subsystem (e.g. file transfer daemon).
              Arguments should be a subsystem name and a command (with optional
-             arguments) to execute upon subsystem request.  The command
-             sftp-server(8) implements the ``sftp'' file transfer subsystem.
+             arguments) to execute upon subsystem request.
+
+             The command sftp-server(8) implements the ``sftp'' file transfer
+             subsystem.
+
+             Alternately the name ``internal-sftp'' implements an in-process
+             ``sftp'' server.  This may simplify configurations using
+             ChrootDirectory to force a different filesystem root on clients.
+
              By default no subsystems are defined.  Note that this option ap-
              plies to protocol version 2 only.
 
@@ -572,4 +627,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-OpenBSD 4.2                      June 11, 2007                               9
+OpenBSD 4.4                      July 2, 2008                               10