diff options
Diffstat (limited to 'sshd_config.0')
-rw-r--r-- | sshd_config.0 | 1052 |
1 files changed, 1052 insertions, 0 deletions
diff --git a/sshd_config.0 b/sshd_config.0 new file mode 100644 index 000000000..1cc7459f8 --- /dev/null +++ b/sshd_config.0 | |||
@@ -0,0 +1,1052 @@ | |||
1 | SSHD_CONFIG(5) File Formats Manual SSHD_CONFIG(5) | ||
2 | |||
3 | NAME | ||
4 | sshd_config M-bM-^@M-^S OpenSSH SSH daemon configuration file | ||
5 | |||
6 | SYNOPSIS | ||
7 | /etc/ssh/sshd_config | ||
8 | |||
9 | DESCRIPTION | ||
10 | sshd(8) reads configuration data from /etc/ssh/sshd_config (or the file | ||
11 | specified with -f on the command line). The file contains keyword- | ||
12 | argument pairs, one per line. Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines | ||
13 | are interpreted as comments. Arguments may optionally be enclosed in | ||
14 | double quotes (") in order to represent arguments containing spaces. | ||
15 | |||
16 | The possible keywords and their meanings are as follows (note that | ||
17 | keywords are case-insensitive and arguments are case-sensitive): | ||
18 | |||
19 | AcceptEnv | ||
20 | Specifies what environment variables sent by the client will be | ||
21 | copied into the session's environ(7). See SendEnv in | ||
22 | ssh_config(5) for how to configure the client. Note that | ||
23 | environment passing is only supported for protocol 2, and that | ||
24 | the TERM environment variable is always sent whenever the client | ||
25 | requests a pseudo-terminal as it is required by the protocol. | ||
26 | Variables are specified by name, which may contain the wildcard | ||
27 | characters M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^X?M-bM-^@M-^Y. Multiple environment variables may be | ||
28 | separated by whitespace or spread across multiple AcceptEnv | ||
29 | directives. Be warned that some environment variables could be | ||
30 | used to bypass restricted user environments. For this reason, | ||
31 | care should be taken in the use of this directive. The default | ||
32 | is not to accept any environment variables. | ||
33 | |||
34 | AddressFamily | ||
35 | Specifies which address family should be used by sshd(8). Valid | ||
36 | arguments are M-bM-^@M-^\anyM-bM-^@M-^], M-bM-^@M-^\inetM-bM-^@M-^] (use IPv4 only), or M-bM-^@M-^\inet6M-bM-^@M-^] (use IPv6 | ||
37 | only). The default is M-bM-^@M-^\anyM-bM-^@M-^]. | ||
38 | |||
39 | AllowAgentForwarding | ||
40 | Specifies whether ssh-agent(1) forwarding is permitted. The | ||
41 | default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that disabling agent forwarding does not | ||
42 | improve security unless users are also denied shell access, as | ||
43 | they can always install their own forwarders. | ||
44 | |||
45 | AllowGroups | ||
46 | This keyword can be followed by a list of group name patterns, | ||
47 | separated by spaces. If specified, login is allowed only for | ||
48 | users whose primary group or supplementary group list matches one | ||
49 | of the patterns. Only group names are valid; a numerical group | ||
50 | ID is not recognized. By default, login is allowed for all | ||
51 | groups. The allow/deny directives are processed in the following | ||
52 | order: DenyUsers, AllowUsers, DenyGroups, and finally | ||
53 | AllowGroups. | ||
54 | |||
55 | See PATTERNS in ssh_config(5) for more information on patterns. | ||
56 | |||
57 | AllowTcpForwarding | ||
58 | Specifies whether TCP forwarding is permitted. The available | ||
59 | options are M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\allM-bM-^@M-^] to allow TCP forwarding, M-bM-^@M-^\noM-bM-^@M-^] to | ||
60 | prevent all TCP forwarding, M-bM-^@M-^\localM-bM-^@M-^] to allow local (from the | ||
61 | perspective of ssh(1)) forwarding only or M-bM-^@M-^\remoteM-bM-^@M-^] to allow | ||
62 | remote forwarding only. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that | ||
63 | disabling TCP forwarding does not improve security unless users | ||
64 | are also denied shell access, as they can always install their | ||
65 | own forwarders. | ||
66 | |||
67 | AllowStreamLocalForwarding | ||
68 | Specifies whether StreamLocal (Unix-domain socket) forwarding is | ||
69 | permitted. The available options are M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\allM-bM-^@M-^] to allow | ||
70 | StreamLocal forwarding, M-bM-^@M-^\noM-bM-^@M-^] to prevent all StreamLocal | ||
71 | forwarding, M-bM-^@M-^\localM-bM-^@M-^] to allow local (from the perspective of | ||
72 | ssh(1)) forwarding only or M-bM-^@M-^\remoteM-bM-^@M-^] to allow remote forwarding | ||
73 | only. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that disabling StreamLocal | ||
74 | forwarding does not improve security unless users are also denied | ||
75 | shell access, as they can always install their own forwarders. | ||
76 | |||
77 | AllowUsers | ||
78 | This keyword can be followed by a list of user name patterns, | ||
79 | separated by spaces. If specified, login is allowed only for | ||
80 | user names that match one of the patterns. Only user names are | ||
81 | valid; a numerical user ID is not recognized. By default, login | ||
82 | is allowed for all users. If the pattern takes the form | ||
83 | USER@HOST then USER and HOST are separately checked, restricting | ||
84 | logins to particular users from particular hosts. The allow/deny | ||
85 | directives are processed in the following order: DenyUsers, | ||
86 | AllowUsers, DenyGroups, and finally AllowGroups. | ||
87 | |||
88 | See PATTERNS in ssh_config(5) for more information on patterns. | ||
89 | |||
90 | AuthenticationMethods | ||
91 | Specifies the authentication methods that must be successfully | ||
92 | completed for a user to be granted access. This option must be | ||
93 | followed by one or more comma-separated lists of authentication | ||
94 | method names. Successful authentication requires completion of | ||
95 | every method in at least one of these lists. | ||
96 | |||
97 | For example, an argument of M-bM-^@M-^\publickey,password | ||
98 | publickey,keyboard-interactiveM-bM-^@M-^] would require the user to | ||
99 | complete public key authentication, followed by either password | ||
100 | or keyboard interactive authentication. Only methods that are | ||
101 | next in one or more lists are offered at each stage, so for this | ||
102 | example, it would not be possible to attempt password or | ||
103 | keyboard-interactive authentication before public key. | ||
104 | |||
105 | For keyboard interactive authentication it is also possible to | ||
106 | restrict authentication to a specific device by appending a colon | ||
107 | followed by the device identifier M-bM-^@M-^\bsdauthM-bM-^@M-^], M-bM-^@M-^\pamM-bM-^@M-^], or M-bM-^@M-^\skeyM-bM-^@M-^], | ||
108 | depending on the server configuration. For example, | ||
109 | M-bM-^@M-^\keyboard-interactive:bsdauthM-bM-^@M-^] would restrict keyboard | ||
110 | interactive authentication to the M-bM-^@M-^\bsdauthM-bM-^@M-^] device. | ||
111 | |||
112 | If the M-bM-^@M-^\publickeyM-bM-^@M-^] method is listed more than once, sshd(8) | ||
113 | verifies that keys that have been used successfully are not | ||
114 | reused for subsequent authentications. For example, an | ||
115 | AuthenticationMethods of M-bM-^@M-^\publickey,publickeyM-bM-^@M-^] will require | ||
116 | successful authentication using two different public keys. | ||
117 | |||
118 | This option is only available for SSH protocol 2 and will yield a | ||
119 | fatal error if enabled if protocol 1 is also enabled. Note that | ||
120 | each authentication method listed should also be explicitly | ||
121 | enabled in the configuration. The default is not to require | ||
122 | multiple authentication; successful completion of a single | ||
123 | authentication method is sufficient. | ||
124 | |||
125 | AuthorizedKeysCommand | ||
126 | Specifies a program to be used to look up the user's public keys. | ||
127 | The program must be owned by root, not writable by group or | ||
128 | others and specified by an absolute path. | ||
129 | |||
130 | Arguments to AuthorizedKeysCommand may be provided using the | ||
131 | following tokens, which will be expanded at runtime: %% is | ||
132 | replaced by a literal '%', %u is replaced by the username being | ||
133 | authenticated, %h is replaced by the home directory of the user | ||
134 | being authenticated, %t is replaced with the key type offered for | ||
135 | authentication, %f is replaced with the fingerprint of the key, | ||
136 | and %k is replaced with the key being offered for authentication. | ||
137 | If no arguments are specified then the username of the target | ||
138 | user will be supplied. | ||
139 | |||
140 | The program should produce on standard output zero or more lines | ||
141 | of authorized_keys output (see AUTHORIZED_KEYS in sshd(8)). If a | ||
142 | key supplied by AuthorizedKeysCommand does not successfully | ||
143 | authenticate and authorize the user then public key | ||
144 | authentication continues using the usual AuthorizedKeysFile | ||
145 | files. By default, no AuthorizedKeysCommand is run. | ||
146 | |||
147 | AuthorizedKeysCommandUser | ||
148 | Specifies the user under whose account the AuthorizedKeysCommand | ||
149 | is run. It is recommended to use a dedicated user that has no | ||
150 | other role on the host than running authorized keys commands. If | ||
151 | AuthorizedKeysCommand is specified but AuthorizedKeysCommandUser | ||
152 | is not, then sshd(8) will refuse to start. | ||
153 | |||
154 | AuthorizedKeysFile | ||
155 | Specifies the file that contains the public keys that can be used | ||
156 | for user authentication. The format is described in the | ||
157 | AUTHORIZED_KEYS FILE FORMAT section of sshd(8). | ||
158 | AuthorizedKeysFile may contain tokens of the form %T which are | ||
159 | substituted during connection setup. The following tokens are | ||
160 | defined: %% is replaced by a literal '%', %h is replaced by the | ||
161 | home directory of the user being authenticated, and %u is | ||
162 | replaced by the username of that user. After expansion, | ||
163 | AuthorizedKeysFile is taken to be an absolute path or one | ||
164 | relative to the user's home directory. Multiple files may be | ||
165 | listed, separated by whitespace. The default is | ||
166 | M-bM-^@M-^\.ssh/authorized_keys .ssh/authorized_keys2M-bM-^@M-^]. | ||
167 | |||
168 | AuthorizedPrincipalsCommand | ||
169 | Specifies a program to be used to generate the list of allowed | ||
170 | certificate principals as per AuthorizedPrincipalsFile. The | ||
171 | program must be owned by root, not writable by group or others | ||
172 | and specified by an absolute path. | ||
173 | |||
174 | Arguments to AuthorizedPrincipalsCommand may be provided using | ||
175 | the following tokens, which will be expanded at runtime: %% is | ||
176 | replaced by a literal '%', %u is replaced by the username being | ||
177 | authenticated and %h is replaced by the home directory of the | ||
178 | user being authenticated. | ||
179 | |||
180 | The program should produce on standard output zero or more lines | ||
181 | of AuthorizedPrincipalsFile output. If either | ||
182 | AuthorizedPrincipalsCommand or AuthorizedPrincipalsFile is | ||
183 | specified, then certificates offered by the client for | ||
184 | authentication must contain a principal that is listed. By | ||
185 | default, no AuthorizedPrincipalsCommand is run. | ||
186 | |||
187 | AuthorizedPrincipalsCommandUser | ||
188 | Specifies the user under whose account the | ||
189 | AuthorizedPrincipalsCommand is run. It is recommended to use a | ||
190 | dedicated user that has no other role on the host than running | ||
191 | authorized principals commands. If AuthorizedPrincipalsCommand | ||
192 | is specified but AuthorizedPrincipalsCommandUser is not, then | ||
193 | sshd(8) will refuse to start. | ||
194 | |||
195 | AuthorizedPrincipalsFile | ||
196 | Specifies a file that lists principal names that are accepted for | ||
197 | certificate authentication. When using certificates signed by a | ||
198 | key listed in TrustedUserCAKeys, this file lists names, one of | ||
199 | which must appear in the certificate for it to be accepted for | ||
200 | authentication. Names are listed one per line preceded by key | ||
201 | options (as described in AUTHORIZED_KEYS FILE FORMAT in sshd(8)). | ||
202 | Empty lines and comments starting with M-bM-^@M-^X#M-bM-^@M-^Y are ignored. | ||
203 | |||
204 | AuthorizedPrincipalsFile may contain tokens of the form %T which | ||
205 | are substituted during connection setup. The following tokens | ||
206 | are defined: %% is replaced by a literal '%', %h is replaced by | ||
207 | the home directory of the user being authenticated, and %u is | ||
208 | replaced by the username of that user. After expansion, | ||
209 | AuthorizedPrincipalsFile is taken to be an absolute path or one | ||
210 | relative to the user's home directory. | ||
211 | |||
212 | The default is M-bM-^@M-^\noneM-bM-^@M-^], i.e. not to use a principals file M-bM-^@M-^S in | ||
213 | this case, the username of the user must appear in a | ||
214 | certificate's principals list for it to be accepted. Note that | ||
215 | AuthorizedPrincipalsFile is only used when authentication | ||
216 | proceeds using a CA listed in TrustedUserCAKeys and is not | ||
217 | consulted for certification authorities trusted via | ||
218 | ~/.ssh/authorized_keys, though the principals= key option offers | ||
219 | a similar facility (see sshd(8) for details). | ||
220 | |||
221 | Banner The contents of the specified file are sent to the remote user | ||
222 | before authentication is allowed. If the argument is M-bM-^@M-^\noneM-bM-^@M-^] then | ||
223 | no banner is displayed. This option is only available for | ||
224 | protocol version 2. By default, no banner is displayed. | ||
225 | |||
226 | ChallengeResponseAuthentication | ||
227 | Specifies whether challenge-response authentication is allowed | ||
228 | (e.g. via PAM or through authentication styles supported in | ||
229 | login.conf(5)) The default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
230 | |||
231 | ChrootDirectory | ||
232 | Specifies the pathname of a directory to chroot(2) to after | ||
233 | authentication. At session startup sshd(8) checks that all | ||
234 | components of the pathname are root-owned directories which are | ||
235 | not writable by any other user or group. After the chroot, | ||
236 | sshd(8) changes the working directory to the user's home | ||
237 | directory. | ||
238 | |||
239 | The pathname may contain the following tokens that are expanded | ||
240 | at runtime once the connecting user has been authenticated: %% is | ||
241 | replaced by a literal '%', %h is replaced by the home directory | ||
242 | of the user being authenticated, and %u is replaced by the | ||
243 | username of that user. | ||
244 | |||
245 | The ChrootDirectory must contain the necessary files and | ||
246 | directories to support the user's session. For an interactive | ||
247 | session this requires at least a shell, typically sh(1), and | ||
248 | basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), | ||
249 | stderr(4), and tty(4) devices. For file transfer sessions using | ||
250 | M-bM-^@M-^\sftpM-bM-^@M-^], no additional configuration of the environment is | ||
251 | necessary if the in-process sftp server is used, though sessions | ||
252 | which use logging may require /dev/log inside the chroot | ||
253 | directory on some operating systems (see sftp-server(8) for | ||
254 | details). | ||
255 | |||
256 | For safety, it is very important that the directory hierarchy be | ||
257 | prevented from modification by other processes on the system | ||
258 | (especially those outside the jail). Misconfiguration can lead | ||
259 | to unsafe environments which sshd(8) cannot detect. | ||
260 | |||
261 | The default is not to chroot(2). | ||
262 | |||
263 | Ciphers | ||
264 | Specifies the ciphers allowed for protocol version 2. Multiple | ||
265 | ciphers must be comma-separated. If the specified value begins | ||
266 | with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified ciphers will be appended | ||
267 | to the default set instead of replacing them. | ||
268 | |||
269 | The supported ciphers are: | ||
270 | |||
271 | 3des-cbc | ||
272 | aes128-cbc | ||
273 | aes192-cbc | ||
274 | aes256-cbc | ||
275 | aes128-ctr | ||
276 | aes192-ctr | ||
277 | aes256-ctr | ||
278 | aes128-gcm@openssh.com | ||
279 | aes256-gcm@openssh.com | ||
280 | arcfour | ||
281 | arcfour128 | ||
282 | arcfour256 | ||
283 | blowfish-cbc | ||
284 | cast128-cbc | ||
285 | chacha20-poly1305@openssh.com | ||
286 | |||
287 | The default is: | ||
288 | |||
289 | aes128-ctr,aes192-ctr,aes256-ctr, | ||
290 | aes128-gcm@openssh.com,aes256-gcm@openssh.com, | ||
291 | chacha20-poly1305@openssh.com | ||
292 | |||
293 | The list of available ciphers may also be obtained using the -Q | ||
294 | option of ssh(1) with an argument of M-bM-^@M-^\cipherM-bM-^@M-^]. | ||
295 | |||
296 | ClientAliveCountMax | ||
297 | Sets the number of client alive messages (see below) which may be | ||
298 | sent without sshd(8) receiving any messages back from the client. | ||
299 | If this threshold is reached while client alive messages are | ||
300 | being sent, sshd will disconnect the client, terminating the | ||
301 | session. It is important to note that the use of client alive | ||
302 | messages is very different from TCPKeepAlive (below). The client | ||
303 | alive messages are sent through the encrypted channel and | ||
304 | therefore will not be spoofable. The TCP keepalive option | ||
305 | enabled by TCPKeepAlive is spoofable. The client alive mechanism | ||
306 | is valuable when the client or server depend on knowing when a | ||
307 | connection has become inactive. | ||
308 | |||
309 | The default value is 3. If ClientAliveInterval (see below) is | ||
310 | set to 15, and ClientAliveCountMax is left at the default, | ||
311 | unresponsive SSH clients will be disconnected after approximately | ||
312 | 45 seconds. This option applies to protocol version 2 only. | ||
313 | |||
314 | ClientAliveInterval | ||
315 | Sets a timeout interval in seconds after which if no data has | ||
316 | been received from the client, sshd(8) will send a message | ||
317 | through the encrypted channel to request a response from the | ||
318 | client. The default is 0, indicating that these messages will | ||
319 | not be sent to the client. This option applies to protocol | ||
320 | version 2 only. | ||
321 | |||
322 | Compression | ||
323 | Specifies whether compression is allowed, or delayed until the | ||
324 | user has authenticated successfully. The argument must be M-bM-^@M-^\yesM-bM-^@M-^], | ||
325 | M-bM-^@M-^\delayedM-bM-^@M-^], or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\delayedM-bM-^@M-^]. | ||
326 | |||
327 | DenyGroups | ||
328 | This keyword can be followed by a list of group name patterns, | ||
329 | separated by spaces. Login is disallowed for users whose primary | ||
330 | group or supplementary group list matches one of the patterns. | ||
331 | Only group names are valid; a numerical group ID is not | ||
332 | recognized. By default, login is allowed for all groups. The | ||
333 | allow/deny directives are processed in the following order: | ||
334 | DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. | ||
335 | |||
336 | See PATTERNS in ssh_config(5) for more information on patterns. | ||
337 | |||
338 | DenyUsers | ||
339 | This keyword can be followed by a list of user name patterns, | ||
340 | separated by spaces. Login is disallowed for user names that | ||
341 | match one of the patterns. Only user names are valid; a | ||
342 | numerical user ID is not recognized. By default, login is | ||
343 | allowed for all users. If the pattern takes the form USER@HOST | ||
344 | then USER and HOST are separately checked, restricting logins to | ||
345 | particular users from particular hosts. The allow/deny | ||
346 | directives are processed in the following order: DenyUsers, | ||
347 | AllowUsers, DenyGroups, and finally AllowGroups. | ||
348 | |||
349 | See PATTERNS in ssh_config(5) for more information on patterns. | ||
350 | |||
351 | FingerprintHash | ||
352 | Specifies the hash algorithm used when logging key fingerprints. | ||
353 | Valid options are: M-bM-^@M-^\md5M-bM-^@M-^] and M-bM-^@M-^\sha256M-bM-^@M-^]. The default is M-bM-^@M-^\sha256M-bM-^@M-^]. | ||
354 | |||
355 | ForceCommand | ||
356 | Forces the execution of the command specified by ForceCommand, | ||
357 | ignoring any command supplied by the client and ~/.ssh/rc if | ||
358 | present. The command is invoked by using the user's login shell | ||
359 | with the -c option. This applies to shell, command, or subsystem | ||
360 | execution. It is most useful inside a Match block. The command | ||
361 | originally supplied by the client is available in the | ||
362 | SSH_ORIGINAL_COMMAND environment variable. Specifying a command | ||
363 | of M-bM-^@M-^\internal-sftpM-bM-^@M-^] will force the use of an in-process sftp | ||
364 | server that requires no support files when used with | ||
365 | ChrootDirectory. | ||
366 | |||
367 | GatewayPorts | ||
368 | Specifies whether remote hosts are allowed to connect to ports | ||
369 | forwarded for the client. By default, sshd(8) binds remote port | ||
370 | forwardings to the loopback address. This prevents other remote | ||
371 | hosts from connecting to forwarded ports. GatewayPorts can be | ||
372 | used to specify that sshd should allow remote port forwardings to | ||
373 | bind to non-loopback addresses, thus allowing other hosts to | ||
374 | connect. The argument may be M-bM-^@M-^\noM-bM-^@M-^] to force remote port | ||
375 | forwardings to be available to the local host only, M-bM-^@M-^\yesM-bM-^@M-^] to | ||
376 | force remote port forwardings to bind to the wildcard address, or | ||
377 | M-bM-^@M-^\clientspecifiedM-bM-^@M-^] to allow the client to select the address to | ||
378 | which the forwarding is bound. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
379 | |||
380 | GSSAPIAuthentication | ||
381 | Specifies whether user authentication based on GSSAPI is allowed. | ||
382 | The default is M-bM-^@M-^\noM-bM-^@M-^]. Note that this option applies to protocol | ||
383 | version 2 only. | ||
384 | |||
385 | GSSAPICleanupCredentials | ||
386 | Specifies whether to automatically destroy the user's credentials | ||
387 | cache on logout. The default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that this option | ||
388 | applies to protocol version 2 only. | ||
389 | |||
390 | GSSAPIStrictAcceptorCheck | ||
391 | Determines whether to be strict about the identity of the GSSAPI | ||
392 | acceptor a client authenticates against. If set to M-bM-^@M-^\yesM-bM-^@M-^] then | ||
393 | the client must authenticate against the host service on the | ||
394 | current hostname. If set to M-bM-^@M-^\noM-bM-^@M-^] then the client may | ||
395 | authenticate against any service key stored in the machine's | ||
396 | default store. This facility is provided to assist with | ||
397 | operation on multi homed machines. The default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
398 | |||
399 | HostbasedAcceptedKeyTypes | ||
400 | Specifies the key types that will be accepted for hostbased | ||
401 | authentication as a comma-separated pattern list. Alternately if | ||
402 | the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the | ||
403 | specified key types will be appended to the default set instead | ||
404 | of replacing them. The default for this option is: | ||
405 | |||
406 | ecdsa-sha2-nistp256-cert-v01@openssh.com, | ||
407 | ecdsa-sha2-nistp384-cert-v01@openssh.com, | ||
408 | ecdsa-sha2-nistp521-cert-v01@openssh.com, | ||
409 | ssh-ed25519-cert-v01@openssh.com, | ||
410 | ssh-rsa-cert-v01@openssh.com, | ||
411 | ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, | ||
412 | ssh-ed25519,ssh-rsa | ||
413 | |||
414 | The -Q option of ssh(1) may be used to list supported key types. | ||
415 | |||
416 | HostbasedAuthentication | ||
417 | Specifies whether rhosts or /etc/hosts.equiv authentication | ||
418 | together with successful public key client host authentication is | ||
419 | allowed (host-based authentication). This option is similar to | ||
420 | RhostsRSAAuthentication and applies to protocol version 2 only. | ||
421 | The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
422 | |||
423 | HostbasedUsesNameFromPacketOnly | ||
424 | Specifies whether or not the server will attempt to perform a | ||
425 | reverse name lookup when matching the name in the ~/.shosts, | ||
426 | ~/.rhosts, and /etc/hosts.equiv files during | ||
427 | HostbasedAuthentication. A setting of M-bM-^@M-^\yesM-bM-^@M-^] means that sshd(8) | ||
428 | uses the name supplied by the client rather than attempting to | ||
429 | resolve the name from the TCP connection itself. The default is | ||
430 | M-bM-^@M-^\noM-bM-^@M-^]. | ||
431 | |||
432 | HostCertificate | ||
433 | Specifies a file containing a public host certificate. The | ||
434 | certificate's public key must match a private host key already | ||
435 | specified by HostKey. The default behaviour of sshd(8) is not to | ||
436 | load any certificates. | ||
437 | |||
438 | HostKey | ||
439 | Specifies a file containing a private host key used by SSH. The | ||
440 | default is /etc/ssh/ssh_host_key for protocol version 1, and | ||
441 | /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_ecdsa_key, | ||
442 | /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_rsa_key for | ||
443 | protocol version 2. | ||
444 | |||
445 | Note that sshd(8) will refuse to use a file if it is group/world- | ||
446 | accessible and that the HostKeyAlgorithms option restricts which | ||
447 | of the keys are actually used by sshd(8). | ||
448 | |||
449 | It is possible to have multiple host key files. M-bM-^@M-^\rsa1M-bM-^@M-^] keys are | ||
450 | used for version 1 and M-bM-^@M-^\dsaM-bM-^@M-^], M-bM-^@M-^\ecdsaM-bM-^@M-^], M-bM-^@M-^\ed25519M-bM-^@M-^] or M-bM-^@M-^\rsaM-bM-^@M-^] are | ||
451 | used for version 2 of the SSH protocol. It is also possible to | ||
452 | specify public host key files instead. In this case operations | ||
453 | on the private key will be delegated to an ssh-agent(1). | ||
454 | |||
455 | HostKeyAgent | ||
456 | Identifies the UNIX-domain socket used to communicate with an | ||
457 | agent that has access to the private host keys. If | ||
458 | M-bM-^@M-^\SSH_AUTH_SOCKM-bM-^@M-^] is specified, the location of the socket will be | ||
459 | read from the SSH_AUTH_SOCK environment variable. | ||
460 | |||
461 | HostKeyAlgorithms | ||
462 | Specifies the protocol version 2 host key algorithms that the | ||
463 | server offers. The default for this option is: | ||
464 | |||
465 | ecdsa-sha2-nistp256-cert-v01@openssh.com, | ||
466 | ecdsa-sha2-nistp384-cert-v01@openssh.com, | ||
467 | ecdsa-sha2-nistp521-cert-v01@openssh.com, | ||
468 | ssh-ed25519-cert-v01@openssh.com, | ||
469 | ssh-rsa-cert-v01@openssh.com, | ||
470 | ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, | ||
471 | ssh-ed25519,ssh-rsa | ||
472 | |||
473 | The list of available key types may also be obtained using the -Q | ||
474 | option of ssh(1) with an argument of M-bM-^@M-^\keyM-bM-^@M-^]. | ||
475 | |||
476 | IgnoreRhosts | ||
477 | Specifies that .rhosts and .shosts files will not be used in | ||
478 | RhostsRSAAuthentication or HostbasedAuthentication. | ||
479 | |||
480 | /etc/hosts.equiv and /etc/shosts.equiv are still used. The | ||
481 | default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
482 | |||
483 | IgnoreUserKnownHosts | ||
484 | Specifies whether sshd(8) should ignore the user's | ||
485 | ~/.ssh/known_hosts during RhostsRSAAuthentication or | ||
486 | HostbasedAuthentication. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
487 | |||
488 | IPQoS Specifies the IPv4 type-of-service or DSCP class for the | ||
489 | connection. Accepted values are M-bM-^@M-^\af11M-bM-^@M-^], M-bM-^@M-^\af12M-bM-^@M-^], M-bM-^@M-^\af13M-bM-^@M-^], M-bM-^@M-^\af21M-bM-^@M-^], | ||
490 | M-bM-^@M-^\af22M-bM-^@M-^], M-bM-^@M-^\af23M-bM-^@M-^], M-bM-^@M-^\af31M-bM-^@M-^], M-bM-^@M-^\af32M-bM-^@M-^], M-bM-^@M-^\af33M-bM-^@M-^], M-bM-^@M-^\af41M-bM-^@M-^], M-bM-^@M-^\af42M-bM-^@M-^], M-bM-^@M-^\af43M-bM-^@M-^], | ||
491 | M-bM-^@M-^\cs0M-bM-^@M-^], M-bM-^@M-^\cs1M-bM-^@M-^], M-bM-^@M-^\cs2M-bM-^@M-^], M-bM-^@M-^\cs3M-bM-^@M-^], M-bM-^@M-^\cs4M-bM-^@M-^], M-bM-^@M-^\cs5M-bM-^@M-^], M-bM-^@M-^\cs6M-bM-^@M-^], M-bM-^@M-^\cs7M-bM-^@M-^], M-bM-^@M-^\efM-bM-^@M-^], | ||
492 | M-bM-^@M-^\lowdelayM-bM-^@M-^], M-bM-^@M-^\throughputM-bM-^@M-^], M-bM-^@M-^\reliabilityM-bM-^@M-^], or a numeric value. | ||
493 | This option may take one or two arguments, separated by | ||
494 | whitespace. If one argument is specified, it is used as the | ||
495 | packet class unconditionally. If two values are specified, the | ||
496 | first is automatically selected for interactive sessions and the | ||
497 | second for non-interactive sessions. The default is M-bM-^@M-^\lowdelayM-bM-^@M-^] | ||
498 | for interactive sessions and M-bM-^@M-^\throughputM-bM-^@M-^] for non-interactive | ||
499 | sessions. | ||
500 | |||
501 | KbdInteractiveAuthentication | ||
502 | Specifies whether to allow keyboard-interactive authentication. | ||
503 | The argument to this keyword must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default | ||
504 | is to use whatever value ChallengeResponseAuthentication is set | ||
505 | to (by default M-bM-^@M-^\yesM-bM-^@M-^]). | ||
506 | |||
507 | KerberosAuthentication | ||
508 | Specifies whether the password provided by the user for | ||
509 | PasswordAuthentication will be validated through the Kerberos | ||
510 | KDC. To use this option, the server needs a Kerberos servtab | ||
511 | which allows the verification of the KDC's identity. The default | ||
512 | is M-bM-^@M-^\noM-bM-^@M-^]. | ||
513 | |||
514 | KerberosGetAFSToken | ||
515 | If AFS is active and the user has a Kerberos 5 TGT, attempt to | ||
516 | acquire an AFS token before accessing the user's home directory. | ||
517 | The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
518 | |||
519 | KerberosOrLocalPasswd | ||
520 | If password authentication through Kerberos fails then the | ||
521 | password will be validated via any additional local mechanism | ||
522 | such as /etc/passwd. The default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
523 | |||
524 | KerberosTicketCleanup | ||
525 | Specifies whether to automatically destroy the user's ticket | ||
526 | cache file on logout. The default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
527 | |||
528 | KexAlgorithms | ||
529 | Specifies the available KEX (Key Exchange) algorithms. Multiple | ||
530 | algorithms must be comma-separated. Alternately if the specified | ||
531 | value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the specified methods | ||
532 | will be appended to the default set instead of replacing them. | ||
533 | The supported algorithms are: | ||
534 | |||
535 | curve25519-sha256@libssh.org | ||
536 | diffie-hellman-group1-sha1 | ||
537 | diffie-hellman-group14-sha1 | ||
538 | diffie-hellman-group-exchange-sha1 | ||
539 | diffie-hellman-group-exchange-sha256 | ||
540 | ecdh-sha2-nistp256 | ||
541 | ecdh-sha2-nistp384 | ||
542 | ecdh-sha2-nistp521 | ||
543 | |||
544 | The default is: | ||
545 | |||
546 | curve25519-sha256@libssh.org, | ||
547 | ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, | ||
548 | diffie-hellman-group-exchange-sha256, | ||
549 | diffie-hellman-group14-sha1 | ||
550 | |||
551 | The list of available key exchange algorithms may also be | ||
552 | obtained using the -Q option of ssh(1) with an argument of M-bM-^@M-^\kexM-bM-^@M-^]. | ||
553 | |||
554 | KeyRegenerationInterval | ||
555 | In protocol version 1, the ephemeral server key is automatically | ||
556 | regenerated after this many seconds (if it has been used). The | ||
557 | purpose of regeneration is to prevent decrypting captured | ||
558 | sessions by later breaking into the machine and stealing the | ||
559 | keys. The key is never stored anywhere. If the value is 0, the | ||
560 | key is never regenerated. The default is 3600 (seconds). | ||
561 | |||
562 | ListenAddress | ||
563 | Specifies the local addresses sshd(8) should listen on. The | ||
564 | following forms may be used: | ||
565 | |||
566 | ListenAddress host|IPv4_addr|IPv6_addr | ||
567 | ListenAddress host|IPv4_addr:port | ||
568 | ListenAddress [host|IPv6_addr]:port | ||
569 | |||
570 | If port is not specified, sshd will listen on the address and all | ||
571 | Port options specified. The default is to listen on all local | ||
572 | addresses. Multiple ListenAddress options are permitted. | ||
573 | |||
574 | LoginGraceTime | ||
575 | The server disconnects after this time if the user has not | ||
576 | successfully logged in. If the value is 0, there is no time | ||
577 | limit. The default is 120 seconds. | ||
578 | |||
579 | LogLevel | ||
580 | Gives the verbosity level that is used when logging messages from | ||
581 | sshd(8). The possible values are: QUIET, FATAL, ERROR, INFO, | ||
582 | VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. | ||
583 | DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify | ||
584 | higher levels of debugging output. Logging with a DEBUG level | ||
585 | violates the privacy of users and is not recommended. | ||
586 | |||
587 | MACs Specifies the available MAC (message authentication code) | ||
588 | algorithms. The MAC algorithm is used in protocol version 2 for | ||
589 | data integrity protection. Multiple algorithms must be comma- | ||
590 | separated. If the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, | ||
591 | then the specified algorithms will be appended to the default set | ||
592 | instead of replacing them. | ||
593 | |||
594 | The algorithms that contain M-bM-^@M-^\-etmM-bM-^@M-^] calculate the MAC after | ||
595 | encryption (encrypt-then-mac). These are considered safer and | ||
596 | their use recommended. The supported MACs are: | ||
597 | |||
598 | hmac-md5 | ||
599 | hmac-md5-96 | ||
600 | hmac-ripemd160 | ||
601 | hmac-sha1 | ||
602 | hmac-sha1-96 | ||
603 | hmac-sha2-256 | ||
604 | hmac-sha2-512 | ||
605 | umac-64@openssh.com | ||
606 | umac-128@openssh.com | ||
607 | hmac-md5-etm@openssh.com | ||
608 | hmac-md5-96-etm@openssh.com | ||
609 | hmac-ripemd160-etm@openssh.com | ||
610 | hmac-sha1-etm@openssh.com | ||
611 | hmac-sha1-96-etm@openssh.com | ||
612 | hmac-sha2-256-etm@openssh.com | ||
613 | hmac-sha2-512-etm@openssh.com | ||
614 | umac-64-etm@openssh.com | ||
615 | umac-128-etm@openssh.com | ||
616 | |||
617 | The default is: | ||
618 | |||
619 | umac-64-etm@openssh.com,umac-128-etm@openssh.com, | ||
620 | hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, | ||
621 | umac-64@openssh.com,umac-128@openssh.com, | ||
622 | hmac-sha2-256,hmac-sha2-512 | ||
623 | |||
624 | The list of available MAC algorithms may also be obtained using | ||
625 | the -Q option of ssh(1) with an argument of M-bM-^@M-^\macM-bM-^@M-^]. | ||
626 | |||
627 | Match Introduces a conditional block. If all of the criteria on the | ||
628 | Match line are satisfied, the keywords on the following lines | ||
629 | override those set in the global section of the config file, | ||
630 | until either another Match line or the end of the file. If a | ||
631 | keyword appears in multiple Match blocks that are satisfied, only | ||
632 | the first instance of the keyword is applied. | ||
633 | |||
634 | The arguments to Match are one or more criteria-pattern pairs or | ||
635 | the single token All which matches all criteria. The available | ||
636 | criteria are User, Group, Host, LocalAddress, LocalPort, and | ||
637 | Address. The match patterns may consist of single entries or | ||
638 | comma-separated lists and may use the wildcard and negation | ||
639 | operators described in the PATTERNS section of ssh_config(5). | ||
640 | |||
641 | The patterns in an Address criteria may additionally contain | ||
642 | addresses to match in CIDR address/masklen format, e.g. | ||
643 | M-bM-^@M-^\192.0.2.0/24M-bM-^@M-^] or M-bM-^@M-^\3ffe:ffff::/32M-bM-^@M-^]. Note that the mask length | ||
644 | provided must be consistent with the address - it is an error to | ||
645 | specify a mask length that is too long for the address or one | ||
646 | with bits set in this host portion of the address. For example, | ||
647 | M-bM-^@M-^\192.0.2.0/33M-bM-^@M-^] and M-bM-^@M-^\192.0.2.0/8M-bM-^@M-^] respectively. | ||
648 | |||
649 | Only a subset of keywords may be used on the lines following a | ||
650 | Match keyword. Available keywords are AcceptEnv, | ||
651 | AllowAgentForwarding, AllowGroups, AllowStreamLocalForwarding, | ||
652 | AllowTcpForwarding, AllowUsers, AuthenticationMethods, | ||
653 | AuthorizedKeysCommand, AuthorizedKeysCommandUser, | ||
654 | AuthorizedKeysFile, AuthorizedPrincipalsFile, Banner, | ||
655 | ChrootDirectory, DenyGroups, DenyUsers, ForceCommand, | ||
656 | GatewayPorts, GSSAPIAuthentication, HostbasedAcceptedKeyTypes, | ||
657 | HostbasedAuthentication, HostbasedUsesNameFromPacketOnly, IPQoS, | ||
658 | KbdInteractiveAuthentication, KerberosAuthentication, | ||
659 | MaxAuthTries, MaxSessions, PasswordAuthentication, | ||
660 | PermitEmptyPasswords, PermitOpen, PermitRootLogin, PermitTTY, | ||
661 | PermitTunnel, PermitUserRC, PubkeyAcceptedKeyTypes, | ||
662 | PubkeyAuthentication, RekeyLimit, RevokedKeys, | ||
663 | RhostsRSAAuthentication, RSAAuthentication, StreamLocalBindMask, | ||
664 | StreamLocalBindUnlink, TrustedUserCAKeys, X11DisplayOffset, | ||
665 | X11Forwarding and X11UseLocalHost. | ||
666 | |||
667 | MaxAuthTries | ||
668 | Specifies the maximum number of authentication attempts permitted | ||
669 | per connection. Once the number of failures reaches half this | ||
670 | value, additional failures are logged. The default is 6. | ||
671 | |||
672 | MaxSessions | ||
673 | Specifies the maximum number of open sessions permitted per | ||
674 | network connection. The default is 10. | ||
675 | |||
676 | MaxStartups | ||
677 | Specifies the maximum number of concurrent unauthenticated | ||
678 | connections to the SSH daemon. Additional connections will be | ||
679 | dropped until authentication succeeds or the LoginGraceTime | ||
680 | expires for a connection. The default is 10:30:100. | ||
681 | |||
682 | Alternatively, random early drop can be enabled by specifying the | ||
683 | three colon separated values M-bM-^@M-^\start:rate:fullM-bM-^@M-^] (e.g. "10:30:60"). | ||
684 | sshd(8) will refuse connection attempts with a probability of | ||
685 | M-bM-^@M-^\rate/100M-bM-^@M-^] (30%) if there are currently M-bM-^@M-^\startM-bM-^@M-^] (10) | ||
686 | unauthenticated connections. The probability increases linearly | ||
687 | and all connection attempts are refused if the number of | ||
688 | unauthenticated connections reaches M-bM-^@M-^\fullM-bM-^@M-^] (60). | ||
689 | |||
690 | PasswordAuthentication | ||
691 | Specifies whether password authentication is allowed. The | ||
692 | default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
693 | |||
694 | PermitEmptyPasswords | ||
695 | When password authentication is allowed, it specifies whether the | ||
696 | server allows login to accounts with empty password strings. The | ||
697 | default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
698 | |||
699 | PermitOpen | ||
700 | Specifies the destinations to which TCP port forwarding is | ||
701 | permitted. The forwarding specification must be one of the | ||
702 | following forms: | ||
703 | |||
704 | PermitOpen host:port | ||
705 | PermitOpen IPv4_addr:port | ||
706 | PermitOpen [IPv6_addr]:port | ||
707 | |||
708 | Multiple forwards may be specified by separating them with | ||
709 | whitespace. An argument of M-bM-^@M-^\anyM-bM-^@M-^] can be used to remove all | ||
710 | restrictions and permit any forwarding requests. An argument of | ||
711 | M-bM-^@M-^\noneM-bM-^@M-^] can be used to prohibit all forwarding requests. By | ||
712 | default all port forwarding requests are permitted. | ||
713 | |||
714 | PermitRootLogin | ||
715 | Specifies whether root can log in using ssh(1). The argument | ||
716 | must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\prohibit-passwordM-bM-^@M-^], M-bM-^@M-^\without-passwordM-bM-^@M-^], | ||
717 | M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], or M-bM-^@M-^\noM-bM-^@M-^]. The default is | ||
718 | M-bM-^@M-^\prohibit-passwordM-bM-^@M-^]. | ||
719 | |||
720 | If this option is set to M-bM-^@M-^\prohibit-passwordM-bM-^@M-^] or | ||
721 | M-bM-^@M-^\without-passwordM-bM-^@M-^], password and keyboard-interactive | ||
722 | authentication are disabled for root. | ||
723 | |||
724 | If this option is set to M-bM-^@M-^\forced-commands-onlyM-bM-^@M-^], root login with | ||
725 | public key authentication will be allowed, but only if the | ||
726 | command option has been specified (which may be useful for taking | ||
727 | remote backups even if root login is normally not allowed). All | ||
728 | other authentication methods are disabled for root. | ||
729 | |||
730 | If this option is set to M-bM-^@M-^\noM-bM-^@M-^], root is not allowed to log in. | ||
731 | |||
732 | PermitTunnel | ||
733 | Specifies whether tun(4) device forwarding is allowed. The | ||
734 | argument must be M-bM-^@M-^\yesM-bM-^@M-^], M-bM-^@M-^\point-to-pointM-bM-^@M-^] (layer 3), M-bM-^@M-^\ethernetM-bM-^@M-^] | ||
735 | (layer 2), or M-bM-^@M-^\noM-bM-^@M-^]. Specifying M-bM-^@M-^\yesM-bM-^@M-^] permits both | ||
736 | M-bM-^@M-^\point-to-pointM-bM-^@M-^] and M-bM-^@M-^\ethernetM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
737 | |||
738 | Independent of this setting, the permissions of the selected | ||
739 | tun(4) device must allow access to the user. | ||
740 | |||
741 | PermitTTY | ||
742 | Specifies whether pty(4) allocation is permitted. The default is | ||
743 | M-bM-^@M-^\yesM-bM-^@M-^]. | ||
744 | |||
745 | PermitUserEnvironment | ||
746 | Specifies whether ~/.ssh/environment and environment= options in | ||
747 | ~/.ssh/authorized_keys are processed by sshd(8). The default is | ||
748 | M-bM-^@M-^\noM-bM-^@M-^]. Enabling environment processing may enable users to bypass | ||
749 | access restrictions in some configurations using mechanisms such | ||
750 | as LD_PRELOAD. | ||
751 | |||
752 | PermitUserRC | ||
753 | Specifies whether any ~/.ssh/rc file is executed. The default is | ||
754 | M-bM-^@M-^\yesM-bM-^@M-^]. | ||
755 | |||
756 | PidFile | ||
757 | Specifies the file that contains the process ID of the SSH | ||
758 | daemon, or M-bM-^@M-^\noneM-bM-^@M-^] to not write one. The default is | ||
759 | /var/run/sshd.pid. | ||
760 | |||
761 | Port Specifies the port number that sshd(8) listens on. The default | ||
762 | is 22. Multiple options of this type are permitted. See also | ||
763 | ListenAddress. | ||
764 | |||
765 | PrintLastLog | ||
766 | Specifies whether sshd(8) should print the date and time of the | ||
767 | last user login when a user logs in interactively. The default | ||
768 | is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
769 | |||
770 | PrintMotd | ||
771 | Specifies whether sshd(8) should print /etc/motd when a user logs | ||
772 | in interactively. (On some systems it is also printed by the | ||
773 | shell, /etc/profile, or equivalent.) The default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
774 | |||
775 | Protocol | ||
776 | Specifies the protocol versions sshd(8) supports. The possible | ||
777 | values are M-bM-^@M-^X1M-bM-^@M-^Y and M-bM-^@M-^X2M-bM-^@M-^Y. Multiple versions must be comma- | ||
778 | separated. The default is M-bM-^@M-^X2M-bM-^@M-^Y. Note that the order of the | ||
779 | protocol list does not indicate preference, because the client | ||
780 | selects among multiple protocol versions offered by the server. | ||
781 | Specifying M-bM-^@M-^\2,1M-bM-^@M-^] is identical to M-bM-^@M-^\1,2M-bM-^@M-^]. | ||
782 | |||
783 | PubkeyAcceptedKeyTypes | ||
784 | Specifies the key types that will be accepted for public key | ||
785 | authentication as a comma-separated pattern list. Alternately if | ||
786 | the specified value begins with a M-bM-^@M-^X+M-bM-^@M-^Y character, then the | ||
787 | specified key types will be appended to the default set instead | ||
788 | of replacing them. The default for this option is: | ||
789 | |||
790 | ecdsa-sha2-nistp256-cert-v01@openssh.com, | ||
791 | ecdsa-sha2-nistp384-cert-v01@openssh.com, | ||
792 | ecdsa-sha2-nistp521-cert-v01@openssh.com, | ||
793 | ssh-ed25519-cert-v01@openssh.com, | ||
794 | ssh-rsa-cert-v01@openssh.com, | ||
795 | ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, | ||
796 | ssh-ed25519,ssh-rsa | ||
797 | |||
798 | The -Q option of ssh(1) may be used to list supported key types. | ||
799 | |||
800 | PubkeyAuthentication | ||
801 | Specifies whether public key authentication is allowed. The | ||
802 | default is M-bM-^@M-^\yesM-bM-^@M-^]. Note that this option applies to protocol | ||
803 | version 2 only. | ||
804 | |||
805 | RekeyLimit | ||
806 | Specifies the maximum amount of data that may be transmitted | ||
807 | before the session key is renegotiated, optionally followed a | ||
808 | maximum amount of time that may pass before the session key is | ||
809 | renegotiated. The first argument is specified in bytes and may | ||
810 | have a suffix of M-bM-^@M-^XKM-bM-^@M-^Y, M-bM-^@M-^XMM-bM-^@M-^Y, or M-bM-^@M-^XGM-bM-^@M-^Y to indicate Kilobytes, | ||
811 | Megabytes, or Gigabytes, respectively. The default is between | ||
812 | M-bM-^@M-^X1GM-bM-^@M-^Y and M-bM-^@M-^X4GM-bM-^@M-^Y, depending on the cipher. The optional second | ||
813 | value is specified in seconds and may use any of the units | ||
814 | documented in the TIME FORMATS section. The default value for | ||
815 | RekeyLimit is M-bM-^@M-^\default noneM-bM-^@M-^], which means that rekeying is | ||
816 | performed after the cipher's default amount of data has been sent | ||
817 | or received and no time based rekeying is done. This option | ||
818 | applies to protocol version 2 only. | ||
819 | |||
820 | RevokedKeys | ||
821 | Specifies revoked public keys file, or M-bM-^@M-^\noneM-bM-^@M-^] to not use one. | ||
822 | Keys listed in this file will be refused for public key | ||
823 | authentication. Note that if this file is not readable, then | ||
824 | public key authentication will be refused for all users. Keys | ||
825 | may be specified as a text file, listing one public key per line, | ||
826 | or as an OpenSSH Key Revocation List (KRL) as generated by | ||
827 | ssh-keygen(1). For more information on KRLs, see the KEY | ||
828 | REVOCATION LISTS section in ssh-keygen(1). | ||
829 | |||
830 | RhostsRSAAuthentication | ||
831 | Specifies whether rhosts or /etc/hosts.equiv authentication | ||
832 | together with successful RSA host authentication is allowed. The | ||
833 | default is M-bM-^@M-^\noM-bM-^@M-^]. This option applies to protocol version 1 only. | ||
834 | |||
835 | RSAAuthentication | ||
836 | Specifies whether pure RSA authentication is allowed. The | ||
837 | default is M-bM-^@M-^\yesM-bM-^@M-^]. This option applies to protocol version 1 | ||
838 | only. | ||
839 | |||
840 | ServerKeyBits | ||
841 | Defines the number of bits in the ephemeral protocol version 1 | ||
842 | server key. The default and minimum value is 1024. | ||
843 | |||
844 | StreamLocalBindMask | ||
845 | Sets the octal file creation mode mask (umask) used when creating | ||
846 | a Unix-domain socket file for local or remote port forwarding. | ||
847 | This option is only used for port forwarding to a Unix-domain | ||
848 | socket file. | ||
849 | |||
850 | The default value is 0177, which creates a Unix-domain socket | ||
851 | file that is readable and writable only by the owner. Note that | ||
852 | not all operating systems honor the file mode on Unix-domain | ||
853 | socket files. | ||
854 | |||
855 | StreamLocalBindUnlink | ||
856 | Specifies whether to remove an existing Unix-domain socket file | ||
857 | for local or remote port forwarding before creating a new one. | ||
858 | If the socket file already exists and StreamLocalBindUnlink is | ||
859 | not enabled, sshd will be unable to forward the port to the Unix- | ||
860 | domain socket file. This option is only used for port forwarding | ||
861 | to a Unix-domain socket file. | ||
862 | |||
863 | The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
864 | |||
865 | StrictModes | ||
866 | Specifies whether sshd(8) should check file modes and ownership | ||
867 | of the user's files and home directory before accepting login. | ||
868 | This is normally desirable because novices sometimes accidentally | ||
869 | leave their directory or files world-writable. The default is | ||
870 | M-bM-^@M-^\yesM-bM-^@M-^]. Note that this does not apply to ChrootDirectory, whose | ||
871 | permissions and ownership are checked unconditionally. | ||
872 | |||
873 | Subsystem | ||
874 | Configures an external subsystem (e.g. file transfer daemon). | ||
875 | Arguments should be a subsystem name and a command (with optional | ||
876 | arguments) to execute upon subsystem request. | ||
877 | |||
878 | The command sftp-server(8) implements the M-bM-^@M-^\sftpM-bM-^@M-^] file transfer | ||
879 | subsystem. | ||
880 | |||
881 | Alternately the name M-bM-^@M-^\internal-sftpM-bM-^@M-^] implements an in-process | ||
882 | M-bM-^@M-^\sftpM-bM-^@M-^] server. This may simplify configurations using | ||
883 | ChrootDirectory to force a different filesystem root on clients. | ||
884 | |||
885 | By default no subsystems are defined. Note that this option | ||
886 | applies to protocol version 2 only. | ||
887 | |||
888 | SyslogFacility | ||
889 | Gives the facility code that is used when logging messages from | ||
890 | sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0, | ||
891 | LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The | ||
892 | default is AUTH. | ||
893 | |||
894 | TCPKeepAlive | ||
895 | Specifies whether the system should send TCP keepalive messages | ||
896 | to the other side. If they are sent, death of the connection or | ||
897 | crash of one of the machines will be properly noticed. However, | ||
898 | this means that connections will die if the route is down | ||
899 | temporarily, and some people find it annoying. On the other | ||
900 | hand, if TCP keepalives are not sent, sessions may hang | ||
901 | indefinitely on the server, leaving M-bM-^@M-^\ghostM-bM-^@M-^] users and consuming | ||
902 | server resources. | ||
903 | |||
904 | The default is M-bM-^@M-^\yesM-bM-^@M-^] (to send TCP keepalive messages), and the | ||
905 | server will notice if the network goes down or the client host | ||
906 | crashes. This avoids infinitely hanging sessions. | ||
907 | |||
908 | To disable TCP keepalive messages, the value should be set to | ||
909 | M-bM-^@M-^\noM-bM-^@M-^]. | ||
910 | |||
911 | TrustedUserCAKeys | ||
912 | Specifies a file containing public keys of certificate | ||
913 | authorities that are trusted to sign user certificates for | ||
914 | authentication, or M-bM-^@M-^\noneM-bM-^@M-^] to not use one. Keys are listed one | ||
915 | per line; empty lines and comments starting with M-bM-^@M-^X#M-bM-^@M-^Y are allowed. | ||
916 | If a certificate is presented for authentication and has its | ||
917 | signing CA key listed in this file, then it may be used for | ||
918 | authentication for any user listed in the certificate's | ||
919 | principals list. Note that certificates that lack a list of | ||
920 | principals will not be permitted for authentication using | ||
921 | TrustedUserCAKeys. For more details on certificates, see the | ||
922 | CERTIFICATES section in ssh-keygen(1). | ||
923 | |||
924 | UseDNS Specifies whether sshd(8) should look up the remote host name, | ||
925 | and to check that the resolved host name for the remote IP | ||
926 | address maps back to the very same IP address. | ||
927 | |||
928 | If this option is set to M-bM-^@M-^\noM-bM-^@M-^] (the default) then only addresses | ||
929 | and not host names may be used in ~/.ssh/known_hosts from and | ||
930 | sshd_config(5) Match Host directives. | ||
931 | |||
932 | UseLogin | ||
933 | Specifies whether login(1) is used for interactive login | ||
934 | sessions. The default is M-bM-^@M-^\noM-bM-^@M-^]. Note that login(1) is never used | ||
935 | for remote command execution. Note also, that if this is | ||
936 | enabled, X11Forwarding will be disabled because login(1) does not | ||
937 | know how to handle xauth(1) cookies. If UsePrivilegeSeparation | ||
938 | is specified, it will be disabled after authentication. | ||
939 | |||
940 | UsePAM Enables the Pluggable Authentication Module interface. If set to | ||
941 | M-bM-^@M-^\yesM-bM-^@M-^] this will enable PAM authentication using | ||
942 | ChallengeResponseAuthentication and PasswordAuthentication in | ||
943 | addition to PAM account and session module processing for all | ||
944 | authentication types. | ||
945 | |||
946 | Because PAM challenge-response authentication usually serves an | ||
947 | equivalent role to password authentication, you should disable | ||
948 | either PasswordAuthentication or ChallengeResponseAuthentication. | ||
949 | |||
950 | If UsePAM is enabled, you will not be able to run sshd(8) as a | ||
951 | non-root user. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
952 | |||
953 | UsePrivilegeSeparation | ||
954 | Specifies whether sshd(8) separates privileges by creating an | ||
955 | unprivileged child process to deal with incoming network traffic. | ||
956 | After successful authentication, another process will be created | ||
957 | that has the privilege of the authenticated user. The goal of | ||
958 | privilege separation is to prevent privilege escalation by | ||
959 | containing any corruption within the unprivileged processes. The | ||
960 | default is M-bM-^@M-^\yesM-bM-^@M-^]. If UsePrivilegeSeparation is set to M-bM-^@M-^\sandboxM-bM-^@M-^] | ||
961 | then the pre-authentication unprivileged process is subject to | ||
962 | additional restrictions. | ||
963 | |||
964 | VersionAddendum | ||
965 | Optionally specifies additional text to append to the SSH | ||
966 | protocol banner sent by the server upon connection. The default | ||
967 | is M-bM-^@M-^\noneM-bM-^@M-^]. | ||
968 | |||
969 | X11DisplayOffset | ||
970 | Specifies the first display number available for sshd(8)'s X11 | ||
971 | forwarding. This prevents sshd from interfering with real X11 | ||
972 | servers. The default is 10. | ||
973 | |||
974 | X11Forwarding | ||
975 | Specifies whether X11 forwarding is permitted. The argument must | ||
976 | be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The default is M-bM-^@M-^\noM-bM-^@M-^]. | ||
977 | |||
978 | When X11 forwarding is enabled, there may be additional exposure | ||
979 | to the server and to client displays if the sshd(8) proxy display | ||
980 | is configured to listen on the wildcard address (see | ||
981 | X11UseLocalhost below), though this is not the default. | ||
982 | Additionally, the authentication spoofing and authentication data | ||
983 | verification and substitution occur on the client side. The | ||
984 | security risk of using X11 forwarding is that the client's X11 | ||
985 | display server may be exposed to attack when the SSH client | ||
986 | requests forwarding (see the warnings for ForwardX11 in | ||
987 | ssh_config(5)). A system administrator may have a stance in | ||
988 | which they want to protect clients that may expose themselves to | ||
989 | attack by unwittingly requesting X11 forwarding, which can | ||
990 | warrant a M-bM-^@M-^\noM-bM-^@M-^] setting. | ||
991 | |||
992 | Note that disabling X11 forwarding does not prevent users from | ||
993 | forwarding X11 traffic, as users can always install their own | ||
994 | forwarders. X11 forwarding is automatically disabled if UseLogin | ||
995 | is enabled. | ||
996 | |||
997 | X11UseLocalhost | ||
998 | Specifies whether sshd(8) should bind the X11 forwarding server | ||
999 | to the loopback address or to the wildcard address. By default, | ||
1000 | sshd binds the forwarding server to the loopback address and sets | ||
1001 | the hostname part of the DISPLAY environment variable to | ||
1002 | M-bM-^@M-^\localhostM-bM-^@M-^]. This prevents remote hosts from connecting to the | ||
1003 | proxy display. However, some older X11 clients may not function | ||
1004 | with this configuration. X11UseLocalhost may be set to M-bM-^@M-^\noM-bM-^@M-^] to | ||
1005 | specify that the forwarding server should be bound to the | ||
1006 | wildcard address. The argument must be M-bM-^@M-^\yesM-bM-^@M-^] or M-bM-^@M-^\noM-bM-^@M-^]. The | ||
1007 | default is M-bM-^@M-^\yesM-bM-^@M-^]. | ||
1008 | |||
1009 | XAuthLocation | ||
1010 | Specifies the full pathname of the xauth(1) program, or M-bM-^@M-^\noneM-bM-^@M-^] to | ||
1011 | not use one. The default is /usr/X11R6/bin/xauth. | ||
1012 | |||
1013 | TIME FORMATS | ||
1014 | sshd(8) command-line arguments and configuration file options that | ||
1015 | specify time may be expressed using a sequence of the form: | ||
1016 | time[qualifier], where time is a positive integer value and qualifier is | ||
1017 | one of the following: | ||
1018 | |||
1019 | M-bM-^_M-(noneM-bM-^_M-) seconds | ||
1020 | s | S seconds | ||
1021 | m | M minutes | ||
1022 | h | H hours | ||
1023 | d | D days | ||
1024 | w | W weeks | ||
1025 | |||
1026 | Each member of the sequence is added together to calculate the total time | ||
1027 | value. | ||
1028 | |||
1029 | Time format examples: | ||
1030 | |||
1031 | 600 600 seconds (10 minutes) | ||
1032 | 10m 10 minutes | ||
1033 | 1h30m 1 hour 30 minutes (90 minutes) | ||
1034 | |||
1035 | FILES | ||
1036 | /etc/ssh/sshd_config | ||
1037 | Contains configuration data for sshd(8). This file should be | ||
1038 | writable by root only, but it is recommended (though not | ||
1039 | necessary) that it be world-readable. | ||
1040 | |||
1041 | SEE ALSO | ||
1042 | sshd(8) | ||
1043 | |||
1044 | AUTHORS | ||
1045 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by | ||
1046 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo | ||
1047 | de Raadt and Dug Song removed many bugs, re-added newer features and | ||
1048 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | ||
1049 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support | ||
1050 | for privilege separation. | ||
1051 | |||
1052 | OpenBSD 5.8 August 6, 2015 OpenBSD 5.8 | ||