diff options
Diffstat (limited to 'sshd_config.5')
-rw-r--r-- | sshd_config.5 | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index 314ecfb0e..ef4164edd 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -426,12 +426,40 @@ Specifies whether user authentication based on GSSAPI is allowed. | |||
426 | The default is | 426 | The default is |
427 | .Dq no . | 427 | .Dq no . |
428 | Note that this option applies to protocol version 2 only. | 428 | Note that this option applies to protocol version 2 only. |
429 | .It Cm GSSAPIKeyExchange | ||
430 | Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange | ||
431 | doesn't rely on ssh keys to verify host identity. | ||
432 | The default is | ||
433 | .Dq no . | ||
434 | Note that this option applies to protocol version 2 only. | ||
429 | .It Cm GSSAPICleanupCredentials | 435 | .It Cm GSSAPICleanupCredentials |
430 | Specifies whether to automatically destroy the user's credentials cache | 436 | Specifies whether to automatically destroy the user's credentials cache |
431 | on logout. | 437 | on logout. |
432 | The default is | 438 | The default is |
433 | .Dq yes . | 439 | .Dq yes . |
434 | Note that this option applies to protocol version 2 only. | 440 | Note that this option applies to protocol version 2 only. |
441 | .It Cm GSSAPIStrictAcceptorCheck | ||
442 | Determines whether to be strict about the identity of the GSSAPI acceptor | ||
443 | a client authenticates against. If | ||
444 | .Dq yes | ||
445 | then the client must authenticate against the | ||
446 | .Pa host | ||
447 | service on the current hostname. If | ||
448 | .Dq no | ||
449 | then the client may authenticate against any service key stored in the | ||
450 | machine's default store. This facility is provided to assist with operation | ||
451 | on multi homed machines. | ||
452 | The default is | ||
453 | .Dq yes . | ||
454 | Note that this option applies only to protocol version 2 GSSAPI connections, | ||
455 | and setting it to | ||
456 | .Dq no | ||
457 | may only work with recent Kerberos GSSAPI libraries. | ||
458 | .It Cm GSSAPIStoreCredentialsOnRekey | ||
459 | Controls whether the user's GSSAPI credentials should be updated following a | ||
460 | successful connection rekeying. This option can be used to accepted renewed | ||
461 | or updated credentials from a compatible client. The default is | ||
462 | .Dq no . | ||
435 | .It Cm HostbasedAuthentication | 463 | .It Cm HostbasedAuthentication |
436 | Specifies whether rhosts or /etc/hosts.equiv authentication together | 464 | Specifies whether rhosts or /etc/hosts.equiv authentication together |
437 | with successful public key client host authentication is allowed | 465 | with successful public key client host authentication is allowed |