diff options
Diffstat (limited to 'sshd_config.5')
-rw-r--r-- | sshd_config.5 | 52 |
1 files changed, 50 insertions, 2 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index ef4164edd..22e7edc94 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -57,6 +57,33 @@ Arguments may optionally be enclosed in double quotes | |||
57 | .Pq \&" | 57 | .Pq \&" |
58 | in order to represent arguments containing spaces. | 58 | in order to represent arguments containing spaces. |
59 | .Pp | 59 | .Pp |
60 | Note that the Debian | ||
61 | .Ic openssh-server | ||
62 | package sets several options as standard in | ||
63 | .Pa /etc/ssh/sshd_config | ||
64 | which are not the default in | ||
65 | .Xr sshd 8 . | ||
66 | The exact list depends on whether the package was installed fresh or | ||
67 | upgraded from various possible previous versions, but includes at least the | ||
68 | following: | ||
69 | .Pp | ||
70 | .Bl -bullet -offset indent -compact | ||
71 | .It | ||
72 | .Cm Protocol No 2 | ||
73 | .It | ||
74 | .Cm ChallengeResponseAuthentication No no | ||
75 | .It | ||
76 | .Cm X11Forwarding No yes | ||
77 | .It | ||
78 | .Cm PrintMotd No no | ||
79 | .It | ||
80 | .Cm AcceptEnv No LANG LC_* | ||
81 | .It | ||
82 | .Cm Subsystem No sftp /usr/lib/openssh/sftp-server | ||
83 | .It | ||
84 | .Cm UsePAM No yes | ||
85 | .El | ||
86 | .Pp | ||
60 | The possible | 87 | The possible |
61 | keywords and their meanings are as follows (note that | 88 | keywords and their meanings are as follows (note that |
62 | keywords are case-insensitive and arguments are case-sensitive): | 89 | keywords are case-insensitive and arguments are case-sensitive): |
@@ -224,8 +251,7 @@ This option is only available for protocol version 2. | |||
224 | By default, no banner is displayed. | 251 | By default, no banner is displayed. |
225 | .It Cm ChallengeResponseAuthentication | 252 | .It Cm ChallengeResponseAuthentication |
226 | Specifies whether challenge-response authentication is allowed (e.g. via | 253 | Specifies whether challenge-response authentication is allowed (e.g. via |
227 | PAM or though authentication styles supported in | 254 | PAM). |
228 | .Xr login.conf 5 ) | ||
229 | The default is | 255 | The default is |
230 | .Dq yes . | 256 | .Dq yes . |
231 | .It Cm ChrootDirectory | 257 | .It Cm ChrootDirectory |
@@ -342,6 +368,11 @@ or | |||
342 | .Dq no . | 368 | .Dq no . |
343 | The default is | 369 | The default is |
344 | .Dq delayed . | 370 | .Dq delayed . |
371 | .It Cm DebianBanner | ||
372 | Specifies whether the distribution-specified extra version suffix is | ||
373 | included during initial protocol handshake. | ||
374 | The default is | ||
375 | .Dq yes . | ||
345 | .It Cm DenyGroups | 376 | .It Cm DenyGroups |
346 | This keyword can be followed by a list of group name patterns, separated | 377 | This keyword can be followed by a list of group name patterns, separated |
347 | by spaces. | 378 | by spaces. |
@@ -803,6 +834,20 @@ are refused if the number of unauthenticated connections reaches | |||
803 | Specifies whether password authentication is allowed. | 834 | Specifies whether password authentication is allowed. |
804 | The default is | 835 | The default is |
805 | .Dq yes . | 836 | .Dq yes . |
837 | .It Cm PermitBlacklistedKeys | ||
838 | Specifies whether | ||
839 | .Xr sshd 8 | ||
840 | should allow keys recorded in its blacklist of known-compromised keys (see | ||
841 | .Xr ssh-vulnkey 1 ) . | ||
842 | If | ||
843 | .Dq yes , | ||
844 | then attempts to authenticate with compromised keys will be logged but | ||
845 | accepted. | ||
846 | If | ||
847 | .Dq no , | ||
848 | then attempts to authenticate with compromised keys will be rejected. | ||
849 | The default is | ||
850 | .Dq no . | ||
806 | .It Cm PermitEmptyPasswords | 851 | .It Cm PermitEmptyPasswords |
807 | When password authentication is allowed, it specifies whether the | 852 | When password authentication is allowed, it specifies whether the |
808 | server allows login to accounts with empty password strings. | 853 | server allows login to accounts with empty password strings. |
@@ -1034,6 +1079,9 @@ This avoids infinitely hanging sessions. | |||
1034 | .Pp | 1079 | .Pp |
1035 | To disable TCP keepalive messages, the value should be set to | 1080 | To disable TCP keepalive messages, the value should be set to |
1036 | .Dq no . | 1081 | .Dq no . |
1082 | .Pp | ||
1083 | This option was formerly called | ||
1084 | .Cm KeepAlive . | ||
1037 | .It Cm TrustedUserCAKeys | 1085 | .It Cm TrustedUserCAKeys |
1038 | Specifies a file containing public keys of certificate authorities that are | 1086 | Specifies a file containing public keys of certificate authorities that are |
1039 | trusted to sign user certificates for authentication. | 1087 | trusted to sign user certificates for authentication. |