diff options
Diffstat (limited to 'sshd_config.5')
-rw-r--r-- | sshd_config.5 | 84 |
1 files changed, 79 insertions, 5 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index ef4164edd..935bb62fa 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -33,8 +33,8 @@ | |||
33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 33 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 34 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
35 | .\" | 35 | .\" |
36 | .\" $OpenBSD: sshd_config.5,v 1.144 2012/06/29 13:57:25 naddy Exp $ | 36 | .\" $OpenBSD: sshd_config.5,v 1.156 2013/02/06 00:20:42 dtucker Exp $ |
37 | .Dd $Mdocdate: June 29 2012 $ | 37 | .Dd $Mdocdate: February 6 2013 $ |
38 | .Dt SSHD_CONFIG 5 | 38 | .Dt SSHD_CONFIG 5 |
39 | .Os | 39 | .Os |
40 | .Sh NAME | 40 | .Sh NAME |
@@ -124,6 +124,19 @@ in | |||
124 | for more information on patterns. | 124 | for more information on patterns. |
125 | .It Cm AllowTcpForwarding | 125 | .It Cm AllowTcpForwarding |
126 | Specifies whether TCP forwarding is permitted. | 126 | Specifies whether TCP forwarding is permitted. |
127 | The available options are | ||
128 | .Dq yes | ||
129 | or | ||
130 | .Dq all | ||
131 | to allow TCP forwarding, | ||
132 | .Dq no | ||
133 | to prevent all TCP forwarding, | ||
134 | .Dq local | ||
135 | to allow local (from the perspective of | ||
136 | .Xr ssh 1 ) | ||
137 | forwarding only or | ||
138 | .Dq remote | ||
139 | to allow remote forwarding only. | ||
127 | The default is | 140 | The default is |
128 | .Dq yes . | 141 | .Dq yes . |
129 | Note that disabling TCP forwarding does not improve security unless | 142 | Note that disabling TCP forwarding does not improve security unless |
@@ -151,6 +164,45 @@ See | |||
151 | in | 164 | in |
152 | .Xr ssh_config 5 | 165 | .Xr ssh_config 5 |
153 | for more information on patterns. | 166 | for more information on patterns. |
167 | .It Cm AuthenticationMethods | ||
168 | Specifies the authentication methods that must be successfully completed | ||
169 | for a user to be granted access. | ||
170 | This option must be followed by one or more comma-separated lists of | ||
171 | authentication method names. | ||
172 | Successful authentication requires completion of every method in at least | ||
173 | one of these lists. | ||
174 | .Pp | ||
175 | For example, an argument of | ||
176 | .Dq publickey,password publickey,keyboard-interactive | ||
177 | would require the user to complete public key authentication, followed by | ||
178 | either password or keyboard interactive authentication. | ||
179 | Only methods that are next in one or more lists are offered at each stage, | ||
180 | so for this example, it would not be possible to attempt password or | ||
181 | keyboard-interactive authentication before public key. | ||
182 | .Pp | ||
183 | This option is only available for SSH protocol 2 and will yield a fatal | ||
184 | error if enabled if protocol 1 is also enabled. | ||
185 | Note that each authentication method listed should also be explicitly enabled | ||
186 | in the configuration. | ||
187 | The default is not to require multiple authentication; successful completion | ||
188 | of a single authentication method is sufficient. | ||
189 | .It Cm AuthorizedKeysCommand | ||
190 | Specifies a program to be used to look up the user's public keys. | ||
191 | The program will be invoked with a single argument of the username | ||
192 | being authenticated, and should produce on standard output zero or | ||
193 | more lines of authorized_keys output (see | ||
194 | .Sx AUTHORIZED_KEYS | ||
195 | in | ||
196 | .Xr sshd 8 ) . | ||
197 | If a key supplied by AuthorizedKeysCommand does not successfully authenticate | ||
198 | and authorize the user then public key authentication continues using the usual | ||
199 | .Cm AuthorizedKeysFile | ||
200 | files. | ||
201 | By default, no AuthorizedKeysCommand is run. | ||
202 | .It Cm AuthorizedKeysCommandUser | ||
203 | Specifies the user under whose account the AuthorizedKeysCommand is run. | ||
204 | It is recommended to use a dedicated user that has no other role on the host | ||
205 | than running authorized keys commands. | ||
154 | .It Cm AuthorizedKeysFile | 206 | .It Cm AuthorizedKeysFile |
155 | Specifies the file that contains the public keys that can be used | 207 | Specifies the file that contains the public keys that can be used |
156 | for user authentication. | 208 | for user authentication. |
@@ -284,6 +336,8 @@ The supported ciphers are | |||
284 | .Dq aes128-ctr , | 336 | .Dq aes128-ctr , |
285 | .Dq aes192-ctr , | 337 | .Dq aes192-ctr , |
286 | .Dq aes256-ctr , | 338 | .Dq aes256-ctr , |
339 | .Dq aes128-gcm@openssh.com , | ||
340 | .Dq aes256-gcm@openssh.com , | ||
287 | .Dq arcfour128 , | 341 | .Dq arcfour128 , |
288 | .Dq arcfour256 , | 342 | .Dq arcfour256 , |
289 | .Dq arcfour , | 343 | .Dq arcfour , |
@@ -293,6 +347,7 @@ and | |||
293 | The default is: | 347 | The default is: |
294 | .Bd -literal -offset 3n | 348 | .Bd -literal -offset 3n |
295 | aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, | 349 | aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, |
350 | aes128-gcm@openssh.com,aes256-gcm@openssh.com, | ||
296 | aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc, | 351 | aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc, |
297 | aes256-cbc,arcfour | 352 | aes256-cbc,arcfour |
298 | .Ed | 353 | .Ed |
@@ -682,9 +737,18 @@ Specifies the available MAC (message authentication code) algorithms. | |||
682 | The MAC algorithm is used in protocol version 2 | 737 | The MAC algorithm is used in protocol version 2 |
683 | for data integrity protection. | 738 | for data integrity protection. |
684 | Multiple algorithms must be comma-separated. | 739 | Multiple algorithms must be comma-separated. |
740 | The algorithms that contain | ||
741 | .Dq -etm | ||
742 | calculate the MAC after encryption (encrypt-then-mac). | ||
743 | These are considered safer and their use recommended. | ||
685 | The default is: | 744 | The default is: |
686 | .Bd -literal -offset indent | 745 | .Bd -literal -offset indent |
687 | hmac-md5,hmac-sha1,umac-64@openssh.com, | 746 | hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com, |
747 | umac-64-etm@openssh.com,umac-128-etm@openssh.com, | ||
748 | hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, | ||
749 | hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com, | ||
750 | hmac-md5-96-etm@openssh.com, | ||
751 | hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com, | ||
688 | hmac-sha2-256,hmac-sha2-512,hmac-ripemd160, | 752 | hmac-sha2-256,hmac-sha2-512,hmac-ripemd160, |
689 | hmac-sha1-96,hmac-md5-96 | 753 | hmac-sha1-96,hmac-md5-96 |
690 | .Ed | 754 | .Ed |
@@ -739,6 +803,9 @@ Available keywords are | |||
739 | .Cm AllowGroups , | 803 | .Cm AllowGroups , |
740 | .Cm AllowTcpForwarding , | 804 | .Cm AllowTcpForwarding , |
741 | .Cm AllowUsers , | 805 | .Cm AllowUsers , |
806 | .Cm AuthenticationMethods , | ||
807 | .Cm AuthorizedKeysCommand , | ||
808 | .Cm AuthorizedKeysCommandUser , | ||
742 | .Cm AuthorizedKeysFile , | 809 | .Cm AuthorizedKeysFile , |
743 | .Cm AuthorizedPrincipalsFile , | 810 | .Cm AuthorizedPrincipalsFile , |
744 | .Cm Banner , | 811 | .Cm Banner , |
@@ -781,7 +848,7 @@ SSH daemon. | |||
781 | Additional connections will be dropped until authentication succeeds or the | 848 | Additional connections will be dropped until authentication succeeds or the |
782 | .Cm LoginGraceTime | 849 | .Cm LoginGraceTime |
783 | expires for a connection. | 850 | expires for a connection. |
784 | The default is 10. | 851 | The default is 10:30:100. |
785 | .Pp | 852 | .Pp |
786 | Alternatively, random early drop can be enabled by specifying | 853 | Alternatively, random early drop can be enabled by specifying |
787 | the three colon separated values | 854 | the three colon separated values |
@@ -955,10 +1022,17 @@ The default is | |||
955 | .Dq yes . | 1022 | .Dq yes . |
956 | Note that this option applies to protocol version 2 only. | 1023 | Note that this option applies to protocol version 2 only. |
957 | .It Cm RevokedKeys | 1024 | .It Cm RevokedKeys |
958 | Specifies a list of revoked public keys. | 1025 | Specifies revoked public keys. |
959 | Keys listed in this file will be refused for public key authentication. | 1026 | Keys listed in this file will be refused for public key authentication. |
960 | Note that if this file is not readable, then public key authentication will | 1027 | Note that if this file is not readable, then public key authentication will |
961 | be refused for all users. | 1028 | be refused for all users. |
1029 | Keys may be specified as a text file, listing one public key per line, or as | ||
1030 | an OpenSSH Key Revocation List (KRL) as generated by | ||
1031 | .Xr ssh-keygen 1 . | ||
1032 | For more information on KRLs, see the | ||
1033 | .Sx KEY REVOCATION LISTS | ||
1034 | section in | ||
1035 | .Xr ssh-keygen 1 . | ||
962 | .It Cm RhostsRSAAuthentication | 1036 | .It Cm RhostsRSAAuthentication |
963 | Specifies whether rhosts or /etc/hosts.equiv authentication together | 1037 | Specifies whether rhosts or /etc/hosts.equiv authentication together |
964 | with successful RSA host authentication is allowed. | 1038 | with successful RSA host authentication is allowed. |