summaryrefslogtreecommitdiff
path: root/sshd_config.5
diff options
context:
space:
mode:
Diffstat (limited to 'sshd_config.5')
-rw-r--r--sshd_config.5194
1 files changed, 159 insertions, 35 deletions
diff --git a/sshd_config.5 b/sshd_config.5
index 90fd3f4a8..7aa7b4733 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: sshd_config.5,v 1.172 2014/02/27 22:47:07 djm Exp $ 36.\" $OpenBSD: sshd_config.5,v 1.176 2014/07/28 15:40:08 schwarze Exp $
37.Dd $Mdocdate: February 27 2014 $ 37.Dd $Mdocdate: July 28 2014 $
38.Dt SSHD_CONFIG 5 38.Dt SSHD_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -165,6 +165,26 @@ The default is
165Note that disabling TCP forwarding does not improve security unless 165Note that disabling TCP forwarding does not improve security unless
166users are also denied shell access, as they can always install their 166users are also denied shell access, as they can always install their
167own forwarders. 167own forwarders.
168.It Cm AllowStreamLocalForwarding
169Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted.
170The available options are
171.Dq yes
172or
173.Dq all
174to allow StreamLocal forwarding,
175.Dq no
176to prevent all StreamLocal forwarding,
177.Dq local
178to allow local (from the perspective of
179.Xr ssh 1 )
180forwarding only or
181.Dq remote
182to allow remote forwarding only.
183The default is
184.Dq yes .
185Note that disabling StreamLocal forwarding does not improve security unless
186users are also denied shell access, as they can always install their
187own forwarders.
168.It Cm AllowUsers 188.It Cm AllowUsers
169This keyword can be followed by a list of user name patterns, separated 189This keyword can be followed by a list of user name patterns, separated
170by spaces. 190by spaces.
@@ -348,9 +368,9 @@ For file transfer sessions using
348.Dq sftp , 368.Dq sftp ,
349no additional configuration of the environment is necessary if the 369no additional configuration of the environment is necessary if the
350in-process sftp server is used, 370in-process sftp server is used,
351though sessions which use logging do require 371though sessions which use logging may require
352.Pa /dev/log 372.Pa /dev/log
353inside the chroot directory (see 373inside the chroot directory on some operating systems (see
354.Xr sftp-server 8 374.Xr sftp-server 8
355for details). 375for details).
356.Pp 376.Pp
@@ -361,30 +381,44 @@ Specifies the ciphers allowed for protocol version 2.
361Multiple ciphers must be comma-separated. 381Multiple ciphers must be comma-separated.
362The supported ciphers are: 382The supported ciphers are:
363.Pp 383.Pp
364.Dq 3des-cbc , 384.Bl -item -compact -offset indent
365.Dq aes128-cbc , 385.It
366.Dq aes192-cbc , 3863des-cbc
367.Dq aes256-cbc , 387.It
368.Dq aes128-ctr , 388aes128-cbc
369.Dq aes192-ctr , 389.It
370.Dq aes256-ctr , 390aes192-cbc
371.Dq aes128-gcm@openssh.com , 391.It
372.Dq aes256-gcm@openssh.com , 392aes256-cbc
373.Dq arcfour128 , 393.It
374.Dq arcfour256 , 394aes128-ctr
375.Dq arcfour , 395.It
376.Dq blowfish-cbc , 396aes192-ctr
377.Dq cast128-cbc , 397.It
378and 398aes256-ctr
379.Dq chacha20-poly1305@openssh.com . 399.It
400aes128-gcm@openssh.com
401.It
402aes256-gcm@openssh.com
403.It
404arcfour
405.It
406arcfour128
407.It
408arcfour256
409.It
410blowfish-cbc
411.It
412cast128-cbc
413.It
414chacha20-poly1305@openssh.com
415.El
380.Pp 416.Pp
381The default is: 417The default is:
382.Bd -literal -offset 3n 418.Bd -literal -offset indent
383aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, 419aes128-ctr,aes192-ctr,aes256-ctr,
384aes128-gcm@openssh.com,aes256-gcm@openssh.com, 420aes128-gcm@openssh.com,aes256-gcm@openssh.com,
385chacha20-poly1305@openssh.com, 421chacha20-poly1305@openssh.com
386aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
387aes256-cbc,arcfour
388.Ed 422.Ed
389.Pp 423.Pp
390The list of available ciphers may also be obtained using the 424The list of available ciphers may also be obtained using the
@@ -729,14 +763,33 @@ The default is
729.It Cm KexAlgorithms 763.It Cm KexAlgorithms
730Specifies the available KEX (Key Exchange) algorithms. 764Specifies the available KEX (Key Exchange) algorithms.
731Multiple algorithms must be comma-separated. 765Multiple algorithms must be comma-separated.
732The default is 766The supported algorithms are:
767.Pp
768.Bl -item -compact -offset indent
769.It
770curve25519-sha256@libssh.org
771.It
772diffie-hellman-group1-sha1
773.It
774diffie-hellman-group14-sha1
775.It
776diffie-hellman-group-exchange-sha1
777.It
778diffie-hellman-group-exchange-sha256
779.It
780ecdh-sha2-nistp256
781.It
782ecdh-sha2-nistp384
783.It
784ecdh-sha2-nistp521
785.El
786.Pp
787The default is:
733.Bd -literal -offset indent 788.Bd -literal -offset indent
734curve25519-sha256@libssh.org, 789curve25519-sha256@libssh.org,
735ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 790ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
736diffie-hellman-group-exchange-sha256, 791diffie-hellman-group-exchange-sha256,
737diffie-hellman-group-exchange-sha1, 792diffie-hellman-group14-sha1
738diffie-hellman-group14-sha1,
739diffie-hellman-group1-sha1
740.Ed 793.Ed
741.It Cm KeyRegenerationInterval 794.It Cm KeyRegenerationInterval
742In protocol version 1, the ephemeral server key is automatically regenerated 795In protocol version 1, the ephemeral server key is automatically regenerated
@@ -808,16 +861,53 @@ The algorithms that contain
808.Dq -etm 861.Dq -etm
809calculate the MAC after encryption (encrypt-then-mac). 862calculate the MAC after encryption (encrypt-then-mac).
810These are considered safer and their use recommended. 863These are considered safer and their use recommended.
864The supported MACs are:
865.Pp
866.Bl -item -compact -offset indent
867.It
868hmac-md5
869.It
870hmac-md5-96
871.It
872hmac-ripemd160
873.It
874hmac-sha1
875.It
876hmac-sha1-96
877.It
878hmac-sha2-256
879.It
880hmac-sha2-512
881.It
882umac-64@openssh.com
883.It
884umac-128@openssh.com
885.It
886hmac-md5-etm@openssh.com
887.It
888hmac-md5-96-etm@openssh.com
889.It
890hmac-ripemd160-etm@openssh.com
891.It
892hmac-sha1-etm@openssh.com
893.It
894hmac-sha1-96-etm@openssh.com
895.It
896hmac-sha2-256-etm@openssh.com
897.It
898hmac-sha2-512-etm@openssh.com
899.It
900umac-64-etm@openssh.com
901.It
902umac-128-etm@openssh.com
903.El
904.Pp
811The default is: 905The default is:
812.Bd -literal -offset indent 906.Bd -literal -offset indent
813hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
814umac-64-etm@openssh.com,umac-128-etm@openssh.com, 907umac-64-etm@openssh.com,umac-128-etm@openssh.com,
815hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 908hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
816hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com, 909umac-64@openssh.com,umac-128@openssh.com,
817hmac-md5-96-etm@openssh.com, 910hmac-sha2-256,hmac-sha2-512
818hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
819hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
820hmac-sha1-96,hmac-md5-96
821.Ed 911.Ed
822.It Cm Match 912.It Cm Match
823Introduces a conditional block. 913Introduces a conditional block.
@@ -899,6 +989,7 @@ Available keywords are
899.Cm PermitRootLogin , 989.Cm PermitRootLogin ,
900.Cm PermitTTY , 990.Cm PermitTTY ,
901.Cm PermitTunnel , 991.Cm PermitTunnel ,
992.Cm PermitUserRC ,
902.Cm PubkeyAuthentication , 993.Cm PubkeyAuthentication ,
903.Cm RekeyLimit , 994.Cm RekeyLimit ,
904.Cm RhostsRSAAuthentication , 995.Cm RhostsRSAAuthentication ,
@@ -1047,6 +1138,12 @@ The default is
1047Enabling environment processing may enable users to bypass access 1138Enabling environment processing may enable users to bypass access
1048restrictions in some configurations using mechanisms such as 1139restrictions in some configurations using mechanisms such as
1049.Ev LD_PRELOAD . 1140.Ev LD_PRELOAD .
1141.It Cm PermitUserRC
1142Specifies whether any
1143.Pa ~/.ssh/rc
1144file is executed.
1145The default is
1146.Dq yes .
1050.It Cm PidFile 1147.It Cm PidFile
1051Specifies the file that contains the process ID of the 1148Specifies the file that contains the process ID of the
1052SSH daemon. 1149SSH daemon.
@@ -1151,6 +1248,33 @@ This option applies to protocol version 1 only.
1151.It Cm ServerKeyBits 1248.It Cm ServerKeyBits
1152Defines the number of bits in the ephemeral protocol version 1 server key. 1249Defines the number of bits in the ephemeral protocol version 1 server key.
1153The minimum value is 512, and the default is 1024. 1250The minimum value is 512, and the default is 1024.
1251.It Cm StreamLocalBindMask
1252Sets the octal file creation mode mask
1253.Pq umask
1254used when creating a Unix-domain socket file for local or remote
1255port forwarding.
1256This option is only used for port forwarding to a Unix-domain socket file.
1257.Pp
1258The default value is 0177, which creates a Unix-domain socket file that is
1259readable and writable only by the owner.
1260Note that not all operating systems honor the file mode on Unix-domain
1261socket files.
1262.It Cm StreamLocalBindUnlink
1263Specifies whether to remove an existing Unix-domain socket file for local
1264or remote port forwarding before creating a new one.
1265If the socket file already exists and
1266.Cm StreamLocalBindUnlink
1267is not enabled,
1268.Nm sshd
1269will be unable to forward the port to the Unix-domain socket file.
1270This option is only used for port forwarding to a Unix-domain socket file.
1271.Pp
1272The argument must be
1273.Dq yes
1274or
1275.Dq no .
1276The default is
1277.Dq no .
1154.It Cm StrictModes 1278.It Cm StrictModes
1155Specifies whether 1279Specifies whether
1156.Xr sshd 8 1280.Xr sshd 8
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-30 12:03:14 +0000