diff options
Diffstat (limited to 'sshd_config.5')
-rw-r--r-- | sshd_config.5 | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index fd44abe75..c8b43dae3 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
@@ -527,12 +527,40 @@ Specifies whether user authentication based on GSSAPI is allowed. | |||
527 | The default is | 527 | The default is |
528 | .Dq no . | 528 | .Dq no . |
529 | Note that this option applies to protocol version 2 only. | 529 | Note that this option applies to protocol version 2 only. |
530 | .It Cm GSSAPIKeyExchange | ||
531 | Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange | ||
532 | doesn't rely on ssh keys to verify host identity. | ||
533 | The default is | ||
534 | .Dq no . | ||
535 | Note that this option applies to protocol version 2 only. | ||
530 | .It Cm GSSAPICleanupCredentials | 536 | .It Cm GSSAPICleanupCredentials |
531 | Specifies whether to automatically destroy the user's credentials cache | 537 | Specifies whether to automatically destroy the user's credentials cache |
532 | on logout. | 538 | on logout. |
533 | The default is | 539 | The default is |
534 | .Dq yes . | 540 | .Dq yes . |
535 | Note that this option applies to protocol version 2 only. | 541 | Note that this option applies to protocol version 2 only. |
542 | .It Cm GSSAPIStrictAcceptorCheck | ||
543 | Determines whether to be strict about the identity of the GSSAPI acceptor | ||
544 | a client authenticates against. If | ||
545 | .Dq yes | ||
546 | then the client must authenticate against the | ||
547 | .Pa host | ||
548 | service on the current hostname. If | ||
549 | .Dq no | ||
550 | then the client may authenticate against any service key stored in the | ||
551 | machine's default store. This facility is provided to assist with operation | ||
552 | on multi homed machines. | ||
553 | The default is | ||
554 | .Dq yes . | ||
555 | Note that this option applies only to protocol version 2 GSSAPI connections, | ||
556 | and setting it to | ||
557 | .Dq no | ||
558 | may only work with recent Kerberos GSSAPI libraries. | ||
559 | .It Cm GSSAPIStoreCredentialsOnRekey | ||
560 | Controls whether the user's GSSAPI credentials should be updated following a | ||
561 | successful connection rekeying. This option can be used to accepted renewed | ||
562 | or updated credentials from a compatible client. The default is | ||
563 | .Dq no . | ||
536 | .It Cm HostbasedAuthentication | 564 | .It Cm HostbasedAuthentication |
537 | Specifies whether rhosts or /etc/hosts.equiv authentication together | 565 | Specifies whether rhosts or /etc/hosts.equiv authentication together |
538 | with successful public key client host authentication is allowed | 566 | with successful public key client host authentication is allowed |