summaryrefslogtreecommitdiff
path: root/sshd_config.5
diff options
context:
space:
mode:
Diffstat (limited to 'sshd_config.5')
-rw-r--r--sshd_config.538
1 files changed, 36 insertions, 2 deletions
diff --git a/sshd_config.5 b/sshd_config.5
index 245ed946f..be3869713 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,8 +34,8 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: sshd_config.5,v 1.84 2008/03/25 11:58:02 djm Exp $ 37.\" $OpenBSD: sshd_config.5,v 1.85 2008/04/04 05:14:38 djm Exp $
38.Dd $Mdocdate: March 25 2008 $ 38.Dd $Mdocdate: April 4 2008 $
39.Dt SSHD_CONFIG 5 39.Dt SSHD_CONFIG 5
40.Os 40.Os
41.Sh NAME 41.Sh NAME
@@ -210,6 +210,29 @@ in-process sftp server is used (see
210.Cm Subsystem 210.Cm Subsystem
211for details). 211for details).
212.Pp 212.Pp
213Please note that there are many ways to misconfigure a chroot environment
214in ways that compromise security.
215These include:
216.Pp
217.Bl -dash -offset indent -compact
218.It
219Making unsafe setuid binaries available;
220.It
221Having missing or incorrect configuration files in the chroot's
222.Pa /etc
223directory;
224.It
225Hard-linking files between the chroot and outside;
226.It
227Leaving unnecessary
228.Pa /dev
229nodes accessible inside the chroot (especially those for physical drives);
230.It
231Executing scripts or binaries inside the chroot from outside, either
232directly or through facilities such as
233.Xr cron 8 .
234.El
235.Pp
213The default is not to 236The default is not to
214.Xr chroot 2 . 237.Xr chroot 2 .
215.It Cm Ciphers 238.It Cm Ciphers
@@ -340,6 +363,11 @@ Specifying a command of
340will force the use of an in-process sftp server that requires no support 363will force the use of an in-process sftp server that requires no support
341files when used with 364files when used with
342.Cm ChrootDirectory . 365.Cm ChrootDirectory .
366Note that
367.Dq internal-sftp
368is only supported when
369.Cm UsePrivilegeSeparation
370is enabled.
343.It Cm GatewayPorts 371.It Cm GatewayPorts
344Specifies whether remote hosts are allowed to connect to ports 372Specifies whether remote hosts are allowed to connect to ports
345forwarded for the client. 373forwarded for the client.
@@ -563,6 +591,7 @@ keyword.
563Available keywords are 591Available keywords are
564.Cm AllowTcpForwarding , 592.Cm AllowTcpForwarding ,
565.Cm Banner , 593.Cm Banner ,
594.Cm ChrootDirectory ,
566.Cm ForceCommand , 595.Cm ForceCommand ,
567.Cm GatewayPorts , 596.Cm GatewayPorts ,
568.Cm GSSApiAuthentication , 597.Cm GSSApiAuthentication ,
@@ -801,6 +830,11 @@ server.
801This may simplify configurations using 830This may simplify configurations using
802.Cm ChrootDirectory 831.Cm ChrootDirectory
803to force a different filesystem root on clients. 832to force a different filesystem root on clients.
833Note that
834.Dq internal-sftp
835is only supported when
836.Cm UsePrivilegeSeparation
837is enabled.
804.Pp 838.Pp
805By default no subsystems are defined. 839By default no subsystems are defined.
806Note that this option applies to protocol version 2 only. 840Note that this option applies to protocol version 2 only.