src/crypto/external/bsd/openssh/dist/sshd_config.5 - diff

Return to sshd_config.5 CVS log

Up to [cvs.NetBSD.org] / src / crypto / external / bsd / openssh / dist

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/crypto/external/bsd/openssh/dist/sshd_config.5 between version 1.5 and 1.6

version 1.5, 2010/04/29 18:14:09

version 1.6, 2010/11/21 18:29:49

Line 35

.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

.\"

.\" $OpenBSD: sshd_config.5,v 1.106 2009/04/21 15:13:17 stevesk Exp $

.\" $OpenBSD: sshd_config.5,v 1.125 2010/06/30 07:28:34 jmc Exp $

.Dd April 21, 2009

.Dd June 30, 2010

.Dt SSHD_CONFIG 5

.Os

.Sh NAME

Line 156 for more information on patterns.

.It Cm AuthorizedKeysFile

Specifies the file that contains the public keys that can be used

for user authentication.

The format is described in the

.Sx AUTHORIZED_KEYS FILE FORMAT

section of

.Xr sshd 8 .

.Cm AuthorizedKeysFile

may contain tokens of the form %T which are substituted during connection

setup.

Line 168 is taken to be an absolute path or one r

Line 172 is taken to be an absolute path or one r

directory.

The default is

.Dq .ssh/authorized_keys .

.It Cm AuthorizedPrincipalsFile

Specifies a file that lists principal names that are accepted for

certificate authentication.

When using certificates signed by a key listed in

.Cm TrustedUserCAKeys ,

this file lists names, one of which must appear in the certificate for it

to be accepted for authentication.

Names are listed one per line preceded by key options (as described

.Sx AUTHORIZED_KEYS FILE FORMAT

.Xr sshd 8 ) .

Empty lines and comments starting with

.Ql #

are ignored.

.Pp

.Cm AuthorizedPrincipalsFile

may contain tokens of the form %T which are substituted during connection

setup.

The following tokens are defined: %% is replaced by a literal '%',

%h is replaced by the home directory of the user being authenticated, and

%u is replaced by the username of that user.

After expansion,

.Cm AuthorizedPrincipalsFile

is taken to be an absolute path or one relative to the user's home

directory.

.Pp

The default is not to use a principals file \(en in this case, the username

of the user must appear in a certificate's principals list for it to be

accepted.

Note that

.Cm AuthorizedPrincipalsFile

is only used when authentication proceeds using a CA listed in

.Cm TrustedUserCAKeys

and is not consulted for certification authorities trusted via

.Pa ~/.ssh/authorized_keys ,

though the

.Cm principals=

key option offers a similar facility (see

.Xr sshd 8

for details).

.It Cm Banner

The contents of the specified file are sent to the remote user before

authentication is allowed.

Line 184 are supported.

Line 229 are supported.

The default is

.Dq yes .

.It Cm ChrootDirectory

Specifies a path to

Specifies the pathname of a directory to

.Xr chroot 2

to after authentication.

This path, and all its components, must be root-owned directories that are

All components of the pathname must be root-owned directories that are

not writable by any other user or group.

After the chroot,

.Xr sshd 8

changes the working directory to the user's home directory.

.Pp

The path may contain the following tokens that are expanded at runtime once

The pathname may contain the following tokens that are expanded at runtime once

the connecting user has been authenticated: %% is replaced by a literal '%',

%h is replaced by the home directory of the user being authenticated, and

%u is replaced by the username of that user.

Line 413 uses the name supplied by the client rat

Line 458 uses the name supplied by the client rat

attempting to resolve the name from the TCP connection itself.

The default is

.Dq no .

.It Cm HostCertificate

Specifies a file containing a public host certificate.

The certificate's public key must match a private host key already specified

.Cm HostKey .

The default behaviour of

.Xr sshd 8

is not to load any certificates.

.It Cm HostKey

Specifies a file containing a private host key

used by SSH.

Line 602 keyword.

Line 655 keyword.

Available keywords are

.Cm AllowAgentForwarding ,

.Cm AllowTcpForwarding ,

.Cm AuthorizedKeysFile ,

.Cm AuthorizedPrincipalsFile ,

.Cm Banner ,

.Cm ChrootDirectory ,

.Cm ForceCommand ,

.Cm GatewayPorts ,

.Cm GSSAPIAuthentication ,

.Cm HostbasedAuthentication ,

.Cm HostbasedUsesNameFromPacketOnly ,

.Cm KbdInteractiveAuthentication ,

.Cm KerberosAuthentication ,

.Cm MaxAuthTries ,

Line 616 Available keywords are

Line 672 Available keywords are

.Cm PermitEmptyPasswords ,

.Cm PermitOpen ,

.Cm PermitRootLogin ,

.Cm PermitTunnel ,

.Cm PubkeyAuthentication ,

.Cm RhostsRSAAuthentication ,

.Cm RSAAuthentication ,

.Cm X11DisplayOffset ,

Line 794 and

Line 852 and

.Sq 2 .

Multiple versions must be comma-separated.

The default is

.Dq 2,1 .

.Sq 2 .

Note that the order of the protocol list does not indicate preference,

because the client selects among multiple protocol versions offered

by the server.

Line 807 Specifies whether public key authenticat

Line 865 Specifies whether public key authenticat

The default is

.Dq yes .

Note that this option applies to protocol version 2 only.

.It Cm RevokedKeys

Specifies a list of revoked public keys.

Keys listed in this file will be refused for public key authentication.

Note that if this file is not readable, then public key authentication will

be refused for all users.

.It Cm RhostsRSAAuthentication

Specifies whether rhosts or /etc/hosts.equiv authentication together

with successful RSA host authentication is allowed.

Line 830 This is normally desirable because novic

Line 893 This is normally desirable because novic

directory or files world-writable.

The default is

.Dq yes .

Note that this does not apply to

.Cm ChrootDirectory ,

whose permissions and ownership are checked unconditionally.

.It Cm Subsystem

Configures an external subsystem (e.g. file transfer daemon).

Arguments should be a subsystem name and a command (with optional arguments)

Line 879 This avoids infinitely hanging sessions.

Line 945 This avoids infinitely hanging sessions.

.Pp

To disable TCP keepalive messages, the value should be set to

.Dq no .

.It Cm TrustedUserCAKeys

Specifies a file containing public keys of certificate authorities that are

trusted to sign user certificates for authentication.

Keys are listed one per line; empty lines and comments starting with

.Ql #

are allowed.

If a certificate is presented for authentication and has its signing CA key

listed in this file, then it may be used for authentication for any user

listed in the certificate's principals list.

Note that certificates that lack a list of principals will not be permitted

for authentication using

.Cm TrustedUserCAKeys .

For more details on certificates, see the

.Sx CERTIFICATES

section in

.Xr ssh-keygen 1 .

.It Cm UseDNS

Specifies whether

.Xr sshd 8

CVSweb <webmaster@jp.NetBSD.org>