- miod@cvs.openbsd.org 2003/09/18 13:02:21

[openssh.git] / ssh_config.5

diff --git a/ssh_config.5 b/ssh_config.5
index 99050d38ac472649c1c5fdcec9ed58072cea71aa..7a435a90e03464b85e79e2b626624bfa1dce1ac9 100644 (file)
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"

-.\" $OpenBSD: ssh_config.5,v 1.11 2003/05/20 12:09:32 jmc Exp $
+.\" $OpenBSD: ssh_config.5,v 1.20 2003/09/02 18:50:06 jmc Exp $

 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os


@@ -104,7 +104,7 @@ keyword) to be only for those hosts that match one of the patterns
 given after the keyword.
 .Ql \&*
 and
 given after the keyword.
 .Ql \&*
 and

-.Ql ?
+.Ql \&?

 can be used as wildcards in the
 patterns.
 A single
 can be used as wildcards in the
 patterns.
 A single


@@ -123,13 +123,6 @@ Valid arguments are
 (Use IPv4 only) or
 .Dq inet6
 (Use IPv6 only.)
 (Use IPv4 only) or
 .Dq inet6
 (Use IPv6 only.)

-.It Cm AFSTokenPassing
-Specifies whether to pass AFS tokens to remote host.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-This option applies to protocol version 1 only.

 .It Cm BatchMode
 If set to
 .Dq yes ,
 .It Cm BatchMode
 If set to
 .Dq yes ,


@@ -246,12 +239,30 @@ over the secure channel, and the application
 protocol is then used to determine where to connect to from the
 remote machine.
 The argument must be a port number.
 protocol is then used to determine where to connect to from the
 remote machine.
 The argument must be a port number.

-Currently the SOCKS4 protocol is supported, and
+Currently the SOCKS4 and SOCKS5 protocols are supported, and

 .Nm ssh
 .Nm ssh

-will act as a SOCKS4 server.
+will act as a SOCKS server.

 Multiple forwardings may be specified, and
 additional forwardings can be given on the command line.
 Only the superuser can forward privileged ports.
 Multiple forwardings may be specified, and
 additional forwardings can be given on the command line.
 Only the superuser can forward privileged ports.

+.It Cm EnableSSHKeysign
+Setting this option to
+.Dq yes
+in the global client configuration file
+.Pa /etc/ssh/ssh_config
+enables the use of the helper program
+.Xr ssh-keysign 8
+during
+.Cm HostbasedAuthentication .
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq no .
+See
+.Xr ssh-keysign 8
+for more information.

 .It Cm EscapeChar
 Sets the escape character (default:
 .Ql ~ ) .
 .It Cm EscapeChar
 Sets the escape character (default:
 .Ql ~ ) .


@@ -320,6 +331,18 @@ The default is
 Specifies a file to use for the global
 host key database instead of
 .Pa /etc/ssh/ssh_known_hosts .
 Specifies a file to use for the global
 host key database instead of
 .Pa /etc/ssh/ssh_known_hosts .

+.It Cm GSSAPIAuthentication
+Specifies whether authentication based on GSSAPI may be used, either using
+the result of a successful key exchange, or using GSSAPI user
+authentication.
+The default is
+.Dq yes .
+Note that this option applies to protocol version 2 only.
+.It Cm GSSAPIDelegateCredentials
+Forward (delegate) credentials to the server.
+The default is
+.Dq no .
+Note that this option applies to protocol version 2 only.

 .It Cm HostbasedAuthentication
 Specifies whether to try rhosts based authentication with public key
 authentication.
 .It Cm HostbasedAuthentication
 Specifies whether to try rhosts based authentication with public key
 authentication.


@@ -384,19 +407,6 @@ This is important in scripts, and many users want it too.
 .Pp
 To disable keepalives, the value should be set to
 .Dq no .
 .Pp
 To disable keepalives, the value should be set to
 .Dq no .

-.It Cm KerberosAuthentication
-Specifies whether Kerberos authentication will be used.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-.It Cm KerberosTgtPassing
-Specifies whether a Kerberos TGT will be forwarded to the server.
-This will only work if the Kerberos server is actually an AFS kaserver.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .

 .It Cm LocalForward
 Specifies that a TCP/IP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.
 .It Cm LocalForward
 Specifies that a TCP/IP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.


@@ -519,26 +529,6 @@ IPv6 addresses can be specified with an alternative syntax:
 Multiple forwardings may be specified, and additional
 forwardings can be given on the command line.
 Only the superuser can forward privileged ports.
 Multiple forwardings may be specified, and additional
 forwardings can be given on the command line.
 Only the superuser can forward privileged ports.

-.It Cm RhostsAuthentication
-Specifies whether to try rhosts based authentication.
-Note that this
-declaration only affects the client side and has no effect whatsoever
-on security.
-Most servers do not permit RhostsAuthentication because it
-is not secure (see
-.Cm RhostsRSAAuthentication ) .
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-This option applies to protocol version 1 only and requires
-.Nm ssh
-to be setuid root and
-.Cm UsePrivilegedPort
-to be set to
-.Dq yes .

 .It Cm RhostsRSAAuthentication
 Specifies whether to try rhosts based authentication with RSA host
 authentication.
 .It Cm RhostsRSAAuthentication
 Specifies whether to try rhosts based authentication with RSA host
 authentication.


@@ -619,11 +609,9 @@ If set to
 must be setuid root.
 Note that this option must be set to
 .Dq yes
 must be setuid root.
 Note that this option must be set to
 .Dq yes

-if
-.Cm RhostsAuthentication
-and
+for

 .Cm RhostsRSAAuthentication
 .Cm RhostsRSAAuthentication

-authentications are needed with older servers.
+with older servers.

 .It Cm User
 Specifies the user to log in as.
 This can be useful when a different user name is used on different machines.
 .It Cm User
 Specifies the user to log in as.
 This can be useful when a different user name is used on different machines.


@@ -638,6 +626,7 @@ Specifies whether to verify the remote key using DNS and SSHFP resource
 records.
 The default is
 .Dq no .
 records.
 The default is
 .Dq no .

+Note that this option applies to protocol version 2 only.

 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1


@@ -663,6 +652,8 @@ values that are not specified in the user's configuration file, and
 for those users who do not have a configuration file.
 This file must be world-readable.
 .El
 for those users who do not have a configuration file.
 This file must be world-readable.
 .El

+.Sh SEE ALSO
+.Xr ssh 1

 .Sh AUTHORS
 OpenSSH is a derivative of the original and free
 ssh 1.2.12 release by Tatu Ylonen.
 .Sh AUTHORS
 OpenSSH is a derivative of the original and free
 ssh 1.2.12 release by Tatu Ylonen.


@@ -672,5 +663,3 @@ removed many bugs, re-added newer features and
 created OpenSSH.
 Markus Friedl contributed the support for SSH
 protocol versions 1.5 and 2.0.
 created OpenSSH.
 Markus Friedl contributed the support for SSH
 protocol versions 1.5 and 2.0.

-.Sh SEE ALSO
-.Xr ssh 1