.Pp
.It Cm DenyUsers
This keyword can be followed by a number of user names, separated
-by spaces. Login is allowed disallowed for user names that match
+by spaces. Login is disallowed for user names that match
one of the patterns.
.Ql \&*
and
.Xr login 1
is used. The default is
.Dq no .
-.It Cm X11Forwarding
-Specifies whether X11 forwarding is permitted. The default is
-.Dq yes .
-Note that disabling X11 forwarding does not improve security in any
-way, as users can always install their own forwarders.
.It Cm X11DisplayOffset
Specifies the first display number available for
.Nm sshd Ns 's
X11 forwarding. This prevents
.Nm
from interfering with real X11 servers.
+.It Cm X11Forwarding
+Specifies whether X11 forwarding is permitted. The default is
+.Dq yes .
+Note that disabling X11 forwarding does not improve security in any
+way, as users can always install their own forwarders.
.El
.Sh LOGIN PROCESS
When a user successfully logs in,