- (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.

[openssh.git] / ssh_config.5

diff --git a/ssh_config.5 b/ssh_config.5
index 4f4678d5b31d1021085f10e1d66bd73e06b0f874..b9ec945708fc7090a4840c7315f48fd079cd4c9f 100644 (file)
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.109 2008/06/12 16:35:31 dtucker Exp $
+.\" $OpenBSD: ssh_config.5,v 1.116 2009/01/24 17:10:22 naddy Exp $
 .Dd $Mdocdate$
 .Dt SSH_CONFIG 5
 .Os
@@ -103,7 +103,7 @@ Restricts the following declarations (up to the next
 .Cm Host
 keyword) to be only for those hosts that match one of the patterns
 given after the keyword.
-If more than one pattern is provided, they should be separated by whitepsace.
+If more than one pattern is provided, they should be separated by whitespace.
 A single
 .Ql *
 as a pattern can be used to provide global
@@ -161,11 +161,6 @@ will additionally check the host IP address in the
 file.
 This allows ssh to detect if a host key changed due to DNS spoofing.
 If the option is set to
-.Dq fingerprint ,
-not only the host IP address will be checked, but also a fingerprint
-along with an ASCII art
-representation of the key will be printed.
-If the option is set to
 .Dq no ,
 the check will not be executed.
 The default is
@@ -209,9 +204,9 @@ and
 .Dq cast128-cbc .
 The default is:
 .Bd -literal -offset 3n
-aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
-arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
-aes192-ctr,aes256-ctr
+aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
+aes256-cbc,arcfour
 .Ed
 .It Cm ClearAllForwardings
 Specifies that all local, remote, and dynamic port forwardings
@@ -816,7 +811,8 @@ and
 .Ar host Ns / Ns Ar hostport .
 Multiple forwardings may be specified, and additional
 forwardings can be given on the command line.
-Only the superuser can forward privileged ports.
+Privileged ports can be forwarded only when
+logging in as root on the remote machine.
 .Pp
 If the
 .Ar bind_address
@@ -1065,12 +1061,35 @@ See also
 .Sx VERIFYING HOST KEYS
 in
 .Xr ssh 1 .
+.It Cm VisualHostKey
+If this flag is set to
+.Dq yes ,
+an ASCII art representation of the remote host key fingerprint is
+printed in addition to the hex fingerprint string at login and
+for unknown host keys.
+If this flag is set to
+.Dq no ,
+no fingerprint strings are printed at login and
+only the hex fingerprint string will be printed for unknown host keys.
+The default is
+.Dq no .
 .It Cm XAuthLocation
 Specifies the full pathname of the
 .Xr xauth 1
 program.
 The default is
 .Pa /usr/X11R6/bin/xauth .
+.It Cm ZeroKnowledgePasswordAuthentication
+Specifies whether to use zero knowledge password authentication.
+This authentication method avoids exposure of password to untrusted
+hosts.
+The argument to this keyword must be
+.Dq yes
+or
+.Dq no .
+The default is currently
+.Dq no
+as this method is considered experimental.
 .El
 .Sh PATTERNS
 A