diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2015-08-06 14:53:22 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2015-08-06 14:53:22 +0000 |
| commit | 9221fa7212521e35bbba4d7108556dd6144068fd (patch) | |
| tree | 8ad8636565e6fa3a3a173716cec6f4363133c614 /usr.bin/ssh/sshd_config.5 | |
| parent | abf3ce54d3d02a3eaf7c5535328f51eb7a8ef772 (diff) | |
add prohibit-password as a synonymn for without-password, since the
without-password is causing too many questions. Harden it to ban all
but pubkey, hostbased, and GSSAPI auth (when the latter is enabled)
from djm, ok markus
Diffstat (limited to 'usr.bin/ssh/sshd_config.5')
| -rw-r--r-- | usr.bin/ssh/sshd_config.5 | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/usr.bin/ssh/sshd_config.5 b/usr.bin/ssh/sshd_config.5 index 9f815e4f0e5..d2e5b25b550 100644 --- a/usr.bin/ssh/sshd_config.5 +++ b/usr.bin/ssh/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.209 2015/07/30 19:23:02 deraadt Exp $ -.Dd $Mdocdate: July 30 2015 $ +.\" $OpenBSD: sshd_config.5,v 1.210 2015/08/06 14:53:21 deraadt Exp $ +.Dd $Mdocdate: August 6 2015 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -1205,16 +1205,19 @@ Specifies whether root can log in using .Xr ssh 1 . The argument must be .Dq yes , +.Dq prohibit-password , .Dq without-password , .Dq forced-commands-only , or .Dq no . The default is -.Dq without-password . +.Dq prohibit-password . .Pp If this option is set to +.Dq prohibit-password +or .Dq without-password , -password authentication is disabled for root. +password and keyboard-interactive authentication are disabled for root. .Pp If this option is set to .Dq forced-commands-only , |