summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/ssh_config.5
AgeCommit message (Collapse)Author
2015-11-15correct section number for ssh-agent;Jason McIntyre
2015-11-15Add an AddKeysToAgent client option which can be set to 'yes', 'no',Joshua Stein
'ask', or 'confirm', and defaults to 'no'. When enabled, a private key that is used during authentication will be added to ssh-agent if it is running (with confirmation enabled if set to 'confirm'). Initial version from Joachim Schipper many years ago. ok markus@
2015-09-24add ssh_config CertificateFile option to explicitly listDamien Miller
a certificate; patch from Meghana Bhat on bz#2436; ok markus@
2015-09-22fix two typos.Igor Sobrado
2015-09-11tweak previous;Jason McIntyre
2015-09-11expand %i in ControlPath to UID; bz#2449Damien Miller
patch from Christian Hesse w/ feedback from dtucker@
2015-09-04full stop belongs outside the brackets, not inside;Jason McIntyre
2015-09-04better document ExitOnForwardFailure; bz#2444, ok dtucker@Damien Miller
2015-08-14match myproposal.h order; from brian conwayJason McIntyre
(i snuck in a tweak while here) ok dtucker
2015-07-30Allow ssh_config and sshd_config kex parameters options be prefixedDamien Miller
by a '+' to indicate that the specified items be appended to the default rather than replacing it. approach suggested by dtucker@, feedback dlg@, ok markus@
2015-07-10Turn off DSA by default; add HostKeyAlgorithms to the server andMarkus Friedl
PubkeyAcceptedKeyTypes to the client side, so it still can be tested or turned back on; feedback and ok djm@
2015-07-03turn off 1024 bit diffie-hellman-group1-sha1 key exchange methodDamien Miller
(already off in server, this turns it off in the client by default too) ok dtucker@
2015-06-02mention CheckHostIP adding addresses to known_hosts;Damien Miller
bz#1993; ok dtucker@
2015-05-28Fix typo (keywork->keyword)Darren Tucker
2015-05-27Reorder client proposal to prefer diffie-hellman-group-exchange-sha1 overDarren Tucker
diffie-hellman-group14-sha1. ok djm@
2015-04-28enviroment -> environment: apologies to darren for not spotting that firstJason McIntyre
time round...
2015-04-28Document that the TERM environment variable is not subject to SendEnvDarren Tucker
and AcceptEnv. bz#2386, based loosely on a patch from jjelen at redhat, help and ok jmc@
2015-03-30ssh-askpass(1) is the default, overridden by SSH_ASKPASS;Jason McIntyre
diff originally from jiri b;
2015-02-20UpdateHostKeys fixes:Damien Miller
I accidentally changed the format of the hostkeys@openssh.com messages last week without changing the extension name, and this has been causing connection failures for people who are running -current. First reported by sthen@ s/hostkeys@openssh.com/hostkeys-00@openssh.com/ Change the name of the proof message too, and reorder it a little. Also, UpdateHostKeys=ask is incompatible with ControlPersist (no TTY available to read the response) so disable UpdateHostKeys if it is in ask mode and ControlPersist is active (and document this)
2015-02-16Revise hostkeys@openssh.com hostkey learning extension.Damien Miller
The client will not ask the server to prove ownership of the private halves of any hitherto-unseen hostkeys it offers to the client. Allow UpdateHostKeys option to take an 'ask' argument to let the user manually review keys offered. ok markus@
2015-02-02turn UpdateHostkeys off by default until I figure out mlarkin@'sDamien Miller
warning message; requested by deraadt@
2015-01-30Add a ssh_config HostbasedKeyType option to control whichDamien Miller
host public key types are tried during hostbased authentication. This may be used to prevent too many keys being sent to the server, and blowing past its MaxAuthTries limit. bz#2211 based on patch by Iain Morgan; ok markus@
2015-01-26correct description of UpdateHostKeys in ssh_config.5 andDamien Miller
add it to -o lists for ssh, scp and sftp; pointed out by jmc@
2015-01-26Host key rotation support.Damien Miller
Add a hostkeys@openssh.com protocol extension (global request) for a server to inform a client of all its available host key after authentication has completed. The client may record the keys in known_hosts, allowing it to upgrade to better host key algorithms and a server to gracefully rotate its keys. The client side of this is controlled by a UpdateHostkeys config option (default on). ok markus@
2014-12-22tweak previous;Jason McIntyre
2014-12-22mention ssh -Q feature to list supported { MAC, cipher, KEX, key }Damien Miller
algorithms in more places and include the query string used to list the relevant information; bz#2288
2014-12-21document FingerprintHash here tooDamien Miller
2014-12-04add RevokedHostKeys option for the clientDamien Miller
Allow textfile or KRL-based revocation of hostkeys.
2014-11-10mux-related manual tweaksDamien Miller
mention ControlPersist=0 is the same as ControlPersist=yes recommend that ControlPath sockets be placed in a og-w directory
2014-10-09tweak previous;Jason McIntyre
2014-10-08Tweak config reparsing with host canonicalisationDamien Miller
Make the second pass through the config files always run when hostname canonicalisation is enabled. Add a "Match canonical" criteria that allows ssh_config Match blocks to trigger only in the second config pass. Add a -G option to ssh that causes it to parse its configuration and dump the result to stdout, similar to "sshd -T" Allow ssh_config Port options set in the second config parse phase to be applied (they were being ignored). bz#2267 bz#2286; ok markus
2014-08-30improve capitalization for the Ed25519 public-key signature system.Igor Sobrado
ok djm@
2014-07-15Add support for Unix domain socket forwarding. A remote TCP portTodd C. Miller
may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
2014-07-07mention that ProxyCommand is executed using shell "exec" to avoidDamien Miller
a lingering process; bz#1977
2014-07-03escape %C since groff thinks it part of an Rs/Re block;Jason McIntyre
2014-07-03Add a %C escape sequence for LocalCommand and ControlPath that expandsDamien Miller
to a unique identifer based on a has of the tuple of (local host, remote user, hostname, port). Helps avoid exceeding sockaddr_un's miserly pathname limits for mux control paths. bz#2220, based on patch from mancha1 AT zoho.com; ok markus@
2014-07-03mention '%%' escape sequence in HostName directives and how it mayDamien Miller
be used to specify IPv6 link-local addresses
2014-03-28sync available and default algorithms, improve algorithm list formattingChristian Weisgerber
help from jmc@ and schwarze@, ok deraadt@
2014-02-23reparse ssh_config and ~/.ssh/config if hostname canonicalisation changesDamien Miller
the hostname. This allows users to write configurations that always refer to canonical hostnames, e.g. CanonicalizeHostname yes CanonicalDomains int.example.org example.org CanonicalizeFallbackLocal no Host *.int.example.org Compression off Host *.example.org User djm ok markus@
2014-01-19fix inverted meaning of 'no' and 'yes' for CanonicalizeFallbackLocalDamien Miller
2013-12-07add missing mentions of ed25519; ok djm@Christian Weisgerber
2013-12-06support ed25519 keys (hostkeys and user identities) using the public domainMarkus Friedl
ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
2013-11-21no need for .Pp before displays;Jason McIntyre
2013-11-21Add a new protocol 2 transport cipher "chacha20-poly1305@openssh.com"Damien Miller
that combines Daniel Bernstein's ChaCha20 stream cipher and Poly1305 MAC to build an authenticated encryption mode. Inspired by and similar to Adam Langley's proposal for TLS: http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03 but differs in layout used for the MAC calculation and the use of a second ChaCha20 instance to separately encrypt packet lengths. Details are in the PROTOCOL.chacha20poly1305 file. Feedback markus@, naddy@; manpage bits Loganden Velvindron @ AfriNIC ok markus@ naddy@
2013-11-02the default kex is now curve25519-sha256@libssh.orgMarkus Friedl
2013-10-24Disallow empty Match statements and add "Match all" which matches everything.Darren Tucker
ok djm, man page help jmc@
2013-10-20tweak the "exec" description, as worded by djm;Jason McIntyre
2013-10-20rename "command" subclause of the recently-added "Match" keyword toDamien Miller
"exec"; it's shorter, clearer in intent and we might want to add the ability to match against the command being executed at the remote end in the future.
2013-10-20document % expansions performed by "Match command ..."Damien Miller
2013-10-16one I missed in previous: s/isation/ization/Damien Miller
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-02 04:48:09 +0000