summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/ssh_config.5
AgeCommit message (Collapse)Author
2019-12-21Replace the term "security key" with "(FIDO) authenticator".Christian Weisgerber
The polysemous use of "key" was too confusing. Input from markus@. ok jmc@
2019-12-21Allow forwarding a different agent socket to the path specified byDamien Miller
$SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
2019-12-19Document that security key-hosted keys can act as host keys.Christian Weisgerber
Update the list of default host key algorithms in ssh_config.5 and sshd_config.5. Copy the description of the SecurityKeyProvider option to sshd_config.5. ok jmc@
2019-11-30tweak the Nd lines for a bit of consistency;Jason McIntyre
ok markus
2019-11-18document '$' environment variable expansion for SecurityKeyProvider; ok djm@Christian Weisgerber
2019-11-18more missing mentions of ed25519-sk; ok djm@Christian Weisgerber
2019-11-18mention ed25519-sk key/cert types here too; prompted by jmc@Damien Miller
2019-11-14directly support U2F/FIDO2 security keys in OpenSSH by linkingDamien Miller
against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging.
2019-11-07Fill in missing man page bits for U2F security key support:Christian Weisgerber
Mention the new key types, the ~/.ssh/id_ecdsa_sk file, ssh's SecurityKeyProvider keyword, the SSH_SK_PROVIDER environment variable, and ssh-keygen's new -w and -x options. Copy the ssh-sk-helper man page from ssh-pkcs11-helper with minimal substitutions. ok djm@
2019-09-13clarify that IdentitiesOnly also applies to the default ~/.ssh/id_*Damien Miller
keys; bz#3062
2019-09-13allow %n to be expanded in ProxyCommand stringsDamien Miller
From Zachary Harmany via github.com/openssh/openssh-portable/pull/118 ok dtucker@
2019-09-13clarify that ConnectTimeout applies both to the TCP connection and toDamien Miller
the protocol handshake/KEX. From Jean-Charles Longuet via Github PR140
2019-09-06Allow prepending a list of algorithms to the default set by startingChristian Weisgerber
the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
2019-09-04Call comma-separated lists as such to clarify semantics.Christian Weisgerber
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list, respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting these semantics. Fix instances missed in first commit. ok jmc@ kn@
2019-08-16Call comma-separated lists as such to clarify semanticskn
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting this semantics (those that provide a list of available elements via "ssh -Q ..."). Input and OK jmc
2019-08-09Change description of TCPKeepAlive from "inactive" to "unresponsive"Darren Tucker
to clarify what it checks for. Patch from jblaine at kickflop.net via github pr#129, ok djm@.
2019-08-02typo; from Christian HesseDamien Miller
2019-06-12Hostname->HostName cleanup; from lauri tirkkonenJason McIntyre
ok dtucker
2019-06-12deraadt noticed some inconsistency in the way we denote the "Hostname" andJason McIntyre
"X11UseLocalhost" keywords; this makes things consistent (effectively reversing my commit of yesterday); ok deraadt markus djm
2019-06-11consistent lettering for "HostName" keyword; from lauri tirkkonenJason McIntyre
2019-05-14Delete some .Sx macros that were used in a wrong way.Ingo Schwarze
Part of a patch from Stephen Gregoratto <dev at sgregoratto dot me>.
2019-03-01mention PKCS11Provide=none, reword a little and remove mention ofDamien Miller
RSA keys only (since we support ECDSA now and might support others in the future). Inspired by Jakub Jelen via bz#2974
2019-02-23openssh-7.9 accidentally reused the server's algorithm lists in theDamien Miller
client for KEX, ciphers and MACs. The ciphers and MACs were identical between the client and server, but the error accidentially disabled the diffie-hellman-group-exchange-sha1 KEX method. This fixes the client code to use the correct method list, but because nobody complained, it also disables the diffie-hellman-group-exchange-sha1 KEX method. Reported by nuxi AT vault24.org via bz#2697; ok dtucker
2019-02-18sync the description of ~/.ssh/config with djm's updated description in ssh.1;Jason McIntyre
issue pointed out by andreas kahari ok dtucker djm
2019-01-22Mention that configuration for the destination host is not appliedDamien Miller
to any ProxyJump/-J hosts. This has confused a few people...
2018-11-23tweak previous;Jason McIntyre
2018-11-23add a ssh_config "Match final" predicateDamien Miller
Matches in same pass as "Match canonical" but doesn't require hostname canonicalisation be enabled. bz#2906 ok markus
2018-10-03Allow ssh_config IdentityAgent directive to accept environment variableDamien Miller
names as well as explicit paths. ok dtucker@
2018-09-21Allow ssh_config ForwardX11Timeout=0 to disable the timeout and allowDamien Miller
X11 connections in untrusted mode indefinitely. ok dtucker@
2018-09-21Treat connections with ProxyJump specified the same as ones with aDamien Miller
ProxyCommand set with regards to hostname canonicalisation (i.e. don't try to canonicalise the hostname unless CanonicalizeHostname is set to 'always'). Patch from Sven Wegener via bz#2896
2018-09-20reorder CASignatureAlgorithms, and add them to the various -o lists;Jason McIntyre
ok djm
2018-09-20add CASignatureAlgorithms option for the client, allowing it to specifyDamien Miller
which signature algorithms may be used by CAs when signing certificates. Useful if you want to ban RSA/SHA1; ok markus@
2018-07-23Point to glob in section 7 for the actual list of special characters insteadkn
the C API in section 3. OK millert jmc nicm, "the right idea" deraadt
2018-07-19Deprecate UsePrivilegedPort now that support for running ssh(1)Darren Tucker
setuid has been removed, remove supporting code and clean up references to it in the man pages We have not shipped ssh(1) the setuid bit since 2002. If ayone really needs to make connections from a low port number this can be implemented via a small setuid ProxyCommand. ok markus@ jmc@ djm@
2018-07-04repair PubkeyAcceptedKeyTypes (and friends) after RSA signature work -Damien Miller
returns ability to add/remove/specify algorithms by wildcard. Algorithm lists are now fully expanded when the server/client configs are finalised, so errors are reported early and the config dumps (e.g. "ssh -G ...") now list the actual algorithms selected. Clarify that, while wildcards are accepted in algorithm lists, they aren't full pattern-lists that support negation. (lots of) feedback, ok markus@
2018-07-03Improve strictness and control over RSA-SHA2 signature types:Damien Miller
In ssh, when an agent fails to return a RSA-SHA2 signature when requested and falls back to RSA-SHA1 instead, retry the signature to ensure that the public key algorithm sent in the SSH_MSG_USERAUTH matches the one in the signature itself. In sshd, strictly enforce that the public key algorithm sent in the SSH_MSG_USERAUTH message matches what appears in the signature. Make the sshd_config PubkeyAcceptedKeyTypes and HostbasedAcceptedKeyTypes options control accepted signature algorithms (previously they selected supported key types). This allows these options to ban RSA-SHA1 in favour of RSA-SHA2. Add new signature algorithms "rsa-sha2-256-cert-v01@openssh.com" and "rsa-sha2-512-cert-v01@openssh.com" to force use of RSA-SHA2 signatures with certificate keys. feedback and ok markus@
2018-06-09sort previous;Jason McIntyre
2018-06-09add a SetEnv directive to ssh_config that allows setting environmentDamien Miller
variables for the remote session (subject to the server accepting them) refactor SendEnv to remove the arbitrary limit of variable names. ok markus@
2018-06-01add missing punctuation after %i in ssh_config.5, and make the grammaticalJason McIntyre
format in sshd_config.5 match that in ssh_config.5;
2018-06-01make UID available as a %-expansion everywhere that the username isDamien Miller
available currently. In the client this is via %i, in the server %U (since %i was already used in the client in some places for this, but used for something different in the server); bz#2870, ok dtucker@
2018-04-10lots of typos in comments/docs. Patch from Karsten Weiss after checkingDamien Miller
with codespell tool (https://github.com/lucasdemarchi/codespell)
2018-04-07tweak previous;Jason McIntyre
2018-04-06Allow "SendEnv -PATTERN" to clear environment variables previouslyDamien Miller
labeled for sendind. bz#1285 ok dtucker@
2018-04-05We don't offer CBC cipher by default any more. Spotted by RenaudDamien Miller
Allard (via otto@)
2018-04-04Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for interactive and CS1 ↵job
for bulk AF21 was selected as this is the highest priority within the low-latency service class (and it is higher than what we have today). SSH is elastic and time-sensitive data, where a user is waiting for a response via the network in order to continue with a task at hand. As such, these flows should be considered foreground traffic, with delays or drops to such traffic directly impacting user-productivity. For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable networks implementing a scavanger/lower-than-best effort class to discriminate scp(1) below normal activities, such as web surfing. In general this type of bulk SSH traffic is a background activity. An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH is that they are recognisable values on all common platforms (IANA https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and for AF21 specifically a definition of the intended behavior exists https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662 The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE 802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate", or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e, MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK"). OK deraadt@, "no objection" djm@
2018-02-23some cleanup for BindInterface and ssh-keyscan;Jason McIntyre
2018-02-23Add BindInterface ssh_config directive and -B command-line argumentDamien Miller
to ssh(1) that directs it to bind its outgoing connection to the address of the specified network interface. BindInterface prefers to use addresses that aren't loopback or link- local, but will fall back to those if no other addresses of the required family are available on that interface. Based on patch by Mike Manning in bz#2820, ok dtucker@
2018-02-16Mention recent DH KEX methods:Damien Miller
diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 From Jakub Jelen via bz#2826
2018-02-10Mention ServerAliveTimeout in context of TCPKeepAlives; prompted byDamien Miller
Christoph Anton Mitterer via github
2018-02-10Shorter, more accurate explanation of NoHostAuthenticationForLocalhostDamien Miller
without the confusing example. Prompted by Christoph Anton Mitterer via github and bz#2293.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-24 18:35:04 +0000