summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/ssh_config.5
AgeCommit message (Collapse)Author
2020-10-16add space between macro arg and punctuation;Jason McIntyre
2020-10-16LogVerbose keyword for ssh and sshdDamien Miller
Allows forcing maximum debug logging by file/function/line pattern- lists. ok markus@
2020-10-08clarify conditions for UpdateHostkeysDamien Miller
2020-10-07disable UpdateHostkeys by default if VerifyHostKeyDNS is enabled;Damien Miller
suggested by Mark D. Baushke
2020-10-03enable UpdateHostkeys by default when the configuration has notDamien Miller
overridden UserKnownHostsFile; ok markus@ "The timing is perfect" deraadt@
2020-10-03prefer ed25519 signature algorithm variants to ECDSA; ok markus@Damien Miller
2020-08-11let ssh_config(5)'s AddKeysToAgent keyword accept a time limit forDamien Miller
keys in addition to its current flag options. Time-limited keys will automatically be removed from ssh-agent after their expiry time has passed; ok markus@
2020-07-17fix macro slip in previous;Jason McIntyre
2020-07-17Add a '%k' TOKEN that expands to the effective HostKey of theDarren Tucker
destination. This allows, eg, keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@ (man page bits)
2020-07-17Add %-TOKEN, environment variable and tilde expansion to UserKnownHostsFile,Darren Tucker
allowing the file to be automagically split up in the configuration (eg bz#1654). ok djm@, man page parts jmc@
2020-05-29remove a stray .El;Jason McIntyre
2020-05-29mention that wildcards are processed in lexical order; bz#3165Damien Miller
2020-05-29Allow some keywords to expand shell-style ${ENV} environmentDarren Tucker
variables on the client side. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. This would for example allow forwarding of Unix domain socket paths that change at runtime. bz#3140, ok djm@
2020-04-11add space between macro arg and punctuation;Jason McIntyre
2020-04-10Add TOKEN percent expansion to LocalFoward and RemoteForward when usedDarren Tucker
for Unix domain socket forwarding. Factor out the code for the config keywords that use the most common subset of TOKENS into its own function. bz#3014, ok jmc@ (man page bits) djm@
2020-04-03Make with config keywords support which percent_expansions more consistent.Darren Tucker
- %C is moved into its own function and added to Match Exec. - move the common (global) options into a macro. This is ugly but it's the least-ugly way I could come up with. - move IdentityAgent and ForwardAgent percent expansion to before the config dump to make it regression-testable. - document all of the above ok jmc@ for man page bits, "makes things less terrible" djm@ for the rest.
2020-02-07Add ssh -Q key-sig for all key and signature types. Teach ssh -Q to acceptDarren Tucker
ssh_config(5) and sshd_config(5) algorithm keywords as an alias for the corresponding query. Man page help jmc@, ok djm@.
2020-01-31spelling fix;Jason McIntyre
2020-01-30document changed default for UpdateHostKeysDamien Miller
2020-01-28make IPTOS_DSCP_LE available via IPQoS directive; bz2986, based onDamien Miller
patch by veegish AT cyberstorm.mu
2020-01-25clarify that BatchMode applies to all interactive prompts (e.g. host keyDamien Miller
confirmation) and not just password prompts.
2020-01-25group14-sha1 is no longer a default algorithmTed Unangst
2020-01-25reword HashKnownHosts description a little more; some people foundDamien Miller
the wording confusing (bz#2560)
2020-01-25weaken the language for what HashKnownHosts provides with regardsDamien Miller
to known_hosts name privacy, it's not practical for this option to offer any guarantee that hostnames cannot be recovered from a disclosed known_hosts file (e.g. by brute force).
2020-01-21document the default value of the ControlPersist option; ok dtucker@ djm@Christian Weisgerber
2019-12-21Replace the term "security key" with "(FIDO) authenticator".Christian Weisgerber
The polysemous use of "key" was too confusing. Input from markus@. ok jmc@
2019-12-21Allow forwarding a different agent socket to the path specified byDamien Miller
$SSH_AUTH_SOCK, by extending the existing ForwardAgent option to accepting an explicit path or the name of an environment variable in addition to yes/no. Patch by Eric Chiang, manpage by me; ok markus@
2019-12-19Document that security key-hosted keys can act as host keys.Christian Weisgerber
Update the list of default host key algorithms in ssh_config.5 and sshd_config.5. Copy the description of the SecurityKeyProvider option to sshd_config.5. ok jmc@
2019-11-30tweak the Nd lines for a bit of consistency;Jason McIntyre
ok markus
2019-11-18document '$' environment variable expansion for SecurityKeyProvider; ok djm@Christian Weisgerber
2019-11-18more missing mentions of ed25519-sk; ok djm@Christian Weisgerber
2019-11-18mention ed25519-sk key/cert types here too; prompted by jmc@Damien Miller
2019-11-14directly support U2F/FIDO2 security keys in OpenSSH by linkingDamien Miller
against the (previously external) USB HID middleware. The dlopen() capability still exists for alternate middlewares, e.g. for Bluetooth, NFC and test/debugging.
2019-11-07Fill in missing man page bits for U2F security key support:Christian Weisgerber
Mention the new key types, the ~/.ssh/id_ecdsa_sk file, ssh's SecurityKeyProvider keyword, the SSH_SK_PROVIDER environment variable, and ssh-keygen's new -w and -x options. Copy the ssh-sk-helper man page from ssh-pkcs11-helper with minimal substitutions. ok djm@
2019-09-13clarify that IdentitiesOnly also applies to the default ~/.ssh/id_*Damien Miller
keys; bz#3062
2019-09-13allow %n to be expanded in ProxyCommand stringsDamien Miller
From Zachary Harmany via github.com/openssh/openssh-portable/pull/118 ok dtucker@
2019-09-13clarify that ConnectTimeout applies both to the TCP connection and toDamien Miller
the protocol handshake/KEX. From Jean-Charles Longuet via Github PR140
2019-09-06Allow prepending a list of algorithms to the default set by startingChristian Weisgerber
the list with the '^' character, e.g. HostKeyAlgorithms ^ssh-ed25519 Ciphers ^aes128-gcm@openssh.com,aes256-gcm@openssh.com ok djm@ dtucker@
2019-09-04Call comma-separated lists as such to clarify semantics.Christian Weisgerber
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list, respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting these semantics. Fix instances missed in first commit. ok jmc@ kn@
2019-08-16Call comma-separated lists as such to clarify semanticskn
Options such as Ciphers take values that may be a list of ciphers; the complete list, not indiviual elements, may be prefixed with a dash or plus character to remove from or append to the default list respectively. Users might read the current text as if each elment took an optional prefix, so tweak the wording from "values" to "list" to prevent such ambiguity for all options supporting this semantics (those that provide a list of available elements via "ssh -Q ..."). Input and OK jmc
2019-08-09Change description of TCPKeepAlive from "inactive" to "unresponsive"Darren Tucker
to clarify what it checks for. Patch from jblaine at kickflop.net via github pr#129, ok djm@.
2019-08-02typo; from Christian HesseDamien Miller
2019-06-12Hostname->HostName cleanup; from lauri tirkkonenJason McIntyre
ok dtucker
2019-06-12deraadt noticed some inconsistency in the way we denote the "Hostname" andJason McIntyre
"X11UseLocalhost" keywords; this makes things consistent (effectively reversing my commit of yesterday); ok deraadt markus djm
2019-06-11consistent lettering for "HostName" keyword; from lauri tirkkonenJason McIntyre
2019-05-14Delete some .Sx macros that were used in a wrong way.Ingo Schwarze
Part of a patch from Stephen Gregoratto <dev at sgregoratto dot me>.
2019-03-01mention PKCS11Provide=none, reword a little and remove mention ofDamien Miller
RSA keys only (since we support ECDSA now and might support others in the future). Inspired by Jakub Jelen via bz#2974
2019-02-23openssh-7.9 accidentally reused the server's algorithm lists in theDamien Miller
client for KEX, ciphers and MACs. The ciphers and MACs were identical between the client and server, but the error accidentially disabled the diffie-hellman-group-exchange-sha1 KEX method. This fixes the client code to use the correct method list, but because nobody complained, it also disables the diffie-hellman-group-exchange-sha1 KEX method. Reported by nuxi AT vault24.org via bz#2697; ok dtucker
2019-02-18sync the description of ~/.ssh/config with djm's updated description in ssh.1;Jason McIntyre
issue pointed out by andreas kahari ok dtucker djm
2019-01-22Mention that configuration for the destination host is not appliedDamien Miller
to any ProxyJump/-J hosts. This has confused a few people...
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 15:31:59 +0000