1.\" -*- nroff -*-
2.\"
3.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5.\" All rights reserved
6.\"
7.\" As far as I am concerned, the code I have written for this software
8.\" can be used freely for any purpose. Any derived versions of this
9.\" software must be clearly marked as such, and if the derived work is
10.\" incompatible with the protocol description in the RFC file, it must be
11.\" called by a name other than "ssh" or "Secure Shell".
12.\"
13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
16.\"
17.\" Redistribution and use in source and binary forms, with or without
18.\" modification, are permitted provided that the following conditions
19.\" are met:
20.\" 1. Redistributions of source code must retain the above copyright
21.\" notice, this list of conditions and the following disclaimer.
22.\" 2. Redistributions in binary form must reproduce the above copyright
23.\" notice, this list of conditions and the following disclaimer in the
24.\" documentation and/or other materials provided with the distribution.
25.\"
26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\"
| 1.\" -*- nroff -*-
2.\"
3.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5.\" All rights reserved
6.\"
7.\" As far as I am concerned, the code I have written for this software
8.\" can be used freely for any purpose. Any derived versions of this
9.\" software must be clearly marked as such, and if the derived work is
10.\" incompatible with the protocol description in the RFC file, it must be
11.\" called by a name other than "ssh" or "Secure Shell".
12.\"
13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
16.\"
17.\" Redistribution and use in source and binary forms, with or without
18.\" modification, are permitted provided that the following conditions
19.\" are met:
20.\" 1. Redistributions of source code must retain the above copyright
21.\" notice, this list of conditions and the following disclaimer.
22.\" 2. Redistributions in binary form must reproduce the above copyright
23.\" notice, this list of conditions and the following disclaimer in the
24.\" documentation and/or other materials provided with the distribution.
25.\"
26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\"
|
37.\" $FreeBSD: head/crypto/openssh/ssh_config.5 128460 2004-04-20 09:46:41Z des $
38.\" $OpenBSD: ssh_config.5,v 1.28 2003/12/16 15:49:51 markus Exp $
| 37.\" $OpenBSD: ssh_config.5,v 1.38 2004/06/26 09:11:14 jmc Exp $
38.\" $FreeBSD: head/crypto/openssh/ssh_config.5 137019 2004-10-28 16:11:31Z des $
|
39.Dd September 25, 1999
40.Dt SSH_CONFIG 5
41.Os
42.Sh NAME
43.Nm ssh_config
44.Nd OpenSSH SSH client configuration files
45.Sh SYNOPSIS
46.Bl -tag -width Ds -compact
47.It Pa $HOME/.ssh/config
48.It Pa /etc/ssh/ssh_config
49.El
50.Sh DESCRIPTION
51.Nm ssh
52obtains configuration data from the following sources in
53the following order:
54.Bl -enum -offset indent -compact
55.It
56command-line options
57.It
58user's configuration file
59.Pq Pa $HOME/.ssh/config
60.It
61system-wide configuration file
62.Pq Pa /etc/ssh/ssh_config
63.El
64.Pp
65For each parameter, the first obtained value
66will be used.
67The configuration files contain sections bracketed by
68.Dq Host
69specifications, and that section is only applied for hosts that
70match one of the patterns given in the specification.
71The matched host name is the one given on the command line.
72.Pp
73Since the first obtained value for each parameter is used, more
74host-specific declarations should be given near the beginning of the
75file, and general defaults at the end.
76.Pp
77The configuration file has the following format:
78.Pp
79Empty lines and lines starting with
80.Ql #
81are comments.
82.Pp
83Otherwise a line is of the format
84.Dq keyword arguments .
85Configuration options may be separated by whitespace or
86optional whitespace and exactly one
87.Ql = ;
88the latter format is useful to avoid the need to quote whitespace
89when specifying configuration options using the
90.Nm ssh ,
91.Nm scp
92and
93.Nm sftp
94.Fl o
95option.
96.Pp
97The possible
98keywords and their meanings are as follows (note that
99keywords are case-insensitive and arguments are case-sensitive):
100.Bl -tag -width Ds
101.It Cm Host
102Restricts the following declarations (up to the next
103.Cm Host
104keyword) to be only for those hosts that match one of the patterns
105given after the keyword.
106.Ql \&*
107and
108.Ql \&?
109can be used as wildcards in the
110patterns.
111A single
112.Ql \&*
113as a pattern can be used to provide global
114defaults for all hosts.
115The host is the
116.Ar hostname
117argument given on the command line (i.e., the name is not converted to
118a canonicalized host name before matching).
119.It Cm AddressFamily
120Specifies which address family to use when connecting.
121Valid arguments are
122.Dq any ,
123.Dq inet
124(Use IPv4 only) or
125.Dq inet6
126(Use IPv6 only.)
127.It Cm BatchMode
128If set to
129.Dq yes ,
130passphrase/password querying will be disabled.
131This option is useful in scripts and other batch jobs where no user
132is present to supply the password.
133The argument must be
134.Dq yes
135or
136.Dq no .
137The default is
138.Dq no .
139.It Cm BindAddress
140Specify the interface to transmit from on machines with multiple
141interfaces or aliased addresses.
142Note that this option does not work if
143.Cm UsePrivilegedPort
144is set to
145.Dq yes .
146.It Cm ChallengeResponseAuthentication
147Specifies whether to use challenge response authentication.
148The argument to this keyword must be
149.Dq yes
150or
151.Dq no .
152The default is
153.Dq yes .
154.It Cm CheckHostIP
155If this flag is set to
156.Dq yes ,
157ssh will additionally check the host IP address in the
158.Pa known_hosts
159file.
160This allows ssh to detect if a host key changed due to DNS spoofing.
161If the option is set to
162.Dq no ,
163the check will not be executed.
164The default is
165.Dq no .
166.It Cm Cipher
167Specifies the cipher to use for encrypting the session
168in protocol version 1.
169Currently,
170.Dq blowfish ,
171.Dq 3des ,
172and
173.Dq des
174are supported.
175.Ar des
176is only supported in the
177.Nm ssh
178client for interoperability with legacy protocol 1 implementations
179that do not support the
180.Ar 3des
181cipher.
182Its use is strongly discouraged due to cryptographic weaknesses.
183The default is
184.Dq 3des .
185.It Cm Ciphers
186Specifies the ciphers allowed for protocol version 2
187in order of preference.
188Multiple ciphers must be comma-separated.
| 39.Dd September 25, 1999
40.Dt SSH_CONFIG 5
41.Os
42.Sh NAME
43.Nm ssh_config
44.Nd OpenSSH SSH client configuration files
45.Sh SYNOPSIS
46.Bl -tag -width Ds -compact
47.It Pa $HOME/.ssh/config
48.It Pa /etc/ssh/ssh_config
49.El
50.Sh DESCRIPTION
51.Nm ssh
52obtains configuration data from the following sources in
53the following order:
54.Bl -enum -offset indent -compact
55.It
56command-line options
57.It
58user's configuration file
59.Pq Pa $HOME/.ssh/config
60.It
61system-wide configuration file
62.Pq Pa /etc/ssh/ssh_config
63.El
64.Pp
65For each parameter, the first obtained value
66will be used.
67The configuration files contain sections bracketed by
68.Dq Host
69specifications, and that section is only applied for hosts that
70match one of the patterns given in the specification.
71The matched host name is the one given on the command line.
72.Pp
73Since the first obtained value for each parameter is used, more
74host-specific declarations should be given near the beginning of the
75file, and general defaults at the end.
76.Pp
77The configuration file has the following format:
78.Pp
79Empty lines and lines starting with
80.Ql #
81are comments.
82.Pp
83Otherwise a line is of the format
84.Dq keyword arguments .
85Configuration options may be separated by whitespace or
86optional whitespace and exactly one
87.Ql = ;
88the latter format is useful to avoid the need to quote whitespace
89when specifying configuration options using the
90.Nm ssh ,
91.Nm scp
92and
93.Nm sftp
94.Fl o
95option.
96.Pp
97The possible
98keywords and their meanings are as follows (note that
99keywords are case-insensitive and arguments are case-sensitive):
100.Bl -tag -width Ds
101.It Cm Host
102Restricts the following declarations (up to the next
103.Cm Host
104keyword) to be only for those hosts that match one of the patterns
105given after the keyword.
106.Ql \&*
107and
108.Ql \&?
109can be used as wildcards in the
110patterns.
111A single
112.Ql \&*
113as a pattern can be used to provide global
114defaults for all hosts.
115The host is the
116.Ar hostname
117argument given on the command line (i.e., the name is not converted to
118a canonicalized host name before matching).
119.It Cm AddressFamily
120Specifies which address family to use when connecting.
121Valid arguments are
122.Dq any ,
123.Dq inet
124(Use IPv4 only) or
125.Dq inet6
126(Use IPv6 only.)
127.It Cm BatchMode
128If set to
129.Dq yes ,
130passphrase/password querying will be disabled.
131This option is useful in scripts and other batch jobs where no user
132is present to supply the password.
133The argument must be
134.Dq yes
135or
136.Dq no .
137The default is
138.Dq no .
139.It Cm BindAddress
140Specify the interface to transmit from on machines with multiple
141interfaces or aliased addresses.
142Note that this option does not work if
143.Cm UsePrivilegedPort
144is set to
145.Dq yes .
146.It Cm ChallengeResponseAuthentication
147Specifies whether to use challenge response authentication.
148The argument to this keyword must be
149.Dq yes
150or
151.Dq no .
152The default is
153.Dq yes .
154.It Cm CheckHostIP
155If this flag is set to
156.Dq yes ,
157ssh will additionally check the host IP address in the
158.Pa known_hosts
159file.
160This allows ssh to detect if a host key changed due to DNS spoofing.
161If the option is set to
162.Dq no ,
163the check will not be executed.
164The default is
165.Dq no .
166.It Cm Cipher
167Specifies the cipher to use for encrypting the session
168in protocol version 1.
169Currently,
170.Dq blowfish ,
171.Dq 3des ,
172and
173.Dq des
174are supported.
175.Ar des
176is only supported in the
177.Nm ssh
178client for interoperability with legacy protocol 1 implementations
179that do not support the
180.Ar 3des
181cipher.
182Its use is strongly discouraged due to cryptographic weaknesses.
183The default is
184.Dq 3des .
185.It Cm Ciphers
186Specifies the ciphers allowed for protocol version 2
187in order of preference.
188Multiple ciphers must be comma-separated.
|
| 189The supported ciphers are
190.Dq 3des-cbc ,
191.Dq aes128-cbc ,
192.Dq aes192-cbc ,
193.Dq aes256-cbc ,
194.Dq aes128-ctr ,
195.Dq aes192-ctr ,
196.Dq aes256-ctr ,
197.Dq arcfour ,
198.Dq blowfish-cbc ,
199and
200.Dq cast128-cbc .
|
189The default is
190.Bd -literal
191 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
192 aes192-cbc,aes256-cbc''
193.Ed
194.It Cm ClearAllForwardings
195Specifies that all local, remote and dynamic port forwardings
196specified in the configuration files or on the command line be
197cleared.
198This option is primarily useful when used from the
199.Nm ssh
200command line to clear port forwardings set in
201configuration files, and is automatically set by
202.Xr scp 1
203and
204.Xr sftp 1 .
205The argument must be
206.Dq yes
207or
208.Dq no .
209The default is
210.Dq no .
211.It Cm Compression
212Specifies whether to use compression.
213The argument must be
214.Dq yes
215or
216.Dq no .
217The default is
218.Dq no .
219.It Cm CompressionLevel
220Specifies the compression level to use if compression is enabled.
221The argument must be an integer from 1 (fast) to 9 (slow, best).
222The default level is 6, which is good for most applications.
223The meaning of the values is the same as in
224.Xr gzip 1 .
225Note that this option applies to protocol version 1 only.
226.It Cm ConnectionAttempts
227Specifies the number of tries (one per second) to make before exiting.
228The argument must be an integer.
229This may be useful in scripts if the connection sometimes fails.
230The default is 1.
231.It Cm ConnectTimeout
232Specifies the timeout (in seconds) used when connecting to the ssh
233server, instead of using the default system TCP timeout.
234This value is used only when the target is down or really unreachable,
235not when it refuses the connection.
| 201The default is
202.Bd -literal
203 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
204 aes192-cbc,aes256-cbc''
205.Ed
206.It Cm ClearAllForwardings
207Specifies that all local, remote and dynamic port forwardings
208specified in the configuration files or on the command line be
209cleared.
210This option is primarily useful when used from the
211.Nm ssh
212command line to clear port forwardings set in
213configuration files, and is automatically set by
214.Xr scp 1
215and
216.Xr sftp 1 .
217The argument must be
218.Dq yes
219or
220.Dq no .
221The default is
222.Dq no .
223.It Cm Compression
224Specifies whether to use compression.
225The argument must be
226.Dq yes
227or
228.Dq no .
229The default is
230.Dq no .
231.It Cm CompressionLevel
232Specifies the compression level to use if compression is enabled.
233The argument must be an integer from 1 (fast) to 9 (slow, best).
234The default level is 6, which is good for most applications.
235The meaning of the values is the same as in
236.Xr gzip 1 .
237Note that this option applies to protocol version 1 only.
238.It Cm ConnectionAttempts
239Specifies the number of tries (one per second) to make before exiting.
240The argument must be an integer.
241This may be useful in scripts if the connection sometimes fails.
242The default is 1.
243.It Cm ConnectTimeout
244Specifies the timeout (in seconds) used when connecting to the ssh
245server, instead of using the default system TCP timeout.
246This value is used only when the target is down or really unreachable,
247not when it refuses the connection.
|
| 248.It Cm ControlMaster
249Enables the sharing of multiple sessions over a single network connection.
250When set to
251.Dq yes
252.Nm ssh
253will listen for connections on a control socket specified using the
254.Cm ControlPath
255argument.
256Additional sessions can connect to this socket using the same
257.Cm ControlPath
258with
259.Cm ControlMaster
260set to
261.Dq no
262(the default).
263These sessions will reuse the master instance's network connection rather
264than initiating new ones.
265Setting this to
266.Dq ask
267will cause
268.Nm ssh
269to listen for control connections, but require confirmation using the
270.Ev SSH_ASKPASS
271program before they are accepted (see
272.Xr ssh-add 1
273for details).
274.It Cm ControlPath
275Specify the path to the control socket used for connection sharing.
276See
277.Cm ControlMaster
278above.
|
236.It Cm DynamicForward
237Specifies that a TCP/IP port on the local machine be forwarded
238over the secure channel, and the application
239protocol is then used to determine where to connect to from the
240remote machine.
241The argument must be a port number.
242Currently the SOCKS4 and SOCKS5 protocols are supported, and
243.Nm ssh
244will act as a SOCKS server.
245Multiple forwardings may be specified, and
246additional forwardings can be given on the command line.
247Only the superuser can forward privileged ports.
248.It Cm EnableSSHKeysign
249Setting this option to
250.Dq yes
251in the global client configuration file
252.Pa /etc/ssh/ssh_config
253enables the use of the helper program
254.Xr ssh-keysign 8
255during
256.Cm HostbasedAuthentication .
257The argument must be
258.Dq yes
259or
260.Dq no .
261The default is
262.Dq no .
263This option should be placed in the non-hostspecific section.
264See
265.Xr ssh-keysign 8
266for more information.
267.It Cm EscapeChar
268Sets the escape character (default:
269.Ql ~ ) .
270The escape character can also
271be set on the command line.
272The argument should be a single character,
273.Ql ^
274followed by a letter, or
275.Dq none
276to disable the escape
277character entirely (making the connection transparent for binary
278data).
279.It Cm ForwardAgent
280Specifies whether the connection to the authentication agent (if any)
281will be forwarded to the remote machine.
282The argument must be
283.Dq yes
284or
285.Dq no .
286The default is
287.Dq no .
288.Pp
289Agent forwarding should be enabled with caution.
290Users with the ability to bypass file permissions on the remote host
291(for the agent's Unix-domain socket)
292can access the local agent through the forwarded connection.
293An attacker cannot obtain key material from the agent,
294however they can perform operations on the keys that enable them to
295authenticate using the identities loaded into the agent.
296.It Cm ForwardX11
297Specifies whether X11 connections will be automatically redirected
298over the secure channel and
299.Ev DISPLAY
300set.
301The argument must be
302.Dq yes
303or
304.Dq no .
305The default is
306.Dq no .
307.Pp
308X11 forwarding should be enabled with caution.
309Users with the ability to bypass file permissions on the remote host
310(for the user's X11 authorization database)
311can access the local X11 display through the forwarded connection.
312An attacker may then be able to perform activities such as keystroke monitoring
313if the
314.Cm ForwardX11Trusted
315option is also enabled.
316.It Cm ForwardX11Trusted
| 279.It Cm DynamicForward
280Specifies that a TCP/IP port on the local machine be forwarded
281over the secure channel, and the application
282protocol is then used to determine where to connect to from the
283remote machine.
284The argument must be a port number.
285Currently the SOCKS4 and SOCKS5 protocols are supported, and
286.Nm ssh
287will act as a SOCKS server.
288Multiple forwardings may be specified, and
289additional forwardings can be given on the command line.
290Only the superuser can forward privileged ports.
291.It Cm EnableSSHKeysign
292Setting this option to
293.Dq yes
294in the global client configuration file
295.Pa /etc/ssh/ssh_config
296enables the use of the helper program
297.Xr ssh-keysign 8
298during
299.Cm HostbasedAuthentication .
300The argument must be
301.Dq yes
302or
303.Dq no .
304The default is
305.Dq no .
306This option should be placed in the non-hostspecific section.
307See
308.Xr ssh-keysign 8
309for more information.
310.It Cm EscapeChar
311Sets the escape character (default:
312.Ql ~ ) .
313The escape character can also
314be set on the command line.
315The argument should be a single character,
316.Ql ^
317followed by a letter, or
318.Dq none
319to disable the escape
320character entirely (making the connection transparent for binary
321data).
322.It Cm ForwardAgent
323Specifies whether the connection to the authentication agent (if any)
324will be forwarded to the remote machine.
325The argument must be
326.Dq yes
327or
328.Dq no .
329The default is
330.Dq no .
331.Pp
332Agent forwarding should be enabled with caution.
333Users with the ability to bypass file permissions on the remote host
334(for the agent's Unix-domain socket)
335can access the local agent through the forwarded connection.
336An attacker cannot obtain key material from the agent,
337however they can perform operations on the keys that enable them to
338authenticate using the identities loaded into the agent.
339.It Cm ForwardX11
340Specifies whether X11 connections will be automatically redirected
341over the secure channel and
342.Ev DISPLAY
343set.
344The argument must be
345.Dq yes
346or
347.Dq no .
348The default is
349.Dq no .
350.Pp
351X11 forwarding should be enabled with caution.
352Users with the ability to bypass file permissions on the remote host
353(for the user's X11 authorization database)
354can access the local X11 display through the forwarded connection.
355An attacker may then be able to perform activities such as keystroke monitoring
356if the
357.Cm ForwardX11Trusted
358option is also enabled.
359.It Cm ForwardX11Trusted
|
317If the this option is set to
| 360If this option is set to
|
318.Dq yes
319then remote X11 clients will have full access to the original X11 display.
320If this option is set to
321.Dq no
322then remote X11 clients will be considered untrusted and prevented
323from stealing or tampering with data belonging to trusted X11
324clients.
325.Pp
326The default is
327.Dq no .
328.Pp
329See the X11 SECURITY extension specification for full details on
330the restrictions imposed on untrusted clients.
331.It Cm GatewayPorts
332Specifies whether remote hosts are allowed to connect to local
333forwarded ports.
334By default,
335.Nm ssh
336binds local port forwardings to the loopback address.
337This prevents other remote hosts from connecting to forwarded ports.
338.Cm GatewayPorts
339can be used to specify that
340.Nm ssh
341should bind local port forwardings to the wildcard address,
342thus allowing remote hosts to connect to forwarded ports.
343The argument must be
344.Dq yes
345or
346.Dq no .
347The default is
348.Dq no .
349.It Cm GlobalKnownHostsFile
350Specifies a file to use for the global
351host key database instead of
352.Pa /etc/ssh/ssh_known_hosts .
353.It Cm GSSAPIAuthentication
354Specifies whether user authentication based on GSSAPI is allowed.
355The default is
356.Dq no .
357Note that this option applies to protocol version 2 only.
358.It Cm GSSAPIDelegateCredentials
359Forward (delegate) credentials to the server.
360The default is
361.Dq no .
362Note that this option applies to protocol version 2 only.
363.It Cm HostbasedAuthentication
364Specifies whether to try rhosts based authentication with public key
365authentication.
366The argument must be
367.Dq yes
368or
369.Dq no .
370The default is
371.Dq no .
372This option applies to protocol version 2 only and
373is similar to
374.Cm RhostsRSAAuthentication .
375.It Cm HostKeyAlgorithms
376Specifies the protocol version 2 host key algorithms
377that the client wants to use in order of preference.
378The default for this option is:
379.Dq ssh-rsa,ssh-dss .
380.It Cm HostKeyAlias
381Specifies an alias that should be used instead of the
382real host name when looking up or saving the host key
383in the host key database files.
384This option is useful for tunneling ssh connections
385or for multiple servers running on a single host.
386.It Cm HostName
387Specifies the real host name to log into.
388This can be used to specify nicknames or abbreviations for hosts.
389Default is the name given on the command line.
390Numeric IP addresses are also permitted (both on the command line and in
391.Cm HostName
392specifications).
393.It Cm IdentityFile
394Specifies a file from which the user's RSA or DSA authentication identity
395is read.
396The default is
397.Pa $HOME/.ssh/identity
398for protocol version 1, and
399.Pa $HOME/.ssh/id_rsa
400and
401.Pa $HOME/.ssh/id_dsa
402for protocol version 2.
403Additionally, any identities represented by the authentication agent
404will be used for authentication.
405The file name may use the tilde
406syntax to refer to a user's home directory.
407It is possible to have
408multiple identity files specified in configuration files; all these
409identities will be tried in sequence.
410.It Cm IdentitiesOnly
411Specifies that
412.Nm ssh
413should only use the authentication identity files configured in the
| 361.Dq yes
362then remote X11 clients will have full access to the original X11 display.
363If this option is set to
364.Dq no
365then remote X11 clients will be considered untrusted and prevented
366from stealing or tampering with data belonging to trusted X11
367clients.
368.Pp
369The default is
370.Dq no .
371.Pp
372See the X11 SECURITY extension specification for full details on
373the restrictions imposed on untrusted clients.
374.It Cm GatewayPorts
375Specifies whether remote hosts are allowed to connect to local
376forwarded ports.
377By default,
378.Nm ssh
379binds local port forwardings to the loopback address.
380This prevents other remote hosts from connecting to forwarded ports.
381.Cm GatewayPorts
382can be used to specify that
383.Nm ssh
384should bind local port forwardings to the wildcard address,
385thus allowing remote hosts to connect to forwarded ports.
386The argument must be
387.Dq yes
388or
389.Dq no .
390The default is
391.Dq no .
392.It Cm GlobalKnownHostsFile
393Specifies a file to use for the global
394host key database instead of
395.Pa /etc/ssh/ssh_known_hosts .
396.It Cm GSSAPIAuthentication
397Specifies whether user authentication based on GSSAPI is allowed.
398The default is
399.Dq no .
400Note that this option applies to protocol version 2 only.
401.It Cm GSSAPIDelegateCredentials
402Forward (delegate) credentials to the server.
403The default is
404.Dq no .
405Note that this option applies to protocol version 2 only.
406.It Cm HostbasedAuthentication
407Specifies whether to try rhosts based authentication with public key
408authentication.
409The argument must be
410.Dq yes
411or
412.Dq no .
413The default is
414.Dq no .
415This option applies to protocol version 2 only and
416is similar to
417.Cm RhostsRSAAuthentication .
418.It Cm HostKeyAlgorithms
419Specifies the protocol version 2 host key algorithms
420that the client wants to use in order of preference.
421The default for this option is:
422.Dq ssh-rsa,ssh-dss .
423.It Cm HostKeyAlias
424Specifies an alias that should be used instead of the
425real host name when looking up or saving the host key
426in the host key database files.
427This option is useful for tunneling ssh connections
428or for multiple servers running on a single host.
429.It Cm HostName
430Specifies the real host name to log into.
431This can be used to specify nicknames or abbreviations for hosts.
432Default is the name given on the command line.
433Numeric IP addresses are also permitted (both on the command line and in
434.Cm HostName
435specifications).
436.It Cm IdentityFile
437Specifies a file from which the user's RSA or DSA authentication identity
438is read.
439The default is
440.Pa $HOME/.ssh/identity
441for protocol version 1, and
442.Pa $HOME/.ssh/id_rsa
443and
444.Pa $HOME/.ssh/id_dsa
445for protocol version 2.
446Additionally, any identities represented by the authentication agent
447will be used for authentication.
448The file name may use the tilde
449syntax to refer to a user's home directory.
450It is possible to have
451multiple identity files specified in configuration files; all these
452identities will be tried in sequence.
453.It Cm IdentitiesOnly
454Specifies that
455.Nm ssh
456should only use the authentication identity files configured in the
|
414.Nm
| 457.Nm
|
415files,
416even if the
417.Nm ssh-agent
418offers more identities.
419The argument to this keyword must be
420.Dq yes
421or
422.Dq no .
423This option is intented for situations where
424.Nm ssh-agent
425offers many different identities.
426The default is
427.Dq no .
428.It Cm LocalForward
429Specifies that a TCP/IP port on the local machine be forwarded over
430the secure channel to the specified host and port from the remote machine.
431The first argument must be a port number, and the second must be
432.Ar host:port .
433IPv6 addresses can be specified with an alternative syntax:
434.Ar host/port .
435Multiple forwardings may be specified, and additional
436forwardings can be given on the command line.
437Only the superuser can forward privileged ports.
438.It Cm LogLevel
439Gives the verbosity level that is used when logging messages from
440.Nm ssh .
441The possible values are:
442QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
443The default is INFO.
444DEBUG and DEBUG1 are equivalent.
445DEBUG2 and DEBUG3 each specify higher levels of verbose output.
446.It Cm MACs
447Specifies the MAC (message authentication code) algorithms
448in order of preference.
449The MAC algorithm is used in protocol version 2
450for data integrity protection.
451Multiple algorithms must be comma-separated.
452The default is
453.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
454.It Cm NoHostAuthenticationForLocalhost
455This option can be used if the home directory is shared across machines.
456In this case localhost will refer to a different machine on each of
457the machines and the user will get many warnings about changed host keys.
458However, this option disables host authentication for localhost.
459The argument to this keyword must be
460.Dq yes
461or
462.Dq no .
463The default is to check the host key for localhost.
464.It Cm NumberOfPasswordPrompts
465Specifies the number of password prompts before giving up.
466The argument to this keyword must be an integer.
467Default is 3.
468.It Cm PasswordAuthentication
469Specifies whether to use password authentication.
470The argument to this keyword must be
471.Dq yes
472or
473.Dq no .
474The default is
475.Dq yes .
476.It Cm Port
477Specifies the port number to connect on the remote host.
478Default is 22.
479.It Cm PreferredAuthentications
480Specifies the order in which the client should try protocol 2
481authentication methods.
482This allows a client to prefer one method (e.g.
483.Cm keyboard-interactive )
484over another method (e.g.
485.Cm password )
486The default for this option is:
487.Dq hostbased,publickey,keyboard-interactive,password .
488.It Cm Protocol
489Specifies the protocol versions
490.Nm ssh
491should support in order of preference.
492The possible values are
493.Dq 1
494and
495.Dq 2 .
496Multiple versions must be comma-separated.
497The default is
498.Dq 2,1 .
499This means that
500.Nm ssh
501tries version 2 and falls back to version 1
502if version 2 is not available.
503.It Cm ProxyCommand
504Specifies the command to use to connect to the server.
505The command
506string extends to the end of the line, and is executed with
507.Pa /bin/sh .
508In the command string,
509.Ql %h
510will be substituted by the host name to
511connect and
512.Ql %p
513by the port.
514The command can be basically anything,
515and should read from its standard input and write to its standard output.
516It should eventually connect an
517.Xr sshd 8
518server running on some machine, or execute
519.Ic sshd -i
520somewhere.
521Host key management will be done using the
522HostName of the host being connected (defaulting to the name typed by
523the user).
524Setting the command to
525.Dq none
526disables this option entirely.
527Note that
528.Cm CheckHostIP
529is not available for connects with a proxy command.
530.Pp
531.It Cm PubkeyAuthentication
532Specifies whether to try public key authentication.
533The argument to this keyword must be
534.Dq yes
535or
536.Dq no .
537The default is
538.Dq yes .
539This option applies to protocol version 2 only.
540.It Cm RemoteForward
541Specifies that a TCP/IP port on the remote machine be forwarded over
542the secure channel to the specified host and port from the local machine.
543The first argument must be a port number, and the second must be
544.Ar host:port .
545IPv6 addresses can be specified with an alternative syntax:
546.Ar host/port .
547Multiple forwardings may be specified, and additional
548forwardings can be given on the command line.
549Only the superuser can forward privileged ports.
550.It Cm RhostsRSAAuthentication
551Specifies whether to try rhosts based authentication with RSA host
552authentication.
553The argument must be
554.Dq yes
555or
556.Dq no .
557The default is
558.Dq no .
559This option applies to protocol version 1 only and requires
560.Nm ssh
561to be setuid root.
562.It Cm RSAAuthentication
563Specifies whether to try RSA authentication.
564The argument to this keyword must be
565.Dq yes
566or
567.Dq no .
568RSA authentication will only be
569attempted if the identity file exists, or an authentication agent is
570running.
571The default is
572.Dq yes .
573Note that this option applies to protocol version 1 only.
| 458files,
459even if the
460.Nm ssh-agent
461offers more identities.
462The argument to this keyword must be
463.Dq yes
464or
465.Dq no .
466This option is intented for situations where
467.Nm ssh-agent
468offers many different identities.
469The default is
470.Dq no .
471.It Cm LocalForward
472Specifies that a TCP/IP port on the local machine be forwarded over
473the secure channel to the specified host and port from the remote machine.
474The first argument must be a port number, and the second must be
475.Ar host:port .
476IPv6 addresses can be specified with an alternative syntax:
477.Ar host/port .
478Multiple forwardings may be specified, and additional
479forwardings can be given on the command line.
480Only the superuser can forward privileged ports.
481.It Cm LogLevel
482Gives the verbosity level that is used when logging messages from
483.Nm ssh .
484The possible values are:
485QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
486The default is INFO.
487DEBUG and DEBUG1 are equivalent.
488DEBUG2 and DEBUG3 each specify higher levels of verbose output.
489.It Cm MACs
490Specifies the MAC (message authentication code) algorithms
491in order of preference.
492The MAC algorithm is used in protocol version 2
493for data integrity protection.
494Multiple algorithms must be comma-separated.
495The default is
496.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
497.It Cm NoHostAuthenticationForLocalhost
498This option can be used if the home directory is shared across machines.
499In this case localhost will refer to a different machine on each of
500the machines and the user will get many warnings about changed host keys.
501However, this option disables host authentication for localhost.
502The argument to this keyword must be
503.Dq yes
504or
505.Dq no .
506The default is to check the host key for localhost.
507.It Cm NumberOfPasswordPrompts
508Specifies the number of password prompts before giving up.
509The argument to this keyword must be an integer.
510Default is 3.
511.It Cm PasswordAuthentication
512Specifies whether to use password authentication.
513The argument to this keyword must be
514.Dq yes
515or
516.Dq no .
517The default is
518.Dq yes .
519.It Cm Port
520Specifies the port number to connect on the remote host.
521Default is 22.
522.It Cm PreferredAuthentications
523Specifies the order in which the client should try protocol 2
524authentication methods.
525This allows a client to prefer one method (e.g.
526.Cm keyboard-interactive )
527over another method (e.g.
528.Cm password )
529The default for this option is:
530.Dq hostbased,publickey,keyboard-interactive,password .
531.It Cm Protocol
532Specifies the protocol versions
533.Nm ssh
534should support in order of preference.
535The possible values are
536.Dq 1
537and
538.Dq 2 .
539Multiple versions must be comma-separated.
540The default is
541.Dq 2,1 .
542This means that
543.Nm ssh
544tries version 2 and falls back to version 1
545if version 2 is not available.
546.It Cm ProxyCommand
547Specifies the command to use to connect to the server.
548The command
549string extends to the end of the line, and is executed with
550.Pa /bin/sh .
551In the command string,
552.Ql %h
553will be substituted by the host name to
554connect and
555.Ql %p
556by the port.
557The command can be basically anything,
558and should read from its standard input and write to its standard output.
559It should eventually connect an
560.Xr sshd 8
561server running on some machine, or execute
562.Ic sshd -i
563somewhere.
564Host key management will be done using the
565HostName of the host being connected (defaulting to the name typed by
566the user).
567Setting the command to
568.Dq none
569disables this option entirely.
570Note that
571.Cm CheckHostIP
572is not available for connects with a proxy command.
573.Pp
574.It Cm PubkeyAuthentication
575Specifies whether to try public key authentication.
576The argument to this keyword must be
577.Dq yes
578or
579.Dq no .
580The default is
581.Dq yes .
582This option applies to protocol version 2 only.
583.It Cm RemoteForward
584Specifies that a TCP/IP port on the remote machine be forwarded over
585the secure channel to the specified host and port from the local machine.
586The first argument must be a port number, and the second must be
587.Ar host:port .
588IPv6 addresses can be specified with an alternative syntax:
589.Ar host/port .
590Multiple forwardings may be specified, and additional
591forwardings can be given on the command line.
592Only the superuser can forward privileged ports.
593.It Cm RhostsRSAAuthentication
594Specifies whether to try rhosts based authentication with RSA host
595authentication.
596The argument must be
597.Dq yes
598or
599.Dq no .
600The default is
601.Dq no .
602This option applies to protocol version 1 only and requires
603.Nm ssh
604to be setuid root.
605.It Cm RSAAuthentication
606Specifies whether to try RSA authentication.
607The argument to this keyword must be
608.Dq yes
609or
610.Dq no .
611RSA authentication will only be
612attempted if the identity file exists, or an authentication agent is
613running.
614The default is
615.Dq yes .
616Note that this option applies to protocol version 1 only.
|
| 617.It Cm SendEnv
618Specifies what variables from the local
619.Xr environ 7
620should be sent to the server.
621Note that environment passing is only supported for protocol 2, the
622server must also support it, and the server must be configured to
623accept these environment variables.
624Refer to
625.Cm AcceptEnv
626in
627.Xr sshd_config 5
628for how to configure the server.
629Variables are specified by name, which may contain the wildcard characters
630.Ql \&*
631and
632.Ql \&? .
633Multiple environment variables may be separated by whitespace or spread
634across multiple
635.Cm SendEnv
636directives.
637The default is not to send any environment variables.
|
574.It Cm ServerAliveInterval
575Sets a timeout interval in seconds after which if no data has been received
576from the server,
577.Nm ssh
578will send a message through the encrypted
579channel to request a response from the server.
580The default
581is 0, indicating that these messages will not be sent to the server.
582This option applies to protocol version 2 only.
583.It Cm ServerAliveCountMax
584Sets the number of server alive messages (see above) which may be
585sent without
586.Nm ssh
587receiving any messages back from the server.
588If this threshold is reached while server alive messages are being sent,
589.Nm ssh
590will disconnect from the server, terminating the session.
591It is important to note that the use of server alive messages is very
592different from
593.Cm TCPKeepAlive
594(below).
595The server alive messages are sent through the encrypted channel
596and therefore will not be spoofable.
597The TCP keepalive option enabled by
598.Cm TCPKeepAlive
599is spoofable.
600The server alive mechanism is valuable when the client or
601server depend on knowing when a connection has become inactive.
602.Pp
603The default value is 3.
604If, for example,
605.Cm ServerAliveInterval
606(above) is set to 15, and
607.Cm ServerAliveCountMax
608is left at the default, if the server becomes unresponsive ssh
609will disconnect after approximately 45 seconds.
610.It Cm SmartcardDevice
611Specifies which smartcard device to use.
612The argument to this keyword is the device
613.Nm ssh
614should use to communicate with a smartcard used for storing the user's
615private RSA key.
616By default, no device is specified and smartcard support is not activated.
617.It Cm StrictHostKeyChecking
618If this flag is set to
619.Dq yes ,
620.Nm ssh
621will never automatically add host keys to the
622.Pa $HOME/.ssh/known_hosts
623file, and refuses to connect to hosts whose host key has changed.
624This provides maximum protection against trojan horse attacks,
625however, can be annoying when the
626.Pa /etc/ssh/ssh_known_hosts
627file is poorly maintained, or connections to new hosts are
628frequently made.
629This option forces the user to manually
630add all new hosts.
631If this flag is set to
632.Dq no ,
633.Nm ssh
634will automatically add new host keys to the
635user known hosts files.
636If this flag is set to
637.Dq ask ,
638new host keys
639will be added to the user known host files only after the user
640has confirmed that is what they really want to do, and
641.Nm ssh
642will refuse to connect to hosts whose host key has changed.
643The host keys of
644known hosts will be verified automatically in all cases.
645The argument must be
646.Dq yes ,
647.Dq no
648or
649.Dq ask .
650The default is
651.Dq ask .
652.It Cm TCPKeepAlive
653Specifies whether the system should send TCP keepalive messages to the
654other side.
655If they are sent, death of the connection or crash of one
656of the machines will be properly noticed.
657However, this means that
658connections will die if the route is down temporarily, and some people
659find it annoying.
660.Pp
661The default is
662.Dq yes
663(to send TCP keepalive messages), and the client will notice
664if the network goes down or the remote host dies.
665This is important in scripts, and many users want it too.
666.Pp
667To disable TCP keepalive messages, the value should be set to
668.Dq no .
669.It Cm UsePrivilegedPort
670Specifies whether to use a privileged port for outgoing connections.
671The argument must be
672.Dq yes
673or
674.Dq no .
675The default is
676.Dq no .
677If set to
678.Dq yes
679.Nm ssh
680must be setuid root.
681Note that this option must be set to
682.Dq yes
683for
684.Cm RhostsRSAAuthentication
685with older servers.
686.It Cm User
687Specifies the user to log in as.
688This can be useful when a different user name is used on different machines.
689This saves the trouble of
690having to remember to give the user name on the command line.
691.It Cm UserKnownHostsFile
692Specifies a file to use for the user
693host key database instead of
694.Pa $HOME/.ssh/known_hosts .
695.It Cm VerifyHostKeyDNS
696Specifies whether to verify the remote key using DNS and SSHFP resource
697records.
698If this option is set to
699.Dq yes ,
700the client will implicitly trust keys that match a secure fingerprint
701from DNS.
702Insecure fingerprints will be handled as if this option was set to
703.Dq ask .
704If this option is set to
705.Dq ask ,
706information on fingerprint match will be displayed, but the user will still
707need to confirm new host keys according to the
708.Cm StrictHostKeyChecking
709option.
710The argument must be
711.Dq yes ,
712.Dq no
713or
714.Dq ask .
715The default is
716.Dq no .
717Note that this option applies to protocol version 2 only.
718.It Cm VersionAddendum
719Specifies a string to append to the regular version string to identify
720OS- or site-specific modifications.
721The default is
| 638.It Cm ServerAliveInterval
639Sets a timeout interval in seconds after which if no data has been received
640from the server,
641.Nm ssh
642will send a message through the encrypted
643channel to request a response from the server.
644The default
645is 0, indicating that these messages will not be sent to the server.
646This option applies to protocol version 2 only.
647.It Cm ServerAliveCountMax
648Sets the number of server alive messages (see above) which may be
649sent without
650.Nm ssh
651receiving any messages back from the server.
652If this threshold is reached while server alive messages are being sent,
653.Nm ssh
654will disconnect from the server, terminating the session.
655It is important to note that the use of server alive messages is very
656different from
657.Cm TCPKeepAlive
658(below).
659The server alive messages are sent through the encrypted channel
660and therefore will not be spoofable.
661The TCP keepalive option enabled by
662.Cm TCPKeepAlive
663is spoofable.
664The server alive mechanism is valuable when the client or
665server depend on knowing when a connection has become inactive.
666.Pp
667The default value is 3.
668If, for example,
669.Cm ServerAliveInterval
670(above) is set to 15, and
671.Cm ServerAliveCountMax
672is left at the default, if the server becomes unresponsive ssh
673will disconnect after approximately 45 seconds.
674.It Cm SmartcardDevice
675Specifies which smartcard device to use.
676The argument to this keyword is the device
677.Nm ssh
678should use to communicate with a smartcard used for storing the user's
679private RSA key.
680By default, no device is specified and smartcard support is not activated.
681.It Cm StrictHostKeyChecking
682If this flag is set to
683.Dq yes ,
684.Nm ssh
685will never automatically add host keys to the
686.Pa $HOME/.ssh/known_hosts
687file, and refuses to connect to hosts whose host key has changed.
688This provides maximum protection against trojan horse attacks,
689however, can be annoying when the
690.Pa /etc/ssh/ssh_known_hosts
691file is poorly maintained, or connections to new hosts are
692frequently made.
693This option forces the user to manually
694add all new hosts.
695If this flag is set to
696.Dq no ,
697.Nm ssh
698will automatically add new host keys to the
699user known hosts files.
700If this flag is set to
701.Dq ask ,
702new host keys
703will be added to the user known host files only after the user
704has confirmed that is what they really want to do, and
705.Nm ssh
706will refuse to connect to hosts whose host key has changed.
707The host keys of
708known hosts will be verified automatically in all cases.
709The argument must be
710.Dq yes ,
711.Dq no
712or
713.Dq ask .
714The default is
715.Dq ask .
716.It Cm TCPKeepAlive
717Specifies whether the system should send TCP keepalive messages to the
718other side.
719If they are sent, death of the connection or crash of one
720of the machines will be properly noticed.
721However, this means that
722connections will die if the route is down temporarily, and some people
723find it annoying.
724.Pp
725The default is
726.Dq yes
727(to send TCP keepalive messages), and the client will notice
728if the network goes down or the remote host dies.
729This is important in scripts, and many users want it too.
730.Pp
731To disable TCP keepalive messages, the value should be set to
732.Dq no .
733.It Cm UsePrivilegedPort
734Specifies whether to use a privileged port for outgoing connections.
735The argument must be
736.Dq yes
737or
738.Dq no .
739The default is
740.Dq no .
741If set to
742.Dq yes
743.Nm ssh
744must be setuid root.
745Note that this option must be set to
746.Dq yes
747for
748.Cm RhostsRSAAuthentication
749with older servers.
750.It Cm User
751Specifies the user to log in as.
752This can be useful when a different user name is used on different machines.
753This saves the trouble of
754having to remember to give the user name on the command line.
755.It Cm UserKnownHostsFile
756Specifies a file to use for the user
757host key database instead of
758.Pa $HOME/.ssh/known_hosts .
759.It Cm VerifyHostKeyDNS
760Specifies whether to verify the remote key using DNS and SSHFP resource
761records.
762If this option is set to
763.Dq yes ,
764the client will implicitly trust keys that match a secure fingerprint
765from DNS.
766Insecure fingerprints will be handled as if this option was set to
767.Dq ask .
768If this option is set to
769.Dq ask ,
770information on fingerprint match will be displayed, but the user will still
771need to confirm new host keys according to the
772.Cm StrictHostKeyChecking
773option.
774The argument must be
775.Dq yes ,
776.Dq no
777or
778.Dq ask .
779The default is
780.Dq no .
781Note that this option applies to protocol version 2 only.
782.It Cm VersionAddendum
783Specifies a string to append to the regular version string to identify
784OS- or site-specific modifications.
785The default is
|
722.Dq FreeBSD-20040419 .
| 786.Dq FreeBSD-20041028 .
|
723.It Cm XAuthLocation
724Specifies the full pathname of the
725.Xr xauth 1
726program.
727The default is
728.Pa /usr/X11R6/bin/xauth .
729.El
730.Sh FILES
731.Bl -tag -width Ds
732.It Pa $HOME/.ssh/config
733This is the per-user configuration file.
734The format of this file is described above.
735This file is used by the
736.Nm ssh
737client.
| 787.It Cm XAuthLocation
788Specifies the full pathname of the
789.Xr xauth 1
790program.
791The default is
792.Pa /usr/X11R6/bin/xauth .
793.El
794.Sh FILES
795.Bl -tag -width Ds
796.It Pa $HOME/.ssh/config
797This is the per-user configuration file.
798The format of this file is described above.
799This file is used by the
800.Nm ssh
801client.
|
738This file does not usually contain any sensitive information,
739but the recommended permissions are read/write for the user, and not
740accessible by others.
| 802Because of the potential for abuse, this file must have strict permissions:
803read/write for the user, and not accessible by others.
|
741.It Pa /etc/ssh/ssh_config
742Systemwide configuration file.
743This file provides defaults for those
744values that are not specified in the user's configuration file, and
745for those users who do not have a configuration file.
746This file must be world-readable.
747.El
748.Sh SEE ALSO
749.Xr ssh 1
750.Sh AUTHORS
751OpenSSH is a derivative of the original and free
752ssh 1.2.12 release by Tatu Ylonen.
753Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
754Theo de Raadt and Dug Song
755removed many bugs, re-added newer features and
756created OpenSSH.
757Markus Friedl contributed the support for SSH
758protocol versions 1.5 and 2.0.
| 804.It Pa /etc/ssh/ssh_config
805Systemwide configuration file.
806This file provides defaults for those
807values that are not specified in the user's configuration file, and
808for those users who do not have a configuration file.
809This file must be world-readable.
810.El
811.Sh SEE ALSO
812.Xr ssh 1
813.Sh AUTHORS
814OpenSSH is a derivative of the original and free
815ssh 1.2.12 release by Tatu Ylonen.
816Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
817Theo de Raadt and Dug Song
818removed many bugs, re-added newer features and
819created OpenSSH.
820Markus Friedl contributed the support for SSH
821protocol versions 1.5 and 2.0.
|