summaryrefslogtreecommitdiffstats
path: root/ssh_config.5 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* upstream commitjmc@openbsd.org2015-01-081-2/+1
| | | | tweak previous;
* upstream commitdjm@openbsd.org2014-12-221-3/+26
| | | | | | mention ssh -Q feature to list supported { MAC, cipher, KEX, key } algorithms in more places and include the query string used to list the relevant information; bz#2288
* upstream commitdjm@openbsd.org2014-12-221-4/+13
| | | | document FingerprintHash here too
* upstream commitdjm@openbsd.org2014-12-041-2/+12
| | | | | | add RevokedHostKeys option for the client Allow textfile or KRL-based revocation of hostkeys.
* upstream commitdjm@openbsd.org2014-11-101-4/+7
| | | | | | | | mux-related manual tweaks mention ControlPersist=0 is the same as ControlPersist=yes recommend that ControlPath sockets be placed in a og-w directory
* upstream commitjmc@openbsd.org2014-10-201-3/+3
| | | | tweak previous;
* upstream commitdjm@openbsd.org2014-10-131-13/+42
| | | | | | | | | | | | | | | | | | Tweak config reparsing with host canonicalisation Make the second pass through the config files always run when hostname canonicalisation is enabled. Add a "Match canonical" criteria that allows ssh_config Match blocks to trigger only in the second config pass. Add a -G option to ssh that causes it to parse its configuration and dump the result to stdout, similar to "sshd -T" Allow ssh_config Port options set in the second config parse phase to be applied (they were being ignored). bz#2267 bz#2286; ok markus
* upstream commitsobrado@openbsd.org2014-10-131-3/+3
| | | | | | | improve capitalization for the Ed25519 public-key signature system. ok djm@
* - millert@cvs.openbsd.org 2014/07/15 15:54:14Damien Miller2014-07-181-2/+29
| | | | | | | | | | | | | | | | [PROTOCOL auth-options.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth.c auth1.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] [auth2-passwd.c auth2-pubkey.c auth2.c canohost.c channels.c channels.h] [clientloop.c misc.c misc.h monitor.c mux.c packet.c readconf.c] [readconf.h servconf.c servconf.h serverloop.c session.c ssh-agent.c] [ssh.c ssh_config.5 sshconnect.c sshconnect1.c sshconnect2.c sshd.c] [sshd_config.5 sshlogin.c] Add support for Unix domain socket forwarding. A remote TCP port may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
* - djm@cvs.openbsd.org 2014/07/07 08:19:12Damien Miller2014-07-091-4/+7
| | | | | | [ssh_config.5] mention that ProxyCommand is executed using shell "exec" to avoid a lingering process; bz#1977
* - jmc@cvs.openbsd.org 2014/07/03 07:45:27Damien Miller2014-07-031-3/+3
| | | | | [ssh_config.5] escape %C since groff thinks it part of an Rs/Re block;
* - djm@cvs.openbsd.org 2014/07/03 06:39:19Damien Miller2014-07-031-5/+9
| | | | | | | | | | | | [ssh.c ssh_config.5] Add a %C escape sequence for LocalCommand and ControlPath that expands to a unique identifer based on a has of the tuple of (local host, remote user, hostname, port). Helps avoid exceeding sockaddr_un's miserly pathname limits for mux control paths. bz#2220, based on patch from mancha1 AT zoho.com; ok markus@
* - djm@cvs.openbsd.org 2014/07/03 05:32:36Damien Miller2014-07-031-2/+8
| | | | | | [ssh_config.5] mention '%%' escape sequence in HostName directives and how it may be used to specify IPv6 link-local addresses
* - naddy@cvs.openbsd.org 2014/03/28 05:17:11Damien Miller2014-04-201-28/+46
| | | | | | [ssh_config.5 sshd_config.5] sync available and default algorithms, improve algorithm list formatting help from jmc@ and schwarze@, ok deraadt@
* - djm@cvs.openbsd.org 2014/02/23 20:11:36Damien Miller2014-02-241-2/+8
| | | | | | | | | | | | | | | | | | [readconf.c readconf.h ssh.c ssh_config.5] reparse ssh_config and ~/.ssh/config if hostname canonicalisation changes the hostname. This allows users to write configurations that always refer to canonical hostnames, e.g. CanonicalizeHostname yes CanonicalDomains int.example.org example.org CanonicalizeFallbackLocal no Host *.int.example.org Compression off Host *.example.org User djm ok markus@
* - djm@cvs.openbsd.org 2014/01/19 04:48:08Darren Tucker2014-01-191-4/+4
| | | | | [ssh_config.5] fix inverted meaning of 'no' and 'yes' for CanonicalizeFallbackLocal
* - naddy@cvs.openbsd.org 2013/12/07 11:58:46Damien Miller2013-12-181-4/+6
| | | | | | [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8 ssh.1] [ssh_config.5 sshd.8 sshd_config.5] add missing mentions of ed25519; ok djm@
* - markus@cvs.openbsd.org 2013/12/06 13:39:49Damien Miller2013-12-071-3/+3
| | | | | | | | | | | | [authfd.c authfile.c key.c key.h myproposal.h pathnames.h readconf.c] [servconf.c ssh-agent.c ssh-keygen.c ssh-keyscan.1 ssh-keyscan.c] [ssh-keysign.c ssh.c ssh_config.5 sshd.8 sshd.c verify.c ssh-ed25519.c] [sc25519.h sc25519.c hash.c ge25519_base.data ge25519.h ge25519.c] [fe25519.h fe25519.c ed25519.c crypto_api.h blocks.c] support ed25519 keys (hostkeys and user identities) using the public domain ed25519 reference code from SUPERCOP, see http://ed25519.cr.yp.to/software.html feedback, help & ok djm@
* - jmc@cvs.openbsd.org 2013/11/21 08:05:09Damien Miller2013-12-051-2/+1
| | | | | [ssh_config.5 sshd_config.5] no need for .Pp before displays;
* - djm@cvs.openbsd.org 2013/11/21 00:45:44Damien Miller2013-11-211-4/+14
| | | | | | | | | | | | | | | | | | | [Makefile.in PROTOCOL PROTOCOL.chacha20poly1305 authfile.c chacha.c] [chacha.h cipher-chachapoly.c cipher-chachapoly.h cipher.c cipher.h] [dh.c myproposal.h packet.c poly1305.c poly1305.h servconf.c ssh.1] [ssh.c ssh_config.5 sshd_config.5] Add a new protocol 2 transport cipher "chacha20-poly1305@openssh.com" that combines Daniel Bernstein's ChaCha20 stream cipher and Poly1305 MAC to build an authenticated encryption mode. Inspired by and similar to Adam Langley's proposal for TLS: http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03 but differs in layout used for the MAC calculation and the use of a second ChaCha20 instance to separately encrypt packet lengths. Details are in the PROTOCOL.chacha20poly1305 file. Feedback markus@, naddy@; manpage bits Loganden Velvindron @ AfriNIC ok markus@ naddy@
* - markus@cvs.openbsd.org 2013/11/02 22:39:19Damien Miller2013-11-031-2/+3
| | | | | [ssh_config.5 sshd_config.5] the default kex is now curve25519-sha256@libssh.org
* - dtucker@cvs.openbsd.org 2013/10/24 00:51:48Damien Miller2013-10-241-3/+6
| | | | | | [readconf.c servconf.c ssh_config.5 sshd_config.5] Disallow empty Match statements and add "Match all" which matches everything. ok djm, man page help jmc@
* - jmc@cvs.openbsd.org 2013/10/20 18:00:13Damien Miller2013-10-231-3/+3
| | | | | [ssh_config.5] tweak the "exec" description, as worded by djm;
* - djm@cvs.openbsd.org 2013/10/20 06:19:28Damien Miller2013-10-231-5/+5
| | | | | | | | [readconf.c ssh_config.5] rename "command" subclause of the recently-added "Match" keyword to "exec"; it's shorter, clearer in intent and we might want to add the ability to match against the command being executed at the remote end in the future.
* - djm@cvs.openbsd.org 2013/10/20 04:39:28Damien Miller2013-10-231-3/+21
| | | | | [ssh_config.5] document % expansions performed by "Match command ..."
* - djm@cvs.openbsd.org 2013/10/16 22:58:01Damien Miller2013-10-171-7/+7
| | | | | [ssh.c ssh_config.5] one I missed in previous: s/isation/ization/
* - djm@cvs.openbsd.org 2013/10/16 22:49:39Damien Miller2013-10-171-12/+12
| | | | | | [readconf.c readconf.h ssh.1 ssh.c ssh_config.5] s/canonicalise/canonicalize/ for consistency with existing spelling, e.g. authorized_keys; pointed out by naddy@
* - jmc@cvs.openbsd.org 2013/10/16 06:42:25Damien Miller2013-10-171-20/+18
| | | | | [ssh_config.5] tweak previous;
* - djm@cvs.openbsd.org 2013/10/16 02:31:47Damien Miller2013-10-171-2/+73
| | | | | | | | | | | | [readconf.c readconf.h roaming_client.c ssh.1 ssh.c ssh_config.5] [sshconnect.c sshconnect.h] Implement client-side hostname canonicalisation to allow an explicit search path of domain suffixes to use to convert unqualified host names to fully-qualified ones for host key matching. This is particularly useful for host certificates, which would otherwise need to list unqualified names alongside fully-qualified ones (and this causes a number of problems). "looks fine" markus@
* - jmc@cvs.openbsd.org 2013/10/15 14:10:25Damien Miller2013-10-171-3/+3
| | | | | [ssh.1 ssh_config.5] tweak previous;
* - djm@cvs.openbsd.org 2013/10/14 22:22:05Damien Miller2013-10-151-2/+50
| | | | | | [readconf.c readconf.h ssh-keysign.c ssh.c ssh_config.5] add a "Match" keyword to ssh_config that allows matching on hostname, user and result of arbitrary commands. "nice work" markus@
* - jmc@cvs.openbsd.org 2013/08/20 06:56:07Damien Miller2013-08-201-3/+3
| | | | | [ssh.1 ssh_config.5] some proxyusefdpass tweaks;
* - djm@cvs.openbsd.org 2013/08/20 00:11:38Damien Miller2013-08-201-2/+10
| | | | | | | | | | [readconf.c readconf.h ssh_config.5 sshconnect.c] Add a ssh_config ProxyUseFDPass option that supports the use of ProxyCommands that establish a connection and then pass a connected file descriptor back to ssh(1). This allows the ProxyCommand to exit rather than have to shuffle data back and forth and enables ssh to use getpeername, etc. to obtain address information just like it does with regular directly-connected sockets. ok markus@
* - jmc@cvs.openbsd.org 2013/06/27 14:05:37Damien Miller2013-07-181-9/+5
| | | | | | | | [ssh-keygen.1 ssh.1 ssh_config.5 sshd.8 sshd_config.5] do not use Sx for sections outwith the man page - ingo informs me that stuff like html will render with broken links; issue reported by Eric S. Raymond, via djm
* - djm@cvs.openbsd.org 2013/06/21 00:37:49Damien Miller2013-07-181-3/+10
| | | | | | [ssh_config.5] explicitly mention that IdentitiesOnly can be used with IdentityFile to control which keys are offered from an agent.
* - jmc@cvs.openbsd.org 2013/05/16 06:28:45Darren Tucker2013-05-161-12/+12
| | | | | [ssh_config.5] put IgnoreUnknown in the right place;
* - djm@cvs.openbsd.org 2013/05/16 04:27:50Darren Tucker2013-05-161-1/+12
| | | | | | [ssh_config.5 readconf.h readconf.c] add the ability to ignore specific unrecognised ssh_config options; bz#866; ok markus@
* - dtucker@cvs.openbsd.org 2013/05/16 02:00:34Darren Tucker2013-05-161-4/+16
| | | | | | | | [ssh_config sshconnect2.c packet.c readconf.h readconf.c clientloop.c ssh_config.5 packet.h] Add an optional second argument to RekeyLimit in the client to allow rekeying based on elapsed time in addition to amount of traffic. with djm@ jmc@, ok djm
* - markus@cvs.openbsd.org 2013/01/08 18:49:04Damien Miller2013-01-091-2/+5
| | | | | | | [PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c] [myproposal.h packet.c ssh_config.5 sshd_config.5] support AES-GCM as defined in RFC 5647 (but with simpler KEX handling) ok and feedback djm@
* - markus@cvs.openbsd.org 2012/12/11 22:31:18Damien Miller2012-12-121-2/+11
| | | | | | | | | | [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h] [packet.c ssh_config.5 sshd_config.5] add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms that change the packet format and compute the MAC over the encrypted message (including the packet size) instead of the plaintext data; these EtM modes are considered more secure and used by default. feedback and ok djm@
* - djm@cvs.openbsd.org 2012/12/02 20:26:11Damien Miller2012-12-021-2/+4
| | | | | | | [ssh_config.5 sshconnect2.c] Make IdentitiesOnly apply to keys obtained from a PKCS11Provider. This allows control of which keys are offered from tokens using IdentityFile. ok markus@
* - markus@cvs.openbsd.org 2012/10/04 13:21:50Darren Tucker2012-10-051-3/+3
| | | | | | [myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c] add umac128 variant; ok djm@ at n2k12 (note: further Makefile work is required)
* - naddy@cvs.openbsd.org 2012/06/29 13:57:25Darren Tucker2012-07-021-4/+4
| | | | | | [ssh_config.5 sshd_config.5] match the documented MAC order of preference to the actual one; ok dtucker@
* - dtucker@cvs.openbsd.org 2012/06/28 05:07:45Damien Miller2012-06-301-4/+3
| | | | | | | [mac.c myproposal.h ssh_config.5 sshd_config.5] Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs since they were removed from draft6 of the spec and will not be in the RFC when published. Patch from mdb at juniper net via bz#2023, ok markus.
* - dtucker@cvs.openbsd.org 2012/06/18 11:49:58Damien Miller2012-06-201-3/+3
| | | | | [ssh_config.5] RSA instead of DSA twice. From Steve.McClellan at radisys com
* - djm@cvs.openbsd.org 2011/09/09 00:43:00Damien Miller2011-09-221-3/+3
| | | | | | [ssh_config.5 sshd_config.5] fix typo in IPQoS parsing: there is no "AF14" class, but there is an "AF21" class. Spotted by giesen AT snickers.org; ok markus stevesk
* - djm@cvs.openbsd.org 2011/08/02 01:22:11Damien Miller2011-08-051-3/+5
| | | | | | | [mac.c myproposal.h ssh.1 ssh_config.5 sshd.8 sshd_config.5] Add new SHA256 and SHA512 based HMAC modes from http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt Patch from mdb AT juniper.net; feedback and ok markus@
* - djm@cvs.openbsd.org 2011/06/04 00:10:26Damien Miller2011-06-201-2/+6
| | | | | | [ssh_config.5] explain IdentifyFile's semantics a little better, prompted by bz#1898 ok dtucker jmc
* - djm@cvs.openbsd.org 2011/05/24 07:15:47Damien Miller2011-05-291-8/+12
| | | | | | | | [readconf.c readconf.h ssh.c ssh_config.5 sshconnect.c sshconnect2.c] Remove undocumented legacy options UserKnownHostsFile2 and GlobalKnownHostsFile2 by making UserKnownHostsFile/GlobalKnownHostsFile accept multiple paths per line and making their defaults include known_hosts2; ok markus
* - jmc@cvs.openbsd.org 2011/05/07 23:19:39Damien Miller2011-05-151-5/+6
| | | | | | | | [ssh_config.5] - tweak previous - come consistency fixes ok djm
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-12 08:17:08 +0100