summaryrefslogtreecommitdiffstats
path: root/sshd_config.5 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* - dtucker@cvs.openbsd.org 2010/01/09 23:04:13Darren Tucker2010-01-101-5/+2
| | | | | | | | | | | | | | | [channels.c ssh.1 servconf.c sshd_config.5 sshd.c channels.h servconf.h ssh-keyscan.1 ssh-keyscan.c readconf.c sshconnect.c misc.c ssh.c readconf.h scp.1 sftp.1 ssh_config.5 misc.h] Remove RoutingDomain from ssh since it's now not needed. It can be replaced with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
* - jmc@cvs.openbsd.org 2009/12/29 18:03:32Darren Tucker2010-01-081-4/+4
| | | | | [sshd_config.5 ssh_config.5] sort previous;
* - stevesk@cvs.openbsd.org 2009/12/29 16:38:41Darren Tucker2010-01-081-3/+3
| | | | | | | | | [sshd_config.5 readconf.c ssh_config.5 scp.1 servconf.c sftp.1 ssh.1] Rename RDomain config option to RoutingDomain to be more clear and consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
* - guenther@cvs.openbsd.org 2009/12/20 07:28:36Darren Tucker2010-01-081-5/+5
| | | | | | | | | | | | | [ssh.c sftp.c scp.c] When passing user-controlled options with arguments to other programs, pass the option and option argument as separate argv entries and not smashed into one (e.g., as -l foo and not -lfoo). Also, always pass a "--" argument to stop option parsing, so that a positional argument that starts with a '-' isn't treated as an option. This fixes some error cases as well as the handling of hostnames and filenames that start with a '-'. Based on a diff by halex@ ok halex@ djm@ deraadt@
* - djm@cvs.openbsd.org 2009/11/10 02:58:56Darren Tucker2010-01-081-2/+5
| | | | | | [sshd_config.5] clarify that StrictModes does not apply to ChrootDirectory. Permissions and ownership are always checked when chrooting. bz#1532
* - jmc@cvs.openbsd.org 2009/10/28 21:45:08Darren Tucker2010-01-081-4/+4
| | | | | [sshd_config.5 sftp.1] tweak previous;
* - reyk@cvs.openbsd.org 2009/10/28 16:38:18Darren Tucker2010-01-081-2/+5
| | | | | | | | [ssh_config.5 sshd.c misc.h ssh-keyscan.1 readconf.h sshconnect.c channels.c channels.h servconf.h servconf.c ssh.1 ssh-keyscan.c scp.1 sftp.1 sshd_config.5 readconf.c ssh.c misc.c] Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan. ok markus@
* - jmc@cvs.openbsd.org 2009/10/08 20:42:12Darren Tucker2009-10-111-2/+2
| | | | | [sshd_config.5 ssh_config.5 sshd.8 ssh.1] some tweaks now that protocol 1 is not offered by default; ok markus
* - (dtucker) OpenBSD CVS SyncDarren Tucker2009-10-111-3/+3
| | | | | | | - markus@cvs.openbsd.org 2009/10/08 14:03:41 [sshd_config readconf.c ssh_config.5 servconf.c sshd_config.5] disable protocol 1 by default (after a transition period of about 10 years) ok deraadt
* - dtucker@cvs.openbsd.org 2009/08/16 23:29:26Darren Tucker2009-10-061-2/+3
| | | | | [sshd_config.5] Add PubkeyAuthentication to the list allowed in a Match block (bz #1577)
* downgrade mention of login.conf to be an example and mention PAM asDamien Miller2009-08-281-4/+3
| | | | another provider for ChallengeResponseAuthentication; bz#1408; ok dtucker@
* - stevesk@cvs.openbsd.org 2009/04/21 15:13:17Darren Tucker2009-06-211-2/+5
| | | | | | [sshd_config.5] clarify we cd to user's home after chroot; ok markus@ on earlier version; tweaks and ok jmc@
* - jmc@cvs.openbsd.org 2009/04/18 18:39:10Darren Tucker2009-06-211-8/+5
| | | | | [sshd_config.5] tweak previous; ok stevesk
* - stevesk@cvs.openbsd.org 2009/04/17 19:40:17Darren Tucker2009-06-211-3/+9
| | | | | | [sshd_config.5] clarify that even internal-sftp needs /dev/log for logging to work; ok markus@
* - stevesk@cvs.openbsd.org 2009/04/13 19:07:44Darren Tucker2009-06-211-3/+3
| | | | | [sshd_config.5] fix possessive; ok djm@
* - djm@cvs.openbsd.org 2009/02/22 23:59:25Damien Miller2009-02-231-2/+2
| | | | | [sshd_config.5] missing period
* - djm@cvs.openbsd.org 2009/02/22 23:50:57Damien Miller2009-02-231-16/+4
| | | | | [ssh_config.5 sshd_config.5] don't advertise experimental options
* - naddy@cvs.openbsd.org 2009/01/24 17:10:22Damien Miller2009-01-281-5/+5
| | | | | [ssh_config.5 sshd_config.5] sync list of preferred ciphers; ok djm@
* - okan@cvs.openbsd.org 2008/12/30 00:46:56Damien Miller2009-01-281-2/+3
| | | | | | [sshd_config.5] add AllowAgentForwarding to available Match keywords list ok djm
* - djm@cvs.openbsd.org 2008/11/04 08:22:13Damien Miller2008-11-051-3/+15
| | | | | | | | | | | | | | | | | | | | | [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h] [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5] [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c] [Makefile.in] Add support for an experimental zero-knowledge password authentication method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
* - djm@cvs.openbsd.org 2008/10/09 03:50:54Damien Miller2008-11-031-2/+3
| | | | | | [servconf.c sshd_config.5] support setting PermitEmptyPasswords in a Match block requested in PR3891; ok dtucker@
* - djm@cvs.openbsd.org 2008/07/02 02:24:18Darren Tucker2008-07-021-3/+3
| | | | | | [sshd_config sshd_config.5 sshd.8 servconf.c] increase default size of ssh protocol 1 ephemeral key from 768 to 1024 bits; prodded by & ok dtucker@ ok deraadt@
* - dtucker@cvs.openbsd.org 2008/06/15 16:58:40Damien Miller2008-06-151-1/+2
| | | | | [servconf.c sshd_config.5] Allow MaxAuthTries within a Match block. ok djm@
* - dtucker@cvs.openbsd.org 2008/06/15 16:55:38Damien Miller2008-06-151-2/+3
| | | | | [sshd_config.5] MaxSessions is allowed in a Match block too
* - jmc@cvs.openbsd.org 2008/06/10 07:12:00Darren Tucker2008-06-101-4/+5
| | | | | [sshd_config.5] tweak previous;
* - djm@cvs.openbsd.org 2008/06/10 04:17:46Darren Tucker2008-06-101-3/+3
| | | | | [sshd_config.5] better reference for pattern-list
* - (dtucker) OpenBSD CVS SyncDarren Tucker2008-06-101-2/+24
| | | | | | | | | | | | - djm@cvs.openbsd.org 2008/06/10 03:57:27 [servconf.c match.h sshd_config.5] support CIDR address matching in sshd_config "Match address" blocks, with full support for negation and fall-back to classic wildcard matching. For example: Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* PasswordAuthentication yes addrmatch.c code mostly lifted from flowd's addr.c feedback and ok dtucker@
* - djm@cvs.openbsd.org 2008/05/08 12:21:16Damien Miller2008-05-191-2/+5
| | | | | | | | | | | | | | | | | [monitor.c monitor_wrap.c session.h servconf.c servconf.h session.c] [sshd_config sshd_config.5] Make the maximum number of sessions run-time controllable via a sshd_config MaxSessions knob. This is useful for disabling login/shell/subsystem access while leaving port-forwarding working (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or simply increasing the number of allows multiplexed sessions. Because some bozos are sure to configure MaxSessions in excess of the number of available file descriptors in sshd (which, at peak, might be as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds on error paths, and make it fail gracefully on out-of-fd conditions - sending channel errors instead of than exiting with fatal(). bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com ok markus@
* - jmc@cvs.openbsd.org 2008/05/07 08:00:14Damien Miller2008-05-191-11/+11
| | | | | [sshd_config.5] sort;
* - pyr@cvs.openbsd.org 2008/05/07 05:49:37Damien Miller2008-05-191-2/+11
| | | | | | | | | | | [servconf.c servconf.h session.c sshd_config.5] Enable the AllowAgentForwarding option in sshd_config (global and match context), to specify if agents should be permitted on the server. As the man page states: ``Note that disabling Agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.'' ok djm@, ok and a mild frown markus@
* - djm@cvs.openbsd.org 2008/04/05 02:46:02Damien Miller2008-05-191-3/+4
| | | | | [sshd_config.5] HostbasedAuthentication is supported under Match too
* - djm@cvs.openbsd.org 2008/04/04 06:44:26Damien Miller2008-05-191-35/+2
| | | | | | [sshd_config.5] oops, some unrelated stuff crept into that commit - backout. spotted by jmc@
* - (djm) OpenBSD CVS SyncDamien Miller2008-05-191-2/+36
| | | | | | | - djm@cvs.openbsd.org 2008/04/04 05:14:38 [sshd_config.5] ChrootDirectory is supported in Match blocks (in fact, it is most useful there). Spotted by Minstrel AT minstrel.org.uk
* - djm@cvs.openbsd.org 2008/03/25 11:58:02Damien Miller2008-03-271-3/+5
| | | | | | [session.c sshd_config.5] ignore ~/.ssh/rc if a sshd_config ForceCommand is specified; from dtucker@ ok deraadt@ djm@
* - jmc@cvs.openbsd.org 2008/02/11 07:58:28Damien Miller2008-03-271-2/+2
| | | | | | [ssh.1 sshd.8 sshd_config.5] bump Mdocdate for pages committed in "febuary", necessary because of a typo in rcs.c;
* - djm@cvs.openbsd.org 2008/02/10 09:55:37Damien Miller2008-02-101-2/+7
| | | | | [sshd_config.5] mantion that "internal-sftp" is useful with ForceCommand too
* - jmc@cvs.openbsd.org 2008/02/09 08:04:31Damien Miller2008-02-101-3/+3
| | | | | [sshd_config.5] missing `)';
* - djm@cvs.openbsd.org 2008/02/08 23:24:07Damien Miller2008-02-101-2/+52
| | | | | | | | [servconf.c servconf.h session.c sftp-server.c sftp.h sshd_config] [sshd_config.5] add sshd_config ChrootDirectory option to chroot(2) users to a directory and tweak internal sftp server to work with it (no special files in chroot required). ok markus@
* - dtucker@cvs.openbsd.org 2008/01/01 09:27:33Darren Tucker2008-01-011-2/+3
| | | | | | [sshd_config.5 servconf.c] Allow PermitRootLogin in a Match block. Allows for, eg, permitting root only from the local network. ok markus@, man page bit ok jmc@
* - djm@cvs.openbsd.org 2007/08/23 03:22:16Damien Miller2007-09-171-4/+5
| | | | | | [auth2-none.c sshd_config sshd_config.5] Support "Banner=none" to disable displaying of the pre-login banner; ok dtucker@ deraadt@
* - jmc@cvs.openbsd.org 2007/06/08 07:48:09Damien Miller2007-06-111-3/+6
| | | | | | [sshd_config.5] oops, here too: put the MAC list into a display, like we do for ciphers, since groff has trouble with wide lines;
* - pvalchev@cvs.openbsd.org 2007/06/07 19:37:34Damien Miller2007-06-111-3/+3
| | | | | | | | | | | | [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1] [ssh_config.5 sshd.8 sshd_config.5] Add a new MAC algorithm for data integrity, UMAC-64 (not default yet, must specify umac-64@openssh.com). Provides about 20% end-to-end speedup compared to hmac-md5. Represents a different approach to message authentication to that of HMAC that may be beneficial if HMAC based on one of its underlying hash algorithms is found to be vulnerable to a new attack. http://www.ietf.org/rfc/rfc4418.txt in conjunction with and OK djm@
* - jmc@cvs.openbsd.org 2007/05/31 19:20:16Darren Tucker2007-06-051-2/+2
| | | | | | | [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1 ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8] convert to new .Dd format; (We will need to teach mdoc2man.awk to understand this too.)
* - OpenBSD CVS SyncDamien Miller2007-03-061-2/+2
| | | | | | - jmc@cvs.openbsd.org 2007/03/01 16:19:33 [sshd_config.5] sort the `match' keywords;
* - dtucker@cvs.openbsd.org 2007/03/01 10:28:02Darren Tucker2007-03-011-3/+2
| | | | | | | | [auth2.c sshd_config.5 servconf.c] Remove ChallengeResponseAuthentication support inside a Match block as its interaction with KbdInteractive makes it difficult to support. Also, relocate the CR/kbdint option special-case code into servconf. "please commit" djm@, ok markus@ for the relocation.
* - dtucker@cvs.openbsd.org 2007/02/19 10:45:58Darren Tucker2007-02-191-1/+9
| | | | | | | | [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5] Teach Match how handle config directives that are used before authentication. This allows configurations such as permitting password authentication from the local net only while requiring pubkey from offsite. ok djm@, man page bits ok jmc@
* - jmc@cvs.openbsd.org 2007/01/02 09:57:25Damien Miller2007-01-051-4/+2
| | | | | | [sshd_config.5] do not use lists for SYNOPSIS; from eric s. raymond via brad
* - (djm) OpenBSD CVS SyncDamien Miller2006-08-301-1/+18
| | | | | | | - dtucker@cvs.openbsd.org 2006/08/21 08:14:01 [sshd_config.5] Document HostbasedUsesNameFromPacketOnly. Corrections from jmc@, ok jmc@ djm@
* - dtucker@cvs.openbsd.org 2006/08/14 12:40:25Damien Miller2006-08-181-1/+2
| | | | | | [servconf.c servconf.h sshd_config.5] Add ability to match groups to Match keyword in sshd_config. Feedback djm@, stevesk@, ok stevesk@.
* - dtucker@cvs.openbsd.org 2006/07/21 12:43:36Damien Miller2006-07-241-4/+2
| | | | | | | [channels.c channels.h servconf.c servconf.h sshd_config.5] Make PermitOpen take a list of permitted ports and act more like most other keywords (ie the first match is the effective setting). This also makes it easier to override a previously set PermitOpen. ok djm@
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 14:05:49 +0100