summaryrefslogtreecommitdiff
path: root/ssh_config.5
Commit message (Collapse)AuthorAgeFilesLines
* - dtucker@cvs.openbsd.org 2010/01/09 23:04:13Darren Tucker2010-01-101-5/+2
| | | | | | | | | | | | | | | [channels.c ssh.1 servconf.c sshd_config.5 sshd.c channels.h servconf.h ssh-keyscan.1 ssh-keyscan.c readconf.c sshconnect.c misc.c ssh.c readconf.h scp.1 sftp.1 ssh_config.5 misc.h] Remove RoutingDomain from ssh since it's now not needed. It can be replaced with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
* - jmc@cvs.openbsd.org 2009/12/29 18:03:32Darren Tucker2010-01-081-4/+4
| | | | | [sshd_config.5 ssh_config.5] sort previous;
* - stevesk@cvs.openbsd.org 2009/12/29 16:38:41Darren Tucker2010-01-081-3/+3
| | | | | | | | | [sshd_config.5 readconf.c ssh_config.5 scp.1 servconf.c sftp.1 ssh.1] Rename RDomain config option to RoutingDomain to be more clear and consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
* - djm@cvs.openbsd.org 2009/11/10 02:56:22Darren Tucker2010-01-081-2/+9
| | | | | | [ssh_config.5] explain the constraints on LocalCommand some more so people don't try to abuse it.
* - reyk@cvs.openbsd.org 2009/10/28 16:38:18Darren Tucker2010-01-081-2/+5
| | | | | | | | [ssh_config.5 sshd.c misc.h ssh-keyscan.1 readconf.h sshconnect.c channels.c channels.h servconf.h servconf.c ssh.1 ssh-keyscan.c scp.1 sftp.1 sshd_config.5 readconf.c ssh.c misc.c] Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan. ok markus@
* - jmc@cvs.openbsd.org 2009/10/08 20:42:12Darren Tucker2009-10-111-3/+3
| | | | | [sshd_config.5 ssh_config.5 sshd.8 ssh.1] some tweaks now that protocol 1 is not offered by default; ok markus
* - (dtucker) OpenBSD CVS SyncDarren Tucker2009-10-111-6/+8
| | | | | | | - markus@cvs.openbsd.org 2009/10/08 14:03:41 [sshd_config readconf.c ssh_config.5 servconf.c sshd_config.5] disable protocol 1 by default (after a transition period of about 10 years) ok deraadt
* - djm@cvs.openbsd.org 2009/02/22 23:50:57Damien Miller2009-02-231-13/+2
| | | | | [ssh_config.5 sshd_config.5] don't advertise experimental options
* - jmc@cvs.openbsd.org 2009/02/12 07:34:20Damien Miller2009-02-141-2/+2
| | | | | [ssh_config.5] kill trailing whitespace;
* - djm@cvs.openbsd.org 2009/02/12 03:46:17Damien Miller2009-02-141-2/+9
| | | | | [ssh_config.5] document RemoteForward usage with 0 listen port
* - naddy@cvs.openbsd.org 2009/01/24 17:10:22Damien Miller2009-01-281-5/+5
| | | | | [ssh_config.5 sshd_config.5] sync list of preferred ciphers; ok djm@
* - djm@cvs.openbsd.org 2008/11/04 08:22:13Damien Miller2008-11-051-2/+13
| | | | | | | | | | | | | | | | | | | | | [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h] [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5] [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c] [Makefile.in] Add support for an experimental zero-knowledge password authentication method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
* - stevesk@cvs.openbsd.org 2008/10/17 18:36:24Damien Miller2008-11-031-4/+6
| | | | | [ssh_config.5] correct and clarify VisualHostKey; ok jmc@
* - stevesk@cvs.openbsd.org 2008/10/10 16:43:27Damien Miller2008-11-031-3/+4
| | | | | | | [ssh_config.5] use 'Privileged ports can be forwarded only when logging in as root on the remote machine.' for RemoteForward just like ssh.1 -R. ok djm@ jmc@
* - krw@cvs.openbsd.org 2008/08/02 04:29:51Damien Miller2008-11-031-3/+3
| | | | | [ssh_config.5] whitepsace -> whitespace. From Matthew Clarke via bugs@.
* - grunk@cvs.openbsd.org 2008/06/26 11:46:31Damien Miller2008-06-301-6/+12
| | | | | | | | | | [readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c] Move SSH Fingerprint Visualization away from sharing the config option CheckHostIP to an own config option named VisualHostKey. While there, fix the behaviour that ssh would draw a random art picture on every newly seen host even when the option was not enabled. prodded by deraadt@, discussions, help and ok markus@ djm@ dtucker@
* - jmc@cvs.openbsd.org 2008/06/12 19:10:09Darren Tucker2008-06-131-4/+3
| | | | | [ssh_config.5 ssh-keygen.1] tweak the ascii art text; ok grunk
* - dtucker@cvs.openbsd.org 2008/06/12 16:35:31Darren Tucker2008-06-131-2/+17
| | | | | [ssh_config.5 ssh.c] keyword expansion for localcommand. ok djm@
* - grunk@cvs.openbsd.org 2008/06/11 23:03:56Darren Tucker2008-06-131-2/+3
| | | | | | [ssh_config.5] CheckHostIP set to ``fingerprint'' will display both hex and random art spotted by naddy@
* - grunk@cvs.openbsd.org 2008/06/11 21:01:35Darren Tucker2008-06-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | [ssh_config.5 key.h readconf.c readconf.h ssh-keygen.1 ssh-keygen.c key.c sshconnect.c] Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the graphical hash visualization schemes known as "random art", and by Dan Kaminsky's musings on the subject during a BlackOp talk at the 23C3 in Berlin. Scientific publication (original paper): "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99) http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf The algorithm used here is a worm crawling over a discrete plane, leaving a trace (augmenting the field) everywhere it goes. Movement is taken from dgst_raw 2bit-wise. Bumping into walls makes the respective movement vector be ignored for this turn, thus switching to the other color of the chessboard. Graphs are not unambiguous for now, because circles in graphs can be walked in either direction. discussions with several people, help, corrections and ok markus@ djm@
* - dtucker@cvs.openbsd.org 2008/06/10 18:21:24Darren Tucker2008-06-111-2/+3
| | | | | [ssh_config.5] clarify that Host patterns are space-separated. ok deraadt
* - jmc@cvs.openbsd.org 2007/10/29 07:48:19Darren Tucker2007-12-021-4/+4
| | | | | [ssh_config.5] clean up after previous macro removal;
* - dtucker@cvs.openbsd.org 2007/10/29 06:51:59Darren Tucker2007-12-021-4/+4
| | | | | [ssh_config.5] ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@
* - djm@cvs.openbsd.org 2007/09/21 03:05:23Damien Miller2007-10-261-2/+10
| | | | | | [ssh_config.5] document KbdInteractiveAuthentication in ssh_config.5; patch from dkg AT fifthhorseman.net
* - stevesk@cvs.openbsd.org 2007/08/15 12:13:41Darren Tucker2007-08-151-3/+3
| | | | | [ssh_config.5] tun device forwarding now honours ExitOnForwardFailure; ok markus@
* - jmc@cvs.openbsd.org 2007/06/08 07:43:46Damien Miller2007-06-111-3/+6
| | | | | | [ssh_config.5] put the MAC list into a display, like we do for ciphers, since groff has trouble handling wide lines;
* - pvalchev@cvs.openbsd.org 2007/06/07 19:37:34Damien Miller2007-06-111-3/+3
| | | | | | | | | | | | [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1] [ssh_config.5 sshd.8 sshd_config.5] Add a new MAC algorithm for data integrity, UMAC-64 (not default yet, must specify umac-64@openssh.com). Provides about 20% end-to-end speedup compared to hmac-md5. Represents a different approach to message authentication to that of HMAC that may be beneficial if HMAC based on one of its underlying hash algorithms is found to be vulnerable to a new attack. http://www.ietf.org/rfc/rfc4418.txt in conjunction with and OK djm@
* - jmc@cvs.openbsd.org 2007/05/31 19:20:16Darren Tucker2007-06-051-2/+2
| | | | | | | [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1 ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8] convert to new .Dd format; (We will need to teach mdoc2man.awk to understand this too.)
* - jmc@cvs.openbsd.org 2007/01/10 13:23:22Darren Tucker2007-02-191-5/+3
| | | | | | | [ssh_config.5] do not use a list for SYNOPSIS; this is actually part of a larger report sent by eric s. raymond and forwarded by brad, but i only read half of it. spotted by brad.
* - jmc@cvs.openbsd.org 2006/07/27 08:00:50Damien Miller2006-08-051-3/+4
| | | | | | | [ssh_config.5] avoid confusing wording in HashKnownHosts: originally spotted by alan amesbury; ok deraadt
* - markus@cvs.openbsd.org 2006/07/11 18:50:48Darren Tucker2006-07-121-1/+12
| | | | | | | | [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c channels.h readconf.c] add ExitOnForwardFailure: terminate the connection if ssh(1) cannot set up all requested dynamic, local, and remote port forwardings. ok djm, dtucker, stevesk, jmc
* - stevesk@cvs.openbsd.org 2006/07/02 17:12:58Damien Miller2006-07-101-9/+29
| | | | | | [ssh.1 ssh.c ssh_config.5 sshd_config.5] more details and clarity for tun(4) device forwarding; ok and help jmc@
* - jmc@cvs.openbsd.org 2006/05/29 16:10:03Damien Miller2006-06-131-2/+7
| | | | | [ssh_config.5] oops - previous was too long; split the list of auths up
* - dtucker@cvs.openbsd.org 2006/05/29 12:54:08Damien Miller2006-06-131-2/+2
| | | | | [ssh_config.5] Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
* - djm@cvs.openbsd.org 2006/03/31 09:13:56Damien Miller2006-03-311-2/+2
| | | | | [ssh_config.5] remote user escape is %r not %h; spotted by jmc@
* - jmc@cvs.openbsd.org 2006/03/31 09:09:30Damien Miller2006-03-311-2/+2
| | | | | [ssh_config.5] kill trailing whitespace;
* - djm@cvs.openbsd.org 2006/03/30 10:41:25Damien Miller2006-03-311-2/+15
| | | | | | [ssh.c ssh_config.5] add percent escape chars to the IdentityFile option, bz #1159 based on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
* - markus@cvs.openbsd.org 2006/03/14 16:32:48Damien Miller2006-03-151-1/+2
| | | | | [ssh_config.5 sshd_config.5] *AliveCountMax applies to protcol v2 only; ok dtucker, djm
* - dtucker@cvs.openbsd.org 2006/03/13 10:14:29Damien Miller2006-03-151-1/+4
| | | | | | [misc.c ssh_config.5 sshd_config.5] Allow config directives to contain whitespace by surrounding them by double quotes. mindrot #482, man page help from jmc@, ok djm@
* - jmc@cvs.openbsd.org 2006/02/26 18:03:10Damien Miller2006-03-151-2/+2
| | | | | [ssh_config.5] comma;
* - jmc@cvs.openbsd.org 2006/02/26 17:17:18Damien Miller2006-03-151-36/+36
| | | | | [ssh_config.5] move PATTERNS to the end of the main body; requested by dtucker
* - jmc@cvs.openbsd.org 2006/02/25 12:26:17Damien Miller2006-03-151-1/+8
| | | | | [ssh_config.5] document the possible values for KbdInteractiveDevices;
* - jmc@cvs.openbsd.org 2006/02/24 23:20:07Damien Miller2006-03-151-78/+74
| | | | | [ssh_config.5] some grammar/wording fixes;
* - jmc@cvs.openbsd.org 2006/02/24 20:31:31Damien Miller2006-03-151-3/+3
| | | | | [ssh.1 ssh_config.5 sshd.8 sshd_config.5] more consistency fixes;
* - jmc@cvs.openbsd.org 2006/02/24 20:22:16Damien Miller2006-03-151-2/+2
| | | | | [ssh-keysign.8 ssh_config.5 sshd_config.5] some consistency fixes;
* - jmc@cvs.openbsd.org 2006/02/24 10:37:07Damien Miller2006-03-151-7/+9
| | | | | [ssh_config.5] tidy up the refs to PATTERNS;
* - jmc@cvs.openbsd.org 2006/02/24 10:25:14Damien Miller2006-03-151-11/+43
| | | | | | [ssh_config.5] add section on patterns; from dtucker + myself
* - jmc@cvs.openbsd.org 2006/02/19 20:12:25Damien Miller2006-03-151-1/+2
| | | | | [ssh_config.5] add some vertical space;
* - jmc@cvs.openbsd.org 2006/02/12 10:49:44Damien Miller2006-03-151-2/+2
| | | | | [ssh_config.5] slight rewording; ok djm
* - djm@cvs.openbsd.org 2006/02/12 06:45:34Damien Miller2006-03-151-2/+4
| | | | | | | [ssh.c ssh_config.5] add a %l expansion code to the ControlPath, which is filled in with the local hostname at runtime. Requested by henning@ to avoid some problems with /home on NFS; ok dtucker@
View Lorry Controller Status