summaryrefslogtreecommitdiff
path: root/sshd_config.5
Commit message (Collapse)AuthorAgeFilesLines
* upstream commitdtucker@openbsd.org2015-04-291-6/+3
| | | | | Allow ListenAddress, Port and AddressFamily in any order. bz#68, ok djm@, jmc@ (for the man page bit).
* upstream commitjmc@openbsd.org2015-04-291-2/+2
| | | | | enviroment -> environment: apologies to darren for not spotting that first time round...
* upstream commitdtucker@openbsd.org2015-04-291-2/+2
| | | | Fix typo in previous
* upstream commitdtucker@openbsd.org2015-04-291-3/+7
| | | | | | Document that the TERM environment variable is not subject to SendEnv and AcceptEnv. bz#2386, based loosely on a patch from jjelen at redhat, help and ok jmc@
* upstream commitdjm@openbsd.org2015-04-291-3/+3
| | | | | Make sshd default to PermitRootLogin=no; ok deraadt@ rpe@
* upstream commitdtucker@openbsd.org2015-04-291-6/+14
| | | | | Document "none" for PidFile XAuthLocation TrustedUserCAKeys and RevokedKeys. bz#2382, feedback from jmc@, ok djm@
* upstream commitdjm@openbsd.org2015-02-221-3/+3
| | | | | sort options useable under Match case-insensitively; prodded jmc@
* upstream commitdjm@openbsd.org2015-02-211-4/+10
| | | | | more options that are available under Match; bz#2353 reported by calestyo AT scientia.net
* upstream commitderaadt@openbsd.org2015-02-031-3/+3
| | | | | increasing encounters with difficult DNS setups in darknets has convinced me UseDNS off by default is better ok djm
* upstream commitjmc@openbsd.org2015-01-261-2/+2
| | | | heirarchy -> hierarchy;
* upstream commitderaadt@openbsd.org2015-01-261-4/+13
| | | | | | | Provide a warning about chroot misuses (which sadly, seem to have become quite popular because shiny). sshd cannot detect/manage/do anything about these cases, best we can do is warn in the right spot in the man page. ok markus
* upstream commitdjm@openbsd.org2015-01-131-2/+26
| | | | | | add sshd_config HostbasedAcceptedKeyTypes and PubkeyAcceptedKeyTypes options to allow sshd to control what public key types will be accepted. Currently defaults to all. Feedback & ok markus@
* upstream commitdjm@openbsd.org2014-12-221-2/+18
| | | | | | mention ssh -Q feature to list supported { MAC, cipher, KEX, key } algorithms in more places and include the query string used to list the relevant information; bz#2288
* upstream commitjmc@openbsd.org2014-12-221-2/+2
| | | | tweak previous;
* upstream commitdjm@openbsd.org2014-12-221-3/+7
| | | | | | correct description of what will happen when a AuthorizedKeysCommand is specified but AuthorizedKeysCommandUser is not (sshd will refuse to start)
* upstream commitdjm@openbsd.org2014-12-221-2/+14
| | | | | | | | | | remember which public keys have been used for authentication and refuse to accept previously-used keys. This allows AuthenticationMethods=publickey,publickey to require that users authenticate using two _different_ pubkeys. ok markus@
* upstream commitjmc@openbsd.org2014-12-221-2/+1
| | | | tweak previous;
* upstream commitdjm@openbsd.org2014-12-221-2/+11
| | | | | | | | Add FingerprintHash option to control algorithm used for key fingerprints. Default changes from MD5 to SHA256 and format from hex to base64. Feedback and ok naddy@ markus@
* upstream commitdjm@openbsd.org2014-12-181-14/+2
| | | | revert chunk I didn't mean to commit yet; via jmc@
* upstream commitdjm@openbsd.org2014-12-111-2/+17
| | | | | mention AuthorizedKeysCommandUser must be set for AuthorizedKeysCommand to be run; bz#2287
* upstream commitjmc@openbsd.org2014-11-241-4/+5
| | | | | restore word zapped in previous, and remove some useless "No" macros;
* upstream commitderaadt@openbsd.org2014-11-241-4/+2
| | | | | | | /dev/random has created the same effect as /dev/arandom (and /dev/urandom) for quite some time. Mop up the last few, by using /dev/random where we actually want it, or not even mentioning arandom where it is irrelevant.
* upstream commitdjm@openbsd.org2014-10-131-2/+6
| | | | | mention permissions on tun(4) devices in PermitTunnel documentation; bz#2273
* upstream commitsobrado@openbsd.org2014-10-131-3/+3
| | | | typo.
* - (djm) [sshd_config.5] typo; from Iain MorganDamien Miller2014-10-031-1/+1
|
* - schwarze@cvs.openbsd.org 2014/07/28 15:40:08Damien Miller2014-07-301-4/+4
| | | | | | | [sftp-server.8 sshd_config.5] some systems no longer need /dev/log; issue noticed by jirib; ok deraadt
* - millert@cvs.openbsd.org 2014/07/15 15:54:14Damien Miller2014-07-181-2/+49
| | | | | | | | | | | | | | | | [PROTOCOL auth-options.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c] [auth-rsa.c auth.c auth1.c auth2-hostbased.c auth2-kbdint.c auth2-none.c] [auth2-passwd.c auth2-pubkey.c auth2.c canohost.c channels.c channels.h] [clientloop.c misc.c misc.h monitor.c mux.c packet.c readconf.c] [readconf.h servconf.c servconf.h serverloop.c session.c ssh-agent.c] [ssh.c ssh_config.5 sshconnect.c sshconnect1.c sshconnect2.c sshd.c] [sshd_config.5 sshlogin.c] Add support for Unix domain socket forwarding. A remote TCP port may be forwarded to a local Unix domain socket and vice versa or both ends may be a Unix domain socket. This is a reimplementation of the streamlocal patches by William Ahern from: http://www.25thandclement.com/~william/projects/streamlocal.html OK djm@ markus@
* - djm@cvs.openbsd.org 2014/07/03 22:40:43Damien Miller2014-07-041-2/+9
| | | | | | | [servconf.c servconf.h session.c sshd.8 sshd_config.5] Add a sshd_config PermitUserRC option to control whether ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys option; bz#2160; ok markus@
* - naddy@cvs.openbsd.org 2014/03/28 05:17:11Damien Miller2014-04-201-33/+103
| | | | | | [ssh_config.5 sshd_config.5] sync available and default algorithms, improve algorithm list formatting help from jmc@ and schwarze@, ok deraadt@
* - djm@cvs.openbsd.org 2014/02/27 22:47:07Damien Miller2014-02-281-2/+6
| | | | | | [sshd_config.5] bz#2184 clarify behaviour of a keyword that appears in multiple matching Match blocks; ok dtucker@
* - jmc@cvs.openbsd.org 2014/01/29 14:04:51Damien Miller2014-02-041-2/+13
| | | | | | | | [sshd_config.5] document kbdinteractiveauthentication; requested From: Ross L Richardson dtucker/markus helped explain its workings;
* - dtucker@cvs.openbsd.org 2013/12/08 09:53:27Damien Miller2013-12-181-10/+10
| | | | | [sshd_config.5] Use a literal for the default value of KEXAlgorithms. ok deraadt jmc
* - naddy@cvs.openbsd.org 2013/12/07 11:58:46Damien Miller2013-12-181-4/+6
| | | | | | [ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8 ssh.1] [ssh_config.5 sshd.8 sshd_config.5] add missing mentions of ed25519; ok djm@
* - jmc@cvs.openbsd.org 2013/11/21 08:05:09Damien Miller2013-12-051-2/+1
| | | | | [ssh_config.5 sshd_config.5] no need for .Pp before displays;
* - djm@cvs.openbsd.org 2013/11/21 00:45:44Damien Miller2013-11-211-4/+14
| | | | | | | | | | | | | | | | | | | [Makefile.in PROTOCOL PROTOCOL.chacha20poly1305 authfile.c chacha.c] [chacha.h cipher-chachapoly.c cipher-chachapoly.h cipher.c cipher.h] [dh.c myproposal.h packet.c poly1305.c poly1305.h servconf.c ssh.1] [ssh.c ssh_config.5 sshd_config.5] Add a new protocol 2 transport cipher "chacha20-poly1305@openssh.com" that combines Daniel Bernstein's ChaCha20 stream cipher and Poly1305 MAC to build an authenticated encryption mode. Inspired by and similar to Adam Langley's proposal for TLS: http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-03 but differs in layout used for the MAC calculation and the use of a second ChaCha20 instance to separately encrypt packet lengths. Details are in the PROTOCOL.chacha20poly1305 file. Feedback markus@, naddy@; manpage bits Loganden Velvindron @ AfriNIC ok markus@ naddy@
* - markus@cvs.openbsd.org 2013/11/02 22:39:19Damien Miller2013-11-041-2/+3
| | | | | [ssh_config.5 sshd_config.5] the default kex is now curve25519-sha256@libssh.org
* - jmc@cvs.openbsd.org 2013/10/29 18:49:32Damien Miller2013-10-301-2/+2
| | | | | [sshd_config.5] pty(4), not pty(7);
* - djm@cvs.openbsd.org 2013/10/29 09:48:02Damien Miller2013-10-301-2/+9
| | | | | | | [servconf.c servconf.h session.c sshd_config sshd_config.5] shd_config PermitTTY to disallow TTY allocation, mirroring the longstanding no-pty authorized_keys option; bz#2070, patch from Teran McKinney; ok markus@
* - dtucker@cvs.openbsd.org 2013/10/24 00:51:48Damien Miller2013-10-241-3/+5
| | | | | | [readconf.c servconf.c ssh_config.5 sshd_config.5] Disallow empty Match statements and add "Match all" which matches everything. ok djm, man page help jmc@
* - markus@cvs.openbsd.org 2013/07/19 07:37:48Damien Miller2013-07-201-2/+14
| | | | | | | | [auth.h kex.h kexdhs.c kexecdhs.c kexgexs.c monitor.c servconf.c] [servconf.h session.c sshd.c sshd_config.5] add ssh-agent(1) support to sshd(8); allows encrypted hostkeys, or hostkeys on smartcards; most of the work by Zev Weiss; bz #1974 ok djm@
* - jmc@cvs.openbsd.org 2013/06/27 14:05:37Damien Miller2013-07-181-29/+12
| | | | | | | | [ssh-keygen.1 ssh.1 ssh_config.5 sshd.8 sshd_config.5] do not use Sx for sections outwith the man page - ingo informs me that stuff like html will render with broken links; issue reported by Eric S. Raymond, via djm
* - jmc@cvs.openbsd.org 2013/05/16 06:30:06Darren Tucker2013-05-161-3/+2
| | | | | [sshd_config.5] oops! avoid Xr to self;
* - dtucker@cvs.openbsd.org 2013/05/16 04:09:14Darren Tucker2013-05-161-2/+30
| | | | | | | [sshd_config.5 servconf.c servconf.h packet.c serverloop.c monitor.c sshd_config sshd.c] Add RekeyLimit to sshd with the same syntax as the client allowing rekeying based on traffic volume or time. ok djm@, help & ok jmc@ for the man page.
* - djm@cvs.openbsd.org 2013/04/19 01:00:10Damien Miller2013-04-231-3/+4
| | | | | | [sshd_config.5] document the requirment that the AuthorizedKeysCommand be owned by root; ok dtucker@ markus@
* - markus@cvs.openbsd.org 2013/03/07 19:27:25Damien Miller2013-04-231-2/+16
| | | | | [auth.h auth2-chall.c auth2.c monitor.c sshd_config.5] add submethod support to AuthenticationMethods; ok and freedback djm@
* - dtucker@cvs.openbsd.org 2013/02/06 00:20:42Damien Miller2013-02-121-3/+3
| | | | | | | | [servconf.c sshd_config sshd_config.5] Change default of MaxStartups to 10:30:100 to start doing random early drop at 10 connections up to 100 connections. This will make it harder to DoS as CPUs have come a long way since the original value was set back in 2000. Prompted by nion at debian org, ok markus@
* - jmc@cvs.openbsd.org 2013/01/18 08:00:49Damien Miller2013-01-201-3/+3
| | | | | [sshd_config.5] tweak previous;
* - djm@cvs.openbsd.org 2013/01/17 23:00:01Damien Miller2013-01-181-3/+10
| | | | | | | | | | [auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5] [krl.c krl.h PROTOCOL.krl] add support for Key Revocation Lists (KRLs). These are a compact way to represent lists of revoked keys and certificates, taking as little as a single bit of incremental cost to revoke a certificate by serial number. KRLs are loaded via the existing RevokedKeys sshd_config option. feedback and ok markus@
* - markus@cvs.openbsd.org 2013/01/08 18:49:04Damien Miller2013-01-091-2/+5
| | | | | | | [PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c] [myproposal.h packet.c ssh_config.5 sshd_config.5] support AES-GCM as defined in RFC 5647 (but with simpler KEX handling) ok and feedback djm@
* - markus@cvs.openbsd.org 2012/12/11 22:31:18Damien Miller2012-12-121-2/+11
| | | | | | | | | | [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h] [packet.c ssh_config.5 sshd_config.5] add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms that change the packet format and compute the MAC over the encrypted message (including the packet size) instead of the plaintext data; these EtM modes are considered more secure and used by default. feedback and ok djm@
View Lorry Controller Status