summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/ssh_config.5 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* tweak previous;jmc2010-06-261-3/+4
|
* Add X11ForwardTimeout option to specify timeout for untrusted X11djm2010-06-251-2/+12
| | | | | | | | | | | authentication cookies to avoid fallback in X11 code to fully-trusted implicit authentication using SO_PEERCRED described at: http://lists.x.org/archives/xorg-devel/2010-May/008636.html After the X11ForwardTimeout has expired the client will now refuse incoming X11 channel opens. based on patch from Tavis Ormandy; "nice" markus@
* tweak previous; ok djmjmc2010-04-161-5/+5
|
* expand %r => remote username in ssh_config:ProxyCommand;djm2010-04-141-5/+7
| | | | ok deraadt markus
* tweak previous; ok dtuckerjmc2010-03-271-6/+8
|
* Reformat default value of PreferredAuthentications entry (current formattingdtucker2010-03-261-7/+3
| | | | implies ", " is acceptable as a separator, which it's not. ok djm@
* mention loading of certificate files from [private]-cert.pub whendjm2010-03-051-2/+8
| | | | they are present; feedback and ok jmc@
* pkcs#11 is no longer optional; improve wording; ok jmc@markus2010-02-101-4/+3
|
* replace our obsolete smartcard code with PKCS#11.markus2010-02-081-9/+9
| | | | | | | | | ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-20/pkcs-11v2-20.pdf ssh(1) and ssh-keygen(1) use dlopen(3) directly to talk to a PKCS#11 provider (shared library) while ssh-agent(1) delegates PKCS#11 to a forked a ssh-pkcs11-helper process. PKCS#11 is currently a compile time option. feedback and ok djm@; inspired by patches from Alon Bar-Lev
* Remove RoutingDomain from ssh since it's now not needed. It can be replaceddtucker2010-01-091-5/+2
| | | | | | | | | | | | | with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
* sort previous;jmc2009-12-291-4/+4
|
* Rename RDomain config option to RoutingDomain to be more clear andstevesk2009-12-291-3/+3
| | | | | | | | | consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
* explain the constraints on LocalCommand some more so people don'tdjm2009-11-101-2/+9
| | | | try to abuse it.
* Allow to set the rdomain in ssh/sftp/scp/sshd and ssh-keyscan.reyk2009-10-281-2/+5
| | | | ok markus@
* some tweaks now that protocol 1 is not offered by default; ok markusjmc2009-10-081-3/+3
|
* disable protocol 1 by default (after a transition period of about 10 years)markus2009-10-081-6/+8
| | | | ok deraadt
* don't advertise experimental optionsdjm2009-02-221-13/+2
|
* kill trailing whitespace;jmc2009-02-121-2/+2
|
* document RemoteForward usage with 0 listen portdjm2009-02-121-2/+9
|
* sync list of preferred ciphers; ok djm@naddy2009-01-241-5/+5
|
* Add support for an experimental zero-knowledge password authenticationdjm2008-11-041-2/+13
| | | | | | | | | | | | | | | | method using the J-PAKE protocol described in F. Hao, P. Ryan, "Password Authenticated Key Exchange by Juggling", 16th Workshop on Security Protocols, Cambridge, April 2008. This method allows password-based authentication without exposing the password to the server. Instead, the client and server exchange cryptographic proofs to demonstrate of knowledge of the password while revealing nothing useful to an attacker or compromised endpoint. This is experimental, work-in-progress code and is presently compiled-time disabled (turn on -DJPAKE in Makefile.inc). "just commit it. It isn't too intrusive." deraadt@
* correct and clarify VisualHostKey; ok jmc@stevesk2008-10-171-4/+6
|
* use 'Privileged ports can be forwarded only when logging in as root onstevesk2008-10-101-3/+4
| | | | | | the remote machine.' for RemoteForward just like ssh.1 -R. ok djm@ jmc@
* whitepsace -> whitespace. From Matthew Clarke via bugs@.krw2008-08-021-3/+3
|
* Move SSH Fingerprint Visualization away from sharing the config optiongrunk2008-06-261-6/+12
| | | | | | | | | CheckHostIP to an own config option named VisualHostKey. While there, fix the behaviour that ssh would draw a random art picture on every newly seen host even when the option was not enabled. prodded by deraadt@, discussions, help and ok markus@ djm@ dtucker@
* tweak the ascii art text; ok grunkjmc2008-06-121-4/+3
|
* keyword expansion for localcommand. ok djm@dtucker2008-06-121-2/+17
|
* CheckHostIP set to ``fingerprint'' will display both hex and random artgrunk2008-06-111-2/+3
| | | | spotted by naddy@
* Introduce SSH Fingerprint ASCII Visualization, a technique inspired by thegrunk2008-06-111-2/+6
| | | | | | | | | | | | | | | | | | | | | | | graphical hash visualization schemes known as "random art", and by Dan Kaminsky's musings on the subject during a BlackOp talk at the 23C3 in Berlin. Scientific publication (original paper): "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99) http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf The algorithm used here is a worm crawling over a discrete plane, leaving a trace (augmenting the field) everywhere it goes. Movement is taken from dgst_raw 2bit-wise. Bumping into walls makes the respective movement vector be ignored for this turn, thus switching to the other color of the chessboard. Graphs are not unambiguous for now, because circles in graphs can be walked in either direction. discussions with several people, help, corrections and ok markus@ djm@
* clarify that Host patterns are space-separated. ok deraadtdtucker2008-06-101-2/+3
|
* clean up after previous macro removal;jmc2007-10-291-3/+3
|
* ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@dtucker2007-10-291-4/+4
|
* document KbdInteractiveAuthentication in ssh_config.5;djm2007-09-211-2/+10
| | | | patch from dkg AT fifthhorseman.net
* tun device forwarding now honours ExitOnForwardFailure; ok markus@stevesk2007-08-151-3/+3
|
* put the MAC list into a display, like we do for ciphers,jmc2007-06-081-3/+6
| | | | since groff has trouble handling wide lines;
* Add a new MAC algorithm for data integrity, UMAC-64 (not default yet, mustpvalchev2007-06-071-3/+3
| | | | | | | | | | specify umac-64@openssh.com). Provides about 20% end-to-end speedup compared to hmac-md5. Represents a different approach to message authentication to that of HMAC that may be beneficial if HMAC based on one of its underlying hash algorithms is found to be vulnerable to a new attack. http://www.ietf.org/rfc/rfc4418.txt in conjunction with and OK djm@
* convert to new .Dd format;jmc2007-05-311-2/+2
|
* do not use a list for SYNOPSIS;jmc2007-01-101-5/+3
| | | | | this is actually part of a larger report sent by eric s. raymond and forwarded by brad, but i only read half of it. spotted by brad.
* avoid confusing wording in HashKnownHosts:jmc2006-07-271-3/+4
| | | | | originally spotted by alan amesbury; ok deraadt
* add ExitOnForwardFailure: terminate the connection if ssh(1)markus2006-07-111-1/+12
| | | | | cannot set up all requested dynamic, local, and remote port forwardings. ok djm, dtucker, stevesk, jmc
* more details and clarity for tun(4) device forwarding; ok and helpstevesk2006-07-021-9/+29
| | | | jmc@
* oops - previous was too long; split the list of auths upjmc2006-05-291-2/+7
|
* Add gssapi-with-mic to PreferredAuthentications default list; ok jmcdtucker2006-05-291-2/+2
|
* remote user escape is %r not %h; spotted by jmc@djm2006-03-311-2/+2
|
* kill trailing whitespace;jmc2006-03-311-2/+2
|
* add percent escape chars to the IdentityFile option, bz #1159 baseddjm2006-03-301-2/+15
| | | | on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
* *AliveCountMax applies to protcol v2 only; ok dtucker, djmmarkus2006-03-141-1/+2
|
* Allow config directives to contain whitespace by surrounding them by doubledtucker2006-03-131-1/+4
| | | | quotes. mindrot #482, man page help from jmc@, ok djm@
* comma;jmc2006-02-261-2/+2
|
* move PATTERNS to the end of the main body; requested by dtuckerjmc2006-02-261-36/+36
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.