summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/sshd_config.5 (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Disallow empty Match statements and add "Match all" which matches everything.dtucker2013-10-241-3/+5
| | | | ok djm, man page help jmc@
* add ssh-agent(1) support to sshd(8); allows encrypted hostkeys,markus2013-07-191-2/+14
| | | | | or hostkeys on smartcards; most of the work by Zev Weiss; bz #1974 ok djm@
* do not use Sx for sections outwith the man page - ingo informs me thatjmc2013-06-271-29/+12
| | | | | | stuff like html will render with broken links; issue reported by Eric S. Raymond, via djm
* oops! avoid Xr to self;jmc2013-05-161-3/+2
|
* Add RekeyLimit to sshd with the same syntax as the client allowing rekeyingdtucker2013-05-161-2/+30
| | | | based on traffic volume or time. ok djm@, help & ok jmc@ for the man page.
* document the requirment that the AuthorizedKeysCommand be owned by root;djm2013-04-191-3/+4
| | | | ok dtucker@ markus@
* add submethod support to AuthenticationMethods; ok and freedback djm@markus2013-03-071-2/+16
|
* Change default of MaxStartups to 10:30:100 to start doing random earlydtucker2013-02-061-3/+3
| | | | | | drop at 10 connections up to 100 connections. This will make it harder to DoS as CPUs have come a long way since the original value was set back in 2000. Prompted by nion at debian org, ok markus@
* tweak previous;jmc2013-01-181-3/+3
|
* add support for Key Revocation Lists (KRLs). These are a compact way todjm2013-01-171-3/+10
| | | | | | | | represent lists of revoked keys and certificates, taking as little as a single bit of incremental cost to revoke a certificate by serial number. KRLs are loaded via the existing RevokedKeys sshd_config option. feedback and ok markus@
* support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)markus2013-01-081-2/+5
| | | | ok and feedback djm@
* add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithmsmarkus2012-12-111-2/+11
| | | | | | | that change the packet format and compute the MAC over the encrypted message (including the packet size) instead of the plaintext data; these EtM modes are considered more secure and used by default. feedback and ok djm@
* tweak previous;jmc2012-12-031-3/+4
|
* make AllowTcpForwarding accept "local" and "remote" in addition to itsdjm2012-12-021-2/+14
| | | | | current "yes"/"no" to allow the server to specify whether just local or remote TCP forwarding is enabled. ok markus@
* Support multiple required authentication via an AuthenticationMethodsdjm2012-11-041-1/+24
| | | | | | | option. This option lists one or more comma-separated lists of authentication method names. Successful completion of all the methods in any list is required for authentication to complete; feedback and ok markus@
* Remove default of AuthorizedCommandUser. Administrators are now expecteddjm2012-11-041-3/+2
| | | | to explicitly specify a user. feedback and ok markus@
* tweak previous;jmc2012-10-311-6/+8
|
* new sshd_config option AuthorizedKeysCommand to support fetchingdjm2012-10-301-2/+20
| | | | | | | | | authorized_keys from a command in addition to (or instead of) from the filesystem. The command is run as the target server user unless another specified via a new AuthorizedKeysCommandUser option. patch originally by jchadima AT redhat.com, reworked by me; feedback and ok markus@
* add umac128 variant; ok djm@ at n2k12markus2012-10-041-3/+3
|
* match the documented MAC order of preference to the actual one; ok dtucker@naddy2012-06-291-4/+4
|
* Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs since they were removeddtucker2012-06-281-4/+3
| | | | | from draft6 of the spec and will not be in the RFC when published. Patch from mdb at juniper net via bz#2023, ok markus.
* tweak previous; ok markusjmc2012-06-191-5/+5
|
* sshd_config: extend Match to allow AcceptEnv and {Allow,Deny}{Users,Groups}markus2012-06-191-4/+9
| | | | | this allows 'Match LocalPort 1022' combined with 'AllowUser bauer' ok djm@ (back in March)
* Document PermitOpen none. bz#2001, patch from Loganaden Velvindrondtucker2012-05-191-2/+5
|
* Add "Match LocalAddress" and "Match LocalPort" to sshd and adjust testsdtucker2012-05-131-2/+4
| | | | to match. Feedback and ok djm@ markus@.
* mention AuthorizedPrincipalsFile=none defaultdjm2012-04-121-2/+4
|
* VersionAddendum option to allow server operators to append some arbitrarydjm2012-04-121-2/+7
| | | | text to the SSH-... banner; ok deraadt@ "don't care" markus@
* fix typo in IPQoS parsing: there is no "AF14" class, but there isdjm2011-09-091-3/+3
| | | | an "AF21" class. Spotted by giesen AT snickers.org; ok markus stevesk
* Add new SHA256 and SHA512 based HMAC modes fromdjm2011-08-021-3/+5
| | | | | | http://www.ietf.org/id/draft-dbider-sha2-mac-for-ssh-02.txt feedback and ok markus@
* introduce sandboxing of the pre-auth privsep child using systrace(4).djm2011-06-221-2/+8
| | | | | | | | | | | | | | | | | | This introduces a new "UsePrivilegeSeparation=sandbox" option for sshd_config that applies mandatory restrictions on the syscalls the privsep child can perform. This prevents a compromised privsep child from being used to attack other hosts (by opening sockets and proxying) or probing local kernel attack surface. The sandbox is implemented using systrace(4) in unsupervised "fast-path" mode, where a list of permitted syscalls is supplied. Any syscall not on the list results in SIGKILL being sent to the privsep child. Note that this requires a kernel with the new SYSTR_POLICY_KILL option. UsePrivilegeSeparation=sandbox will become the default in the future so please start testing it now. feedback dtucker@; ok markus@
* tweak previous; ok djmjmc2011-05-231-6/+4
|
* allow AuthorizedKeysFile to specify multiple files, separated by spaces.djm2011-05-231-4/+7
| | | | | | | | | Bring back authorized_keys2 as a default search path (to avoid breaking existing users of this file), but override this in sshd_config so it will be no longer used on fresh installs. Maybe in 2015 we can remove it entierly :) feedback and ok markus@ dtucker@
* explain that IPQoS arguments are separated by whitespace; iirc requesteddjm2010-12-081-3/+3
| | | | | by jmc@ a while back CVS ----------------------------------------------------------------------
* add IPQoS to the various -o lists, and zap some trailing whitespace;jmc2010-11-181-3/+3
|
* allow ssh and sshd to set arbitrary TOS/DSCP/QoS values instead ofdjm2010-11-131-2/+39
| | | | | | hardcoding lowdelay/throughput. bz#1733 patch from philipp AT redfish-solutions.com; ok markus@ deraadt@
* knock out some "-*- nroff -*-" lines;jmc2010-10-281-3/+2
|
* add a KexAlgorithms knob to the client and server configuration to allowdjm2010-09-221-2/+13
| | | | | | | selection of which key exchange methods are used by ssh(1) and sshd(8) and their order of preference. ok markus@
* Implement Elliptic Curve Cryptography modes for key exchange (ECDH) anddjm2010-08-311-5/+7
| | | | | | | | | | | | | | | | | host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@
* tweak previous;jmc2010-06-301-4/+4
|
* allow key options (command="..." and friends) in AuthorizedPrincipals;djm2010-06-291-3/+12
| | | | ok markus@
* expose some more sshd_config options inside Match blocks:djm2010-06-221-2/+6
| | | | | | AuthorizedKeysFile AuthorizedPrincipalsFile HostbasedUsesNameFromPacketOnly PermitTunnel bz#1764; feedback from imorgan AT nas.nasa.gov; ok dtucker@
* tweak previous;jmc2010-05-071-3/+2
|
* add some optional indirection to matching of principal names listeddjm2010-05-071-2/+39
| | | | | | | | | | | | | | | | | | | | | in certificates. Currently, a certificate must include the a user's name to be accepted for authentication. This change adds the ability to specify a list of certificate principal names that are acceptable. When authenticating using a CA trusted through ~/.ssh/authorized_keys, this adds a new principals="name1[,name2,...]" key option. For CAs listed through sshd_config's TrustedCAKeys option, a new config option "AuthorizedPrincipalsFile" specifies a per-user file containing the list of acceptable names. If either option is absent, the current behaviour of requiring the username to appear in principals continues to apply. These options are useful for role accounts, disjoint account namespaces and "user@realm"-style naming policies in certificates. feedback and ok markus@
* missing word; spotted by jmc@djm2010-03-041-2/+2
|
* tweak previous;jmc2010-03-041-3/+3
|
* Add a TrustedUserCAKeys option to sshd_config to specify CA keys thatdjm2010-03-041-2/+23
| | | | | | | | | | | are trusted to authenticate users (in addition than doing it per-user in authorized_keys). Add a RevokedKeys option to sshd_config and a @revoked marker to known_hosts to allow keys to me revoked and banned for user or host authentication. feedback and ok markus@
* Add support for certificate key types for users and hosts.djm2010-02-261-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@
* Remove RoutingDomain from ssh since it's now not needed. It can be replaceddtucker2010-01-091-5/+2
| | | | | | | | | | | | | with "route exec" or "nc -V" as a proxycommand. "route exec" also ensures that trafic such as DNS lookups stays withing the specified routingdomain. For example (from reyk): # route -T 2 exec /usr/sbin/sshd or inherited from the parent process $ route -T 2 exec sh $ ssh 10.1.2.3 ok deraadt@ markus@ stevesk@ reyk@
* sort previous;jmc2009-12-291-4/+4
|
* Rename RDomain config option to RoutingDomain to be more clear andstevesk2009-12-291-3/+3
| | | | | | | | | consistent with other options. NOTE: if you currently use RDomain in the ssh client or server config, or ssh/sshd -o, you must update to use RoutingDomain. ok markus@ djm@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.