2 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
3 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 .\" All rights reserved
6 .\" As far as I am concerned, the code I have written for this software
7 .\" can be used freely for any purpose. Any derived versions of this
8 .\" software must be clearly marked as such, and if the derived work is
9 .\" incompatible with the protocol description in the RFC file, it must be
10 .\" called by a name other than "ssh" or "Secure Shell".
12 .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
13 .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
14 .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
16 .\" Redistribution and use in source and binary forms, with or without
17 .\" modification, are permitted provided that the following conditions
19 .\" 1. Redistributions of source code must retain the above copyright
20 .\" notice, this list of conditions and the following disclaimer.
21 .\" 2. Redistributions in binary form must reproduce the above copyright
22 .\" notice, this list of conditions and the following disclaimer in the
23 .\" documentation and/or other materials provided with the distribution.
25 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30 .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31 .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32 .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 .\" $OpenBSD: ssh_config.5,v 1.387 2023/10/04 04:03:50 djm Exp $
37 .Dd $Mdocdate: October 4 2023 $
42 .Nd OpenSSH client configuration file
45 obtains configuration data from the following sources in
48 .Bl -enum -offset indent -compact
52 user's configuration file
55 system-wide configuration file
56 .Pq Pa /etc/ssh/ssh_config
59 Unless noted otherwise, for each parameter, the first obtained value
61 The configuration files contain sections separated by
63 specifications, and that section is only applied for hosts that
64 match one of the patterns given in the specification.
65 The matched host name is usually the one given on the command line
67 .Cm CanonicalizeHostname
68 option for exceptions).
70 Since the first obtained value for each parameter is used, more
71 host-specific declarations should be given near the beginning of the
72 file, and general defaults at the end.
74 The file contains keyword-argument pairs, one per line.
77 and empty lines are interpreted as comments.
78 Arguments may optionally be enclosed in double quotes
80 in order to represent arguments containing spaces.
81 Configuration options may be separated by whitespace or
82 optional whitespace and exactly one
84 the latter format is useful to avoid the need to quote whitespace
85 when specifying configuration options using the
94 keywords and their meanings are as follows (note that
95 keywords are case-insensitive and arguments are case-sensitive):
98 Restricts the following declarations (up to the next
102 keyword) to be only for those hosts that match one of the patterns
103 given after the keyword.
104 If more than one pattern is provided, they should be separated by whitespace.
107 as a pattern can be used to provide global
108 defaults for all hosts.
109 The host is usually the
111 argument given on the command line
113 .Cm CanonicalizeHostname
114 keyword for exceptions).
116 A pattern entry may be negated by prefixing it with an exclamation mark
118 If a negated entry is matched, then the
120 entry is ignored, regardless of whether any other patterns on the line
122 Negated matches are therefore useful to provide exceptions for wildcard
127 for more information on patterns.
129 Restricts the following declarations (up to the next
133 keyword) to be used only when the conditions following the
135 keyword are satisfied.
136 Match conditions are specified using one or more criteria
139 which always matches.
140 The available criteria keywords are:
153 criteria must appear alone or immediately after
157 Other criteria may be combined arbitrarily.
164 Criteria may be negated by prepending an exclamation mark
169 keyword matches only when the configuration file is being re-parsed
170 after hostname canonicalization (see the
171 .Cm CanonicalizeHostname
173 This may be useful to specify conditions that work with canonical host
178 keyword requests that the configuration be re-parsed (regardless of whether
179 .Cm CanonicalizeHostname
180 is enabled), and matches only during this final pass.
182 .Cm CanonicalizeHostname
187 match during the same pass.
191 keyword executes the specified command under the user's shell.
192 If the command returns a zero exit status then the condition is considered true.
193 Commands containing whitespace characters must be quoted.
196 accept the tokens described in the
202 keyword matches the addresses of active local network interfaces against the
203 supplied list of networks in CIDR format.
204 This may be convenient for varying the effective configuration on devices that
205 roam between networks.
206 Note that network address is not a trustworthy criteria in many
207 situations (e.g. when the network is automatically configured using DHCP)
208 and so caution should be applied if using it to control security-sensitive
211 The other keywords' criteria must be single entries or comma-separated
212 lists and may use the wildcard and negation operators described in the
217 keyword are matched against the target hostname, after any substitution
221 .Cm CanonicalizeHostname
225 keyword matches against the hostname as it was specified on the command-line.
228 keyword matches a tag name specified by a prior
232 command-line using the
237 keyword matches against the target username on the remote host.
240 keyword matches against the name of the local user running
242 (this keyword may be useful in system-wide
245 .It Cm AddKeysToAgent
246 Specifies whether keys should be automatically added to a running
248 If this option is set to
250 and a key is loaded from a file, the key and its passphrase are added to
251 the agent with the default lifetime, as if by
253 If this option is set to
256 will require confirmation using the
258 program before adding a key (see
261 If this option is set to
263 each use of the key must be confirmed, as if the
265 option was specified to
267 If this option is set to
269 no keys are added to the agent.
270 Alternately, this option may be specified as a time interval
271 using the format described in the
275 to specify the key's lifetime in
277 after which it will automatically be removed.
283 (optionally followed by a time interval),
287 Specifies which address family to use when connecting.
298 user interaction such as password prompts and host key confirmation requests
300 This option is useful in scripts and other batch jobs where no user
301 is present to interact with
309 Use the specified address on the local machine as the source address of
311 Only useful on systems with more than one address.
313 Use the address of the specified interface on the local machine as the
314 source address of the connection.
315 .It Cm CanonicalDomains
317 .Cm CanonicalizeHostname
318 is enabled, this option specifies the list of domain suffixes in which to
319 search for the specified destination host.
320 .It Cm CanonicalizeFallbackLocal
321 Specifies whether to fail with an error when hostname canonicalization fails.
324 will attempt to look up the unqualified hostname using the system resolver's
331 .Cm CanonicalizeHostname
332 is enabled and the target hostname cannot be found in any of the domains
334 .Cm CanonicalDomains .
335 .It Cm CanonicalizeHostname
336 Controls whether explicit hostname canonicalization is performed.
339 is not to perform any name rewriting and let the system resolver handle all
343 then, for connections that do not use a
348 will attempt to canonicalize the hostname specified on the command line
352 .Cm CanonicalizePermittedCNAMEs
355 .Cm CanonicalizeHostname
358 then canonicalization is applied to proxied connections too.
360 If this option is enabled, then the configuration files are processed
361 again using the new target name to pick up any new configuration in matching
368 disables the use of a
371 .It Cm CanonicalizeMaxDots
372 Specifies the maximum number of dot characters in a hostname before
373 canonicalization is disabled.
375 allows a single dot (i.e. hostname.subdomain).
376 .It Cm CanonicalizePermittedCNAMEs
377 Specifies rules to determine whether CNAMEs should be followed when
378 canonicalizing hostnames.
379 The rules consist of one or more arguments of
380 .Ar source_domain_list : Ns Ar target_domain_list ,
382 .Ar source_domain_list
383 is a pattern-list of domains that may follow CNAMEs in canonicalization,
385 .Ar target_domain_list
386 is a pattern-list of domains that they may resolve to.
389 .Qq *.a.example.com:*.b.example.com,*.c.example.com
390 will allow hostnames matching
392 to be canonicalized to names in the
400 causes no CNAMEs to be considered for canonicalization.
401 This is the default behaviour.
402 .It Cm CASignatureAlgorithms
403 Specifies which algorithms are allowed for signing of certificates
404 by certificate authorities (CAs).
406 .Bd -literal -offset indent
407 ssh-ed25519,ecdsa-sha2-nistp256,
408 ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
409 sk-ssh-ed25519@openssh.com,
410 sk-ecdsa-sha2-nistp256@openssh.com,
411 rsa-sha2-512,rsa-sha2-256
414 If the specified list begins with a
416 character, then the specified algorithms will be appended to the default set
417 instead of replacing them.
418 If the specified list begins with a
420 character, then the specified algorithms (including wildcards) will be removed
421 from the default set instead of replacing them.
424 will not accept host certificates signed using algorithms other than those
426 .It Cm CertificateFile
427 Specifies a file from which the user's certificate is read.
428 A corresponding private key must be provided separately in order
429 to use this certificate either
441 .Cm SecurityKeyProvider .
445 may use the tilde syntax to refer to a user's home directory,
446 the tokens described in the
448 section and environment variables as described in the
449 .Sx ENVIRONMENT VARIABLES
452 It is possible to have multiple certificate files specified in
453 configuration files; these certificates will be tried in sequence.
456 directives will add to the list of certificates used for
462 will additionally check the host IP address in the
465 This allows it to detect if a host key changed due to DNS spoofing
466 and will add addresses of destination hosts to
467 .Pa ~/.ssh/known_hosts
468 in the process, regardless of the setting of
469 .Cm StrictHostKeyChecking .
470 If the option is set to
473 the check will not be executed.
477 Specifies the ciphers allowed and their order of preference.
478 Multiple ciphers must be comma-separated.
479 If the specified list begins with a
481 character, then the specified ciphers will be appended to the default set
482 instead of replacing them.
483 If the specified list begins with a
485 character, then the specified ciphers (including wildcards) will be removed
486 from the default set instead of replacing them.
487 If the specified list begins with a
489 character, then the specified ciphers will be placed at the head of the
492 The supported ciphers are:
493 .Bd -literal -offset indent
501 aes128-gcm@openssh.com
502 aes256-gcm@openssh.com
503 chacha20-poly1305@openssh.com
507 .Bd -literal -offset indent
508 chacha20-poly1305@openssh.com,
509 aes128-ctr,aes192-ctr,aes256-ctr,
510 aes128-gcm@openssh.com,aes256-gcm@openssh.com
513 The list of available ciphers may also be obtained using
515 .It Cm ClearAllForwardings
516 Specifies that all local, remote, and dynamic port forwardings
517 specified in the configuration files or on the command line be
519 This option is primarily useful when used from the
521 command line to clear port forwardings set in
522 configuration files, and is automatically set by
532 Specifies whether to use compression.
538 .It Cm ConnectionAttempts
539 Specifies the number of tries (one per second) to make before exiting.
540 The argument must be an integer.
541 This may be useful in scripts if the connection sometimes fails.
543 .It Cm ConnectTimeout
544 Specifies the timeout (in seconds) used when connecting to the
545 SSH server, instead of using the default system TCP timeout.
546 This timeout is applied both to establishing the connection and to performing
547 the initial SSH protocol handshake and key exchange.
549 Enables the sharing of multiple sessions over a single network connection.
553 will listen for connections on a control socket specified using the
556 Additional sessions can connect to this socket using the same
563 These sessions will try to reuse the master instance's network connection
564 rather than initiating new ones, but will fall back to connecting normally
565 if the control socket does not exist, or is not listening.
571 to listen for control connections, but require confirmation using
577 will continue without connecting to a master instance.
581 forwarding is supported over these multiplexed connections, however the
582 display and agent forwarded will be the one belonging to the master
583 connection i.e. it is not possible to forward multiple displays or agents.
585 Two additional options allow for opportunistic multiplexing: try to use a
586 master connection but fall back to creating a new one if one does not already
592 The latter requires confirmation like the
596 Specify the path to the control socket used for connection sharing as described
599 section above or the string
601 to disable connection sharing.
604 may use the tilde syntax to refer to a user's home directory,
605 the tokens described in the
607 section and environment variables as described in the
608 .Sx ENVIRONMENT VARIABLES
610 It is recommended that any
612 used for opportunistic connection sharing include
613 at least %h, %p, and %r (or alternatively %C) and be placed in a directory
614 that is not writable by other users.
615 This ensures that shared connections are uniquely identified.
616 .It Cm ControlPersist
617 When used in conjunction with
619 specifies that the master connection should remain open
620 in the background (waiting for future client connections)
621 after the initial client connection has been closed.
625 then the master connection will not be placed into the background,
626 and will close as soon as the initial client connection is closed.
630 then the master connection will remain in the background indefinitely
631 (until killed or closed via a mechanism such as the
633 If set to a time in seconds, or a time in any of the formats documented in
635 then the backgrounded master connection will automatically terminate
636 after it has remained idle (with no client connections) for the
638 .It Cm DynamicForward
639 Specifies that a TCP port on the local machine be forwarded
640 over the secure channel, and the application
641 protocol is then used to determine where to connect to from the
646 .Oo Ar bind_address : Oc Ar port .
648 IPv6 addresses can be specified by enclosing addresses in square brackets.
649 By default, the local port is bound in accordance with the
654 may be used to bind the connection to a specific address.
659 indicates that the listening port be bound for local use only, while an
662 indicates that the port should be available from all interfaces.
664 Currently the SOCKS4 and SOCKS5 protocols are supported, and
666 will act as a SOCKS server.
667 Multiple forwardings may be specified, and
668 additional forwardings can be given on the command line.
669 Only the superuser can forward privileged ports.
670 .It Cm EnableEscapeCommandline
671 Enables the command line option in the
673 menu for interactive sessions (default
675 By default, the command line is disabled.
676 .It Cm EnableSSHKeysign
677 Setting this option to
679 in the global client configuration file
680 .Pa /etc/ssh/ssh_config
681 enables the use of the helper program
684 .Cm HostbasedAuthentication .
690 This option should be placed in the non-hostspecific section.
693 for more information.
695 Sets the escape character (default:
697 The escape character can also
698 be set on the command line.
699 The argument should be a single character,
701 followed by a letter, or
703 to disable the escape
704 character entirely (making the connection transparent for binary
706 .It Cm ExitOnForwardFailure
709 should terminate the connection if it cannot set up all requested
710 dynamic, tunnel, local, and remote port forwardings, (e.g.\&
711 if either end is unable to bind and listen on a specified port).
713 .Cm ExitOnForwardFailure
714 does not apply to connections made over port forwardings and will not,
717 to exit if TCP connections to the ultimate forwarding destination fail.
723 .It Cm FingerprintHash
724 Specifies the hash algorithm used when displaying key fingerprints.
730 .It Cm ForkAfterAuthentication
733 to go to background just before command execution.
736 is going to ask for passwords or passphrases, but the user
737 wants it in the background.
740 configuration option being set to
742 The recommended way to start X11 programs at a remote site is with
744 .Ic ssh -f host xterm ,
748 .Cm ForkAfterAuthentication
749 configuration option is set to
753 .Cm ExitOnForwardFailure
754 configuration option is set to
756 then a client started with the
757 .Cm ForkAfterAuthentication
758 configuration option being set to
760 will wait for all remote port forwards to be successfully established
761 before placing itself in the background.
762 The argument to this keyword must be
770 Specifies whether the connection to the authentication agent (if any)
771 will be forwarded to the remote machine.
776 an explicit path to an agent socket or the name of an environment variable
779 in which to find the path.
781 Agent forwarding should be enabled with caution.
782 Users with the ability to bypass file permissions on the remote host
783 (for the agent's Unix-domain socket)
784 can access the local agent through the forwarded connection.
785 An attacker cannot obtain key material from the agent,
786 however they can perform operations on the keys that enable them to
787 authenticate using the identities loaded into the agent.
789 Specifies whether X11 connections will be automatically redirected
790 over the secure channel and
799 X11 forwarding should be enabled with caution.
800 Users with the ability to bypass file permissions on the remote host
801 (for the user's X11 authorization database)
802 can access the local X11 display through the forwarded connection.
803 An attacker may then be able to perform activities such as keystroke monitoring
805 .Cm ForwardX11Trusted
806 option is also enabled.
807 .It Cm ForwardX11Timeout
808 Specify a timeout for untrusted X11 forwarding
809 using the format described in the
813 X11 connections received by
815 after this time will be refused.
817 .Cm ForwardX11Timeout
818 to zero will disable the timeout and permit X11 forwarding for the life
820 The default is to disable untrusted X11 forwarding after twenty minutes has
822 .It Cm ForwardX11Trusted
823 If this option is set to
825 remote X11 clients will have full access to the original X11 display.
827 If this option is set to
830 remote X11 clients will be considered untrusted and prevented
831 from stealing or tampering with data belonging to trusted X11
835 token used for the session will be set to expire after 20 minutes.
836 Remote clients will be refused access after this time.
838 See the X11 SECURITY extension specification for full details on
839 the restrictions imposed on untrusted clients.
841 Specifies whether remote hosts are allowed to connect to local
845 binds local port forwardings to the loopback address.
846 This prevents other remote hosts from connecting to forwarded ports.
848 can be used to specify that ssh
849 should bind local port forwardings to the wildcard address,
850 thus allowing remote hosts to connect to forwarded ports.
856 .It Cm GlobalKnownHostsFile
857 Specifies one or more files to use for the global
858 host key database, separated by whitespace.
860 .Pa /etc/ssh/ssh_known_hosts ,
861 .Pa /etc/ssh/ssh_known_hosts2 .
862 .It Cm GSSAPIAuthentication
863 Specifies whether user authentication based on GSSAPI is allowed.
866 .It Cm GSSAPIDelegateCredentials
867 Forward (delegate) credentials to the server.
870 .It Cm HashKnownHosts
873 should hash host names and addresses when they are added to
874 .Pa ~/.ssh/known_hosts .
875 These hashed names may be used normally by
879 but they do not visually reveal identifying information if the
880 file's contents are disclosed.
883 Note that existing names and addresses in known hosts files
884 will not be converted automatically,
885 but may be manually hashed using
887 .It Cm HostbasedAcceptedAlgorithms
888 Specifies the signature algorithms that will be used for hostbased
889 authentication as a comma-separated list of patterns.
890 Alternately if the specified list begins with a
892 character, then the specified signature algorithms will be appended
893 to the default set instead of replacing them.
894 If the specified list begins with a
896 character, then the specified signature algorithms (including wildcards)
897 will be removed from the default set instead of replacing them.
898 If the specified list begins with a
900 character, then the specified signature algorithms will be placed
901 at the head of the default set.
902 The default for this option is:
903 .Bd -literal -offset 3n
904 ssh-ed25519-cert-v01@openssh.com,
905 ecdsa-sha2-nistp256-cert-v01@openssh.com,
906 ecdsa-sha2-nistp384-cert-v01@openssh.com,
907 ecdsa-sha2-nistp521-cert-v01@openssh.com,
908 sk-ssh-ed25519-cert-v01@openssh.com,
909 sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
910 rsa-sha2-512-cert-v01@openssh.com,
911 rsa-sha2-256-cert-v01@openssh.com,
913 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
914 sk-ssh-ed25519@openssh.com,
915 sk-ecdsa-sha2-nistp256@openssh.com,
916 rsa-sha2-512,rsa-sha2-256
923 may be used to list supported signature algorithms.
924 This was formerly named HostbasedKeyTypes.
925 .It Cm HostbasedAuthentication
926 Specifies whether to try rhosts based authentication with public key
933 .It Cm HostKeyAlgorithms
934 Specifies the host key signature algorithms
935 that the client wants to use in order of preference.
936 Alternately if the specified list begins with a
938 character, then the specified signature algorithms will be appended to
939 the default set instead of replacing them.
940 If the specified list begins with a
942 character, then the specified signature algorithms (including wildcards)
943 will be removed from the default set instead of replacing them.
944 If the specified list begins with a
946 character, then the specified signature algorithms will be placed
947 at the head of the default set.
948 The default for this option is:
949 .Bd -literal -offset 3n
950 ssh-ed25519-cert-v01@openssh.com,
951 ecdsa-sha2-nistp256-cert-v01@openssh.com,
952 ecdsa-sha2-nistp384-cert-v01@openssh.com,
953 ecdsa-sha2-nistp521-cert-v01@openssh.com,
954 sk-ssh-ed25519-cert-v01@openssh.com,
955 sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
956 rsa-sha2-512-cert-v01@openssh.com,
957 rsa-sha2-256-cert-v01@openssh.com,
959 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
960 sk-ecdsa-sha2-nistp256@openssh.com,
961 sk-ssh-ed25519@openssh.com,
962 rsa-sha2-512,rsa-sha2-256
965 If hostkeys are known for the destination host then this default is modified
966 to prefer their algorithms.
968 The list of available signature algorithms may also be obtained using
969 .Qq ssh -Q HostKeyAlgorithms .
971 Specifies an alias that should be used instead of the
972 real host name when looking up or saving the host key
973 in the host key database files and when validating host certificates.
974 This option is useful for tunneling SSH connections
975 or for multiple servers running on a single host.
977 Specifies the real host name to log into.
978 This can be used to specify nicknames or abbreviations for hosts.
981 accept the tokens described in the
984 Numeric IP addresses are also permitted (both on the command line and in
987 The default is the name given on the command line.
988 .It Cm IdentitiesOnly
991 should only use the configured authentication identity and certificate files
992 (either the default files, or those explicitly configured in the
1003 .Cm SecurityKeyProvider
1004 offers more identities.
1005 The argument to this keyword must be
1010 This option is intended for situations where ssh-agent
1011 offers many different identities.
1012 .It Cm IdentityAgent
1015 socket used to communicate with the authentication agent.
1017 This option overrides the
1019 environment variable and can be used to select a specific agent.
1020 Setting the socket name to
1022 disables the use of an authentication agent.
1025 is specified, the location of the socket will be read from the
1027 environment variable.
1028 Otherwise if the specified value begins with a
1030 character, then it will be treated as an environment variable containing
1031 the location of the socket.
1035 may use the tilde syntax to refer to a user's home directory,
1036 the tokens described in the
1038 section and environment variables as described in the
1039 .Sx ENVIRONMENT VARIABLES
1042 Specifies a file from which the user's DSA, ECDSA, authenticator-hosted ECDSA,
1043 Ed25519, authenticator-hosted Ed25519 or RSA authentication identity is read.
1044 You can also specify a public key file to use the corresponding
1045 private key that is loaded in
1047 when the private key file is not present locally.
1050 .Pa ~/.ssh/id_ecdsa ,
1051 .Pa ~/.ssh/id_ecdsa_sk ,
1052 .Pa ~/.ssh/id_ed25519 ,
1053 .Pa ~/.ssh/id_ed25519_sk
1056 Additionally, any identities represented by the authentication agent
1057 will be used for authentication unless
1060 If no certificates have been explicitly specified by
1061 .Cm CertificateFile ,
1063 will try to load certificate information from the filename obtained by
1066 to the path of a specified
1071 may use the tilde syntax to refer to a user's home directory
1072 or the tokens described in the
1076 It is possible to have
1077 multiple identity files specified in configuration files; all these
1078 identities will be tried in sequence.
1081 directives will add to the list of identities tried (this behaviour
1082 differs from that of other configuration directives).
1085 may be used in conjunction with
1087 to select which identities in an agent are offered during authentication.
1089 may also be used in conjunction with
1091 in order to provide any certificate also needed for authentication with
1093 .It Cm IgnoreUnknown
1094 Specifies a pattern-list of unknown options to be ignored if they are
1095 encountered in configuration parsing.
1096 This may be used to suppress errors if
1098 contains options that are unrecognised by
1100 It is recommended that
1102 be listed early in the configuration file as it will not be applied
1103 to unknown options that appear before it.
1105 Include the specified configuration file(s).
1106 Multiple pathnames may be specified and each pathname may contain
1108 wildcards and, for user configurations, shell-like
1110 references to user home directories.
1111 Wildcards will be expanded and processed in lexical order.
1112 Files without absolute paths are assumed to be in
1114 if included in a user configuration file or
1116 if included from the system configuration file.
1118 directive may appear inside a
1123 to perform conditional inclusion.
1125 Specifies the IPv4 type-of-service or DSCP class for connections.
1154 to use the operating system default.
1155 This option may take one or two arguments, separated by whitespace.
1156 If one argument is specified, it is used as the packet class unconditionally.
1157 If two values are specified, the first is automatically selected for
1158 interactive sessions and the second for non-interactive sessions.
1162 for interactive sessions and
1165 for non-interactive sessions.
1166 .It Cm KbdInteractiveAuthentication
1167 Specifies whether to use keyboard-interactive authentication.
1168 The argument to this keyword must be
1173 .Cm ChallengeResponseAuthentication
1174 is a deprecated alias for this.
1175 .It Cm KbdInteractiveDevices
1176 Specifies the list of methods to use in keyboard-interactive authentication.
1177 Multiple method names must be comma-separated.
1178 The default is to use the server specified list.
1179 The methods available vary depending on what the server supports.
1180 For an OpenSSH server,
1181 it may be zero or more of:
1185 .It Cm KexAlgorithms
1186 Specifies the available KEX (Key Exchange) algorithms.
1187 Multiple algorithms must be comma-separated.
1188 If the specified list begins with a
1190 character, then the specified algorithms will be appended to the default set
1191 instead of replacing them.
1192 If the specified list begins with a
1194 character, then the specified algorithms (including wildcards) will be removed
1195 from the default set instead of replacing them.
1196 If the specified list begins with a
1198 character, then the specified algorithms will be placed at the head of the
1201 .Bd -literal -offset indent
1202 sntrup761x25519-sha512@openssh.com,
1203 curve25519-sha256,curve25519-sha256@libssh.org,
1204 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
1205 diffie-hellman-group-exchange-sha256,
1206 diffie-hellman-group16-sha512,
1207 diffie-hellman-group18-sha512,
1208 diffie-hellman-group14-sha256
1211 The list of available key exchange algorithms may also be obtained using
1213 .It Cm KnownHostsCommand
1214 Specifies a command to use to obtain a list of host keys, in addition to
1216 .Cm UserKnownHostsFile
1218 .Cm GlobalKnownHostsFile .
1219 This command is executed after the files have been read.
1220 It may write host key lines to standard output in identical format to the
1221 usual files (described in the
1222 .Sx VERIFYING HOST KEYS
1226 .Cm KnownHostsCommand
1227 accept the tokens described in the
1230 The command may be invoked multiple times per connection: once when preparing
1231 the preference list of host key algorithms to use, again to obtain the
1232 host key for the requested host name and, if
1234 is enabled, one more time to obtain the host key matching the server's
1236 If the command exits abnormally or returns a non-zero exit status then the
1237 connection is terminated.
1239 Specifies a command to execute on the local machine after successfully
1240 connecting to the server.
1241 The command string extends to the end of the line, and is executed with
1245 accept the tokens described in the
1249 The command is run synchronously and does not have access to the
1253 It should not be used for interactive commands.
1255 This directive is ignored unless
1256 .Cm PermitLocalCommand
1259 Specifies that a TCP port on the local machine be forwarded over
1260 the secure channel to the specified host and port from the remote machine.
1261 The first argument specifies the listener and may be
1263 .Oo Ar bind_address : Oc Ar port
1265 or a Unix domain socket path.
1266 The second argument is the destination and may be
1267 .Ar host : Ns Ar hostport
1268 or a Unix domain socket path if the remote host supports it.
1270 IPv6 addresses can be specified by enclosing addresses in square brackets.
1271 Multiple forwardings may be specified, and additional forwardings can be
1272 given on the command line.
1273 Only the superuser can forward privileged ports.
1274 By default, the local port is bound in accordance with the
1277 However, an explicit
1279 may be used to bind the connection to a specific address.
1284 indicates that the listening port be bound for local use only, while an
1287 indicates that the port should be available from all interfaces.
1288 Unix domain socket paths may use the tokens described in the
1290 section and environment variables as described in the
1291 .Sx ENVIRONMENT VARIABLES
1294 Gives the verbosity level that is used when logging messages from
1296 The possible values are:
1297 QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.
1298 The default is INFO.
1299 DEBUG and DEBUG1 are equivalent.
1300 DEBUG2 and DEBUG3 each specify higher levels of verbose output.
1302 Specify one or more overrides to LogLevel.
1303 An override consists of a pattern lists that matches the source file, function
1304 and line number to force detailed logging for.
1305 For example, an override pattern of:
1306 .Bd -literal -offset indent
1307 kex.c:*:1000,*:kex_exchange_identification():*,packet.c:*
1310 would enable detailed logging for line 1000 of
1313 .Fn kex_exchange_identification
1314 function, and all code in the
1317 This option is intended for debugging and no overrides are enabled by default.
1319 Specifies the MAC (message authentication code) algorithms
1320 in order of preference.
1321 The MAC algorithm is used for data integrity protection.
1322 Multiple algorithms must be comma-separated.
1323 If the specified list begins with a
1325 character, then the specified algorithms will be appended to the default set
1326 instead of replacing them.
1327 If the specified list begins with a
1329 character, then the specified algorithms (including wildcards) will be removed
1330 from the default set instead of replacing them.
1331 If the specified list begins with a
1333 character, then the specified algorithms will be placed at the head of the
1336 The algorithms that contain
1338 calculate the MAC after encryption (encrypt-then-mac).
1339 These are considered safer and their use recommended.
1342 .Bd -literal -offset indent
1343 umac-64-etm@openssh.com,umac-128-etm@openssh.com,
1344 hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
1345 hmac-sha1-etm@openssh.com,
1346 umac-64@openssh.com,umac-128@openssh.com,
1347 hmac-sha2-256,hmac-sha2-512,hmac-sha1
1350 The list of available MAC algorithms may also be obtained using
1352 .It Cm NoHostAuthenticationForLocalhost
1353 Disable host authentication for localhost (loopback addresses).
1354 The argument to this keyword must be
1359 .It Cm NumberOfPasswordPrompts
1360 Specifies the number of password prompts before giving up.
1361 The argument to this keyword must be an integer.
1363 .It Cm ObscureKeystrokeTiming
1366 should try to obscure inter-keystroke timings from passive observers of
1368 If enabled, then for interactive sessions,
1370 will send keystrokes at fixed intervals of a few tens of milliseconds
1371 and will send fake keystroke packets for some time after typing ceases.
1372 The argument to this keyword must be
1375 or an interval specifier of the form
1376 .Cm interval:milliseconds
1379 for 80 milliseconds).
1380 The default is to obscure keystrokes using a 20ms packet interval.
1381 Note that smaller intervals will result in higher fake keystroke packet rates.
1382 .It Cm PasswordAuthentication
1383 Specifies whether to use password authentication.
1384 The argument to this keyword must be
1389 .It Cm PermitLocalCommand
1390 Allow local command execution via the
1393 .Ic !\& Ns Ar command
1396 The argument must be
1401 .It Cm PermitRemoteOpen
1402 Specifies the destinations to which remote TCP port forwarding is permitted when
1404 is used as a SOCKS proxy.
1405 The forwarding specification must be one of the following forms:
1407 .Bl -item -offset indent -compact
1409 .Cm PermitRemoteOpen
1414 .Cm PermitRemoteOpen
1416 .Ar IPv4_addr : port
1419 .Cm PermitRemoteOpen
1421 .Ar \&[ IPv6_addr \&] : port
1425 Multiple forwards may be specified by separating them with whitespace.
1428 can be used to remove all restrictions and permit any forwarding requests.
1431 can be used to prohibit all forwarding requests.
1434 can be used for host or port to allow all hosts or ports respectively.
1435 Otherwise, no pattern matching or address lookups are performed on supplied
1437 .It Cm PKCS11Provider
1438 Specifies which PKCS#11 provider to use or
1440 to indicate that no provider should be used (the default).
1441 The argument to this keyword is a path to the PKCS#11 shared library
1443 should use to communicate with a PKCS#11 token providing keys for user
1446 Specifies the port number to connect on the remote host.
1448 .It Cm PreferredAuthentications
1449 Specifies the order in which the client should try authentication methods.
1450 This allows a client to prefer one method (e.g.\&
1451 .Cm keyboard-interactive )
1452 over another method (e.g.\&
1455 .Bd -literal -offset indent
1456 gssapi-with-mic,hostbased,publickey,
1457 keyboard-interactive,password
1460 Specifies the command to use to connect to the server.
1462 string extends to the end of the line, and is executed
1463 using the user's shell
1465 directive to avoid a lingering shell process.
1469 accept the tokens described in the
1472 The command can be basically anything,
1473 and should read from its standard input and write to its standard output.
1474 It should eventually connect an
1476 server running on some machine, or execute
1479 Host key management will be done using the
1481 of the host being connected (defaulting to the name typed by the user).
1482 Setting the command to
1484 disables this option entirely.
1487 is not available for connects with a proxy command.
1489 This directive is useful in conjunction with
1491 and its proxy support.
1492 For example, the following directive would connect via an HTTP proxy at
1494 .Bd -literal -offset 3n
1495 ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
1498 Specifies one or more jump proxies as either
1507 Multiple proxies may be separated by comma characters and will be visited
1509 Setting this option will cause
1511 to connect to the target host by first making a
1513 connection to the specified
1515 host and then establishing a
1516 TCP forwarding to the ultimate target from there.
1519 disables this option entirely.
1521 Note that this option will compete with the
1523 option - whichever is specified first will prevent later instances of the
1524 other from taking effect.
1526 Note also that the configuration for the destination host (either supplied
1527 via the command-line or the configuration file) is not generally applied
1530 should be used if specific configuration is required for jump hosts.
1531 .It Cm ProxyUseFdpass
1534 will pass a connected file descriptor back to
1536 instead of continuing to execute and pass data.
1539 .It Cm PubkeyAcceptedAlgorithms
1540 Specifies the signature algorithms that will be used for public key
1541 authentication as a comma-separated list of patterns.
1542 If the specified list begins with a
1544 character, then the algorithms after it will be appended to the default
1545 instead of replacing it.
1546 If the specified list begins with a
1548 character, then the specified algorithms (including wildcards) will be removed
1549 from the default set instead of replacing them.
1550 If the specified list begins with a
1552 character, then the specified algorithms will be placed at the head of the
1554 The default for this option is:
1555 .Bd -literal -offset 3n
1556 ssh-ed25519-cert-v01@openssh.com,
1557 ecdsa-sha2-nistp256-cert-v01@openssh.com,
1558 ecdsa-sha2-nistp384-cert-v01@openssh.com,
1559 ecdsa-sha2-nistp521-cert-v01@openssh.com,
1560 sk-ssh-ed25519-cert-v01@openssh.com,
1561 sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
1562 rsa-sha2-512-cert-v01@openssh.com,
1563 rsa-sha2-256-cert-v01@openssh.com,
1565 ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
1566 sk-ssh-ed25519@openssh.com,
1567 sk-ecdsa-sha2-nistp256@openssh.com,
1568 rsa-sha2-512,rsa-sha2-256
1571 The list of available signature algorithms may also be obtained using
1572 .Qq ssh -Q PubkeyAcceptedAlgorithms .
1573 .It Cm PubkeyAuthentication
1574 Specifies whether to try public key authentication.
1575 The argument to this keyword must be
1582 The final two options enable public key authentication while respectively
1583 disabling or enabling the OpenSSH host-bound authentication protocol
1584 extension required for restricted
1588 Specifies the maximum amount of data that may be transmitted or received
1589 before the session key is renegotiated, optionally followed by a maximum
1590 amount of time that may pass before the session key is renegotiated.
1591 The first argument is specified in bytes and may have a suffix of
1596 to indicate Kilobytes, Megabytes, or Gigabytes, respectively.
1597 The default is between
1601 depending on the cipher.
1602 The optional second value is specified in seconds and may use any of the
1603 units documented in the TIME FORMATS section of
1605 The default value for
1609 which means that rekeying is performed after the cipher's default amount
1610 of data has been sent or received and no time based rekeying is done.
1611 .It Cm RemoteCommand
1612 Specifies a command to execute on the remote machine after successfully
1613 connecting to the server.
1614 The command string extends to the end of the line, and is executed with
1618 accept the tokens described in the
1621 .It Cm RemoteForward
1622 Specifies that a TCP port on the remote machine be forwarded over
1624 The remote port may either be forwarded to a specified host and port
1625 from the local machine, or may act as a SOCKS 4/5 proxy that allows a remote
1626 client to connect to arbitrary destinations from the local machine.
1627 The first argument is the listening specification and may be
1629 .Oo Ar bind_address : Oc Ar port
1631 or, if the remote host supports it, a Unix domain socket path.
1632 If forwarding to a specific destination then the second argument must be
1633 .Ar host : Ns Ar hostport
1634 or a Unix domain socket path,
1635 otherwise if no destination argument is specified then the remote forwarding
1636 will be established as a SOCKS proxy.
1637 When acting as a SOCKS proxy, the destination of the connection can be
1639 .Cm PermitRemoteOpen .
1641 IPv6 addresses can be specified by enclosing addresses in square brackets.
1642 Multiple forwardings may be specified, and additional
1643 forwardings can be given on the command line.
1644 Privileged ports can be forwarded only when
1645 logging in as root on the remote machine.
1646 Unix domain socket paths may use the tokens described in the
1648 section and environment variables as described in the
1649 .Sx ENVIRONMENT VARIABLES
1655 the listen port will be dynamically allocated on the server and reported
1656 to the client at run time.
1660 is not specified, the default is to only bind to loopback addresses.
1665 or an empty string, then the forwarding is requested to listen on all
1669 will only succeed if the server's
1671 option is enabled (see
1672 .Xr sshd_config 5 ) .
1674 Specifies whether to request a pseudo-tty for the session.
1675 The argument may be one of:
1677 (never request a TTY),
1679 (always request a TTY when standard input is a TTY),
1681 (always request a TTY) or
1683 (request a TTY when opening a login session).
1684 This option mirrors the
1690 .It Cm RequiredRSASize
1691 Specifies the minimum RSA key size (in bits) that
1694 User authentication keys smaller than this limit will be ignored.
1695 Servers that present host keys smaller than this limit will cause the
1696 connection to be terminated.
1700 Note that this limit may only be raised from the default.
1701 .It Cm RevokedHostKeys
1702 Specifies revoked host public keys.
1703 Keys listed in this file will be refused for host authentication.
1704 Note that if this file does not exist or is not readable,
1705 then host authentication will be refused for all hosts.
1706 Keys may be specified as a text file, listing one public key per line, or as
1707 an OpenSSH Key Revocation List (KRL) as generated by
1709 For more information on KRLs, see the KEY REVOCATION LISTS section in
1713 may use the tilde syntax to refer to a user's home directory,
1714 the tokens described in the
1716 section and environment variables as described in the
1717 .Sx ENVIRONMENT VARIABLES
1719 .It Cm SecurityKeyProvider
1720 Specifies a path to a library that will be used when loading any
1721 FIDO authenticator-hosted keys, overriding the default of using
1722 the built-in USB HID support.
1724 If the specified value begins with a
1726 character, then it will be treated as an environment variable containing
1727 the path to the library.
1729 Specifies what variables from the local
1731 should be sent to the server.
1732 The server must also support it, and the server must be configured to
1733 accept these environment variables.
1736 environment variable is always sent whenever a
1737 pseudo-terminal is requested as it is required by the protocol.
1742 for how to configure the server.
1743 Variables are specified by name, which may contain wildcard characters.
1744 Multiple environment variables may be separated by whitespace or spread
1751 for more information on patterns.
1753 It is possible to clear previously set
1755 variable names by prefixing patterns with
1757 The default is not to send any environment variables.
1758 .It Cm ServerAliveCountMax
1759 Sets the number of server alive messages (see below) which may be
1762 receiving any messages back from the server.
1763 If this threshold is reached while server alive messages are being sent,
1764 ssh will disconnect from the server, terminating the session.
1765 It is important to note that the use of server alive messages is very
1769 The server alive messages are sent through the encrypted channel
1770 and therefore will not be spoofable.
1771 The TCP keepalive option enabled by
1774 The server alive mechanism is valuable when the client or
1775 server depend on knowing when a connection has become unresponsive.
1777 The default value is 3.
1779 .Cm ServerAliveInterval
1780 (see below) is set to 15 and
1781 .Cm ServerAliveCountMax
1782 is left at the default, if the server becomes unresponsive,
1783 ssh will disconnect after approximately 45 seconds.
1784 .It Cm ServerAliveInterval
1785 Sets a timeout interval in seconds after which if no data has been received
1788 will send a message through the encrypted
1789 channel to request a response from the server.
1791 is 0, indicating that these messages will not be sent to the server.
1793 May be used to either request invocation of a subsystem on the remote system,
1794 or to prevent the execution of a remote command at all.
1795 The latter is useful for just forwarding ports.
1796 The argument to this keyword must be
1806 (shell or command execution).
1808 Directly specify one or more environment variables and their contents to
1809 be sent to the server.
1812 with the exception of the
1814 variable, the server must be prepared to accept the environment variable.
1816 Redirects stdin from
1818 (actually, prevents reading from stdin).
1819 Either this or the equivalent
1821 option must be used when
1823 is run in the background.
1824 The argument to this keyword must be
1831 .It Cm StreamLocalBindMask
1832 Sets the octal file creation mode mask
1834 used when creating a Unix-domain socket file for local or remote
1836 This option is only used for port forwarding to a Unix-domain socket file.
1838 The default value is 0177, which creates a Unix-domain socket file that is
1839 readable and writable only by the owner.
1840 Note that not all operating systems honor the file mode on Unix-domain
1842 .It Cm StreamLocalBindUnlink
1843 Specifies whether to remove an existing Unix-domain socket file for local
1844 or remote port forwarding before creating a new one.
1845 If the socket file already exists and
1846 .Cm StreamLocalBindUnlink
1849 will be unable to forward the port to the Unix-domain socket file.
1850 This option is only used for port forwarding to a Unix-domain socket file.
1852 The argument must be
1857 .It Cm StrictHostKeyChecking
1858 If this flag is set to
1861 will never automatically add host keys to the
1862 .Pa ~/.ssh/known_hosts
1863 file, and refuses to connect to hosts whose host key has changed.
1864 This provides maximum protection against man-in-the-middle (MITM) attacks,
1865 though it can be annoying when the
1866 .Pa /etc/ssh/ssh_known_hosts
1867 file is poorly maintained or when connections to new hosts are
1869 This option forces the user to manually
1872 If this flag is set to
1874 then ssh will automatically add new host keys to the user's
1876 file, but will not permit connections to hosts with
1878 If this flag is set to
1882 ssh will automatically add new host keys to the user known hosts files
1883 and allow connections to hosts with changed hostkeys to proceed,
1884 subject to some restrictions.
1885 If this flag is set to
1889 will be added to the user known host files only after the user
1890 has confirmed that is what they really want to do, and
1891 ssh will refuse to connect to hosts whose host key has changed.
1893 known hosts will be verified automatically in all cases.
1894 .It Cm SyslogFacility
1895 Gives the facility code that is used when logging messages from
1897 The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
1898 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
1899 The default is USER.
1901 Specifies whether the system should send TCP keepalive messages to the
1903 If they are sent, death of the connection or crash of one
1904 of the machines will be properly noticed.
1905 However, this means that
1906 connections will die if the route is down temporarily, and some people
1911 (to send TCP keepalive messages), and the client will notice
1912 if the network goes down or the remote host dies.
1913 This is important in scripts, and many users want it too.
1915 To disable TCP keepalive messages, the value should be set to
1918 .Cm ServerAliveInterval
1919 for protocol-level keepalives.
1921 Specify a configuration tag name that may be later used by a
1923 directive to select a block of configuration.
1927 device forwarding between the client and the server.
1928 The argument must be
1939 requests the default tunnel mode, which is
1940 .Cm point-to-point .
1944 devices to open on the client
1949 The argument must be
1951 .Ar local_tun Op : Ar remote_tun .
1953 The devices may be specified by numerical ID or the keyword
1955 which uses the next available tunnel device.
1958 is not specified, it defaults to
1962 .It Cm UpdateHostKeys
1965 should accept notifications of additional hostkeys from the server sent
1966 after authentication has completed and add them to
1967 .Cm UserKnownHostsFile .
1968 The argument must be
1973 This option allows learning alternate hostkeys for a server
1974 and supports graceful key rotation by allowing a server to send replacement
1975 public keys before old ones are removed.
1977 Additional hostkeys are only accepted if the key used to authenticate the
1978 host was already trusted or explicitly accepted by the user, the host was
1980 .Cm UserKnownHostsFile
1982 .Cm GlobalKnownHostsFile )
1983 and the host was authenticated using a plain key and not a certificate.
1986 is enabled by default if the user has not overridden the default
1987 .Cm UserKnownHostsFile
1988 setting and has not enabled
1989 .Cm VerifyHostKeyDNS ,
1999 then the user is asked to confirm the modifications to the known_hosts file.
2000 Confirmation is currently incompatible with
2001 .Cm ControlPersist ,
2002 and will be disabled if it is enabled.
2006 from OpenSSH 6.8 and greater support the
2007 .Qq hostkeys@openssh.com
2008 protocol extension used to inform the client of all the server's hostkeys.
2010 Specifies the user to log in as.
2011 This can be useful when a different user name is used on different machines.
2012 This saves the trouble of
2013 having to remember to give the user name on the command line.
2014 .It Cm UserKnownHostsFile
2015 Specifies one or more files to use for the user
2016 host key database, separated by whitespace.
2017 Each filename may use tilde notation to refer to the user's home directory,
2018 the tokens described in the
2020 section and environment variables as described in the
2021 .Sx ENVIRONMENT VARIABLES
2027 to ignore any user-specific known hosts files.
2029 .Pa ~/.ssh/known_hosts ,
2030 .Pa ~/.ssh/known_hosts2 .
2031 .It Cm VerifyHostKeyDNS
2032 Specifies whether to verify the remote key using DNS and SSHFP resource
2034 If this option is set to
2036 the client will implicitly trust keys that match a secure fingerprint
2038 Insecure fingerprints will be handled as if this option was set to
2040 If this option is set to
2042 information on fingerprint match will be displayed, but the user will still
2043 need to confirm new host keys according to the
2044 .Cm StrictHostKeyChecking
2050 .Sx VERIFYING HOST KEYS
2053 .It Cm VisualHostKey
2054 If this flag is set to
2056 an ASCII art representation of the remote host key fingerprint is
2057 printed in addition to the fingerprint string at login and
2058 for unknown host keys.
2059 If this flag is set to
2062 no fingerprint strings are printed at login and
2063 only the fingerprint string will be printed for unknown host keys.
2064 .It Cm XAuthLocation
2065 Specifies the full pathname of the
2069 .Pa /usr/local/bin/xauth .
2074 consists of zero or more non-whitespace characters,
2076 (a wildcard that matches zero or more characters),
2079 (a wildcard that matches exactly one character).
2080 For example, to specify a set of declarations for any host in the
2083 the following pattern could be used:
2087 The following pattern
2088 would match any host in the 192.168.0.[0-9] network range:
2090 .Dl Host 192.168.0.?
2094 is a comma-separated list of patterns.
2095 Patterns within pattern-lists may be negated
2096 by preceding them with an exclamation mark
2099 to allow a key to be used from anywhere within an organization
2103 the following entry (in authorized_keys) could be used:
2105 .Dl from=\&"!*.dialup.example.com,*.example.com\&"
2107 Note that a negated match will never produce a positive result by itself.
2108 For example, attempting to match
2110 against the following pattern-list will fail:
2112 .Dl from=\&"!host1,!host2\&"
2114 The solution here is to include a term that will yield a positive match,
2117 .Dl from=\&"!host1,!host2,*\&"
2119 Arguments to some keywords can make use of tokens,
2120 which are expanded at runtime:
2122 .Bl -tag -width XXXX -offset indent -compact
2129 Local user's home directory.
2131 The fingerprint of the server's host key.
2135 hostname or address that is being searched for.
2137 The remote hostname.
2139 A string describing the reason for a
2140 .Cm KnownHostsCommand
2143 when looking up a host by address (only when
2147 when searching by hostname, or
2149 when preparing the host key algorithm preference list to use for the
2154 The base64 encoded host key.
2156 The host key alias if specified, otherwise the original remote hostname given
2157 on the command line.
2161 The local hostname, including the domain name.
2163 The original remote hostname, as given on the command line.
2167 The remote username.
2173 network interface assigned if
2174 tunnel forwarding was requested, or
2178 The type of the server host key, e.g.
2184 .Cm CertificateFile ,
2188 .Cm KnownHostsCommand ,
2193 .Cm RevokedHostKeys ,
2195 .Cm UserKnownHostsFile
2196 accept the tokens %%, %C, %d, %h, %i, %k, %L, %l, %n, %p, %r, and %u.
2198 .Cm KnownHostsCommand
2199 additionally accepts the tokens %f, %H, %I, %K and %t.
2202 accepts the tokens %% and %h.
2210 accept the tokens %%, %h, %n, %p, and %r.
2212 Note that some of these directives build commands for execution via the shell.
2215 performs no filtering or escaping of characters that have special meaning in
2216 shell commands (e.g. quotes), it is the user's reposibility to ensure that
2217 the arguments passed to
2219 do not contain such characters and that tokens are appropriately quoted
2221 .Sh ENVIRONMENT VARIABLES
2222 Arguments to some keywords can be expanded at runtime from environment
2223 variables on the client by enclosing them in
2227 would refer to the user's .ssh directory.
2228 If a specified environment variable does not exist then an error will be
2229 returned and the setting for that keyword will be ignored.
2232 .Cm CertificateFile ,
2236 .Cm KnownHostsCommand ,
2238 .Cm UserKnownHostsFile
2239 support environment variables.
2244 support environment variables only for Unix domain socket paths.
2247 .It Pa ~/.ssh/config
2248 This is the per-user configuration file.
2249 The format of this file is described above.
2250 This file is used by the SSH client.
2251 Because of the potential for abuse, this file must have strict permissions:
2252 read/write for the user, and not writable by others.
2253 .It Pa /etc/ssh/ssh_config
2254 Systemwide configuration file.
2255 This file provides defaults for those
2256 values that are not specified in the user's configuration file, and
2257 for those users who do not have a configuration file.
2258 This file must be world-readable.
2264 OpenSSH is a derivative of the original and free
2265 ssh 1.2.12 release by
2267 .An Aaron Campbell , Bob Beck , Markus Friedl ,
2268 .An Niels Provos , Theo de Raadt
2271 removed many bugs, re-added newer features and
2274 contributed the support for SSH protocol versions 1.5 and 2.0.
projects / FreeBSD / FreeBSD.git / blob