1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $OpenBSD: sshd_config.5,v 1.44 2005/07/25 11:59:40 markus Exp $ 38.\" $FreeBSD$ 39.Dd September 25, 1999 40.Dt SSHD_CONFIG 5 41.Os 42.Sh NAME 43.Nm sshd_config 44.Nd OpenSSH SSH daemon configuration file 45.Sh SYNOPSIS 46.Bl -tag -width Ds -compact 47.It Pa /etc/ssh/sshd_config 48.El 49.Sh DESCRIPTION 50.Nm sshd 51reads configuration data from 52.Pa /etc/ssh/sshd_config 53(or the file specified with 54.Fl f 55on the command line). 56The file contains keyword-argument pairs, one per line. 57Lines starting with 58.Ql # 59and empty lines are interpreted as comments. 60.Pp 61The possible 62keywords and their meanings are as follows (note that 63keywords are case-insensitive and arguments are case-sensitive): 64.Bl -tag -width Ds 65.It Cm AcceptEnv 66Specifies what environment variables sent by the client will be copied into 67the session's 68.Xr environ 7 . 69See 70.Cm SendEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74Note that environment passing is only supported for protocol 2. 75Variables are specified by name, which may contain the wildcard characters 76.Ql \&* 77and 78.Ql \&? . 79Multiple environment variables may be separated by whitespace or spread 80across multiple 81.Cm AcceptEnv 82directives. 83Be warned that some environment variables could be used to bypass restricted 84user environments. 85For this reason, care should be taken in the use of this directive. 86The default is not to accept any environment variables. 87.It Cm AddressFamily 88Specifies which address family should be used by 89.Nm sshd . 90Valid arguments are 91.Dq any , 92.Dq inet 93(use IPv4 only) or 94.Dq inet6 95(use IPv6 only). 96The default is 97.Dq any . 98.It Cm AllowGroups 99This keyword can be followed by a list of group name patterns, separated 100by spaces. 101If specified, login is allowed only for users whose primary 102group or supplementary group list matches one of the patterns. 103.Ql \&* 104and 105.Ql \&? 106can be used as 107wildcards in the patterns. 108Only group names are valid; a numerical group ID is not recognized. 109By default, login is allowed for all groups. 110.It Cm AllowTcpForwarding 111Specifies whether TCP forwarding is permitted. 112The default is 113.Dq yes . 114Note that disabling TCP forwarding does not improve security unless 115users are also denied shell access, as they can always install their 116own forwarders. 117.It Cm AllowUsers 118This keyword can be followed by a list of user name patterns, separated 119by spaces. 120If specified, login is allowed only for user names that 121match one of the patterns. 122.Ql \&* 123and 124.Ql \&? 125can be used as 126wildcards in the patterns. 127Only user names are valid; a numerical user ID is not recognized. 128By default, login is allowed for all users. 129If the pattern takes the form USER@HOST then USER and HOST 130are separately checked, restricting logins to particular 131users from particular hosts. 132.It Cm AuthorizedKeysFile 133Specifies the file that contains the public keys that can be used 134for user authentication. 135.Cm AuthorizedKeysFile 136may contain tokens of the form %T which are substituted during connection 137set-up. 138The following tokens are defined: %% is replaced by a literal '%', 139%h is replaced by the home directory of the user being authenticated and 140%u is replaced by the username of that user. 141After expansion, 142.Cm AuthorizedKeysFile 143is taken to be an absolute path or one relative to the user's home 144directory. 145The default is 146.Dq .ssh/authorized_keys . 147.It Cm Banner 148In some jurisdictions, sending a warning message before authentication 149may be relevant for getting legal protection. 150The contents of the specified file are sent to the remote user before 151authentication is allowed. 152This option is only available for protocol version 2. 153By default, no banner is displayed. 154.It Cm ChallengeResponseAuthentication 155Specifies whether challenge-response authentication is allowed. 156Specifically, in 157.Fx , 158this controls the use of PAM (see 159.Xr pam 3 ) 160for authentication. 161Note that this affects the effectiveness of the 162.Cm PasswordAuthentication 163and 164.Cm PermitRootLogin 165variables. 166The default is 167.Dq yes . 168.It Cm Ciphers 169Specifies the ciphers allowed for protocol version 2. 170Multiple ciphers must be comma-separated. 171The supported ciphers are 172.Dq 3des-cbc , 173.Dq aes128-cbc , 174.Dq aes192-cbc , 175.Dq aes256-cbc , 176.Dq aes128-ctr , 177.Dq aes192-ctr , 178.Dq aes256-ctr , 179.Dq arcfour128 , 180.Dq arcfour256 , 181.Dq arcfour , 182.Dq blowfish-cbc , 183and 184.Dq cast128-cbc . 185The default is 186.Bd -literal 187 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, 188 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, 189 aes192-ctr,aes256-ctr'' 190.Ed 191.It Cm ClientAliveCountMax 192Sets the number of client alive messages (see above) which may be 193sent without 194.Nm sshd 195receiving any messages back from the client. 196If this threshold is reached while client alive messages are being sent, 197.Nm sshd 198will disconnect the client, terminating the session. 199It is important to note that the use of client alive messages is very 200different from 201.Cm TCPKeepAlive 202(below). 203The client alive messages are sent through the encrypted channel 204and therefore will not be spoofable. 205The TCP keepalive option enabled by 206.Cm TCPKeepAlive 207is spoofable. 208The client alive mechanism is valuable when the client or 209server depend on knowing when a connection has become inactive. 210.Pp 211The default value is 3. 212If 213.Cm ClientAliveInterval 214(above) is set to 15, and 215.Cm ClientAliveCountMax 216is left at the default, unresponsive ssh clients 217will be disconnected after approximately 45 seconds. 218.It Cm ClientAliveInterval 219Sets a timeout interval in seconds after which if no data has been received 220from the client, 221.Nm sshd 222will send a message through the encrypted 223channel to request a response from the client. 224The default 225is 0, indicating that these messages will not be sent to the client. 226This option applies to protocol version 2 only. 227.It Cm Compression 228Specifies whether compression is allowed, or delayed until 229the user has authenticated successfully. 230The argument must be 231.Dq yes , 232.Dq delayed , 233or 234.Dq no . 235The default is 236.Dq delayed . 237.It Cm DenyGroups 238This keyword can be followed by a list of group name patterns, separated 239by spaces. 240Login is disallowed for users whose primary group or supplementary 241group list matches one of the patterns. 242.Ql \&* 243and 244.Ql \&? 245can be used as 246wildcards in the patterns. 247Only group names are valid; a numerical group ID is not recognized. 248By default, login is allowed for all groups. 249.It Cm DenyUsers 250This keyword can be followed by a list of user name patterns, separated 251by spaces. 252Login is disallowed for user names that match one of the patterns. 253.Ql \&* 254and 255.Ql \&? 256can be used as wildcards in the patterns. 257Only user names are valid; a numerical user ID is not recognized. 258By default, login is allowed for all users. 259If the pattern takes the form USER@HOST then USER and HOST 260are separately checked, restricting logins to particular 261users from particular hosts. 262.It Cm GatewayPorts 263Specifies whether remote hosts are allowed to connect to ports 264forwarded for the client. 265By default, 266.Nm sshd 267binds remote port forwardings to the loopback address. 268This prevents other remote hosts from connecting to forwarded ports. 269.Cm GatewayPorts 270can be used to specify that 271.Nm sshd 272should allow remote port forwardings to bind to non-loopback addresses, thus 273allowing other hosts to connect. 274The argument may be 275.Dq no 276to force remote port forwardings to be available to the local host only, 277.Dq yes 278to force remote port forwardings to bind to the wildcard address, or 279.Dq clientspecified 280to allow the client to select the address to which the forwarding is bound. 281The default is 282.Dq no . 283.It Cm GSSAPIAuthentication 284Specifies whether user authentication based on GSSAPI is allowed. 285The default is 286.Dq no . 287Note that this option applies to protocol version 2 only. 288.It Cm GSSAPICleanupCredentials 289Specifies whether to automatically destroy the user's credentials cache 290on logout. 291The default is 292.Dq yes . 293Note that this option applies to protocol version 2 only. 294.It Cm HostbasedAuthentication 295Specifies whether rhosts or /etc/hosts.equiv authentication together 296with successful public key client host authentication is allowed 297(hostbased authentication). 298This option is similar to 299.Cm RhostsRSAAuthentication 300and applies to protocol version 2 only. 301The default is 302.Dq no . 303.It Cm HostKey 304Specifies a file containing a private host key 305used by SSH. 306The default is 307.Pa /etc/ssh/ssh_host_key 308for protocol version 1, and 309.Pa /etc/ssh/ssh_host_dsa_key 310for protocol version 2. 311Note that 312.Nm sshd 313will refuse to use a file if it is group/world-accessible. 314It is possible to have multiple host key files. 315.Dq rsa1 316keys are used for version 1 and 317.Dq dsa 318or 319.Dq rsa 320are used for version 2 of the SSH protocol. 321.It Cm IgnoreRhosts 322Specifies that 323.Pa .rhosts 324and 325.Pa .shosts 326files will not be used in 327.Cm RhostsRSAAuthentication 328or 329.Cm HostbasedAuthentication . 330.Pp 331.Pa /etc/hosts.equiv 332and 333.Pa /etc/ssh/shosts.equiv 334are still used. 335The default is 336.Dq yes . 337.It Cm IgnoreUserKnownHosts 338Specifies whether 339.Nm sshd 340should ignore the user's 341.Pa ~/.ssh/known_hosts 342during 343.Cm RhostsRSAAuthentication 344or 345.Cm HostbasedAuthentication . 346The default is 347.Dq no . 348.It Cm KerberosAuthentication 349Specifies whether the password provided by the user for 350.Cm PasswordAuthentication 351will be validated through the Kerberos KDC. 352To use this option, the server needs a 353Kerberos servtab which allows the verification of the KDC's identity. 354Default is 355.Dq no . 356.It Cm KerberosGetAFSToken 357If AFS is active and the user has a Kerberos 5 TGT, attempt to aquire 358an AFS token before accessing the user's home directory. 359Default is 360.Dq no . 361.It Cm KerberosOrLocalPasswd 362If set then if password authentication through Kerberos fails then 363the password will be validated via any additional local mechanism 364such as 365.Pa /etc/passwd . 366Default is 367.Dq yes . 368.It Cm KerberosTicketCleanup 369Specifies whether to automatically destroy the user's ticket cache 370file on logout. 371Default is 372.Dq yes . 373.It Cm KeyRegenerationInterval 374In protocol version 1, the ephemeral server key is automatically regenerated 375after this many seconds (if it has been used). 376The purpose of regeneration is to prevent 377decrypting captured sessions by later breaking into the machine and 378stealing the keys. 379The key is never stored anywhere. 380If the value is 0, the key is never regenerated. 381The default is 3600 (seconds). 382.It Cm ListenAddress 383Specifies the local addresses 384.Nm sshd 385should listen on. 386The following forms may be used: 387.Pp 388.Bl -item -offset indent -compact 389.It 390.Cm ListenAddress 391.Sm off 392.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 393.Sm on 394.It 395.Cm ListenAddress 396.Sm off 397.Ar host No | Ar IPv4_addr No : Ar port 398.Sm on 399.It 400.Cm ListenAddress 401.Sm off 402.Oo 403.Ar host No | Ar IPv6_addr Oc : Ar port 404.Sm on 405.El 406.Pp 407If 408.Ar port 409is not specified, 410.Nm sshd 411will listen on the address and all prior 412.Cm Port 413options specified. 414The default is to listen on all local addresses. 415Multiple 416.Cm ListenAddress 417options are permitted. 418Additionally, any 419.Cm Port 420options must precede this option for non port qualified addresses. 421.It Cm LoginGraceTime 422The server disconnects after this time if the user has not 423successfully logged in. 424If the value is 0, there is no time limit. 425The default is 120 seconds. 426.It Cm LogLevel 427Gives the verbosity level that is used when logging messages from 428.Nm sshd . 429The possible values are: 430QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. 431The default is INFO. 432DEBUG and DEBUG1 are equivalent. 433DEBUG2 and DEBUG3 each specify higher levels of debugging output. 434Logging with a DEBUG level violates the privacy of users and is not recommended. 435.It Cm MACs 436Specifies the available MAC (message authentication code) algorithms. 437The MAC algorithm is used in protocol version 2 438for data integrity protection. 439Multiple algorithms must be comma-separated. 440The default is 441.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . 442.It Cm MaxAuthTries 443Specifies the maximum number of authentication attempts permitted per 444connection. 445Once the number of failures reaches half this value, 446additional failures are logged. 447The default is 6. 448.It Cm MaxStartups 449Specifies the maximum number of concurrent unauthenticated connections to the 450.Nm sshd 451daemon. 452Additional connections will be dropped until authentication succeeds or the 453.Cm LoginGraceTime 454expires for a connection. 455The default is 10. 456.Pp 457Alternatively, random early drop can be enabled by specifying 458the three colon separated values 459.Dq start:rate:full 460(e.g., "10:30:60"). 461.Nm sshd 462will refuse connection attempts with a probability of 463.Dq rate/100 464(30%) 465if there are currently 466.Dq start 467(10) 468unauthenticated connections. 469The probability increases linearly and all connection attempts 470are refused if the number of unauthenticated connections reaches 471.Dq full 472(60). 473.It Cm PasswordAuthentication 474Specifies whether password authentication is allowed. 475The default is 476.Dq no , 477unless 478.Nm sshd 479was built without PAM support, in which case the default is 480.Dq yes . 481Note that if 482.Cm ChallengeResponseAuthentication 483is 484.Dq yes , 485and the PAM authentication policy for 486.Nm sshd 487includes 488.Xr pam_unix 8 , 489password authentication will be allowed through the challenge-response 490mechanism regardless of the value of 491.Cm PasswordAuthentication . 492.It Cm PermitEmptyPasswords 493When password authentication is allowed, it specifies whether the 494server allows login to accounts with empty password strings. 495The default is 496.Dq no . 497.It Cm PermitRootLogin 498Specifies whether root can log in using 499.Xr ssh 1 . 500The argument must be 501.Dq yes , 502.Dq without-password , 503.Dq forced-commands-only 504or 505.Dq no . 506The default is 507.Dq no . 508Note that if 509.Cm ChallengeResponseAuthentication 510is 511.Dq yes , 512the root user may be allowed in with its password even if 513.Cm PermitRootLogin is set to 514.Dq without-password . 515.Pp 516If this option is set to 517.Dq without-password 518password authentication is disabled for root. 519.Pp 520If this option is set to 521.Dq forced-commands-only 522root login with public key authentication will be allowed, 523but only if the 524.Ar command 525option has been specified 526(which may be useful for taking remote backups even if root login is 527normally not allowed). 528All other authentication methods are disabled for root. 529.Pp 530If this option is set to 531.Dq no 532root is not allowed to log in. 533.It Cm PermitUserEnvironment 534Specifies whether 535.Pa ~/.ssh/environment 536and 537.Cm environment= 538options in 539.Pa ~/.ssh/authorized_keys 540are processed by 541.Nm sshd . 542The default is 543.Dq no . 544Enabling environment processing may enable users to bypass access 545restrictions in some configurations using mechanisms such as 546.Ev LD_PRELOAD . 547.It Cm PidFile 548Specifies the file that contains the process ID of the 549.Nm sshd 550daemon. 551The default is 552.Pa /var/run/sshd.pid . 553.It Cm Port 554Specifies the port number that 555.Nm sshd 556listens on. 557The default is 22. 558Multiple options of this type are permitted. 559See also 560.Cm ListenAddress . 561.It Cm PrintLastLog 562Specifies whether 563.Nm sshd 564should print the date and time of the last user login when a user logs 565in interactively. 566The default is 567.Dq yes . 568.It Cm PrintMotd 569Specifies whether 570.Nm sshd 571should print 572.Pa /etc/motd 573when a user logs in interactively. 574(On some systems it is also printed by the shell, 575.Pa /etc/profile , 576or equivalent.) 577The default is 578.Dq yes . 579.It Cm Protocol 580Specifies the protocol versions 581.Nm sshd 582supports. 583The possible values are 584.Dq 1 585and 586.Dq 2 . 587Multiple versions must be comma-separated. 588The default is 589.Dq 2 . 590Note that the order of the protocol list does not indicate preference, 591because the client selects among multiple protocol versions offered 592by the server. 593Specifying 594.Dq 2,1 595is identical to 596.Dq 1,2 . 597.It Cm PubkeyAuthentication 598Specifies whether public key authentication is allowed. 599The default is 600.Dq yes . 601Note that this option applies to protocol version 2 only. 602.It Cm RhostsRSAAuthentication 603Specifies whether rhosts or 604.Pa /etc/hosts.equiv 605authentication together 606with successful RSA host authentication is allowed. 607The default is 608.Dq no . 609This option applies to protocol version 1 only. 610.It Cm RSAAuthentication 611Specifies whether pure RSA authentication is allowed. 612The default is 613.Dq yes . 614This option applies to protocol version 1 only. 615.It Cm ServerKeyBits 616Defines the number of bits in the ephemeral protocol version 1 server key. 617The minimum value is 512, and the default is 768. 618.It Cm StrictModes 619Specifies whether 620.Nm sshd 621should check file modes and ownership of the 622user's files and home directory before accepting login. 623This is normally desirable because novices sometimes accidentally leave their 624directory or files world-writable. 625The default is 626.Dq yes . 627.It Cm Subsystem 628Configures an external subsystem (e.g., file transfer daemon). 629Arguments should be a subsystem name and a command to execute upon subsystem 630request. 631The command 632.Xr sftp-server 8 633implements the 634.Dq sftp 635file transfer subsystem. 636By default no subsystems are defined. 637Note that this option applies to protocol version 2 only. 638.It Cm SyslogFacility 639Gives the facility code that is used when logging messages from 640.Nm sshd . 641The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 642LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 643The default is AUTH. 644.It Cm TCPKeepAlive 645Specifies whether the system should send TCP keepalive messages to the 646other side. 647If they are sent, death of the connection or crash of one 648of the machines will be properly noticed. 649However, this means that 650connections will die if the route is down temporarily, and some people 651find it annoying. 652On the other hand, if TCP keepalives are not sent, 653sessions may hang indefinitely on the server, leaving 654.Dq ghost 655users and consuming server resources. 656.Pp 657The default is 658.Dq yes 659(to send TCP keepalive messages), and the server will notice 660if the network goes down or the client host crashes. 661This avoids infinitely hanging sessions. 662.Pp 663To disable TCP keepalive messages, the value should be set to 664.Dq no . 665.It Cm UseDNS 666Specifies whether 667.Nm sshd 668should look up the remote host name and check that 669the resolved host name for the remote IP address maps back to the 670very same IP address. 671The default is 672.Dq yes . 673.It Cm UseLogin 674Specifies whether 675.Xr login 1 676is used for interactive login sessions. 677The default is 678.Dq no . 679Note that 680.Xr login 1 681is never used for remote command execution. 682Note also, that if this is enabled, 683.Cm X11Forwarding 684will be disabled because 685.Xr login 1 686does not know how to handle 687.Xr xauth 1 688cookies. 689If 690.Cm UsePrivilegeSeparation 691is specified, it will be disabled after authentication. 692.It Cm UsePAM 693Enables the Pluggable Authentication Module interface. 694If set to 695.Dq yes 696this will enable PAM authentication using 697.Cm ChallengeResponseAuthentication 698and PAM account and session module processing for all authentication types. 699.Pp 700Because PAM challenge-response authentication usually serves an equivalent 701role to password authentication, you should disable either 702.Cm PasswordAuthentication 703or 704.Cm ChallengeResponseAuthentication. 705.Pp 706If 707.Cm UsePAM 708is enabled, you will not be able to run 709.Xr sshd 8 710as a non-root user. 711The default is 712.Dq yes . 713.It Cm UsePrivilegeSeparation 714Specifies whether 715.Nm sshd 716separates privileges by creating an unprivileged child process 717to deal with incoming network traffic. 718After successful authentication, another process will be created that has 719the privilege of the authenticated user. 720The goal of privilege separation is to prevent privilege 721escalation by containing any corruption within the unprivileged processes. 722The default is 723.Dq yes . 724.It Cm VersionAddendum 725Specifies a string to append to the regular version string to identify 726OS- or site-specific modifications. 727The default is 728.Dq FreeBSD-20050903 . 729.It Cm X11DisplayOffset 730Specifies the first display number available for 731.Nm sshd Ns 's 732X11 forwarding. 733This prevents 734.Nm sshd 735from interfering with real X11 servers. 736The default is 10. 737.It Cm X11Forwarding 738Specifies whether X11 forwarding is permitted. 739The argument must be 740.Dq yes 741or 742.Dq no . 743The default is 744.Dq yes . 745.Pp 746When X11 forwarding is enabled, there may be additional exposure to 747the server and to client displays if the 748.Nm sshd 749proxy display is configured to listen on the wildcard address (see 750.Cm X11UseLocalhost 751below), however this is not the default. 752Additionally, the authentication spoofing and authentication data 753verification and substitution occur on the client side. 754The security risk of using X11 forwarding is that the client's X11 755display server may be exposed to attack when the ssh client requests 756forwarding (see the warnings for 757.Cm ForwardX11 758in 759.Xr ssh_config 5 ) . 760A system administrator may have a stance in which they want to 761protect clients that may expose themselves to attack by unwittingly 762requesting X11 forwarding, which can warrant a 763.Dq no 764setting. 765.Pp 766Note that disabling X11 forwarding does not prevent users from 767forwarding X11 traffic, as users can always install their own forwarders. 768X11 forwarding is automatically disabled if 769.Cm UseLogin 770is enabled. 771.It Cm X11UseLocalhost 772Specifies whether 773.Nm sshd 774should bind the X11 forwarding server to the loopback address or to 775the wildcard address. 776By default, 777.Nm sshd 778binds the forwarding server to the loopback address and sets the 779hostname part of the 780.Ev DISPLAY 781environment variable to 782.Dq localhost . 783This prevents remote hosts from connecting to the proxy display. 784However, some older X11 clients may not function with this 785configuration. 786.Cm X11UseLocalhost 787may be set to 788.Dq no 789to specify that the forwarding server should be bound to the wildcard 790address. 791The argument must be 792.Dq yes 793or 794.Dq no . 795The default is 796.Dq yes . 797.It Cm XAuthLocation 798Specifies the full pathname of the 799.Xr xauth 1 800program. 801The default is 802.Pa /usr/X11R6/bin/xauth . 803.El 804.Ss Time Formats 805.Nm sshd 806command-line arguments and configuration file options that specify time 807may be expressed using a sequence of the form: 808.Sm off 809.Ar time Op Ar qualifier , 810.Sm on 811where 812.Ar time 813is a positive integer value and 814.Ar qualifier 815is one of the following: 816.Pp 817.Bl -tag -width Ds -compact -offset indent 818.It Cm <none> 819seconds 820.It Cm s | Cm S 821seconds 822.It Cm m | Cm M 823minutes 824.It Cm h | Cm H 825hours 826.It Cm d | Cm D 827days 828.It Cm w | Cm W 829weeks 830.El 831.Pp 832Each member of the sequence is added together to calculate 833the total time value. 834.Pp 835Time format examples: 836.Pp 837.Bl -tag -width Ds -compact -offset indent 838.It 600 839600 seconds (10 minutes) 840.It 10m 84110 minutes 842.It 1h30m 8431 hour 30 minutes (90 minutes) 844.El 845.Sh FILES 846.Bl -tag -width Ds 847.It Pa /etc/ssh/sshd_config 848Contains configuration data for 849.Nm sshd . 850This file should be writable by root only, but it is recommended 851(though not necessary) that it be world-readable. 852.El 853.Sh SEE ALSO 854.Xr sshd 8 855.Sh AUTHORS 856OpenSSH is a derivative of the original and free 857ssh 1.2.12 release by Tatu Ylonen. 858Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 859Theo de Raadt and Dug Song 860removed many bugs, re-added newer features and 861created OpenSSH. 862Markus Friedl contributed the support for SSH 863protocol versions 1.5 and 2.0. 864Niels Provos and Markus Friedl contributed support 865for privilege separation. 866