1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $OpenBSD: sshd_config.5,v 1.35 2004/06/26 09:14:40 jmc Exp $ 38.\" $FreeBSD$ 39.Dd September 25, 1999 40.Dt SSHD_CONFIG 5 41.Os 42.Sh NAME 43.Nm sshd_config 44.Nd OpenSSH SSH daemon configuration file 45.Sh SYNOPSIS 46.Bl -tag -width Ds -compact 47.It Pa /etc/ssh/sshd_config 48.El 49.Sh DESCRIPTION 50.Nm sshd 51reads configuration data from 52.Pa /etc/ssh/sshd_config 53(or the file specified with 54.Fl f 55on the command line). 56The file contains keyword-argument pairs, one per line. 57Lines starting with 58.Ql # 59and empty lines are interpreted as comments. 60.Pp 61The possible 62keywords and their meanings are as follows (note that 63keywords are case-insensitive and arguments are case-sensitive): 64.Bl -tag -width Ds 65.It Cm AcceptEnv 66Specifies what environment variables sent by the client will be copied into 67the session's 68.Xr environ 7 . 69See 70.Cm SendEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74Note that environment passing is only supported for protocol 2. 75Variables are specified by name, which may contain the wildcard characters 76.Ql \&* 77and 78.Ql \&? . 79Multiple environment variables may be separated by whitespace or spread 80across multiple 81.Cm AcceptEnv 82directives. 83Be warned that some environment variables could be used to bypass restricted 84user environments. 85For this reason, care should be taken in the use of this directive. 86The default is not to accept any environment variables. 87.It Cm AllowGroups 88This keyword can be followed by a list of group name patterns, separated 89by spaces. 90If specified, login is allowed only for users whose primary 91group or supplementary group list matches one of the patterns. 92.Ql \&* 93and 94.Ql \&? 95can be used as 96wildcards in the patterns. 97Only group names are valid; a numerical group ID is not recognized. 98By default, login is allowed for all groups. 99.It Cm AllowTcpForwarding 100Specifies whether TCP forwarding is permitted. 101The default is 102.Dq yes . 103Note that disabling TCP forwarding does not improve security unless 104users are also denied shell access, as they can always install their 105own forwarders. 106.It Cm AllowUsers 107This keyword can be followed by a list of user name patterns, separated 108by spaces. 109If specified, login is allowed only for user names that 110match one of the patterns. 111.Ql \&* 112and 113.Ql \&? 114can be used as 115wildcards in the patterns. 116Only user names are valid; a numerical user ID is not recognized. 117By default, login is allowed for all users. 118If the pattern takes the form USER@HOST then USER and HOST 119are separately checked, restricting logins to particular 120users from particular hosts. 121.It Cm AuthorizedKeysFile 122Specifies the file that contains the public keys that can be used 123for user authentication. 124.Cm AuthorizedKeysFile 125may contain tokens of the form %T which are substituted during connection 126set-up. 127The following tokens are defined: %% is replaced by a literal '%', 128%h is replaced by the home directory of the user being authenticated and 129%u is replaced by the username of that user. 130After expansion, 131.Cm AuthorizedKeysFile 132is taken to be an absolute path or one relative to the user's home 133directory. 134The default is 135.Dq .ssh/authorized_keys . 136.It Cm Banner 137In some jurisdictions, sending a warning message before authentication 138may be relevant for getting legal protection. 139The contents of the specified file are sent to the remote user before 140authentication is allowed. 141This option is only available for protocol version 2. 142By default, no banner is displayed. 143.It Cm ChallengeResponseAuthentication 144Specifies whether challenge-response authentication is allowed. 145Specifically, in 146.Fx , 147this controls the use of PAM (see 148.Xr pam 3 ) 149for authentication. 150Note that this affects the effectiveness of the 151.Cm PasswordAuthentication 152and 153.Cm PermitRootLogin 154variables. 155The default is 156.Dq yes . 157.It Cm Ciphers 158Specifies the ciphers allowed for protocol version 2. 159Multiple ciphers must be comma-separated. 160The supported ciphers are 161.Dq 3des-cbc , 162.Dq aes128-cbc , 163.Dq aes192-cbc , 164.Dq aes256-cbc , 165.Dq aes128-ctr , 166.Dq aes192-ctr , 167.Dq aes256-ctr , 168.Dq arcfour , 169.Dq blowfish-cbc , 170and 171.Dq cast128-cbc . 172The default is 173.Bd -literal 174 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour, 175 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr'' 176.Ed 177.It Cm ClientAliveInterval 178Sets a timeout interval in seconds after which if no data has been received 179from the client, 180.Nm sshd 181will send a message through the encrypted 182channel to request a response from the client. 183The default 184is 0, indicating that these messages will not be sent to the client. 185This option applies to protocol version 2 only. 186.It Cm ClientAliveCountMax 187Sets the number of client alive messages (see above) which may be 188sent without 189.Nm sshd 190receiving any messages back from the client. 191If this threshold is reached while client alive messages are being sent, 192.Nm sshd 193will disconnect the client, terminating the session. 194It is important to note that the use of client alive messages is very 195different from 196.Cm TCPKeepAlive 197(below). 198The client alive messages are sent through the encrypted channel 199and therefore will not be spoofable. 200The TCP keepalive option enabled by 201.Cm TCPKeepAlive 202is spoofable. 203The client alive mechanism is valuable when the client or 204server depend on knowing when a connection has become inactive. 205.Pp 206The default value is 3. 207If 208.Cm ClientAliveInterval 209(above) is set to 15, and 210.Cm ClientAliveCountMax 211is left at the default, unresponsive ssh clients 212will be disconnected after approximately 45 seconds. 213.It Cm Compression 214Specifies whether compression is allowed. 215The argument must be 216.Dq yes 217or 218.Dq no . 219The default is 220.Dq yes . 221.It Cm DenyGroups 222This keyword can be followed by a list of group name patterns, separated 223by spaces. 224Login is disallowed for users whose primary group or supplementary 225group list matches one of the patterns. 226.Ql \&* 227and 228.Ql \&? 229can be used as 230wildcards in the patterns. 231Only group names are valid; a numerical group ID is not recognized. 232By default, login is allowed for all groups. 233.It Cm DenyUsers 234This keyword can be followed by a list of user name patterns, separated 235by spaces. 236Login is disallowed for user names that match one of the patterns. 237.Ql \&* 238and 239.Ql \&? 240can be used as wildcards in the patterns. 241Only user names are valid; a numerical user ID is not recognized. 242By default, login is allowed for all users. 243If the pattern takes the form USER@HOST then USER and HOST 244are separately checked, restricting logins to particular 245users from particular hosts. 246.It Cm GatewayPorts 247Specifies whether remote hosts are allowed to connect to ports 248forwarded for the client. 249By default, 250.Nm sshd 251binds remote port forwardings to the loopback address. 252This prevents other remote hosts from connecting to forwarded ports. 253.Cm GatewayPorts 254can be used to specify that 255.Nm sshd 256should bind remote port forwardings to the wildcard address, 257thus allowing remote hosts to connect to forwarded ports. 258The argument must be 259.Dq yes 260or 261.Dq no . 262The default is 263.Dq no . 264.It Cm GSSAPIAuthentication 265Specifies whether user authentication based on GSSAPI is allowed. 266The default is 267.Dq no . 268Note that this option applies to protocol version 2 only. 269.It Cm GSSAPICleanupCredentials 270Specifies whether to automatically destroy the user's credentials cache 271on logout. 272The default is 273.Dq yes . 274Note that this option applies to protocol version 2 only. 275.It Cm HostbasedAuthentication 276Specifies whether rhosts or /etc/hosts.equiv authentication together 277with successful public key client host authentication is allowed 278(hostbased authentication). 279This option is similar to 280.Cm RhostsRSAAuthentication 281and applies to protocol version 2 only. 282The default is 283.Dq no . 284.It Cm HostKey 285Specifies a file containing a private host key 286used by SSH. 287The default is 288.Pa /etc/ssh/ssh_host_key 289for protocol version 1, and 290.Pa /etc/ssh/ssh_host_dsa_key 291for protocol version 2. 292Note that 293.Nm sshd 294will refuse to use a file if it is group/world-accessible. 295It is possible to have multiple host key files. 296.Dq rsa1 297keys are used for version 1 and 298.Dq dsa 299or 300.Dq rsa 301are used for version 2 of the SSH protocol. 302.It Cm IgnoreRhosts 303Specifies that 304.Pa .rhosts 305and 306.Pa .shosts 307files will not be used in 308.Cm RhostsRSAAuthentication 309or 310.Cm HostbasedAuthentication . 311.Pp 312.Pa /etc/hosts.equiv 313and 314.Pa /etc/ssh/shosts.equiv 315are still used. 316The default is 317.Dq yes . 318.It Cm IgnoreUserKnownHosts 319Specifies whether 320.Nm sshd 321should ignore the user's 322.Pa $HOME/.ssh/known_hosts 323during 324.Cm RhostsRSAAuthentication 325or 326.Cm HostbasedAuthentication . 327The default is 328.Dq no . 329.It Cm KerberosAuthentication 330Specifies whether the password provided by the user for 331.Cm PasswordAuthentication 332will be validated through the Kerberos KDC. 333To use this option, the server needs a 334Kerberos servtab which allows the verification of the KDC's identity. 335Default is 336.Dq no . 337.It Cm KerberosGetAFSToken 338If AFS is active and the user has a Kerberos 5 TGT, attempt to aquire 339an AFS token before accessing the user's home directory. 340Default is 341.Dq no . 342.It Cm KerberosOrLocalPasswd 343If set then if password authentication through Kerberos fails then 344the password will be validated via any additional local mechanism 345such as 346.Pa /etc/passwd . 347Default is 348.Dq yes . 349.It Cm KerberosTicketCleanup 350Specifies whether to automatically destroy the user's ticket cache 351file on logout. 352Default is 353.Dq yes . 354.It Cm KeyRegenerationInterval 355In protocol version 1, the ephemeral server key is automatically regenerated 356after this many seconds (if it has been used). 357The purpose of regeneration is to prevent 358decrypting captured sessions by later breaking into the machine and 359stealing the keys. 360The key is never stored anywhere. 361If the value is 0, the key is never regenerated. 362The default is 3600 (seconds). 363.It Cm ListenAddress 364Specifies the local addresses 365.Nm sshd 366should listen on. 367The following forms may be used: 368.Pp 369.Bl -item -offset indent -compact 370.It 371.Cm ListenAddress 372.Sm off 373.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 374.Sm on 375.It 376.Cm ListenAddress 377.Sm off 378.Ar host No | Ar IPv4_addr No : Ar port 379.Sm on 380.It 381.Cm ListenAddress 382.Sm off 383.Oo 384.Ar host No | Ar IPv6_addr Oc : Ar port 385.Sm on 386.El 387.Pp 388If 389.Ar port 390is not specified, 391.Nm sshd 392will listen on the address and all prior 393.Cm Port 394options specified. 395The default is to listen on all local addresses. 396Multiple 397.Cm ListenAddress 398options are permitted. 399Additionally, any 400.Cm Port 401options must precede this option for non port qualified addresses. 402.It Cm LoginGraceTime 403The server disconnects after this time if the user has not 404successfully logged in. 405If the value is 0, there is no time limit. 406The default is 120 seconds. 407.It Cm LogLevel 408Gives the verbosity level that is used when logging messages from 409.Nm sshd . 410The possible values are: 411QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. 412The default is INFO. 413DEBUG and DEBUG1 are equivalent. 414DEBUG2 and DEBUG3 each specify higher levels of debugging output. 415Logging with a DEBUG level violates the privacy of users and is not recommended. 416.It Cm MACs 417Specifies the available MAC (message authentication code) algorithms. 418The MAC algorithm is used in protocol version 2 419for data integrity protection. 420Multiple algorithms must be comma-separated. 421The default is 422.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . 423.It Cm MaxAuthTries 424Specifies the maximum number of authentication attempts permitted per 425connection. 426Once the number of failures reaches half this value, 427additional failures are logged. 428The default is 6. 429.It Cm MaxStartups 430Specifies the maximum number of concurrent unauthenticated connections to the 431.Nm sshd 432daemon. 433Additional connections will be dropped until authentication succeeds or the 434.Cm LoginGraceTime 435expires for a connection. 436The default is 10. 437.Pp 438Alternatively, random early drop can be enabled by specifying 439the three colon separated values 440.Dq start:rate:full 441(e.g., "10:30:60"). 442.Nm sshd 443will refuse connection attempts with a probability of 444.Dq rate/100 445(30%) 446if there are currently 447.Dq start 448(10) 449unauthenticated connections. 450The probability increases linearly and all connection attempts 451are refused if the number of unauthenticated connections reaches 452.Dq full 453(60). 454.It Cm PasswordAuthentication 455Specifies whether password authentication is allowed. 456The default is 457.Dq no , 458unless 459.Nm sshd 460was built without PAM support, in which case the default is 461.Dq yes . 462Note that if 463.Cm ChallengeResponseAuthentication 464is 465.Dq yes , 466and the PAM authentication policy for 467.Nm sshd 468includes 469.Xr pam_unix 8 , 470password authentication will be allowed through the challenge-response 471mechanism regardless of the value of 472.Cm PasswordAuthentication . 473.It Cm PermitEmptyPasswords 474When password authentication is allowed, it specifies whether the 475server allows login to accounts with empty password strings. 476The default is 477.Dq no . 478.It Cm PermitRootLogin 479Specifies whether root can login using 480.Xr ssh 1 . 481The argument must be 482.Dq yes , 483.Dq without-password , 484.Dq forced-commands-only 485or 486.Dq no . 487The default is 488.Dq no . 489Note that if 490.Cm ChallengeResponseAuthentication 491is 492.Dq yes , 493the root user may be allowed in with its password even if 494.Cm PermitRootLogin is set to 495.Dq without-password . 496.Pp 497If this option is set to 498.Dq without-password 499password authentication is disabled for root. Note that other authentication 500methods (e.g., keyboard-interactive/PAM) may still allow root to login using 501a password. 502.Pp 503If this option is set to 504.Dq forced-commands-only 505root login with public key authentication will be allowed, 506but only if the 507.Ar command 508option has been specified 509(which may be useful for taking remote backups even if root login is 510normally not allowed). 511All other authentication methods are disabled for root. 512.Pp 513If this option is set to 514.Dq no 515root is not allowed to login. 516.It Cm PermitUserEnvironment 517Specifies whether 518.Pa ~/.ssh/environment 519and 520.Cm environment= 521options in 522.Pa ~/.ssh/authorized_keys 523are processed by 524.Nm sshd . 525The default is 526.Dq no . 527Enabling environment processing may enable users to bypass access 528restrictions in some configurations using mechanisms such as 529.Ev LD_PRELOAD . 530.It Cm PidFile 531Specifies the file that contains the process ID of the 532.Nm sshd 533daemon. 534The default is 535.Pa /var/run/sshd.pid . 536.It Cm Port 537Specifies the port number that 538.Nm sshd 539listens on. 540The default is 22. 541Multiple options of this type are permitted. 542See also 543.Cm ListenAddress . 544.It Cm PrintLastLog 545Specifies whether 546.Nm sshd 547should print the date and time when the user last logged in. 548The default is 549.Dq yes . 550.It Cm PrintMotd 551Specifies whether 552.Nm sshd 553should print 554.Pa /etc/motd 555when a user logs in interactively. 556(On some systems it is also printed by the shell, 557.Pa /etc/profile , 558or equivalent.) 559The default is 560.Dq yes . 561.It Cm Protocol 562Specifies the protocol versions 563.Nm sshd 564supports. 565The possible values are 566.Dq 1 567and 568.Dq 2 . 569Multiple versions must be comma-separated. 570The default is 571.Dq 2 . 572Note that the order of the protocol list does not indicate preference, 573because the client selects among multiple protocol versions offered 574by the server. 575Specifying 576.Dq 2,1 577is identical to 578.Dq 1,2 . 579.It Cm PubkeyAuthentication 580Specifies whether public key authentication is allowed. 581The default is 582.Dq yes . 583Note that this option applies to protocol version 2 only. 584.It Cm RhostsRSAAuthentication 585Specifies whether rhosts or 586.Pa /etc/hosts.equiv 587authentication together 588with successful RSA host authentication is allowed. 589The default is 590.Dq no . 591This option applies to protocol version 1 only. 592.It Cm RSAAuthentication 593Specifies whether pure RSA authentication is allowed. 594The default is 595.Dq yes . 596This option applies to protocol version 1 only. 597.It Cm ServerKeyBits 598Defines the number of bits in the ephemeral protocol version 1 server key. 599The minimum value is 512, and the default is 768. 600.It Cm StrictModes 601Specifies whether 602.Nm sshd 603should check file modes and ownership of the 604user's files and home directory before accepting login. 605This is normally desirable because novices sometimes accidentally leave their 606directory or files world-writable. 607The default is 608.Dq yes . 609.It Cm Subsystem 610Configures an external subsystem (e.g., file transfer daemon). 611Arguments should be a subsystem name and a command to execute upon subsystem 612request. 613The command 614.Xr sftp-server 8 615implements the 616.Dq sftp 617file transfer subsystem. 618By default no subsystems are defined. 619Note that this option applies to protocol version 2 only. 620.It Cm SyslogFacility 621Gives the facility code that is used when logging messages from 622.Nm sshd . 623The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 624LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 625The default is AUTH. 626.It Cm TCPKeepAlive 627Specifies whether the system should send TCP keepalive messages to the 628other side. 629If they are sent, death of the connection or crash of one 630of the machines will be properly noticed. 631However, this means that 632connections will die if the route is down temporarily, and some people 633find it annoying. 634On the other hand, if TCP keepalives are not sent, 635sessions may hang indefinitely on the server, leaving 636.Dq ghost 637users and consuming server resources. 638.Pp 639The default is 640.Dq yes 641(to send TCP keepalive messages), and the server will notice 642if the network goes down or the client host crashes. 643This avoids infinitely hanging sessions. 644.Pp 645To disable TCP keepalive messages, the value should be set to 646.Dq no . 647.It Cm UseDNS 648Specifies whether 649.Nm sshd 650should lookup the remote host name and check that 651the resolved host name for the remote IP address maps back to the 652very same IP address. 653The default is 654.Dq yes . 655.It Cm UseLogin 656Specifies whether 657.Xr login 1 658is used for interactive login sessions. 659The default is 660.Dq no . 661Note that 662.Xr login 1 663is never used for remote command execution. 664Note also, that if this is enabled, 665.Cm X11Forwarding 666will be disabled because 667.Xr login 1 668does not know how to handle 669.Xr xauth 1 670cookies. 671If 672.Cm UsePrivilegeSeparation 673is specified, it will be disabled after authentication. 674.It Cm UsePAM 675Enables the Pluggable Authentication Module interface. 676If set to 677.Dq yes 678this will enable PAM authentication using 679.Cm ChallengeResponseAuthentication 680and PAM account and session module processing for all authentication types. 681.Pp 682Because PAM challenge-response authentication usually serves an equivalent 683role to password authentication, you should disable either 684.Cm PasswordAuthentication 685or 686.Cm ChallengeResponseAuthentication. 687.Pp 688If 689.Cm UsePAM 690is enabled, you will not be able to run 691.Xr sshd 8 692as a non-root user. 693The default is 694.Dq yes . 695.It Cm UsePrivilegeSeparation 696Specifies whether 697.Nm sshd 698separates privileges by creating an unprivileged child process 699to deal with incoming network traffic. 700After successful authentication, another process will be created that has 701the privilege of the authenticated user. 702The goal of privilege separation is to prevent privilege 703escalation by containing any corruption within the unprivileged processes. 704The default is 705.Dq yes . 706.It Cm VersionAddendum 707Specifies a string to append to the regular version string to identify 708OS- or site-specific modifications. 709The default is 710.Dq FreeBSD-20041028 . 711.It Cm X11DisplayOffset 712Specifies the first display number available for 713.Nm sshd Ns 's 714X11 forwarding. 715This prevents 716.Nm sshd 717from interfering with real X11 servers. 718The default is 10. 719.It Cm X11Forwarding 720Specifies whether X11 forwarding is permitted. 721The argument must be 722.Dq yes 723or 724.Dq no . 725The default is 726.Dq yes . 727.Pp 728When X11 forwarding is enabled, there may be additional exposure to 729the server and to client displays if the 730.Nm sshd 731proxy display is configured to listen on the wildcard address (see 732.Cm X11UseLocalhost 733below), however this is not the default. 734Additionally, the authentication spoofing and authentication data 735verification and substitution occur on the client side. 736The security risk of using X11 forwarding is that the client's X11 737display server may be exposed to attack when the ssh client requests 738forwarding (see the warnings for 739.Cm ForwardX11 740in 741.Xr ssh_config 5 ) . 742A system administrator may have a stance in which they want to 743protect clients that may expose themselves to attack by unwittingly 744requesting X11 forwarding, which can warrant a 745.Dq no 746setting. 747.Pp 748Note that disabling X11 forwarding does not prevent users from 749forwarding X11 traffic, as users can always install their own forwarders. 750X11 forwarding is automatically disabled if 751.Cm UseLogin 752is enabled. 753.It Cm X11UseLocalhost 754Specifies whether 755.Nm sshd 756should bind the X11 forwarding server to the loopback address or to 757the wildcard address. 758By default, 759.Nm sshd 760binds the forwarding server to the loopback address and sets the 761hostname part of the 762.Ev DISPLAY 763environment variable to 764.Dq localhost . 765This prevents remote hosts from connecting to the proxy display. 766However, some older X11 clients may not function with this 767configuration. 768.Cm X11UseLocalhost 769may be set to 770.Dq no 771to specify that the forwarding server should be bound to the wildcard 772address. 773The argument must be 774.Dq yes 775or 776.Dq no . 777The default is 778.Dq yes . 779.It Cm XAuthLocation 780Specifies the full pathname of the 781.Xr xauth 1 782program. 783The default is 784.Pa /usr/X11R6/bin/xauth . 785.El 786.Ss Time Formats 787.Nm sshd 788command-line arguments and configuration file options that specify time 789may be expressed using a sequence of the form: 790.Sm off 791.Ar time Op Ar qualifier , 792.Sm on 793where 794.Ar time 795is a positive integer value and 796.Ar qualifier 797is one of the following: 798.Pp 799.Bl -tag -width Ds -compact -offset indent 800.It Cm <none> 801seconds 802.It Cm s | Cm S 803seconds 804.It Cm m | Cm M 805minutes 806.It Cm h | Cm H 807hours 808.It Cm d | Cm D 809days 810.It Cm w | Cm W 811weeks 812.El 813.Pp 814Each member of the sequence is added together to calculate 815the total time value. 816.Pp 817Time format examples: 818.Pp 819.Bl -tag -width Ds -compact -offset indent 820.It 600 821600 seconds (10 minutes) 822.It 10m 82310 minutes 824.It 1h30m 8251 hour 30 minutes (90 minutes) 826.El 827.Sh FILES 828.Bl -tag -width Ds 829.It Pa /etc/ssh/sshd_config 830Contains configuration data for 831.Nm sshd . 832This file should be writable by root only, but it is recommended 833(though not necessary) that it be world-readable. 834.El 835.Sh SEE ALSO 836.Xr sshd 8 837.Sh AUTHORS 838OpenSSH is a derivative of the original and free 839ssh 1.2.12 release by Tatu Ylonen. 840Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 841Theo de Raadt and Dug Song 842removed many bugs, re-added newer features and 843created OpenSSH. 844Markus Friedl contributed the support for SSH 845protocol versions 1.5 and 2.0. 846Niels Provos and Markus Friedl contributed support 847for privilege separation. 848