xref: /freebsd/crypto/openssh/sshd_config.5 (revision d056fa046c6a91b90cd98165face0e42a33a5173)
1.\"  -*- nroff -*-
2.\"
3.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5.\"                    All rights reserved
6.\"
7.\" As far as I am concerned, the code I have written for this software
8.\" can be used freely for any purpose.  Any derived versions of this
9.\" software must be clearly marked as such, and if the derived work is
10.\" incompatible with the protocol description in the RFC file, it must be
11.\" called by a name other than "ssh" or "Secure Shell".
12.\"
13.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
14.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
15.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
16.\"
17.\" Redistribution and use in source and binary forms, with or without
18.\" modification, are permitted provided that the following conditions
19.\" are met:
20.\" 1. Redistributions of source code must retain the above copyright
21.\"    notice, this list of conditions and the following disclaimer.
22.\" 2. Redistributions in binary form must reproduce the above copyright
23.\"    notice, this list of conditions and the following disclaimer in the
24.\"    documentation and/or other materials provided with the distribution.
25.\"
26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\"
37.\" $OpenBSD: sshd_config.5,v 1.48 2006/01/02 17:09:49 jmc Exp $
38.\" $FreeBSD$
39.Dd September 25, 1999
40.Dt SSHD_CONFIG 5
41.Os
42.Sh NAME
43.Nm sshd_config
44.Nd OpenSSH SSH daemon configuration file
45.Sh SYNOPSIS
46.Bl -tag -width Ds -compact
47.It Pa /etc/ssh/sshd_config
48.El
49.Sh DESCRIPTION
50.Nm sshd
51reads configuration data from
52.Pa /etc/ssh/sshd_config
53(or the file specified with
54.Fl f
55on the command line).
56The file contains keyword-argument pairs, one per line.
57Lines starting with
58.Ql #
59and empty lines are interpreted as comments.
60.Pp
61The possible
62keywords and their meanings are as follows (note that
63keywords are case-insensitive and arguments are case-sensitive):
64.Bl -tag -width Ds
65.It Cm AcceptEnv
66Specifies what environment variables sent by the client will be copied into
67the session's
68.Xr environ 7 .
69See
70.Cm SendEnv
71in
72.Xr ssh_config 5
73for how to configure the client.
74Note that environment passing is only supported for protocol 2.
75Variables are specified by name, which may contain the wildcard characters
76.Ql \&*
77and
78.Ql \&? .
79Multiple environment variables may be separated by whitespace or spread
80across multiple
81.Cm AcceptEnv
82directives.
83Be warned that some environment variables could be used to bypass restricted
84user environments.
85For this reason, care should be taken in the use of this directive.
86The default is not to accept any environment variables.
87.It Cm AddressFamily
88Specifies which address family should be used by
89.Nm sshd .
90Valid arguments are
91.Dq any ,
92.Dq inet
93(use IPv4 only) or
94.Dq inet6
95(use IPv6 only).
96The default is
97.Dq any .
98.It Cm AllowGroups
99This keyword can be followed by a list of group name patterns, separated
100by spaces.
101If specified, login is allowed only for users whose primary
102group or supplementary group list matches one of the patterns.
103.Ql \&*
104and
105.Ql \&?
106can be used as
107wildcards in the patterns.
108Only group names are valid; a numerical group ID is not recognized.
109By default, login is allowed for all groups.
110.It Cm AllowTcpForwarding
111Specifies whether TCP forwarding is permitted.
112The default is
113.Dq yes .
114Note that disabling TCP forwarding does not improve security unless
115users are also denied shell access, as they can always install their
116own forwarders.
117.It Cm AllowUsers
118This keyword can be followed by a list of user name patterns, separated
119by spaces.
120If specified, login is allowed only for user names that
121match one of the patterns.
122.Ql \&*
123and
124.Ql \&?
125can be used as
126wildcards in the patterns.
127Only user names are valid; a numerical user ID is not recognized.
128By default, login is allowed for all users.
129If the pattern takes the form USER@HOST then USER and HOST
130are separately checked, restricting logins to particular
131users from particular hosts.
132.It Cm AuthorizedKeysFile
133Specifies the file that contains the public keys that can be used
134for user authentication.
135.Cm AuthorizedKeysFile
136may contain tokens of the form %T which are substituted during connection
137set-up.
138The following tokens are defined: %% is replaced by a literal '%',
139%h is replaced by the home directory of the user being authenticated and
140%u is replaced by the username of that user.
141After expansion,
142.Cm AuthorizedKeysFile
143is taken to be an absolute path or one relative to the user's home
144directory.
145The default is
146.Dq .ssh/authorized_keys .
147.It Cm Banner
148In some jurisdictions, sending a warning message before authentication
149may be relevant for getting legal protection.
150The contents of the specified file are sent to the remote user before
151authentication is allowed.
152This option is only available for protocol version 2.
153By default, no banner is displayed.
154.It Cm ChallengeResponseAuthentication
155Specifies whether challenge-response authentication is allowed.
156Specifically, in
157.Fx ,
158this controls the use of PAM (see
159.Xr pam 3 )
160for authentication.
161Note that this affects the effectiveness of the
162.Cm PasswordAuthentication
163and
164.Cm PermitRootLogin
165variables.
166The default is
167.Dq yes .
168.It Cm Ciphers
169Specifies the ciphers allowed for protocol version 2.
170Multiple ciphers must be comma-separated.
171The supported ciphers are
172.Dq 3des-cbc ,
173.Dq aes128-cbc ,
174.Dq aes192-cbc ,
175.Dq aes256-cbc ,
176.Dq aes128-ctr ,
177.Dq aes192-ctr ,
178.Dq aes256-ctr ,
179.Dq arcfour128 ,
180.Dq arcfour256 ,
181.Dq arcfour ,
182.Dq blowfish-cbc ,
183and
184.Dq cast128-cbc .
185The default is
186.Bd -literal
187  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
188    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
189    aes192-ctr,aes256-ctr''
190.Ed
191.It Cm ClientAliveCountMax
192Sets the number of client alive messages (see below) which may be
193sent without
194.Nm sshd
195receiving any messages back from the client.
196If this threshold is reached while client alive messages are being sent,
197.Nm sshd
198will disconnect the client, terminating the session.
199It is important to note that the use of client alive messages is very
200different from
201.Cm TCPKeepAlive
202(below).
203The client alive messages are sent through the encrypted channel
204and therefore will not be spoofable.
205The TCP keepalive option enabled by
206.Cm TCPKeepAlive
207is spoofable.
208The client alive mechanism is valuable when the client or
209server depend on knowing when a connection has become inactive.
210.Pp
211The default value is 3.
212If
213.Cm ClientAliveInterval
214(see below) is set to 15, and
215.Cm ClientAliveCountMax
216is left at the default, unresponsive ssh clients
217will be disconnected after approximately 45 seconds.
218.It Cm ClientAliveInterval
219Sets a timeout interval in seconds after which if no data has been received
220from the client,
221.Nm sshd
222will send a message through the encrypted
223channel to request a response from the client.
224The default
225is 0, indicating that these messages will not be sent to the client.
226This option applies to protocol version 2 only.
227.It Cm Compression
228Specifies whether compression is allowed, or delayed until
229the user has authenticated successfully.
230The argument must be
231.Dq yes ,
232.Dq delayed ,
233or
234.Dq no .
235The default is
236.Dq delayed .
237.It Cm DenyGroups
238This keyword can be followed by a list of group name patterns, separated
239by spaces.
240Login is disallowed for users whose primary group or supplementary
241group list matches one of the patterns.
242.Ql \&*
243and
244.Ql \&?
245can be used as
246wildcards in the patterns.
247Only group names are valid; a numerical group ID is not recognized.
248By default, login is allowed for all groups.
249.It Cm DenyUsers
250This keyword can be followed by a list of user name patterns, separated
251by spaces.
252Login is disallowed for user names that match one of the patterns.
253.Ql \&*
254and
255.Ql \&?
256can be used as wildcards in the patterns.
257Only user names are valid; a numerical user ID is not recognized.
258By default, login is allowed for all users.
259If the pattern takes the form USER@HOST then USER and HOST
260are separately checked, restricting logins to particular
261users from particular hosts.
262.It Cm GatewayPorts
263Specifies whether remote hosts are allowed to connect to ports
264forwarded for the client.
265By default,
266.Nm sshd
267binds remote port forwardings to the loopback address.
268This prevents other remote hosts from connecting to forwarded ports.
269.Cm GatewayPorts
270can be used to specify that
271.Nm sshd
272should allow remote port forwardings to bind to non-loopback addresses, thus
273allowing other hosts to connect.
274The argument may be
275.Dq no
276to force remote port forwardings to be available to the local host only,
277.Dq yes
278to force remote port forwardings to bind to the wildcard address, or
279.Dq clientspecified
280to allow the client to select the address to which the forwarding is bound.
281The default is
282.Dq no .
283.It Cm GSSAPIAuthentication
284Specifies whether user authentication based on GSSAPI is allowed.
285The default is
286.Dq no .
287Note that this option applies to protocol version 2 only.
288.It Cm GSSAPICleanupCredentials
289Specifies whether to automatically destroy the user's credentials cache
290on logout.
291The default is
292.Dq yes .
293Note that this option applies to protocol version 2 only.
294.It Cm HostbasedAuthentication
295Specifies whether rhosts or /etc/hosts.equiv authentication together
296with successful public key client host authentication is allowed
297(hostbased authentication).
298This option is similar to
299.Cm RhostsRSAAuthentication
300and applies to protocol version 2 only.
301The default is
302.Dq no .
303.It Cm HostKey
304Specifies a file containing a private host key
305used by SSH.
306The default is
307.Pa /etc/ssh/ssh_host_key
308for protocol version 1, and
309.Pa /etc/ssh/ssh_host_dsa_key
310for protocol version 2.
311Note that
312.Nm sshd
313will refuse to use a file if it is group/world-accessible.
314It is possible to have multiple host key files.
315.Dq rsa1
316keys are used for version 1 and
317.Dq dsa
318or
319.Dq rsa
320are used for version 2 of the SSH protocol.
321.It Cm IgnoreRhosts
322Specifies that
323.Pa .rhosts
324and
325.Pa .shosts
326files will not be used in
327.Cm RhostsRSAAuthentication
328or
329.Cm HostbasedAuthentication .
330.Pp
331.Pa /etc/hosts.equiv
332and
333.Pa /etc/ssh/shosts.equiv
334are still used.
335The default is
336.Dq yes .
337.It Cm IgnoreUserKnownHosts
338Specifies whether
339.Nm sshd
340should ignore the user's
341.Pa ~/.ssh/known_hosts
342during
343.Cm RhostsRSAAuthentication
344or
345.Cm HostbasedAuthentication .
346The default is
347.Dq no .
348.It Cm KerberosAuthentication
349Specifies whether the password provided by the user for
350.Cm PasswordAuthentication
351will be validated through the Kerberos KDC.
352To use this option, the server needs a
353Kerberos servtab which allows the verification of the KDC's identity.
354Default is
355.Dq no .
356.It Cm KerberosGetAFSToken
357If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire
358an AFS token before accessing the user's home directory.
359Default is
360.Dq no .
361.It Cm KerberosOrLocalPasswd
362If set then if password authentication through Kerberos fails then
363the password will be validated via any additional local mechanism
364such as
365.Pa /etc/passwd .
366Default is
367.Dq yes .
368.It Cm KerberosTicketCleanup
369Specifies whether to automatically destroy the user's ticket cache
370file on logout.
371Default is
372.Dq yes .
373.It Cm KeyRegenerationInterval
374In protocol version 1, the ephemeral server key is automatically regenerated
375after this many seconds (if it has been used).
376The purpose of regeneration is to prevent
377decrypting captured sessions by later breaking into the machine and
378stealing the keys.
379The key is never stored anywhere.
380If the value is 0, the key is never regenerated.
381The default is 3600 (seconds).
382.It Cm ListenAddress
383Specifies the local addresses
384.Nm sshd
385should listen on.
386The following forms may be used:
387.Pp
388.Bl -item -offset indent -compact
389.It
390.Cm ListenAddress
391.Sm off
392.Ar host No | Ar IPv4_addr No | Ar IPv6_addr
393.Sm on
394.It
395.Cm ListenAddress
396.Sm off
397.Ar host No | Ar IPv4_addr No : Ar port
398.Sm on
399.It
400.Cm ListenAddress
401.Sm off
402.Oo
403.Ar host No | Ar IPv6_addr Oc : Ar port
404.Sm on
405.El
406.Pp
407If
408.Ar port
409is not specified,
410.Nm sshd
411will listen on the address and all prior
412.Cm Port
413options specified.
414The default is to listen on all local addresses.
415Multiple
416.Cm ListenAddress
417options are permitted.
418Additionally, any
419.Cm Port
420options must precede this option for non port qualified addresses.
421.It Cm LoginGraceTime
422The server disconnects after this time if the user has not
423successfully logged in.
424If the value is 0, there is no time limit.
425The default is 120 seconds.
426.It Cm LogLevel
427Gives the verbosity level that is used when logging messages from
428.Nm sshd .
429The possible values are:
430QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
431The default is INFO.
432DEBUG and DEBUG1 are equivalent.
433DEBUG2 and DEBUG3 each specify higher levels of debugging output.
434Logging with a DEBUG level violates the privacy of users and is not recommended.
435.It Cm MACs
436Specifies the available MAC (message authentication code) algorithms.
437The MAC algorithm is used in protocol version 2
438for data integrity protection.
439Multiple algorithms must be comma-separated.
440The default is
441.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
442.It Cm MaxAuthTries
443Specifies the maximum number of authentication attempts permitted per
444connection.
445Once the number of failures reaches half this value,
446additional failures are logged.
447The default is 6.
448.It Cm MaxStartups
449Specifies the maximum number of concurrent unauthenticated connections to the
450.Nm sshd
451daemon.
452Additional connections will be dropped until authentication succeeds or the
453.Cm LoginGraceTime
454expires for a connection.
455The default is 10.
456.Pp
457Alternatively, random early drop can be enabled by specifying
458the three colon separated values
459.Dq start:rate:full
460(e.g., "10:30:60").
461.Nm sshd
462will refuse connection attempts with a probability of
463.Dq rate/100
464(30%)
465if there are currently
466.Dq start
467(10)
468unauthenticated connections.
469The probability increases linearly and all connection attempts
470are refused if the number of unauthenticated connections reaches
471.Dq full
472(60).
473.It Cm PasswordAuthentication
474Specifies whether password authentication is allowed.
475The default is
476.Dq no ,
477unless
478.Nm sshd
479was built without PAM support, in which case the default is
480.Dq yes .
481Note that if
482.Cm ChallengeResponseAuthentication
483is
484.Dq yes ,
485and the PAM authentication policy for
486.Nm sshd
487includes
488.Xr pam_unix 8 ,
489password authentication will be allowed through the challenge-response
490mechanism regardless of the value of
491.Cm PasswordAuthentication .
492.It Cm PermitEmptyPasswords
493When password authentication is allowed, it specifies whether the
494server allows login to accounts with empty password strings.
495The default is
496.Dq no .
497.It Cm PermitRootLogin
498Specifies whether root can log in using
499.Xr ssh 1 .
500The argument must be
501.Dq yes ,
502.Dq without-password ,
503.Dq forced-commands-only
504or
505.Dq no .
506The default is
507.Dq no .
508Note that if
509.Cm ChallengeResponseAuthentication
510is
511.Dq yes ,
512the root user may be allowed in with its password even if
513.Cm PermitRootLogin is set to
514.Dq without-password .
515.Pp
516If this option is set to
517.Dq without-password
518password authentication is disabled for root.
519.Pp
520If this option is set to
521.Dq forced-commands-only
522root login with public key authentication will be allowed,
523but only if the
524.Ar command
525option has been specified
526(which may be useful for taking remote backups even if root login is
527normally not allowed).
528All other authentication methods are disabled for root.
529.Pp
530If this option is set to
531.Dq no
532root is not allowed to log in.
533.It Cm PermitTunnel
534Specifies whether
535.Xr tun 4
536device forwarding is allowed.
537The argument must be
538.Dq yes ,
539.Dq point-to-point ,
540.Dq ethernet
541or
542.Dq no .
543The default is
544.Dq no .
545.It Cm PermitUserEnvironment
546Specifies whether
547.Pa ~/.ssh/environment
548and
549.Cm environment=
550options in
551.Pa ~/.ssh/authorized_keys
552are processed by
553.Nm sshd .
554The default is
555.Dq no .
556Enabling environment processing may enable users to bypass access
557restrictions in some configurations using mechanisms such as
558.Ev LD_PRELOAD .
559.It Cm PidFile
560Specifies the file that contains the process ID of the
561.Nm sshd
562daemon.
563The default is
564.Pa /var/run/sshd.pid .
565.It Cm Port
566Specifies the port number that
567.Nm sshd
568listens on.
569The default is 22.
570Multiple options of this type are permitted.
571See also
572.Cm ListenAddress .
573.It Cm PrintLastLog
574Specifies whether
575.Nm sshd
576should print the date and time of the last user login when a user logs
577in interactively.
578The default is
579.Dq yes .
580.It Cm PrintMotd
581Specifies whether
582.Nm sshd
583should print
584.Pa /etc/motd
585when a user logs in interactively.
586(On some systems it is also printed by the shell,
587.Pa /etc/profile ,
588or equivalent.)
589The default is
590.Dq yes .
591.It Cm Protocol
592Specifies the protocol versions
593.Nm sshd
594supports.
595The possible values are
596.Dq 1
597and
598.Dq 2 .
599Multiple versions must be comma-separated.
600The default is
601.Dq 2 .
602Note that the order of the protocol list does not indicate preference,
603because the client selects among multiple protocol versions offered
604by the server.
605Specifying
606.Dq 2,1
607is identical to
608.Dq 1,2 .
609.It Cm PubkeyAuthentication
610Specifies whether public key authentication is allowed.
611The default is
612.Dq yes .
613Note that this option applies to protocol version 2 only.
614.It Cm RhostsRSAAuthentication
615Specifies whether rhosts or
616.Pa /etc/hosts.equiv
617authentication together
618with successful RSA host authentication is allowed.
619The default is
620.Dq no .
621This option applies to protocol version 1 only.
622.It Cm RSAAuthentication
623Specifies whether pure RSA authentication is allowed.
624The default is
625.Dq yes .
626This option applies to protocol version 1 only.
627.It Cm ServerKeyBits
628Defines the number of bits in the ephemeral protocol version 1 server key.
629The minimum value is 512, and the default is 768.
630.It Cm StrictModes
631Specifies whether
632.Nm sshd
633should check file modes and ownership of the
634user's files and home directory before accepting login.
635This is normally desirable because novices sometimes accidentally leave their
636directory or files world-writable.
637The default is
638.Dq yes .
639.It Cm Subsystem
640Configures an external subsystem (e.g., file transfer daemon).
641Arguments should be a subsystem name and a command to execute upon subsystem
642request.
643The command
644.Xr sftp-server 8
645implements the
646.Dq sftp
647file transfer subsystem.
648By default no subsystems are defined.
649Note that this option applies to protocol version 2 only.
650.It Cm SyslogFacility
651Gives the facility code that is used when logging messages from
652.Nm sshd .
653The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
654LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
655The default is AUTH.
656.It Cm TCPKeepAlive
657Specifies whether the system should send TCP keepalive messages to the
658other side.
659If they are sent, death of the connection or crash of one
660of the machines will be properly noticed.
661However, this means that
662connections will die if the route is down temporarily, and some people
663find it annoying.
664On the other hand, if TCP keepalives are not sent,
665sessions may hang indefinitely on the server, leaving
666.Dq ghost
667users and consuming server resources.
668.Pp
669The default is
670.Dq yes
671(to send TCP keepalive messages), and the server will notice
672if the network goes down or the client host crashes.
673This avoids infinitely hanging sessions.
674.Pp
675To disable TCP keepalive messages, the value should be set to
676.Dq no .
677.It Cm UseDNS
678Specifies whether
679.Nm sshd
680should look up the remote host name and check that
681the resolved host name for the remote IP address maps back to the
682very same IP address.
683The default is
684.Dq yes .
685.It Cm UseLogin
686Specifies whether
687.Xr login 1
688is used for interactive login sessions.
689The default is
690.Dq no .
691Note that
692.Xr login 1
693is never used for remote command execution.
694Note also, that if this is enabled,
695.Cm X11Forwarding
696will be disabled because
697.Xr login 1
698does not know how to handle
699.Xr xauth 1
700cookies.
701If
702.Cm UsePrivilegeSeparation
703is specified, it will be disabled after authentication.
704.It Cm UsePAM
705Enables the Pluggable Authentication Module interface.
706If set to
707.Dq yes
708this will enable PAM authentication using
709.Cm ChallengeResponseAuthentication
710and PAM account and session module processing for all authentication types.
711.Pp
712Because PAM challenge-response authentication usually serves an equivalent
713role to password authentication, you should disable either
714.Cm PasswordAuthentication
715or
716.Cm ChallengeResponseAuthentication.
717.Pp
718If
719.Cm UsePAM
720is enabled, you will not be able to run
721.Xr sshd 8
722as a non-root user.
723The default is
724.Dq yes .
725.It Cm UsePrivilegeSeparation
726Specifies whether
727.Nm sshd
728separates privileges by creating an unprivileged child process
729to deal with incoming network traffic.
730After successful authentication, another process will be created that has
731the privilege of the authenticated user.
732The goal of privilege separation is to prevent privilege
733escalation by containing any corruption within the unprivileged processes.
734The default is
735.Dq yes .
736.It Cm VersionAddendum
737Specifies a string to append to the regular version string to identify
738OS- or site-specific modifications.
739The default is
740.Dq FreeBSD-20060322 .
741.It Cm X11DisplayOffset
742Specifies the first display number available for
743.Nm sshd Ns 's
744X11 forwarding.
745This prevents
746.Nm sshd
747from interfering with real X11 servers.
748The default is 10.
749.It Cm X11Forwarding
750Specifies whether X11 forwarding is permitted.
751The argument must be
752.Dq yes
753or
754.Dq no .
755The default is
756.Dq yes .
757.Pp
758When X11 forwarding is enabled, there may be additional exposure to
759the server and to client displays if the
760.Nm sshd
761proxy display is configured to listen on the wildcard address (see
762.Cm X11UseLocalhost
763below), however this is not the default.
764Additionally, the authentication spoofing and authentication data
765verification and substitution occur on the client side.
766The security risk of using X11 forwarding is that the client's X11
767display server may be exposed to attack when the ssh client requests
768forwarding (see the warnings for
769.Cm ForwardX11
770in
771.Xr ssh_config 5 ) .
772A system administrator may have a stance in which they want to
773protect clients that may expose themselves to attack by unwittingly
774requesting X11 forwarding, which can warrant a
775.Dq no
776setting.
777.Pp
778Note that disabling X11 forwarding does not prevent users from
779forwarding X11 traffic, as users can always install their own forwarders.
780X11 forwarding is automatically disabled if
781.Cm UseLogin
782is enabled.
783.It Cm X11UseLocalhost
784Specifies whether
785.Nm sshd
786should bind the X11 forwarding server to the loopback address or to
787the wildcard address.
788By default,
789.Nm sshd
790binds the forwarding server to the loopback address and sets the
791hostname part of the
792.Ev DISPLAY
793environment variable to
794.Dq localhost .
795This prevents remote hosts from connecting to the proxy display.
796However, some older X11 clients may not function with this
797configuration.
798.Cm X11UseLocalhost
799may be set to
800.Dq no
801to specify that the forwarding server should be bound to the wildcard
802address.
803The argument must be
804.Dq yes
805or
806.Dq no .
807The default is
808.Dq yes .
809.It Cm XAuthLocation
810Specifies the full pathname of the
811.Xr xauth 1
812program.
813The default is
814.Pa /usr/X11R6/bin/xauth .
815.El
816.Ss Time Formats
817.Nm sshd
818command-line arguments and configuration file options that specify time
819may be expressed using a sequence of the form:
820.Sm off
821.Ar time Op Ar qualifier ,
822.Sm on
823where
824.Ar time
825is a positive integer value and
826.Ar qualifier
827is one of the following:
828.Pp
829.Bl -tag -width Ds -compact -offset indent
830.It Cm <none>
831seconds
832.It Cm s | Cm S
833seconds
834.It Cm m | Cm M
835minutes
836.It Cm h | Cm H
837hours
838.It Cm d | Cm D
839days
840.It Cm w | Cm W
841weeks
842.El
843.Pp
844Each member of the sequence is added together to calculate
845the total time value.
846.Pp
847Time format examples:
848.Pp
849.Bl -tag -width Ds -compact -offset indent
850.It 600
851600 seconds (10 minutes)
852.It 10m
85310 minutes
854.It 1h30m
8551 hour 30 minutes (90 minutes)
856.El
857.Sh FILES
858.Bl -tag -width Ds
859.It Pa /etc/ssh/sshd_config
860Contains configuration data for
861.Nm sshd .
862This file should be writable by root only, but it is recommended
863(though not necessary) that it be world-readable.
864.El
865.Sh SEE ALSO
866.Xr sshd 8
867.Sh AUTHORS
868OpenSSH is a derivative of the original and free
869ssh 1.2.12 release by Tatu Ylonen.
870Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
871Theo de Raadt and Dug Song
872removed many bugs, re-added newer features and
873created OpenSSH.
874Markus Friedl contributed the support for SSH
875protocol versions 1.5 and 2.0.
876Niels Provos and Markus Friedl contributed support
877for privilege separation.
878