1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $OpenBSD: sshd_config.5,v 1.48 2006/01/02 17:09:49 jmc Exp $ 38.\" $FreeBSD$ 39.Dd September 25, 1999 40.Dt SSHD_CONFIG 5 41.Os 42.Sh NAME 43.Nm sshd_config 44.Nd OpenSSH SSH daemon configuration file 45.Sh SYNOPSIS 46.Bl -tag -width Ds -compact 47.It Pa /etc/ssh/sshd_config 48.El 49.Sh DESCRIPTION 50.Nm sshd 51reads configuration data from 52.Pa /etc/ssh/sshd_config 53(or the file specified with 54.Fl f 55on the command line). 56The file contains keyword-argument pairs, one per line. 57Lines starting with 58.Ql # 59and empty lines are interpreted as comments. 60.Pp 61The possible 62keywords and their meanings are as follows (note that 63keywords are case-insensitive and arguments are case-sensitive): 64.Bl -tag -width Ds 65.It Cm AcceptEnv 66Specifies what environment variables sent by the client will be copied into 67the session's 68.Xr environ 7 . 69See 70.Cm SendEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74Note that environment passing is only supported for protocol 2. 75Variables are specified by name, which may contain the wildcard characters 76.Ql \&* 77and 78.Ql \&? . 79Multiple environment variables may be separated by whitespace or spread 80across multiple 81.Cm AcceptEnv 82directives. 83Be warned that some environment variables could be used to bypass restricted 84user environments. 85For this reason, care should be taken in the use of this directive. 86The default is not to accept any environment variables. 87.It Cm AddressFamily 88Specifies which address family should be used by 89.Nm sshd . 90Valid arguments are 91.Dq any , 92.Dq inet 93(use IPv4 only) or 94.Dq inet6 95(use IPv6 only). 96The default is 97.Dq any . 98.It Cm AllowGroups 99This keyword can be followed by a list of group name patterns, separated 100by spaces. 101If specified, login is allowed only for users whose primary 102group or supplementary group list matches one of the patterns. 103.Ql \&* 104and 105.Ql \&? 106can be used as 107wildcards in the patterns. 108Only group names are valid; a numerical group ID is not recognized. 109By default, login is allowed for all groups. 110.It Cm AllowTcpForwarding 111Specifies whether TCP forwarding is permitted. 112The default is 113.Dq yes . 114Note that disabling TCP forwarding does not improve security unless 115users are also denied shell access, as they can always install their 116own forwarders. 117.It Cm AllowUsers 118This keyword can be followed by a list of user name patterns, separated 119by spaces. 120If specified, login is allowed only for user names that 121match one of the patterns. 122.Ql \&* 123and 124.Ql \&? 125can be used as 126wildcards in the patterns. 127Only user names are valid; a numerical user ID is not recognized. 128By default, login is allowed for all users. 129If the pattern takes the form USER@HOST then USER and HOST 130are separately checked, restricting logins to particular 131users from particular hosts. 132.It Cm AuthorizedKeysFile 133Specifies the file that contains the public keys that can be used 134for user authentication. 135.Cm AuthorizedKeysFile 136may contain tokens of the form %T which are substituted during connection 137set-up. 138The following tokens are defined: %% is replaced by a literal '%', 139%h is replaced by the home directory of the user being authenticated and 140%u is replaced by the username of that user. 141After expansion, 142.Cm AuthorizedKeysFile 143is taken to be an absolute path or one relative to the user's home 144directory. 145The default is 146.Dq .ssh/authorized_keys . 147.It Cm Banner 148In some jurisdictions, sending a warning message before authentication 149may be relevant for getting legal protection. 150The contents of the specified file are sent to the remote user before 151authentication is allowed. 152This option is only available for protocol version 2. 153By default, no banner is displayed. 154.It Cm ChallengeResponseAuthentication 155Specifies whether challenge-response authentication is allowed. 156Specifically, in 157.Fx , 158this controls the use of PAM (see 159.Xr pam 3 ) 160for authentication. 161Note that this affects the effectiveness of the 162.Cm PasswordAuthentication 163and 164.Cm PermitRootLogin 165variables. 166The default is 167.Dq yes . 168.It Cm Ciphers 169Specifies the ciphers allowed for protocol version 2. 170Multiple ciphers must be comma-separated. 171The supported ciphers are 172.Dq 3des-cbc , 173.Dq aes128-cbc , 174.Dq aes192-cbc , 175.Dq aes256-cbc , 176.Dq aes128-ctr , 177.Dq aes192-ctr , 178.Dq aes256-ctr , 179.Dq arcfour128 , 180.Dq arcfour256 , 181.Dq arcfour , 182.Dq blowfish-cbc , 183and 184.Dq cast128-cbc . 185The default is 186.Bd -literal 187 ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128, 188 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr, 189 aes192-ctr,aes256-ctr'' 190.Ed 191.It Cm ClientAliveCountMax 192Sets the number of client alive messages (see below) which may be 193sent without 194.Nm sshd 195receiving any messages back from the client. 196If this threshold is reached while client alive messages are being sent, 197.Nm sshd 198will disconnect the client, terminating the session. 199It is important to note that the use of client alive messages is very 200different from 201.Cm TCPKeepAlive 202(below). 203The client alive messages are sent through the encrypted channel 204and therefore will not be spoofable. 205The TCP keepalive option enabled by 206.Cm TCPKeepAlive 207is spoofable. 208The client alive mechanism is valuable when the client or 209server depend on knowing when a connection has become inactive. 210.Pp 211The default value is 3. 212If 213.Cm ClientAliveInterval 214(see below) is set to 15, and 215.Cm ClientAliveCountMax 216is left at the default, unresponsive ssh clients 217will be disconnected after approximately 45 seconds. 218.It Cm ClientAliveInterval 219Sets a timeout interval in seconds after which if no data has been received 220from the client, 221.Nm sshd 222will send a message through the encrypted 223channel to request a response from the client. 224The default 225is 0, indicating that these messages will not be sent to the client. 226This option applies to protocol version 2 only. 227.It Cm Compression 228Specifies whether compression is allowed, or delayed until 229the user has authenticated successfully. 230The argument must be 231.Dq yes , 232.Dq delayed , 233or 234.Dq no . 235The default is 236.Dq delayed . 237.It Cm DenyGroups 238This keyword can be followed by a list of group name patterns, separated 239by spaces. 240Login is disallowed for users whose primary group or supplementary 241group list matches one of the patterns. 242.Ql \&* 243and 244.Ql \&? 245can be used as 246wildcards in the patterns. 247Only group names are valid; a numerical group ID is not recognized. 248By default, login is allowed for all groups. 249.It Cm DenyUsers 250This keyword can be followed by a list of user name patterns, separated 251by spaces. 252Login is disallowed for user names that match one of the patterns. 253.Ql \&* 254and 255.Ql \&? 256can be used as wildcards in the patterns. 257Only user names are valid; a numerical user ID is not recognized. 258By default, login is allowed for all users. 259If the pattern takes the form USER@HOST then USER and HOST 260are separately checked, restricting logins to particular 261users from particular hosts. 262.It Cm GatewayPorts 263Specifies whether remote hosts are allowed to connect to ports 264forwarded for the client. 265By default, 266.Nm sshd 267binds remote port forwardings to the loopback address. 268This prevents other remote hosts from connecting to forwarded ports. 269.Cm GatewayPorts 270can be used to specify that 271.Nm sshd 272should allow remote port forwardings to bind to non-loopback addresses, thus 273allowing other hosts to connect. 274The argument may be 275.Dq no 276to force remote port forwardings to be available to the local host only, 277.Dq yes 278to force remote port forwardings to bind to the wildcard address, or 279.Dq clientspecified 280to allow the client to select the address to which the forwarding is bound. 281The default is 282.Dq no . 283.It Cm GSSAPIAuthentication 284Specifies whether user authentication based on GSSAPI is allowed. 285The default is 286.Dq no . 287Note that this option applies to protocol version 2 only. 288.It Cm GSSAPICleanupCredentials 289Specifies whether to automatically destroy the user's credentials cache 290on logout. 291The default is 292.Dq yes . 293Note that this option applies to protocol version 2 only. 294.It Cm HostbasedAuthentication 295Specifies whether rhosts or /etc/hosts.equiv authentication together 296with successful public key client host authentication is allowed 297(hostbased authentication). 298This option is similar to 299.Cm RhostsRSAAuthentication 300and applies to protocol version 2 only. 301The default is 302.Dq no . 303.It Cm HostKey 304Specifies a file containing a private host key 305used by SSH. 306The default is 307.Pa /etc/ssh/ssh_host_key 308for protocol version 1, and 309.Pa /etc/ssh/ssh_host_dsa_key 310for protocol version 2. 311Note that 312.Nm sshd 313will refuse to use a file if it is group/world-accessible. 314It is possible to have multiple host key files. 315.Dq rsa1 316keys are used for version 1 and 317.Dq dsa 318or 319.Dq rsa 320are used for version 2 of the SSH protocol. 321.It Cm IgnoreRhosts 322Specifies that 323.Pa .rhosts 324and 325.Pa .shosts 326files will not be used in 327.Cm RhostsRSAAuthentication 328or 329.Cm HostbasedAuthentication . 330.Pp 331.Pa /etc/hosts.equiv 332and 333.Pa /etc/ssh/shosts.equiv 334are still used. 335The default is 336.Dq yes . 337.It Cm IgnoreUserKnownHosts 338Specifies whether 339.Nm sshd 340should ignore the user's 341.Pa ~/.ssh/known_hosts 342during 343.Cm RhostsRSAAuthentication 344or 345.Cm HostbasedAuthentication . 346The default is 347.Dq no . 348.It Cm KerberosAuthentication 349Specifies whether the password provided by the user for 350.Cm PasswordAuthentication 351will be validated through the Kerberos KDC. 352To use this option, the server needs a 353Kerberos servtab which allows the verification of the KDC's identity. 354Default is 355.Dq no . 356.It Cm KerberosGetAFSToken 357If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 358an AFS token before accessing the user's home directory. 359Default is 360.Dq no . 361.It Cm KerberosOrLocalPasswd 362If set then if password authentication through Kerberos fails then 363the password will be validated via any additional local mechanism 364such as 365.Pa /etc/passwd . 366Default is 367.Dq yes . 368.It Cm KerberosTicketCleanup 369Specifies whether to automatically destroy the user's ticket cache 370file on logout. 371Default is 372.Dq yes . 373.It Cm KeyRegenerationInterval 374In protocol version 1, the ephemeral server key is automatically regenerated 375after this many seconds (if it has been used). 376The purpose of regeneration is to prevent 377decrypting captured sessions by later breaking into the machine and 378stealing the keys. 379The key is never stored anywhere. 380If the value is 0, the key is never regenerated. 381The default is 3600 (seconds). 382.It Cm ListenAddress 383Specifies the local addresses 384.Nm sshd 385should listen on. 386The following forms may be used: 387.Pp 388.Bl -item -offset indent -compact 389.It 390.Cm ListenAddress 391.Sm off 392.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 393.Sm on 394.It 395.Cm ListenAddress 396.Sm off 397.Ar host No | Ar IPv4_addr No : Ar port 398.Sm on 399.It 400.Cm ListenAddress 401.Sm off 402.Oo 403.Ar host No | Ar IPv6_addr Oc : Ar port 404.Sm on 405.El 406.Pp 407If 408.Ar port 409is not specified, 410.Nm sshd 411will listen on the address and all prior 412.Cm Port 413options specified. 414The default is to listen on all local addresses. 415Multiple 416.Cm ListenAddress 417options are permitted. 418Additionally, any 419.Cm Port 420options must precede this option for non port qualified addresses. 421.It Cm LoginGraceTime 422The server disconnects after this time if the user has not 423successfully logged in. 424If the value is 0, there is no time limit. 425The default is 120 seconds. 426.It Cm LogLevel 427Gives the verbosity level that is used when logging messages from 428.Nm sshd . 429The possible values are: 430QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. 431The default is INFO. 432DEBUG and DEBUG1 are equivalent. 433DEBUG2 and DEBUG3 each specify higher levels of debugging output. 434Logging with a DEBUG level violates the privacy of users and is not recommended. 435.It Cm MACs 436Specifies the available MAC (message authentication code) algorithms. 437The MAC algorithm is used in protocol version 2 438for data integrity protection. 439Multiple algorithms must be comma-separated. 440The default is 441.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . 442.It Cm MaxAuthTries 443Specifies the maximum number of authentication attempts permitted per 444connection. 445Once the number of failures reaches half this value, 446additional failures are logged. 447The default is 6. 448.It Cm MaxStartups 449Specifies the maximum number of concurrent unauthenticated connections to the 450.Nm sshd 451daemon. 452Additional connections will be dropped until authentication succeeds or the 453.Cm LoginGraceTime 454expires for a connection. 455The default is 10. 456.Pp 457Alternatively, random early drop can be enabled by specifying 458the three colon separated values 459.Dq start:rate:full 460(e.g., "10:30:60"). 461.Nm sshd 462will refuse connection attempts with a probability of 463.Dq rate/100 464(30%) 465if there are currently 466.Dq start 467(10) 468unauthenticated connections. 469The probability increases linearly and all connection attempts 470are refused if the number of unauthenticated connections reaches 471.Dq full 472(60). 473.It Cm PasswordAuthentication 474Specifies whether password authentication is allowed. 475The default is 476.Dq no , 477unless 478.Nm sshd 479was built without PAM support, in which case the default is 480.Dq yes . 481Note that if 482.Cm ChallengeResponseAuthentication 483is 484.Dq yes , 485and the PAM authentication policy for 486.Nm sshd 487includes 488.Xr pam_unix 8 , 489password authentication will be allowed through the challenge-response 490mechanism regardless of the value of 491.Cm PasswordAuthentication . 492.It Cm PermitEmptyPasswords 493When password authentication is allowed, it specifies whether the 494server allows login to accounts with empty password strings. 495The default is 496.Dq no . 497.It Cm PermitRootLogin 498Specifies whether root can log in using 499.Xr ssh 1 . 500The argument must be 501.Dq yes , 502.Dq without-password , 503.Dq forced-commands-only 504or 505.Dq no . 506The default is 507.Dq no . 508Note that if 509.Cm ChallengeResponseAuthentication 510is 511.Dq yes , 512the root user may be allowed in with its password even if 513.Cm PermitRootLogin is set to 514.Dq without-password . 515.Pp 516If this option is set to 517.Dq without-password 518password authentication is disabled for root. 519.Pp 520If this option is set to 521.Dq forced-commands-only 522root login with public key authentication will be allowed, 523but only if the 524.Ar command 525option has been specified 526(which may be useful for taking remote backups even if root login is 527normally not allowed). 528All other authentication methods are disabled for root. 529.Pp 530If this option is set to 531.Dq no 532root is not allowed to log in. 533.It Cm PermitTunnel 534Specifies whether 535.Xr tun 4 536device forwarding is allowed. 537The argument must be 538.Dq yes , 539.Dq point-to-point , 540.Dq ethernet 541or 542.Dq no . 543The default is 544.Dq no . 545.It Cm PermitUserEnvironment 546Specifies whether 547.Pa ~/.ssh/environment 548and 549.Cm environment= 550options in 551.Pa ~/.ssh/authorized_keys 552are processed by 553.Nm sshd . 554The default is 555.Dq no . 556Enabling environment processing may enable users to bypass access 557restrictions in some configurations using mechanisms such as 558.Ev LD_PRELOAD . 559.It Cm PidFile 560Specifies the file that contains the process ID of the 561.Nm sshd 562daemon. 563The default is 564.Pa /var/run/sshd.pid . 565.It Cm Port 566Specifies the port number that 567.Nm sshd 568listens on. 569The default is 22. 570Multiple options of this type are permitted. 571See also 572.Cm ListenAddress . 573.It Cm PrintLastLog 574Specifies whether 575.Nm sshd 576should print the date and time of the last user login when a user logs 577in interactively. 578The default is 579.Dq yes . 580.It Cm PrintMotd 581Specifies whether 582.Nm sshd 583should print 584.Pa /etc/motd 585when a user logs in interactively. 586(On some systems it is also printed by the shell, 587.Pa /etc/profile , 588or equivalent.) 589The default is 590.Dq yes . 591.It Cm Protocol 592Specifies the protocol versions 593.Nm sshd 594supports. 595The possible values are 596.Dq 1 597and 598.Dq 2 . 599Multiple versions must be comma-separated. 600The default is 601.Dq 2 . 602Note that the order of the protocol list does not indicate preference, 603because the client selects among multiple protocol versions offered 604by the server. 605Specifying 606.Dq 2,1 607is identical to 608.Dq 1,2 . 609.It Cm PubkeyAuthentication 610Specifies whether public key authentication is allowed. 611The default is 612.Dq yes . 613Note that this option applies to protocol version 2 only. 614.It Cm RhostsRSAAuthentication 615Specifies whether rhosts or 616.Pa /etc/hosts.equiv 617authentication together 618with successful RSA host authentication is allowed. 619The default is 620.Dq no . 621This option applies to protocol version 1 only. 622.It Cm RSAAuthentication 623Specifies whether pure RSA authentication is allowed. 624The default is 625.Dq yes . 626This option applies to protocol version 1 only. 627.It Cm ServerKeyBits 628Defines the number of bits in the ephemeral protocol version 1 server key. 629The minimum value is 512, and the default is 768. 630.It Cm StrictModes 631Specifies whether 632.Nm sshd 633should check file modes and ownership of the 634user's files and home directory before accepting login. 635This is normally desirable because novices sometimes accidentally leave their 636directory or files world-writable. 637The default is 638.Dq yes . 639.It Cm Subsystem 640Configures an external subsystem (e.g., file transfer daemon). 641Arguments should be a subsystem name and a command to execute upon subsystem 642request. 643The command 644.Xr sftp-server 8 645implements the 646.Dq sftp 647file transfer subsystem. 648By default no subsystems are defined. 649Note that this option applies to protocol version 2 only. 650.It Cm SyslogFacility 651Gives the facility code that is used when logging messages from 652.Nm sshd . 653The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 654LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 655The default is AUTH. 656.It Cm TCPKeepAlive 657Specifies whether the system should send TCP keepalive messages to the 658other side. 659If they are sent, death of the connection or crash of one 660of the machines will be properly noticed. 661However, this means that 662connections will die if the route is down temporarily, and some people 663find it annoying. 664On the other hand, if TCP keepalives are not sent, 665sessions may hang indefinitely on the server, leaving 666.Dq ghost 667users and consuming server resources. 668.Pp 669The default is 670.Dq yes 671(to send TCP keepalive messages), and the server will notice 672if the network goes down or the client host crashes. 673This avoids infinitely hanging sessions. 674.Pp 675To disable TCP keepalive messages, the value should be set to 676.Dq no . 677.It Cm UseDNS 678Specifies whether 679.Nm sshd 680should look up the remote host name and check that 681the resolved host name for the remote IP address maps back to the 682very same IP address. 683The default is 684.Dq yes . 685.It Cm UseLogin 686Specifies whether 687.Xr login 1 688is used for interactive login sessions. 689The default is 690.Dq no . 691Note that 692.Xr login 1 693is never used for remote command execution. 694Note also, that if this is enabled, 695.Cm X11Forwarding 696will be disabled because 697.Xr login 1 698does not know how to handle 699.Xr xauth 1 700cookies. 701If 702.Cm UsePrivilegeSeparation 703is specified, it will be disabled after authentication. 704.It Cm UsePAM 705Enables the Pluggable Authentication Module interface. 706If set to 707.Dq yes 708this will enable PAM authentication using 709.Cm ChallengeResponseAuthentication 710and PAM account and session module processing for all authentication types. 711.Pp 712Because PAM challenge-response authentication usually serves an equivalent 713role to password authentication, you should disable either 714.Cm PasswordAuthentication 715or 716.Cm ChallengeResponseAuthentication. 717.Pp 718If 719.Cm UsePAM 720is enabled, you will not be able to run 721.Xr sshd 8 722as a non-root user. 723The default is 724.Dq yes . 725.It Cm UsePrivilegeSeparation 726Specifies whether 727.Nm sshd 728separates privileges by creating an unprivileged child process 729to deal with incoming network traffic. 730After successful authentication, another process will be created that has 731the privilege of the authenticated user. 732The goal of privilege separation is to prevent privilege 733escalation by containing any corruption within the unprivileged processes. 734The default is 735.Dq yes . 736.It Cm VersionAddendum 737Specifies a string to append to the regular version string to identify 738OS- or site-specific modifications. 739The default is 740.Dq FreeBSD-20060322 . 741.It Cm X11DisplayOffset 742Specifies the first display number available for 743.Nm sshd Ns 's 744X11 forwarding. 745This prevents 746.Nm sshd 747from interfering with real X11 servers. 748The default is 10. 749.It Cm X11Forwarding 750Specifies whether X11 forwarding is permitted. 751The argument must be 752.Dq yes 753or 754.Dq no . 755The default is 756.Dq yes . 757.Pp 758When X11 forwarding is enabled, there may be additional exposure to 759the server and to client displays if the 760.Nm sshd 761proxy display is configured to listen on the wildcard address (see 762.Cm X11UseLocalhost 763below), however this is not the default. 764Additionally, the authentication spoofing and authentication data 765verification and substitution occur on the client side. 766The security risk of using X11 forwarding is that the client's X11 767display server may be exposed to attack when the ssh client requests 768forwarding (see the warnings for 769.Cm ForwardX11 770in 771.Xr ssh_config 5 ) . 772A system administrator may have a stance in which they want to 773protect clients that may expose themselves to attack by unwittingly 774requesting X11 forwarding, which can warrant a 775.Dq no 776setting. 777.Pp 778Note that disabling X11 forwarding does not prevent users from 779forwarding X11 traffic, as users can always install their own forwarders. 780X11 forwarding is automatically disabled if 781.Cm UseLogin 782is enabled. 783.It Cm X11UseLocalhost 784Specifies whether 785.Nm sshd 786should bind the X11 forwarding server to the loopback address or to 787the wildcard address. 788By default, 789.Nm sshd 790binds the forwarding server to the loopback address and sets the 791hostname part of the 792.Ev DISPLAY 793environment variable to 794.Dq localhost . 795This prevents remote hosts from connecting to the proxy display. 796However, some older X11 clients may not function with this 797configuration. 798.Cm X11UseLocalhost 799may be set to 800.Dq no 801to specify that the forwarding server should be bound to the wildcard 802address. 803The argument must be 804.Dq yes 805or 806.Dq no . 807The default is 808.Dq yes . 809.It Cm XAuthLocation 810Specifies the full pathname of the 811.Xr xauth 1 812program. 813The default is 814.Pa /usr/X11R6/bin/xauth . 815.El 816.Ss Time Formats 817.Nm sshd 818command-line arguments and configuration file options that specify time 819may be expressed using a sequence of the form: 820.Sm off 821.Ar time Op Ar qualifier , 822.Sm on 823where 824.Ar time 825is a positive integer value and 826.Ar qualifier 827is one of the following: 828.Pp 829.Bl -tag -width Ds -compact -offset indent 830.It Cm <none> 831seconds 832.It Cm s | Cm S 833seconds 834.It Cm m | Cm M 835minutes 836.It Cm h | Cm H 837hours 838.It Cm d | Cm D 839days 840.It Cm w | Cm W 841weeks 842.El 843.Pp 844Each member of the sequence is added together to calculate 845the total time value. 846.Pp 847Time format examples: 848.Pp 849.Bl -tag -width Ds -compact -offset indent 850.It 600 851600 seconds (10 minutes) 852.It 10m 85310 minutes 854.It 1h30m 8551 hour 30 minutes (90 minutes) 856.El 857.Sh FILES 858.Bl -tag -width Ds 859.It Pa /etc/ssh/sshd_config 860Contains configuration data for 861.Nm sshd . 862This file should be writable by root only, but it is recommended 863(though not necessary) that it be world-readable. 864.El 865.Sh SEE ALSO 866.Xr sshd 8 867.Sh AUTHORS 868OpenSSH is a derivative of the original and free 869ssh 1.2.12 release by Tatu Ylonen. 870Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 871Theo de Raadt and Dug Song 872removed many bugs, re-added newer features and 873created OpenSSH. 874Markus Friedl contributed the support for SSH 875protocol versions 1.5 and 2.0. 876Niels Provos and Markus Friedl contributed support 877for privilege separation. 878