Host=hhhhPAT the following lines are for hosts that match hhhhPAT
* and ? can be used.
A single * as pattern provides defaults for all hosts.
The host is the hostname argument given on the command line (i.e., the name is not converted to a canonicalized host name before matching).
|
HostName=altHostName to log into, for nicknames or abbreviations .
Numeric IP addresses are permitted Default : name on command line.
| User uname useful when current uname not the same as target host's.
| ConnectionAttempts=n| one per second, before exiting. Default 1.
| ConnectTimeout=sss| instead of the system TCP timeout.
|
EscapeChar x | ^x | none
a single character or ^ followed by a letter or none (disables the escape character making the connection transparent for binary data).
Can be set on the command line.
Default: ~.
| LogLevel=lvlINFO| QUIET| FATAL| ERROR| VERBOSE| DEBUG| DEBUG2 | DEBUG3 Default INFO.
| Port ppp| port number to connect on the remote host. Default: 22.
| CheckHostIP yes|no yes: check IP address in ~/.ssh/known_hosts.
Detect if a host key changed (possibly due to DNS spoofing). Default yes.
Not available for connects with a proxy command.
| StrictHostKeyChecking ask|yes|no
yes do not add host keys to $HOME/.ssh/known_hosts and refuse to connect to hosts whose host key has changed.
Provides protection against trojan horse attacks i.e. hosts pretending to be hostnamexxx.
User must add new hosts.
no : Add new host keys .
ask : New host keys will be added if the user confirms the sshfp.
refuse to connect to hosts whose host key has changed.
Default: ask.
| Protocol 2,1 protocol versions ito support in order of preference.
Default: 2,1. i.e. 2 falls back to 1 if 2 is not available.
| Compression=no|yes default no.
| KeepAlive=yes|no Default yes important in scripts
| HostKeyAlias alias used when looking up or saving the host key.
Useful for tunneling ssh connections or for multiple servers running on a single host.
|
| Forwarding
|
|---|
ClearAllForwardings=no|yes all local, remote and dynamic port forwardings specified in the
configuration files or on the command line be cleared.
Useful from ssh command line to clear port forwardings set in configuration files.
Default for scp and sftp.
The default is no.
| LocalForward port host:port port on the local machine be forwarded to the host:port
from the remote machine.
IPv6 addresses are specified : host/port.
Multiple forwardings may be specified, and additional forwardings can be given on the command line.
Only the superuser can forward privileged ports.
| DynamicForward ppp
TCP/IP port on the local machine be forwarded over the secure channel. The application protocol is then
used to determine where to connect to from the remote machine.
The SOCKS4 protocol is supported, and ssh will act as a SOCKS4 server.
Multiple forwardings may be specified, and additional forwardings can be given on the command line.
Only the superuser can forward privileged ports.
RemoteForward port host:port …
TCP/IP port on the remote machine be forwarded to the specified host :port from the local machine.
IPv6 addresses use host/port.
Multiple forwardings may be specified, and additional forwardings can be given on the command line.
Only the superuser can forward privileged ports.
ForwardAgent=no|yes
the connection to the authentication agent (if any) will be forwarded to the remote machine.
default no.
Caution: Users with the ability to bypass file permissions on the remote host (for the agent's Unix-domain socket) can access
the local agent through the forwarded connection.
| ForwardX11=no|yes
connections will be redirected over the secure channel and $DISPLAY set. default is no.
Caution: Users with the ability to bypass file permissions on the remote host (for the
user's X authorization database) can access the local X11 display
through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring.
| GatewayPorts=no|yes whether remote hosts are allowed to connect to local forwarded ports.
By default, ssh binds local port forwardings to the loopback address. preventing other remote hosts from connecting to forwarded ports.
GatewayPorts can be used to specify that ssh should bind local port forwardings to the wildcard address, thus allowing
remote hosts to connect to forwarded ports.
The default is no.
|
| Authentication
|
|---|
PubkeyAuthentication=yes|no Default: yes. Protocol version 2 only.
| PasswordAuthentication=yes|no Default yes.
| BatchMode=no|yes
yes:passphrase/password querying is disabled.
Useful in scripts and other batch jobs.
Default no i.e. password is requested.
| NumberOfPasswordPrompts n| Default 3.
| ChallengeResponseAuthentication=
yes|no Default yes.
| HostbasedAuthentication=no|yes
Try rhosts based authentication with public key authentication.
default :no.
protocol version 2 and is similar to RhostsRSAAuthentication.
| PreferredAuthentications list, client preferred order of authentication methods,
publickey
keyboard-interactive (a multi-step, challenge-response system.)
password
hostbased verifies the client computer, rather than the user's credentials.
Relies on a pre-established trust relationship between the client host and the server host.
The client machine uses its system-wide host private key to sign the authentication request.
The server checks this against trusted host public keys (in /etc/ssh/ssh_known_hosts).
Once the host is verified, the server checks local configuration files (like ~/.shosts or /etc/ssh/shosts.equiv)
to see if the specific user login is permitted from that machine.
Passwordless: Users log in without entering a password or managing personal SSH keys.
System-Wide: Trust is granted to the entire machine, not a specific user .
Rarely Used
Default : hostbased, publickey, keyboard-interactive, password.
protocol 2
| Cipher 3des| blowfish| des
Default 3des.
(des only supported for interoperability with legacy protocol 1 )
| Ciphers cipher [, … in order of preference
Default :
aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, aes192‑cbc, aes256‑cbc
protocol version 2
| MACs list, Message Authentication Code algorithms in order of preference. .
Default : hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96.
protocol version 2
| HostKeyAlgorithms alg1[,alg2 … host key algorithms the client wants to use (in order of preference).
Default : ssh-rsa,ssh-dss.
protocol version 2
| IdentityFile filename Location of user's RSA or DSA authentication identity.
Default
for protocol 1 $HOME/.ssh/identity ,
for protocol 2 $HOME/.ssh/id_rsa and $HOME/.ssh/id_dsa . Additionally, any identities represented by the
authentication agent will be used for authentication.
Tilde refers to $HOME.
Multiple identity files will be tried in sequence.
| KerberosAuthentication no|yes|
| KerberosTgtPassing no|yes| a Kerberos TGT(Ticket Granting Ticket ) will be forwarded to the server. only if AFS kaserver.
| AFSTokenPassing no|yes | to remote host, protocol version 1 only.
| NoHostAuthenticationForLocalhost
no|yes
Disables Host Authentication for localhost.
Used if the home directory is shared across machines. In this case localhost will refer to a different
machine on each of the machines and the user will get warnings about changed host keys.
The argument to this keyword must
Default: check the host key for localhost.
|
RhostsAuthentication no|yes
Use rhosts based authentication, only affects the client side and has no effect on security.
Requires ssh to be setuid root and UsePrivilegedPort to be yes.
Default : no protocol version 1
| RhostsRSAAuthentication no|yes Use rhosts based authentication with RSA host authentication.
ssh must be setuid root.
Default :no. protocol version 1 only
| RSAAuthentication yes|no
RSA authentication will only be attempted if the identity file exists, or an authentication agent is running.
Default : yes. protocol version 1 only.
| UserKnownHostsFile file default $HOME/.ssh/known_hosts.
| UsePrivilegedPort no|yes use a privileged port for outgoing connections.
If yes ssh must be setuid root.
Set to yes if RhostsAuthentication and RhostsRSAAuthentication are needed with older servers.
Default: no.
| XAuthLocation /path/...progname full pathname of xauth program.
Default : /usr/X11R6/bin/xauth.
|
ControlMaster no|yes|ask
auto | autoask
Share multiple sessions over a single network connection.
| ControlPath string path to the control socket used for connection sharing.
none disable connection sharing.
~ for a user's home directory or the tokens described in the TOKENS section.
ControlPath used for opportunistic connection sharing should include at least %h, %p, and %r (or alternatively %C) and
be placed in a directory that is not writable by other users to ensures that shared connections are unique.
| ControlPersist yes|no|sss|hh:mm:ss
With ControlMaster waiting for future client connections:
yes or 0, the master connection remains open until closed with ssh -O exit).
no the master connection closes as soon as the initial client connection is closed.
For sss seconds or until hh:mm:ss
the backgrounded master connection will terminate after it has remained idle (with no client connections) for the specified time.
| ProxyCommand none|commands
Commands to use to connect to the server with /bin/sh.
%h the host name to connect and %p the port.
The command reads from standard input and writes to standard output.
Before connecting to an sshd or execute sshd -i some where.
Host key management will use the HostName of the host being connected (defaulting to the name typed by the user).
Setting the command to none disables this option.
| SmartcardDevice /dev/smcard
device to use to communicate with a smart card used for storing the user's private RSA key.
default, no device is specified and smartcard support is not activated.
| CompressionLevel n| 1 (fast) to 9 (slow, best). Default:6, See gzip. Protocol version 1 only.
| BindAddress iface interface to transmit from Only if UsePrivilegedPort is yes.
| GlobalKnownHostsFile file Default /etc/ssh/ssh_known_hosts
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |