Config-Model-OpenSsh-2.8.7.1/0000755000175000017500000000000014160662115014153 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/README-build-from-git.md0000644000175000017500000000372414160662115020257 0ustar domidomi# How to build Config::Model::OpenSsh from git repository `Config::Model::OpenSsh` is build with [Dist::Zilla](http://dzil.org/). This page details how to install the tools and dependencies required to build this module. ## Install tools and dependencies ### Debian, Ubuntu and derivatives Run $ sudo apt install libdist-zilla-perl libdist-zilla-app-command-authordebs-perl $ dzil authordebs --install $ sudo apt build-dep libconfig-model-openssh-perl The [libdist-zilla-app-command-authordebs-perl package](https://tracker.debian.org/pkg/libdist-zilla-app-command-authordebs-perl) is quite recent (uploaded on Dec 2016 in Debian/unstable) and may not be available yet on your favorite distribution. ### Other systems Run $ cpamn Dist::Zilla $ dzil authordeps -missing | cpanm --notest $ dzil listdeps --missing | cpanm --notest NB: The author would welcome pull requests that explains how to install these tools and dependencies using native package of other distributions. ## Build Config::Model::OpenSsh Run dzil build or dzil test `dzil` may complain about missing `EmailNotify` or `Twitter` plugin. You may ignore this or edit [dist.ini](dist.ini) to comment out the last 2 sections. These are useful only to the author when releasing a new version. `dzil` may also return an error like `Cannot determine local time zone`. In this case, you should specify explicitely your timezone in a `TZ` environement variable. E.g run `dzil` this way: TZ="Europe/Paris" dzil test The list of possible timezones is provided by [DateTime::TimeZone::Catalog](https://metacpan.org/pod/DateTime::TimeZone::Catalog) documentation. ## Model generation Ssh model can be regenerated from ssh man pages with the following steps: * make sure that `ssh_config` and `sshd_config` man pages are available * Run `perl contrib/parse-man.pl` * Inspect the result * Then build the module as shown above For more details, see this [readme file](contrib/README.org) Config-Model-OpenSsh-2.8.7.1/META.json0000644000175000017500000000474514160662115015606 0ustar domidomi{ "abstract" : "OpenSSH config editor", "author" : [ "Dominique Dumont" ], "dynamic_config" : 0, "generated_by" : "Dist::Zilla version 6.024, CPAN::Meta::Converter version 2.150010", "license" : [ "lgpl_2_1" ], "meta-spec" : { "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec", "version" : 2 }, "name" : "Config-Model-OpenSsh", "prereqs" : { "build" : { "requires" : { "Config::Model" : "2.146", "Module::Build" : "0.34" } }, "configure" : { "requires" : { "Module::Build" : "0.34" } }, "develop" : { "requires" : { "ParseMan" : "0", "Path::Tiny" : "0", "Test::Differences" : "0", "Test::More" : "0", "Test::Perl::Critic" : "0", "XXX" : "0" } }, "runtime" : { "recommends" : { "App::Cme" : "0", "Config::Model::TkUI" : "0" }, "requires" : { "Carp" : "0", "Config::Model" : "2.146", "Config::Model::Backend::Any" : "0", "File::Copy" : "0", "File::HomeDir" : "0", "File::Path" : "0", "IO::File" : "0", "Log::Log4perl" : "1.11", "Mouse" : "0", "Mouse::Role" : "0", "perl" : "5.012" } }, "test" : { "requires" : { "Config::Model" : "2.146", "Config::Model::BackendMgr" : "0", "Config::Model::Tester" : "4.001", "Config::Model::Tester::Setup" : "0", "English" : "0", "Path::Tiny" : "0", "Test::Differences" : "0", "Test::More" : "0", "Test::Pod" : "1.00", "Test::Warn" : "0" } } }, "release_status" : "stable", "resources" : { "bugtracker" : { "mailto" : "ddumont at cpan.org", "web" : "https://github.com/dod38fr/config-model-openssh/issues" }, "homepage" : "https://github.com/dod38fr/config-model/wiki", "repository" : { "type" : "git", "url" : "git://github.com/dod38fr/config-model-openssh.git", "web" : "http://github.com/dod38fr/config-model-openssh.git" } }, "version" : "2.8.7.1", "x_generated_by_perl" : "v5.32.1", "x_serialization_backend" : "Cpanel::JSON::XS version 4.27", "x_spdx_expression" : "LGPL-2.1" } Config-Model-OpenSsh-2.8.7.1/weaver.ini0000644000175000017500000000022014160662115016137 0ustar domidomi[@Default] [-Transformer] transformer = List [Support] perldoc = 0 bugs = metadata websites = search,ratings,kwalitee,testers,testmatrix,deps Config-Model-OpenSsh-2.8.7.1/SIGNATURE0000644000175000017500000002021514160662115015437 0ustar domidomiThis file contains message digests of all files listed in MANIFEST, signed via the Module::Signature module, version 0.87. To verify the content in this distribution, first make sure you have Module::Signature installed, then type: % cpansign -v It will check each file's integrity, as well as the signature's validity. If "==> Signature verified OK! <==" is not displayed, the distribution may already have been compromised, and you should not run its Makefile.PL or Build.PL. -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 SHA256 0c20533c1f84885de093f4440b030e4b1b31fa2246787ebba9ac123156b20429 Build.PL SHA256 7e50be3672bcf92576d883651d8e0a1a19927d57811ca8bc46eb98b4df9ebec1 Changes SHA256 f0de0cd7339b272e8462f0fb27c36834014ea4ff1bdc31e3c264a90a240bcf87 LICENSE SHA256 a104d5d7368a5b6f7e6b858560afbce96cb2622f1de2c9ee87e8d2b984c407eb MANIFEST SHA256 83cde117e56bb7e27ac1846c47cb0914793253fd150e300b62a084d10a50f6d1 MANIFEST.SKIP SHA256 702c7fd9a117230ef137c265241c6756ae72c67a272fa2414f659a3d3957a986 META.json SHA256 e9f0ff06951f29ad36292fcc39893b79b0315f55378d4d613b78cbd9329b1617 META.yml SHA256 a5c6e1e0f286d00ccbdf52b78719d6470efa951509f195d047f2c94bbb84bc93 README-build-from-git.md SHA256 03196295c148eb819152bf0563710a9a4cc67bf058dd8c28664918a0ba9f00b2 README.pod SHA256 a99baade319dd6eec826f49739aff6d351737c6533c1b5d92851f4779409eb28 contrib/README.org SHA256 cae9d5c67e9b6182ae33b6b75416b80cd96404fd966832a93b12b7873e37c20f contrib/fixup-element-ipqos.yml SHA256 171381101d6e0ce162dda5e90ccbe5e4a231c93c798148be42ad9a6fc4770779 contrib/lib/ParseMan.pm SHA256 35d2269d2e89acc8cd3964a9cce91904b46695a6ddc8458fff76581367ce07b2 contrib/parse-man.pl SHA256 12db64f16f51e266b3c040cd01a830284ce6f82e0d78b8e9853de0192ae9b474 contrib/ssh-fixup.yaml SHA256 660f02c5d6d16a2c4e9261b100745ab97671864065c3fc3675533e7a3e1376ce contrib/ssh-portforward.yml SHA256 6037fafb1c2988c223c447ef8edcbf754b6e0844812c745320322f0643c04120 contrib/sshd-fixup.yaml SHA256 7dfc2e3e97cf0f457a3adf55ac125d9384a67498c7922e2a5be9c66c0148f856 contrib/sshd-matchblock.yml SHA256 3c4b96244f3832070a713a15423d4def0b8f1c32ff652b43f39ea30f4d8230c7 contrib/sshd-matchcondition.yml SHA256 0a69a85ec92f43a559c0e63c013e5f16dd05989e10f551786170edfe3148b977 contrib/systemssh.yml SHA256 729329669ba9d0d45b2f7037f5675d8c1e2d9261d3835d4a76f4ca6347a7b36d lib/Config/Model/Backend/OpenSsh/Role/MatchBlock.pm SHA256 1f5b0ca148ce056f6917b1bd9093466f64ddc5d28576d73da2028703170ff6f6 lib/Config/Model/Backend/OpenSsh/Role/Reader.pm SHA256 f8ba9aa1e0799bfac313d71bbbf3107c00f3301f0e34c35512442a9fd8aa43af lib/Config/Model/Backend/OpenSsh/Role/Writer.pm SHA256 6a1e2b955815b84dacf4e6cdff17d8fa70acfa32edfe49d45f1a1b0eb24de045 lib/Config/Model/Backend/OpenSsh/Ssh.pm SHA256 cfc8ed92dc44b01e308f4ff2794b563c4ffde51edbd7c60d6e808bd2b3a407f8 lib/Config/Model/Backend/OpenSsh/Sshd.pm SHA256 eb1bb18a8b69d00db631880b67d2354a9870a7c3638aa9ef0ed0d41ec5842314 lib/Config/Model/OpenSsh.pm SHA256 cffe7159366910655f358aea6ce92d98a73a841290c80da5f57d2efdf16e5a8e lib/Config/Model/models/Ssh.pl SHA256 050f4621a7549ed8cca454409905d3feeb2cabaa60f5acd6b394151478d6e8a9 lib/Config/Model/models/Ssh.pod SHA256 346d2ef886d28b501ee1c4acbe75509f8e6ef5d47b7903eb1460d350bb4d12ec lib/Config/Model/models/Ssh/HostElement.pl SHA256 e5025ef915daaa0941ee2ec8a46a18a24b1f6233236a888b42457d529d296406 lib/Config/Model/models/Ssh/HostElement.pod SHA256 c5a0f83ef95e41c05b618c122d85e36c990dd82fabdb2b61249ab6bb6c557c60 lib/Config/Model/models/Ssh/PortForward.pl SHA256 1b4d0a8fc9c625d9f9ca4e7384673f0a7744c44f31219f391551e7eeb4fa8514 lib/Config/Model/models/Ssh/PortForward.pod SHA256 fdb0f6246a13500c0acfe6cdbd0e711cf46d090eb27ee23469bf2c8c54983600 lib/Config/Model/models/Sshd.pl SHA256 bc765e8e639949d55db092d2892482502d3c7394fa88ce08b8db672599d4777b lib/Config/Model/models/Sshd.pod SHA256 c202e1e5be95784c407c296032e13bf471104f67b6f486870f31e2a7099fdbac lib/Config/Model/models/Sshd/MatchBlock.pl SHA256 e3f1bd3987b2f61e10cfb8e849890f13743bdb0f8da2d42b9416e0f95572c972 lib/Config/Model/models/Sshd/MatchBlock.pod SHA256 92bb75f27cf1f8d4a887fa4ac2c63a16d6def3d2a80dcba6dadc0f60bad4449f lib/Config/Model/models/Sshd/MatchCondition.pl SHA256 c5014f54f5c9e719b075a97d620e8f1cdb75a7ef62f13fe7be741c4779a7e89d lib/Config/Model/models/Sshd/MatchCondition.pod SHA256 ffd0f05b89a77b92713366a34eee23989e77377e035e301418b96237459c82ad lib/Config/Model/models/Sshd/MatchElement.pl SHA256 22c6a07e79ddd9819c1c3bc856f326fd70b980f60c347211f5953052eeb511e8 lib/Config/Model/models/Sshd/MatchElement.pod SHA256 c464b8ce6b833a6f67a2ea39f3f3be2254aa48f30f0d48cae9a7eb0c02d26c8e lib/Config/Model/models/SystemSsh.pl SHA256 8ea1fde028f7a0a9c90183a46b90029449f70bd330d57f29d402f97bcbde349e lib/Config/Model/models/SystemSsh.pod SHA256 abc411a045e7ebd2b6e7f69e235fdcd3d6e751ec1e5389cd33302ca5a51cab02 lib/Config/Model/system.d/sshd SHA256 2a092e1f33fae5651bf43844466a2674b415be82bedfdc8e4ffbdbe2f06e373e lib/Config/Model/system.d/system-ssh SHA256 8c1b6804023efde823bc2923c59df15b50550203adb30c59d78998484573861d lib/Config/Model/user.d/ssh SHA256 37b0c1e42f32b65108338d788b851bea3546fc6558cf993603155b214a707bff t/README.md SHA256 ff73e81be54b2fbf1cbd85d3265f7f07dfb617b9bc0574ff2a6c38fe090715ea t/author-critic.t SHA256 5b72eec83c4d654ff6aaa40da83f190c95f14bded23efe04769557d2f5b5224d t/custom_sshd.t SHA256 268b76551bebacaa6bbf57127b0cf9a71778640e05456358b243c064ea825659 t/custom_sshd_match.t SHA256 ae4f766645640b4759a6f6ee038a5aae3d81f2aac5570d48c36bb7ea8b0c98a9 t/model_tests.d/ssh-examples/bad-forward/user_ssh_config SHA256 e21f71e65baee8bf50a952c701f7ca4d6453e58e21db44cff9c6827f10ba8187 t/model_tests.d/ssh-examples/bad-pref-auth/user_ssh_config SHA256 be250e1d18e69d56d68983e576ca6c58a62fefb2ca454f3bb7306d917179661a t/model_tests.d/ssh-examples/basic/user_ssh_config SHA256 59acb818b7dffddc2fa07e100d988b040af28410f6ea38fd983e96cd886b5eeb t/model_tests.d/ssh-examples/delete-user-file/user_ssh_config SHA256 eed979fad7725af4b9aee83d640b7d37212f6962a13318107de38983095aa89b t/model_tests.d/ssh-examples/legacy/user_ssh_config SHA256 b0debeeb03ee6500b0ff686223914c40015d5a1f11923797b5457aec2085c449 t/model_tests.d/ssh-test-conf.pl SHA256 b3769d0b98ed939aaf5d0b0b51770a96c26fd9fcb1e29944eb7d9f727e548c84 t/model_tests.d/sshd-examples/bad-password-authentication/system_sshd_config SHA256 e054ac4377cad69c9a274e095850eb03bf400cfb9bf8029650e8ff22683ab01a t/model_tests.d/sshd-examples/debian-bug-671367/system_sshd_config SHA256 d0ccebdea2f3480cb340bd1d6a878191dbb35a337133de6cc6ab92209ef8cf5e t/model_tests.d/sshd-test-conf.pl SHA256 332cb8ef463668773cab5d80022a65778ab2ce3b8f01fd0f63dc639fb5a80afe t/model_tests.d/system-ssh-examples/basic/system_ssh_config SHA256 ee95bb0323ce1ee2c45d9d39e41a295ccbfd717d886d6b91e4e14bac146d65c1 t/model_tests.d/system-ssh-test-conf.pl SHA256 a191f3fad4325c3f95ce7c368ec005ac64956d78b8b2198e42d035cc1053c685 t/model_tests.t SHA256 5bea52d8d41af37e3a4e119badf37f8e0bb7b9e8830f33d9d88a07dce34b5769 t/pod.t SHA256 369f67a4d86e14d9fa1f7ca17c1b7fad78969b75c174bb9e7309afbffbc0114e t/ssh_config.t SHA256 dc2e6b91767be659e12635d5f3a07055c69d4f57431492be23fc06935414ba6f weaver.ini SHA256 cadcc45b9af8977e2c4c89d087ea88b8acecd085068c74cf18b5c8ac915cc2a6 xt/parser.t SHA256 13cb35d21552373cf5cb22d21f6cb18f46b128ba1cb920c66d4c241d0afa0e5a xt/ssh_config.html SHA256 c1158276415b2fa85727520a00bbd7638dc3c67eb7319aa67a65c57342aaaa59 xt/sshd_config.html SHA256 8a919a9c429e050c610be4ce57f2d8812b8d264a85160eae7973ecda17c59f98 xt/sshd_parser.t -----BEGIN PGP SIGNATURE----- iQIzBAEBAwAdFiEEn3I5/LZk8Qsz6dwDwx9P2UmrK2wFAmHDZE0ACgkQwx9P2Umr K2wszQ//T+KS4MnD+s6nNFfo5mxpGwRvUiSUNPuQxbsc6gzltGAzDLO6IHnqTcT9 RllErWVhiVX7Zsfi64lBkN7yCEia2pu734sl6KHQ7UJynJZa6ObIBt4+O61+xKAA Xkyb/77kvMXFpnx3/lpXq0w5eeDSTPmwZNyPvcjnESXmJGi8yZiHh+MCXwunV8hj T4h7FmoOKQ2sHCy3TLlhx4OVpP6dyUH9Uh99g3MkJhDw6NIZQ3EhC13TdXY+xIbw wMBuxF5kWmrej1Ij3amqHmNUqS97ShiXfE84oCSTgoJf2OCUFUuM7v2LLhz+2LMM FQheEbucWoPSSLmXlEsFQqLfSx6HyjIuFnE0fabHo4bWZIM51meRpbiH1BzxQafB ER3s5UT+7P77FUhnN08+i5WCAjdZ8H5lkTVsLRFolh0MF1NgwwOKhTey3XCl5G+U 5bI18S2I2GBrjJV+cFDxQxPAO6l5dtgOh16VBv90LZRkR3NE8tQMw+BGABS/0WvK YWcvMhkJVGDPn7kPEvKDDjRhjUEW8V9b1dzFc11PCt9yxkACLGUybHuW5wDleBL7 QRMlovfsiKfX3isCsuc2V80dOsE7eXaMKqfTBXCvaGryyeqtinoMu68Z4mIdUu7F O/vpcdvhPk2sDy/vLyOpXGQXr5y8wZfZUeGjpW9tbi+qoSS7C80= =KWjU -----END PGP SIGNATURE----- Config-Model-OpenSsh-2.8.7.1/Changes0000644000175000017500000003531614160662115015456 0ustar domidomi2.8.7.1 2021-12-22 Update: * Support for OpenSsh 8.7 * Added migration instructions for some parameters deprecated between OpenSsh 8.4 and 8.7 Bug fix related to generation of OpenSsh model: * fix (model generation): add deprecated elements * fix (ParseMan): handle description like "supported keywords are..." * fix (model generation): override value types of PerSource* * fix (model): improve warning about identity file * fix (parse-man.pl): improve user messages * fix (model generation): avoid long unbreakable lines (origin/master) Other changes: * build depends on Config::Model 2.146 2.8.4.3 2021-05-07 Bug fixes: * Keep order of Host and Match sections (fix #6) * No longer use content of /etc/ssh/ssh_config as upstream default values for ~/.ssh/config. See commit 766442b log for details * Fix crash when starting with empty user file (fix #5) * docs: fix typos and grammar 2.8.4.2 2021-01-13 Update: * Support for OpenSsh 8.4 * update copyright year 2.8.0.1 2019-09-08 Update: * Support for OpenSsh 8.0 Bug fix related to generation of OpenSsh model: * fix storage of description text * change quoted text to text with bold font * replace utf-8 quote with ascii quote 2.7.9.2 2019-06-14 This release fixes CI/CD bugs: * Work around Dzil bug that break tests on travis. * Fix statement in test not compatible with perl 5.12 2.7.9.1 2019-06-10 The main visible changes of this release are: * Support for OpenSsh 7.9 * A new version number scheme: v... Under the hood, the major change of this release is the way Ssh and Sshd model are updated. It used to be a manual work (which explain why only OpenSsh 6.4 parameters were supported). Now the model is generated from ssh_config and sshd_config manuel pages. All parameters from OpenSsh 7.9 are supported and obsolete parameters are silently dropped or migrated to new parameters. Other changes: * update test specifications (requires Config::Model::Tester 4.001) * require Config::Model 2.134 1.241 2018-12-01 * Tests require Config::Model 2.128 (gh #4) 1.240 2018-11-30 Fix behavior of 'cme -force' so user can load ssh config files containing errors: * allow force load when Match block contain bad data * propagate 'check' when setting check_list parameter (require Config::Model 2.127) Model update: * PortForward parameter: port must be alphanumeric 1.239 2018-05-08 * OpenSsh backend: fix backend (broke with Config::Model 2.123, requires Config::Model 2.123. Sorry about the mess). * added t/README.md * remove deprecated suffix method 1.238 2017-10-08 * udpated models to use new rw_config parameter (requires Config::Model 2.111) * update Ciphers parameter * UseLogin parameter is deprecated 1.237 2016-03-07 * Fix tests broken by Config::Model 2.080 changes (RT #112736) * Build.PL: avoid dependency on cme to build doc * dist.ini: * updated to use github's bug tracker - removed build dependency on Tk * updated README.pod to use cme meta edit 1.236 2014-05-22 * removed experience parameters from OpenSsh model with config-model-edit * removed build time dependency on AnyEvent * warn and propose a fix when public key is used as IdendityFile 1.235 2014-04-04 * tweak test to be compatible with Config::Model >= or < 2.052 * fix man pages abstract section (for Pod::Weaver) 1.234 2014-03-01 * fixed skipped test count in ssh_config.t to enable cpanm installation (RT 93314) * test $inst->has_warning (requires Config::Model 2.050) 1.233 2014-02-13 * Ssh backends: send a clear error message when unknown parameters are found (RT 92639) * Ssh: added deprecated UseRSh and FallBackToRsh (RT 92639) 1.232 2013-12-29 * Ssh::GSSAPI* params: set upstream_default to 0 (instead of default) * fixed typo in Sshd::MatchCondition description (tx gregoa) 1.231 2013-12-23 * Added parameters supported by OpenSsh 6.4 (i.e. IgnoreUnknown ForwardX11Timeout GatewayPorts GSSAPIKeyExchange GSSAPIClientIdentity GSSAPIServerIdentity GSSAPIDelegateCredentials GSSAPIRenewalForcesRekey GSSAPITrustDns IPQoS KexAlgorithms PKCS11Provider AllowAgentForwarding AuthenticationMethods AuthorizedKeysCommand AuthorizedKeysCommandUser AuthorizedPrincipalsFile ChrootDirectory GSSAPIStoreCredentialsOnRekey HostCertificate HostKeyAgent MaxSessions PermitBlacklistedKeys PubkeyAuthentication RekeyLimit RevokedKeys RhostsRSAAuthentication TrustedUserCAKeys VersionAddendum) 1.230 2013-08-27 This new release now works on MacOS X. It does take into account the different location of ssh configuration files compared to Linux or BSD. * Fixed tests for MacOS X 1.230_04 2013-08-19 * Depends on Config::Model 2.041 * Build depends on Config::Model::Tester 2.042 1.230_03 2013-08-09 * Load EV at beginning of test to avoid failure in CPAN smoke tests. 1.230_02 2013-08-08 * Load AnyEvent at beginning of test to avoid failure in CPAN smoke tests. 1.230_01 2013-08-07 * Fixed dist.ini to tweak $VERSION in all module files 1.229 2013-07-23 * fixed dist::zilla files to include .ssh dir needed for tests 1.228 2013-07-21 [ Usage changes ] * 'cme edit ssh|sshd|system-ssh' is now working on MacOS X * '/etc/ssh/ssh_config' is now handled by system-ssh. I.e. use 'cme edit system-ssh' to change this file * root user can edit its ~/.ssh/config file like any other user with 'cme edit ssh'. [ Bug fixes ] * corrected OpenSSH project name (was OpenSsh) * ssh backend: fix bug that prevented reading user file with global parameters * Ssh model: allow config file creation [ Other changes ] * renamed ChangeLog in Changes * Ssh model: use new default layer from C::M 2.040 to read system config file (hence the updated requirement on Config::Model 2.040) * All backends: removed custom code to open file. Lets Config::Model::BackendMgr handle this 2013-04-04 - 1.227 * Removed Augeas backend (no longer needed, comments are handled by Config::Model::Backend::OpenSsh) * Removed unused deps (File::Slurp) * Replaced Any::Moose with Mouse. Directly depend on Mouse. Removed dependency on Any::Mooose 2012-12-07 - 1.226 * ssh model: + added ControlPersist parameter + added Re-Build parameter (fix RT #81346) * Changed experience of Control* parameters to beginner * backend: ensure clear error message if Host is used in sshd_config * updated demos to use cme * use cme gen-class-pod to re-build when necessary * updated Config::Model dependency to 2.026 for this 2012-10-28 Dominique Dumont v 1.225 Doc and demo fix release * updated demos to use cme instead of deprecated config-edit * likewise, clean up pod doc to use cme command * removed non utf-8 char from ssh doc (Fix RT 79077) 2012-05-22 Dominique Dumont v 1.224 * Backend: make sure that AuthorizedKeysFile items are written on a single line. * Depends on Config::Model 2.017 (which has a correct dependency list). * Note to distro packagers: this dependency on Config::Model 2.017 is required for people installing this module with cpanm and for Perl smoke tests. From a feature point of view, this module requires only Config::Model 2.015 2012-05-18 Dominique Dumont v 1.223 * Added build-dependencies required by t/model_test.t (which use Config::Model::Tester) * Fix sshd-test-conf.pl to avoid test failure due to Text::Balanced warnings with perl 5.15 2012-05-16 Dominique Dumont v 1.222 * added AuthorizedKeysFile2 parameter (See Debian #671367) and migration from AuthorizedKeysFile2 to AuthorizedKeysFile to help migration from Debian Squeeze to Wheezy * replaced deprecated get_all_indexes with fetch_all_indexes * depends on Config::Model 2.015 2012-04-25 Dominique Dumont v 1.221 * Ssh model: ControlMaster also supports auto keyword (tx to harleypig and Daniel Dehennin) Closes Debian #670319 * Test: Fix skip count when test is run as root (fix smoke test failures) 2012-02-20 Dominique Dumont v 1.220 * Fix test to force write back even if no data were changed in the test (Fix FTBS Debian #660371 and Ubuntu #935221) * This fix depends on Config::Model 2.004 * Requires perl 5.10 * Move runtime dependencies in configure-requires as config::model is called by Build.PL to (re)generate pod (see also RT73611) 2011-12-07 Dominique Dumont v 1.219 * Ssh model: do not warp LocalForward with GatewayPorts. They are independant * Ssh backend: store root config in layered data instead of preset data (also fix RT#72916) * Depends on Config::Model 1.265 2011-07-22 Dominique Dumont v 1.218 * OpenSsh backend: Fix bug that tried to open a file in /etc when saving ssh config as a regular user. 2011-05-11 Dominique Dumont v 1.217 * All Backend: test value with length instead of defined (avoid keyword without value lines) * added Test::Difference build dependency * lib/Config/Model/user.d/ssh: added forgotten user file for ssh 2011-04-11 Dominique Dumont v 1.216 * All: use Any::Moose instead of plain Moose * depends on Any::Moose (fix RT# 67307) 2011-04-04 Dominique Dumont v 1.215 * All models: Added author, license and class_description * Added generated documentation from configuration classes. * Requires Config::Model 1.236 2011-03-03 Dominique Dumont v 1.214 * Fixed Build.PL to install files from lib/.../system.d/ * Fixed Ssh backend to write Host pattern annotations/comments 2011-02-28 Dominique Dumont v 1.213 * Fixed MANIFEST.SKIP to remove cruft shipped by Dist::Zilla. As downstream packager, I was not amused :/ 2011-02-23 Dominique Dumont v 1.212 * Fixed Build.PL to include prereqs computed by Dist::Zilla 2011-02-21 Dominique Dumont v 1.211 * *.t: fixed tests (Fix Debian bug #605792) * demo: split user and maintainer demo * removed config-edit-*. config-edit now has auto-completion and can be invoked with '-application ssh' or '-application sshd' * removed dependency on Parse::RecDescent * depend on Config::Model 1.234 * Single backend was split in 3 (OpenSsh, Ssh and Sshd) to benefit from C::M::Backend::Any 2010-02-02 Dominique Dumont * demo/demo.pl (my_system): new demo (requires Config::Model::Itself) 2010-01-24 Dominique Dumont * lib/Config/Model/models/Ssh/PortForward.pl: host and hostport are mandatory 2010-01-22 Dominique Dumont v1.210 * lib/Config/Model/OpenSsh.pm: Modified to read and write Port forward information from PortForward config class. * lib/Config/Model/models/Ssh/PortForward.pl: New configuration class to make ssh port forwarding configuration easier. 2010-01-18 Dominique Dumont v1.209 * lib/Config/Model/models/Sshd.pl: Added automatic migration of data from deprecated KeepAlive parameter to TCPKeepAlive parameter. This enables an automatic migration from old sshd config to new syntax. * lib/Config/Model/models/Ssh/HostElement.pl: Since ssh_config doc mentions that LocalForward and RemoteForward can be specified several times, these 2 parameters are changed from leaf to a list of leaf. * lib/Config/Model/models/Ssh.pl: As specifying Host block as list of patterns and content was not practical, the Host element in Ssh model was changed from list of HostBlock nodes to hash of HostElement. The Host patterns is used as the key of the hash. This enables a better view of shh configuration in the GUI. * lib/Config/Model/OpenSsh.pm (assign): Store value in uniline leaf even with embedded white spaces. (write_all_host_block): adapted to Host structure change in model 2009-09-10 Dominique Dumont v1.208 * lib/Config/Model/models/**.pl: Changed 'level' of some elements to 'important' so the new wizard provided by C::M::TkUI will show the most imporant ssh and sshd configuration parameters. 2009-07-29 Dominique Dumont v1.207 * t/ssh_config.t: When run as root, skip the tests that must be run as regular user. (Fix Debian FTBS) * lib/Config/Model/models/Ssh/HostElement.pl: Fix model error: ServerAliveInterval is an integer, not a boolean 2009-06-24 Dominique Dumont v1.206 * Build.PL: added forgotten dependency on Parse::RecDescent. Depends on Config::Model 0.637 2009-06-23 Dominique Dumont * lib/Config/Model/models/**.pl: replaced deprecated 'built_in' model parameter with 'upstream_default'. (In fact I just had to run "config-model-edit -model Ssh -save" (from Config::Model::Itself)) 2009-04-11 Dominique Dumont v1.205 * lib/Config/Model/OpenSsh.pm (read_ssh_file): fix bug that breaks with Config::Model 0.635 2009-03-09 Dominique Dumont v1.204 * t/ssh_config.t: Removed unused options that broke with Config::Model 0.634 * config-edit-ssh: Update documentation 2009-02-03 Dominique Dumont v1.203 * t/augeas_*.t: Do the exec only if Augeas part can be tested. Use $^X in exec instead of 'perl'. This should also fix tests in CPAN. 2009-02-02 Dominique Dumont v1.202 * t/augeas*.t : Changed Augeas locale workaround to reduce the number of test failures in CPAN tests. 2009-01-29 Dominique Dumont v1.201 * config-edit-sshd: added workaround Augeas locale bug * Sshd files: Major bug fixes for Augeas integration * lib/Config/Model/OpenSsh.pm (read_ssh_file): Fix: Host names are separated by white spaces and not comma 2008-11-16 Domi * lib/Config/Model/models/Sshd.pl: Added write through Augeas so comment in /etc/ssh/sshd_config can be preserved (requires Augeas and Config::Model::Backend::Augeas) * config-edit-ssh: new command line to edit ~/.ssh/config file (as normal user) or /etc/ssh/ssh_config (as root) 2008-05-26 Dominique Dumont v0.104 * all: changed module name from Sshd to OpenSsh 2008-05-24 Dominique Dumont v0.103 * lib/Config/Model/Sshd.pm (): Added doc * config-edit-sshd: new file Config-Model-OpenSsh-2.8.7.1/xt/0000755000175000017500000000000014160662115014606 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/xt/sshd_parser.t0000644000175000017500000000375114160662115017316 0ustar domidomiuse strict; use warnings; use lib qw(contrib/lib); use 5.22.0; use ParseMan; use Test::More; use Test::Differences; use Path::Tiny; use experimental qw/postderef signatures/ ; my $html = path('xt/sshd_config.html')->slurp; my $data = parse_html_man_page($html); subtest "man page transformation" => sub { # test some data items is($data->{element_list}[0],'AcceptEnv', "first element name"); is($data->{element_list}[5],'AllowTcpForwarding', "5th element name"); }; subtest "test generation of model string" => sub { my @unilines = qw/AuthorizedKeysCommand/; my $boolean = sub { return "type=leaf value_type=boolean write_as=no,yes upstream_default=$_[0]"; }; my $enum = sub ($set,$def = undef) { my $str = "type=leaf value_type=enum choice=$set"; $str .= " upstream_default=$def" if defined $def; return $str; }; my %expected_load = ( # AddKeysToAgent => $enum->('yes,confirm,ask,no', 'no'), AddressFamily => $enum->('any,inet,inet6', 'any'), AllowStreamLocalForwarding => $enum->('yes,all,no,local,remote','yes'), AllowGroups => 'type=list cargo type=leaf value_type=uniline', AllowUsers => 'type=list cargo type=leaf value_type=uniline', AuthorizedKeysFile => 'type=list cargo type=leaf value_type=uniline', MaxStartups => 'type=leaf value_type=uniline upstream_default=10', X11Forwarding => $boolean->('no'), ); foreach my $p (@unilines) { $expected_load{$p} = 'type=leaf value_type=uniline'; } foreach my $param ($data->{element_list}->@*) { my @desc = $data->{element_data}{$param}->@*; my $load = create_load_data(sshd => $param => @desc); # check only some of the parameters if (defined $expected_load{$param}) { note("test failed with @desc") unless $load eq $expected_load{$param}; is($load, $expected_load{$param}, "check generated load string of $param"); } } }; done_testing; Config-Model-OpenSsh-2.8.7.1/xt/sshd_config.html0000644000175000017500000017367014160662115020000 0ustar domidomi

SSHD_CONFIG(5) BSD File Formats Manual SSHD_CONFIG(5)

NAME

sshd_config — OpenSSH SSH daemon configuration file

DESCRIPTION

sshd(8) reads configuration data from /etc/ssh/sshd_config (or the file specified with -f on the command line). The file contains keyword-argument pairs, one per line. For each keyword, the first obtained value will be used. Lines starting with ’#’ and empty lines are interpreted as comments. Arguments may optionally be enclosed in double quotes (") in order to represent arguments containing spaces.

Note that the Debian openssh-server package sets several options as standard in /etc/ssh/sshd_config which are not the default in sshd(8):

•

ChallengeResponseAuthentication no

•

X11Forwarding yes

•

PrintMotd no

•

AcceptEnv LANG LC_*

•

Subsystem sftp /usr/lib/openssh/sftp-server

•

UsePAM yes

The possible keywords and their meanings are as follows (note that keywords are case-insensitive and arguments are case-sensitive):

AcceptEnv

Specifies what environment variables sent by the client will be copied into the session’s environ(7). See SendEnv and SetEnv in ssh_config(5) for how to configure the client. The TERM environment variable is always accepted whenever the client requests a pseudo-terminal as it is required by the protocol. Variables are specified by name, which may contain the wildcard characters ’*’ and ’?’. Multiple environment variables may be separated by whitespace or spread across multiple AcceptEnv directives. Be warned that some environment variables could be used to bypass restricted user environments. For this reason, care should be taken in the use of this directive. The default is not to accept any environment variables.

AddressFamily

Specifies which address family should be used by sshd(8). Valid arguments are any (the default), inet (use IPv4 only), or inet6 (use IPv6 only).

AllowAgentForwarding

Specifies whether ssh-agent(1) forwarding is permitted. The default is yes. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

AllowGroups

This keyword can be followed by a list of group name patterns, separated by spaces. If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns.

AllowStreamLocalForwarding

Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. The available options are yes (the default) or all to allow StreamLocal forwarding, no to prevent all StreamLocal forwarding, local to allow local (from the perspective of ssh(1)) forwarding only or remote to allow remote forwarding only. Note that disabling StreamLocal forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

AllowTcpForwarding

Specifies whether TCP forwarding is permitted. The available options are yes (the default) or all to allow TCP forwarding, no to prevent all TCP forwarding, local to allow local (from the perspective of ssh(1)) forwarding only or remote to allow remote forwarding only. Note that disabling TCP forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders.

AllowUsers

This keyword can be followed by a list of user name patterns, separated by spaces. If specified, login is allowed only for user names that match one of the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. HOST criteria may additionally contain addresses to match in CIDR address/masklen format. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns.

AuthenticationMethods

Specifies the authentication methods that must be successfully completed for a user to be granted access. This option must be followed by one or more lists of comma-separated authentication method names, or by the single string any to indicate the default behaviour of accepting any single authentication method. If the default is overridden, then successful authentication requires completion of every method in at least one of these lists.

For example, "publickey,password publickey,keyboard-interactive" would require the user to complete public key authentication, followed by either password or keyboard interactive authentication. Only methods that are next in one or more lists are offered at each stage, so for this example it would not be possible to attempt password or keyboard-interactive authentication before public key.

For keyboard interactive authentication it is also possible to restrict authentication to a specific device by appending a colon followed by the device identifier bsdauth or pam. depending on the server configuration. For example, "keyboard-interactive:bsdauth" would restrict keyboard interactive authentication to the bsdauth device.

If the publickey method is listed more than once, sshd(8) verifies that keys that have been used successfully are not reused for subsequent authentications. For example, "publickey,publickey" requires successful authentication using two different public keys.

Note that each authentication method listed should also be explicitly enabled in the configuration.

The available authentication methods are: "gssapi-with-mic", "hostbased", "keyboard-interactive", "none" (used for access to password-less accounts when PermitEmptyPasswords is enabled), "password" and "publickey".

AuthorizedKeysCommand

Specifies a program to be used to look up the user’s public keys. The program must be owned by root, not writable by group or others and specified by an absolute path. Arguments to AuthorizedKeysCommand accept the tokens described in the TOKENS section. If no arguments are specified then the username of the target user is used.

The program should produce on standard output zero or more lines of authorized_keys output (see AUTHORIZED_KEYS in sshd(8)). If a key supplied by AuthorizedKeysCommand does not successfully authenticate and authorize the user then public key authentication continues using the usual AuthorizedKeysFile files. By default, no AuthorizedKeysCommand is run.

AuthorizedKeysCommandUser

Specifies the user under whose account the AuthorizedKeysCommand is run. It is recommended to use a dedicated user that has no other role on the host than running authorized keys commands. If AuthorizedKeysCommand is specified but AuthorizedKeysCommandUser is not, then sshd(8) will refuse to start.

AuthorizedKeysFile

Specifies the file that contains the public keys used for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile accept the tokens described in the TOKENS section. After expansion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user’s home directory. Multiple files may be listed, separated by whitespace. Alternately this option may be set to none to skip checking for user keys in files. The default is ".ssh/authorized_keys .ssh/authorized_keys2".

AuthorizedPrincipalsCommand

Specifies a program to be used to generate the list of allowed certificate principals as per AuthorizedPrincipalsFile. The program must be owned by root, not writable by group or others and specified by an absolute path. Arguments to AuthorizedPrincipalsCommand accept the tokens described in the TOKENS section. If no arguments are specified then the username of the target user is used.

The program should produce on standard output zero or more lines of AuthorizedPrincipalsFile output. If either AuthorizedPrincipalsCommand or AuthorizedPrincipalsFile is specified, then certificates offered by the client for authentication must contain a principal that is listed. By default, no AuthorizedPrincipalsCommand is run.

AuthorizedPrincipalsCommandUser

Specifies the user under whose account the AuthorizedPrincipalsCommand is run. It is recommended to use a dedicated user that has no other role on the host than running authorized principals commands. If AuthorizedPrincipalsCommand is specified but AuthorizedPrincipalsCommandUser is not, then sshd(8) will refuse to start.

AuthorizedPrincipalsFile

Specifies a file that lists principal names that are accepted for certificate authentication. When using certificates signed by a key listed in TrustedUserCAKeys, this file lists names, one of which must appear in the certificate for it to be accepted for authentication. Names are listed one per line preceded by key options (as described in AUTHORIZED_KEYS FILE FORMAT in sshd(8)). Empty lines and comments starting with ’#’ are ignored.

Arguments to AuthorizedPrincipalsFile accept the tokens described in the TOKENS section. After expansion, AuthorizedPrincipalsFile is taken to be an absolute path or one relative to the user’s home directory. The default is none, i.e. not to use a principals file – in this case, the username of the user must appear in a certificate’s principals list for it to be accepted.

Note that AuthorizedPrincipalsFile is only used when authentication proceeds using a CA listed in TrustedUserCAKeys and is not consulted for certification authorities trusted via ~/.ssh/authorized_keys, though the principals= key option offers a similar facility (see sshd(8) for details).

Banner

The contents of the specified file are sent to the remote user before authentication is allowed. If the argument is none then no banner is displayed. By default, no banner is displayed.

CASignatureAlgorithms

Specifies which algorithms are allowed for signing of certificates by certificate authorities (CAs). The default is:

ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

Certificates signed using other algorithms will not be accepted for public key or host-based authentication.

ChallengeResponseAuthentication

Specifies whether challenge-response authentication is allowed (e.g. via PAM). The default is yes.

ChrootDirectory

Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user’s home directory. Arguments to ChrootDirectory accept the tokens described in the TOKENS section.

The ChrootDirectory must contain the necessary files and directories to support the user’s session. For an interactive session this requires at least a shell, typically sh(1), and basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), and tty(4) devices. For file transfer sessions using SFTP no additional configuration of the environment is necessary if the in-process sftp-server is used, though sessions which use logging may require /dev/log inside the chroot directory on some operating systems (see sftp-server(8) for details).

For safety, it is very important that the directory hierarchy be prevented from modification by other processes on the system (especially those outside the jail). Misconfiguration can lead to unsafe environments which sshd(8) cannot detect.

The default is none, indicating not to chroot(2).

Ciphers

Specifies the ciphers allowed. Multiple ciphers must be comma-separated. If the specified value begins with a ’+’ character, then the specified ciphers will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified ciphers (including wildcards) will be removed from the default set instead of replacing them.

The supported ciphers are:

3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

The default is:

chacha20-poly1305@openssh.com,
aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm@openssh.com,aes256-gcm@openssh.com

The list of available ciphers may also be obtained using "ssh -Q cipher".

ClientAliveCountMax

Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive.

The default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds.

ClientAliveInterval

Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client.

Compression

Specifies whether compression is enabled after the user has authenticated successfully. The argument must be yes, delayed (a legacy synonym for yes) or no. The default is yes.

DebianBanner

Specifies whether the distribution-specified extra version suffix is included during initial protocol handshake. The default is yes.

DenyGroups

This keyword can be followed by a list of group name patterns, separated by spaces. Login is disallowed for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns.

DenyUsers

This keyword can be followed by a list of user name patterns, separated by spaces. Login is disallowed for user names that match one of the patterns. Only user names are valid; a numerical user ID is not recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. HOST criteria may additionally contain addresses to match in CIDR address/masklen format. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

See PATTERNS in ssh_config(5) for more information on patterns.

DisableForwarding

Disables all forwarding features, including X11, ssh-agent(1), TCP and StreamLocal. This option overrides all other forwarding-related options and may simplify restricted configurations.

ExposeAuthInfo

Writes a temporary file containing a list of authentication methods and public credentials (e.g. keys) used to authenticate the user. The location of the file is exposed to the user session through the SSH_USER_AUTH environment variable. The default is no.

FingerprintHash

Specifies the hash algorithm used when logging key fingerprints. Valid options are: md5 and sha256. The default is sha256.

ForceCommand

Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user’s login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Specifying a command of internal-sftp will force the use of an in-process SFTP server that requires no support files when used with ChrootDirectory. The default is none.

GatewayPorts

Specifies whether remote hosts are allowed to connect to ports forwarded for the client. By default, sshd(8) binds remote port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that sshd should allow remote port forwardings to bind to non-loopback addresses, thus allowing other hosts to connect. The argument may be no to force remote port forwardings to be available to the local host only, yes to force remote port forwardings to bind to the wildcard address, or clientspecified to allow the client to select the address to which the forwarding is bound. The default is no.

GSSAPIAuthentication

Specifies whether user authentication based on GSSAPI is allowed. The default is no.

GSSAPIKeyExchange

Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange doesn’t rely on ssh keys to verify host identity. The default is no.

GSSAPICleanupCredentials

Specifies whether to automatically destroy the user’s credentials cache on logout. The default is yes.

GSSAPIStrictAcceptorCheck

Determines whether to be strict about the identity of the GSSAPI acceptor a client authenticates against. If set to yes then the client must authenticate against the host service on the current hostname. If set to no then the client may authenticate against any service key stored in the machine’s default store. This facility is provided to assist with operation on multi homed machines. The default is yes.

GSSAPIStoreCredentialsOnRekey

Controls whether the user’s GSSAPI credentials should be updated following a successful connection rekeying. This option can be used to accepted renewed or updated credentials from a compatible client. The default is no.

HostbasedAcceptedKeyTypes

Specifies the key types that will be accepted for hostbased authentication as a list of comma-separated patterns. Alternately if the specified value begins with a ’+’ character, then the specified key types will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified key types (including wildcards) will be removed from the default set instead of replacing them. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The list of available key types may also be obtained using "ssh -Q key".

HostbasedAuthentication

Specifies whether rhosts or /etc/hosts.equiv authentication together with successful public key client host authentication is allowed (host-based authentication). The default is no.

HostbasedUsesNameFromPacketOnly

Specifies whether or not the server will attempt to perform a reverse name lookup when matching the name in the ~/.shosts, ~/.rhosts, and /etc/hosts.equiv files during HostbasedAuthentication. A setting of yes means that sshd(8) uses the name supplied by the client rather than attempting to resolve the name from the TCP connection itself. The default is no.

HostCertificate

Specifies a file containing a public host certificate. The certificate’s public key must match a private host key already specified by HostKey. The default behaviour of sshd(8) is not to load any certificates.

HostKey

Specifies a file containing a private host key used by SSH. The defaults are /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_rsa_key.

Note that sshd(8) will refuse to use a file if it is group/world-accessible and that the HostKeyAlgorithms option restricts which of the keys are actually used by sshd(8).

It is possible to have multiple host key files. It is also possible to specify public host key files instead. In this case operations on the private key will be delegated to an ssh-agent(1).

HostKeyAgent

Identifies the UNIX-domain socket used to communicate with an agent that has access to the private host keys. If the string "SSH_AUTH_SOCK" is specified, the location of the socket will be read from the SSH_AUTH_SOCK environment variable.

HostKeyAlgorithms

Specifies the host key algorithms that the server offers. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The list of available key types may also be obtained using "ssh -Q key".

IgnoreRhosts

Specifies that .rhosts and .shosts files will not be used in HostbasedAuthentication.

/etc/hosts.equiv and /etc/ssh/shosts.equiv are still used. The default is yes.

IgnoreUserKnownHosts

Specifies whether sshd(8) should ignore the user’s ~/.ssh/known_hosts during HostbasedAuthentication and use only the system-wide known hosts file /etc/ssh/known_hosts. The default is no.

IPQoS

Specifies the IPv4 type-of-service or DSCP class for the connection. Accepted values are af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef, lowdelay, throughput, reliability, a numeric value, or none to use the operating system default. This option may take one or two arguments, separated by whitespace. If one argument is specified, it is used as the packet class unconditionally. If two values are specified, the first is automatically selected for interactive sessions and the second for non-interactive sessions. The default is af21 (Low-Latency Data) for interactive sessions and cs1 (Lower Effort) for non-interactive sessions.

KbdInteractiveAuthentication

Specifies whether to allow keyboard-interactive authentication. The argument to this keyword must be yes or no. The default is to use whatever value ChallengeResponseAuthentication is set to (by default yes).

KerberosAuthentication

Specifies whether the password provided by the user for PasswordAuthentication will be validated through the Kerberos KDC. To use this option, the server needs a Kerberos servtab which allows the verification of the KDC’s identity. The default is no.

KerberosGetAFSToken

If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire an AFS token before accessing the user’s home directory. The default is no.

KerberosOrLocalPasswd

If password authentication through Kerberos fails then the password will be validated via any additional local mechanism such as /etc/passwd. The default is yes.

KerberosTicketCleanup

Specifies whether to automatically destroy the user’s ticket cache file on logout. The default is yes.

KexAlgorithms

Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must be comma-separated. Alternately if the specified value begins with a ’+’ character, then the specified methods will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified methods (including wildcards) will be removed from the default set instead of replacing them. The supported algorithms are:

curve25519-sha256
curve25519-sha256@libssh.org
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521

The default is:

curve25519-sha256,curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
diffie-hellman-group14-sha256,diffie-hellman-group14-sha1

The list of available key exchange algorithms may also be obtained using "ssh -Q kex".

ListenAddress

Specifies the local addresses sshd(8) should listen on. The following forms may be used:

ListenAddress hostname|address [rdomain domain]
ListenAddress hostname:port [rdomain domain]
ListenAddress IPv4_address:port [rdomain domain]
ListenAddress [

hostname|address ]:port [rdomain domain]

The optional rdomain qualifier requests sshd(8) listen in an explicit routing domain. If port is not specified, sshd will listen on the address and all Port options specified. The default is to listen on all local addresses on the current default routing domain. Multiple ListenAddress options are permitted. For more information on routing domains, see rdomain(4).

LoginGraceTime

The server disconnects after this time if the user has not successfully logged in. If the value is 0, there is no time limit. The default is 120 seconds.

LogLevel

Gives the verbosity level that is used when logging messages from sshd(8). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level violates the privacy of users and is not recommended.

MACs

Specifies the available MAC (message authentication code) algorithms. The MAC algorithm is used for data integrity protection. Multiple algorithms must be comma-separated. If the specified value begins with a ’+’ character, then the specified algorithms will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified algorithms (including wildcards) will be removed from the default set instead of replacing them.

The algorithms that contain "-etm" calculate the MAC after encryption (encrypt-then-mac). These are considered safer and their use recommended. The supported MACs are:

hmac-md5
hmac-md5-96
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
umac-64@openssh.com
umac-128@openssh.com
hmac-md5-etm@openssh.com
hmac-md5-96-etm@openssh.com
hmac-sha1-etm@openssh.com
hmac-sha1-96-etm@openssh.com
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
umac-64-etm@openssh.com
umac-128-etm@openssh.com

The default is:

umac-64-etm@openssh.com,umac-128-etm@openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,
hmac-sha2-256,hmac-sha2-512,hmac-sha1

The list of available MAC algorithms may also be obtained using "ssh -Q mac".

Match

Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.

The arguments to Match are one or more criteria-pattern pairs or the single token All which matches all criteria. The available criteria are User, Group, Host, LocalAddress, LocalPort, RDomain, and Address (with RDomain representing the rdomain(4) on which the connection was received.)

The match patterns may consist of single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section of ssh_config(5).

The patterns in an Address criteria may additionally contain addresses to match in CIDR address/masklen format, such as 192.0.2.0/24 or 2001:db8::/32. Note that the mask length provided must be consistent with the address - it is an error to specify a mask length that is too long for the address or one with bits set in this host portion of the address. For example, 192.0.2.0/33 and 192.0.2.0/8, respectively.

Only a subset of keywords may be used on the lines following a Match keyword. Available keywords are AcceptEnv, AllowAgentForwarding, AllowGroups, AllowStreamLocalForwarding, AllowTcpForwarding, AllowUsers, AuthenticationMethods, AuthorizedKeysCommand, AuthorizedKeysCommandUser, AuthorizedKeysFile, AuthorizedPrincipalsCommand, AuthorizedPrincipalsCommandUser, AuthorizedPrincipalsFile, Banner, ChrootDirectory, ClientAliveCountMax, ClientAliveInterval, DenyGroups, DenyUsers, ForceCommand, GatewayPorts, GSSAPIAuthentication, HostbasedAcceptedKeyTypes, HostbasedAuthentication, HostbasedUsesNameFromPacketOnly, IPQoS, KbdInteractiveAuthentication, KerberosAuthentication, LogLevel, MaxAuthTries, MaxSessions, PasswordAuthentication, PermitEmptyPasswords, PermitListen, PermitOpen, PermitRootLogin, PermitTTY, PermitTunnel, PermitUserRC, PubkeyAcceptedKeyTypes, PubkeyAuthentication, RekeyLimit, RevokedKeys, RDomain, SetEnv, StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys, X11DisplayOffset, X11Forwarding and X11UseLocalHost.

MaxAuthTries

Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

MaxSessions

Specifies the maximum number of open shell, login or subsystem (e.g. sftp) sessions permitted per network connection. Multiple sessions may be established by clients that support connection multiplexing. Setting MaxSessions to 1 will effectively disable session multiplexing, whereas setting it to 0 will prevent all shell, login and subsystem sessions while still permitting forwarding. The default is 10.

MaxStartups

Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. The default is 10:30:100.

Alternatively, random early drop can be enabled by specifying the three colon separated values start:rate:full (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of rate/100 (30%) if there are currently start (10) unauthenticated connections. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches full (60).

PasswordAuthentication

Specifies whether password authentication is allowed. The default is yes.

PermitEmptyPasswords

When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The default is no.

PermitListen

Specifies the addresses/ports on which a remote TCP port forwarding may listen. The listen specification must be one of the following forms:

PermitListen port
PermitListen host:port

Multiple permissions may be specified by separating them with whitespace. An argument of any can be used to remove all restrictions and permit any listen requests. An argument of none can be used to prohibit all listen requests. The host name may contain wildcards as described in the PATTERNS section in ssh_config(5). The wildcard ’*’ can also be used in place of a port number to allow all ports. By default all port forwarding listen requests are permitted. Note that the GatewayPorts option may further restrict which addresses may be listened on. Note also that ssh(1) will request a listen host of “localhost” if no listen host was specifically requested, and this this name is treated differently to explicit localhost addresses of “127.0.0.1” and “::1”.

PermitOpen

Specifies the destinations to which TCP port forwarding is permitted. The forwarding specification must be one of the following forms:

PermitOpen host:port
PermitOpen IPv4_addr:port
PermitOpen [IPv6_addr]:port

Multiple forwards may be specified by separating them with whitespace. An argument of any can be used to remove all restrictions and permit any forwarding requests. An argument of none can be used to prohibit all forwarding requests. The wildcard ’*’ can be used for host or port to allow all hosts or ports, respectively. By default all port forwarding requests are permitted.

PermitRootLogin

Specifies whether root can log in using ssh(1). The argument must be yes, prohibit-password, forced-commands-only, or no. The default is prohibit-password.

If this option is set to prohibit-password (or its deprecated alias, without-password), password and keyboard-interactive authentication are disabled for root.

If this option is set to forced-commands-only, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

If this option is set to no, root is not allowed to log in.

PermitTTY

Specifies whether pty(4) allocation is permitted. The default is yes.

PermitTunnel

Specifies whether tun(4) device forwarding is allowed. The argument must be yes, point-to-point (layer 3), ethernet (layer 2), or no. Specifying yes permits both point-to-point and ethernet. The default is no.

Independent of this setting, the permissions of the selected tun(4) device must allow access to the user.

PermitUserEnvironment

Specifies whether ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd(8). Valid options are yes, no or a pattern-list specifying which environment variable names to accept (for example "LANG,LC_*"). The default is no. Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.

PermitUserRC

Specifies whether any ~/.ssh/rc file is executed. The default is yes.

PidFile

Specifies the file that contains the process ID of the SSH daemon, or none to not write one. The default is /run/sshd.pid.

Port

Specifies the port number that sshd(8) listens on. The default is 22. Multiple options of this type are permitted. See also ListenAddress.

PrintLastLog

Specifies whether sshd(8) should print the date and time of the last user login when a user logs in interactively. The default is yes.

PrintMotd

Specifies whether sshd(8) should print /etc/motd when a user logs in interactively. (On some systems it is also printed by the shell, /etc/profile, or equivalent.) The default is yes.

PubkeyAcceptedKeyTypes

Specifies the key types that will be accepted for public key authentication as a list of comma-separated patterns. Alternately if the specified value begins with a ’+’ character, then the specified key types will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified key types (including wildcards) will be removed from the default set instead of replacing them. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The list of available key types may also be obtained using "ssh -Q key".

PubkeyAuthentication

Specifies whether public key authentication is allowed. The default is yes.

RekeyLimit

Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time that may pass before the session key is renegotiated. The first argument is specified in bytes and may have a suffix of ’K’, ’M’, or ’G’ to indicate Kilobytes, Megabytes, or Gigabytes, respectively. The default is between ’1G’ and ’4G’, depending on the cipher. The optional second value is specified in seconds and may use any of the units documented in the TIME FORMATS section. The default value for RekeyLimit is default none, which means that rekeying is performed after the cipher’s default amount of data has been sent or received and no time based rekeying is done.

RevokedKeys

Specifies revoked public keys file, or none to not use one. Keys listed in this file will be refused for public key authentication. Note that if this file is not readable, then public key authentication will be refused for all users. Keys may be specified as a text file, listing one public key per line, or as an OpenSSH Key Revocation List (KRL) as generated by ssh-keygen(1). For more information on KRLs, see the KEY REVOCATION LISTS section in ssh-keygen(1).

RDomain

Specifies an explicit routing domain that is applied after authentication has completed. The user session, as well and any forwarded or listening IP sockets, will be bound to this rdomain(4). If the routing domain is set to %D, then the domain in which the incoming connection was received will be applied.

SetEnv

Specifies one or more environment variables to set in child sessions started by sshd(8) as “NAME=VALUE”. The environment value may be quoted (e.g. if it contains whitespace characters). Environment variables set by SetEnv override the default environment and any variables specified by the user via AcceptEnv or PermitUserEnvironment.

StreamLocalBindMask

Sets the octal file creation mode mask (umask) used when creating a Unix-domain socket file for local or remote port forwarding. This option is only used for port forwarding to a Unix-domain socket file.

The default value is 0177, which creates a Unix-domain socket file that is readable and writable only by the owner. Note that not all operating systems honor the file mode on Unix-domain socket files.

StreamLocalBindUnlink

Specifies whether to remove an existing Unix-domain socket file for local or remote port forwarding before creating a new one. If the socket file already exists and StreamLocalBindUnlink is not enabled, sshd will be unable to forward the port to the Unix-domain socket file. This option is only used for port forwarding to a Unix-domain socket file.

The argument must be yes or no. The default is no.

StrictModes

Specifies whether sshd(8) should check file modes and ownership of the user’s files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The default is yes. Note that this does not apply to ChrootDirectory, whose permissions and ownership are checked unconditionally.

Subsystem

Configures an external subsystem (e.g. file transfer daemon). Arguments should be a subsystem name and a command (with optional arguments) to execute upon subsystem request.

The command sftp-server implements the SFTP file transfer subsystem.

Alternately the name internal-sftp implements an in-process SFTP server. This may simplify configurations using ChrootDirectory to force a different filesystem root on clients.

By default no subsystems are defined.

SyslogFacility

Gives the facility code that is used when logging messages from sshd(8). The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH.

TCPKeepAlive

Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find it annoying. On the other hand, if TCP keepalives are not sent, sessions may hang indefinitely on the server, leaving "ghost" users and consuming server resources.

The default is yes (to send TCP keepalive messages), and the server will notice if the network goes down or the client host crashes. This avoids infinitely hanging sessions.

To disable TCP keepalive messages, the value should be set to no.

This option was formerly called KeepAlive.

TrustedUserCAKeys

Specifies a file containing public keys of certificate authorities that are trusted to sign user certificates for authentication, or none to not use one. Keys are listed one per line; empty lines and comments starting with ’#’ are allowed. If a certificate is presented for authentication and has its signing CA key listed in this file, then it may be used for authentication for any user listed in the certificate’s principals list. Note that certificates that lack a list of principals will not be permitted for authentication using TrustedUserCAKeys. For more details on certificates, see the CERTIFICATES section in ssh-keygen(1).

UseDNS

Specifies whether sshd(8) should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.

If this option is set to no (the default) then only addresses and not host names may be used in ~/.ssh/authorized_keys from and sshd_config Match Host directives.

UsePAM

Enables the Pluggable Authentication Module interface. If set to yes this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types.

Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.

If UsePAM is enabled, you will not be able to run sshd(8) as a non-root user. The default is no.

VersionAddendum

Optionally specifies additional text to append to the SSH protocol banner sent by the server upon connection. The default is none.

X11DisplayOffset

Specifies the first display number available for sshd(8)’s X11 forwarding. This prevents sshd from interfering with real X11 servers. The default is 10.

X11Forwarding

Specifies whether X11 forwarding is permitted. The argument must be yes or no. The default is no.

When X11 forwarding is enabled, there may be additional exposure to the server and to client displays if the sshd(8) proxy display is configured to listen on the wildcard address (see X11UseLocalhost), though this is not the default. Additionally, the authentication spoofing and authentication data verification and substitution occur on the client side. The security risk of using X11 forwarding is that the client’s X11 display server may be exposed to attack when the SSH client requests forwarding (see the warnings for ForwardX11 in ssh_config(5)). A system administrator may have a stance in which they want to protect clients that may expose themselves to attack by unwittingly requesting X11 forwarding, which can warrant a no setting.

Note that disabling X11 forwarding does not prevent users from forwarding X11 traffic, as users can always install their own forwarders.

X11UseLocalhost

Specifies whether sshd(8) should bind the X11 forwarding server to the loopback address or to the wildcard address. By default, sshd binds the forwarding server to the loopback address and sets the hostname part of the DISPLAY environment variable to localhost. This prevents remote hosts from connecting to the proxy display. However, some older X11 clients may not function with this configuration. X11UseLocalhost may be set to no to specify that the forwarding server should be bound to the wildcard address. The argument must be yes or no. The default is yes.

XAuthLocation

Specifies the full pathname of the xauth(1) program, or none to not use one. The default is /usr/bin/xauth.

TIME FORMATS

sshd(8) command-line arguments and configuration file options that specify time may be expressed using a sequence of the form: time[qualifier], where time is a positive integer value and qualifier is one of the following:

⟨ none⟩

seconds

s | S

seconds

m | M

minutes

h | H

hours

d | D

days

w | W

weeks

Each member of the sequence is added together to calculate the total time value.

Time format examples:

600

600 seconds (10 minutes)

10m

10 minutes

1h30m

1 hour 30 minutes (90 minutes)

TOKENS

Arguments to some keywords can make use of tokens, which are expanded at runtime:

%%

A literal ’%’.

%D

The routing domain in which the incoming connection was received.

%F

The fingerprint of the CA key.

%f

The fingerprint of the key or certificate.

%h

The home directory of the user.

%i

The key ID in the certificate.

%K

The base64-encoded CA key.

%k

The base64-encoded key or certificate for authentication.

%s

The serial number of the certificate.

%T

The type of the CA key.

%t

The key or certificate type.

%U

The numeric user ID of the target user.

%u

The username.

AuthorizedKeysCommand accepts the tokens %%, %f, %h, %k, %t, %U, and %u.

AuthorizedKeysFile accepts the tokens %%, %h, %U, and %u.

AuthorizedPrincipalsCommand accepts the tokens %%, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u.

AuthorizedPrincipalsFile accepts the tokens %%, %h, %U, and %u.

ChrootDirectory accepts the tokens %%, %h, %U, and %u.

RoutingDomain accepts the token %D.

FILES
/etc/ssh/sshd_config

Contains configuration data for sshd(8). This file should be writable by root only, but it is recommended (though not necessary) that it be world-readable.

SEE ALSO

sftp-server(8), sshd(8)

AUTHORS

OpenSSH is a derivative of the original and free ssh 1.2.12 release by Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt and Dug Song removed many bugs, re-added newer features and created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support for privilege separation.

BSD September 20, 2018 BSD

Config-Model-OpenSsh-2.8.7.1/xt/ssh_config.html0000644000175000017500000020073114160662115017621 0ustar domidomi

SSH_CONFIG(5) BSD File Formats Manual SSH_CONFIG(5)

NAME

ssh_config — OpenSSH SSH client configuration files

DESCRIPTION

ssh(1) obtains configuration data from the following sources in the following order:

1.

command-line options

2.

user’s configuration file (~/.ssh/config)

3.

system-wide configuration file (/etc/ssh/ssh_config)

For each parameter, the first obtained value will be used. The configuration files contain sections separated by Host specifications, and that section is only applied for hosts that match one of the patterns given in the specification. The matched host name is usually the one given on the command line (see the CanonicalizeHostname option for exceptions).

Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end.

Note that the Debian openssh-client package sets several options as standard in /etc/ssh/ssh_config which are not the default in ssh(1):

•

SendEnv LANG LC_*

•

HashKnownHosts yes

•

GSSAPIAuthentication yes

The file contains keyword-argument pairs, one per line. Lines starting with ’#’ and empty lines are interpreted as comments. Arguments may optionally be enclosed in double quotes (") in order to represent arguments containing spaces. Configuration options may be separated by whitespace or optional whitespace and exactly one ’=’; the latter format is useful to avoid the need to quote whitespace when specifying configuration options using the ssh, scp, and sftp -o option.

The possible keywords and their meanings are as follows (note that keywords are case-insensitive and arguments are case-sensitive):

Host

Restricts the following declarations (up to the next Host or Match keyword) to be only for those hosts that match one of the patterns given after the keyword. If more than one pattern is provided, they should be separated by whitespace. A single ’*’ as a pattern can be used to provide global defaults for all hosts. The host is usually the hostname argument given on the command line (see the CanonicalizeHostname keyword for exceptions).

A pattern entry may be negated by prefixing it with an exclamation mark (’!’). If a negated entry is matched, then the Host entry is ignored, regardless of whether any other patterns on the line match. Negated matches are therefore useful to provide exceptions for wildcard matches.

See PATTERNS for more information on patterns.

Match

Restricts the following declarations (up to the next Host or Match keyword) to be used only when the conditions following the Match keyword are satisfied. Match conditions are specified using one or more criteria or the single token all which always matches. The available criteria keywords are: canonical, exec, host, originalhost, user, and localuser. The all criteria must appear alone or immediately after canonical. Other criteria may be combined arbitrarily. All criteria but all and canonical require an argument. Criteria may be negated by prepending an exclamation mark (’!’).

The canonical keyword matches only when the configuration file is being re-parsed after hostname canonicalization (see the CanonicalizeHostname option.) This may be useful to specify conditions that work with canonical host names only. The exec keyword executes the specified command under the user’s shell. If the command returns a zero exit status then the condition is considered true. Commands containing whitespace characters must be quoted. Arguments to exec accept the tokens described in the TOKENS section.

The other keywords’ criteria must be single entries or comma-separated lists and may use the wildcard and negation operators described in the PATTERNS section. The criteria for the host keyword are matched against the target hostname, after any substitution by the Hostname or CanonicalizeHostname options. The originalhost keyword matches against the hostname as it was specified on the command-line. The user keyword matches against the target username on the remote host. The localuser keyword matches against the name of the local user running ssh(1) (this keyword may be useful in system-wide ssh_config files).

AddKeysToAgent

Specifies whether keys should be automatically added to a running ssh-agent(1). If this option is set to yes and a key is loaded from a file, the key and its passphrase are added to the agent with the default lifetime, as if by ssh-add(1). If this option is set to ask, ssh(1) will require confirmation using the SSH_ASKPASS program before adding a key (see ssh-add(1) for details). If this option is set to confirm, each use of the key must be confirmed, as if the -c option was specified to ssh-add(1). If this option is set to no, no keys are added to the agent. The argument must be yes, confirm, ask, or no (the default).

AddressFamily

Specifies which address family to use when connecting. Valid arguments are any (the default), inet (use IPv4 only), or inet6 (use IPv6 only).

BatchMode

If set to yes, passphrase/password querying will be disabled. In addition, the ServerAliveInterval option will be set to 300 seconds by default (Debian-specific). This option is useful in scripts and other batch jobs where no user is present to supply the password, and where it is desirable to detect a broken network swiftly. The argument must be yes or no (the default).

BindAddress

Use the specified address on the local machine as the source address of the connection. Only useful on systems with more than one address.

BindInterface

Use the address of the specified interface on the local machine as the source address of the connection.

CanonicalDomains

When CanonicalizeHostname is enabled, this option specifies the list of domain suffixes in which to search for the specified destination host.

CanonicalizeFallbackLocal

Specifies whether to fail with an error when hostname canonicalization fails. The default, yes, will attempt to look up the unqualified hostname using the system resolver’s search rules. A value of no will cause ssh(1) to fail instantly if CanonicalizeHostname is enabled and the target hostname cannot be found in any of the domains specified by CanonicalDomains.

CanonicalizeHostname

Controls whether explicit hostname canonicalization is performed. The default, no, is not to perform any name rewriting and let the system resolver handle all hostname lookups. If set to yes then, for connections that do not use a ProxyCommand or ProxyJump, ssh(1) will attempt to canonicalize the hostname specified on the command line using the CanonicalDomains suffixes and CanonicalizePermittedCNAMEs rules. If CanonicalizeHostname is set to always, then canonicalization is applied to proxied connections too.

If this option is enabled, then the configuration files are processed again using the new target name to pick up any new configuration in matching Host and Match stanzas.

CanonicalizeMaxDots

Specifies the maximum number of dot characters in a hostname before canonicalization is disabled. The default, 1, allows a single dot (i.e. hostname.subdomain).

CanonicalizePermittedCNAMEs

Specifies rules to determine whether CNAMEs should be followed when canonicalizing hostnames. The rules consist of one or more arguments of source_domain_list:target_domain_list, where source_domain_list is a pattern-list of domains that may follow CNAMEs in canonicalization, and target_domain_list is a pattern-list of domains that they may resolve to.

For example, "*.a.example.com:*.b.example.com,*.c.example.com" will allow hostnames matching "*.a.example.com" to be canonicalized to names in the "*.b.example.com" or "*.c.example.com" domains.

CASignatureAlgorithms

Specifies which algorithms are allowed for signing of certificates by certificate authorities (CAs). The default is:

ecdsa-sha2-nistp256.ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

ssh(1) will not accept host certificates signed using algorithms other than those specified.

CertificateFile

Specifies a file from which the user’s certificate is read. A corresponding private key must be provided separately in order to use this certificate either from an IdentityFile directive or -i flag to ssh(1), via ssh-agent(1), or via a PKCS11Provider.

Arguments to CertificateFile may use the tilde syntax to refer to a user’s home directory or the tokens described in the TOKENS section.

It is possible to have multiple certificate files specified in configuration files; these certificates will be tried in sequence. Multiple CertificateFile directives will add to the list of certificates used for authentication.

ChallengeResponseAuthentication

Specifies whether to use challenge-response authentication. The argument to this keyword must be yes (the default) or no.

CheckHostIP

If set to yes (the default), ssh(1) will additionally check the host IP address in the known_hosts file. This allows it to detect if a host key changed due to DNS spoofing and will add addresses of destination hosts to ~/.ssh/known_hosts in the process, regardless of the setting of StrictHostKeyChecking. If the option is set to no, the check will not be executed.

Ciphers

Specifies the ciphers allowed and their order of preference. Multiple ciphers must be comma-separated. If the specified value begins with a ’+’ character, then the specified ciphers will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified ciphers (including wildcards) will be removed from the default set instead of replacing them.

The supported ciphers are:

3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com

The default is:

chacha20-poly1305@openssh.com,
aes128-ctr,aes192-ctr,aes256-ctr,
aes128-gcm@openssh.com,aes256-gcm@openssh.com

The list of available ciphers may also be obtained using "ssh -Q cipher".

ClearAllForwardings

Specifies that all local, remote, and dynamic port forwardings specified in the configuration files or on the command line be cleared. This option is primarily useful when used from the ssh(1) command line to clear port forwardings set in configuration files, and is automatically set by scp(1) and sftp(1). The argument must be yes or no (the default).

Compression

Specifies whether to use compression. The argument must be yes or no (the default).

ConnectionAttempts

Specifies the number of tries (one per second) to make before exiting. The argument must be an integer. This may be useful in scripts if the connection sometimes fails. The default is 1.

ConnectTimeout

Specifies the timeout (in seconds) used when connecting to the SSH server, instead of using the default system TCP timeout. This value is used only when the target is down or really unreachable, not when it refuses the connection.

ControlMaster

Enables the sharing of multiple sessions over a single network connection. When set to yes, ssh(1) will listen for connections on a control socket specified using the ControlPath argument. Additional sessions can connect to this socket using the same ControlPath with ControlMaster set to no (the default). These sessions will try to reuse the master instance’s network connection rather than initiating new ones, but will fall back to connecting normally if the control socket does not exist, or is not listening.

Setting this to ask will cause ssh(1) to listen for control connections, but require confirmation using ssh-askpass(1). If the ControlPath cannot be opened, ssh(1) will continue without connecting to a master instance.

X11 and ssh-agent(1) forwarding is supported over these multiplexed connections, however the display and agent forwarded will be the one belonging to the master connection i.e. it is not possible to forward multiple displays or agents.

Two additional options allow for opportunistic multiplexing: try to use a master connection but fall back to creating a new one if one does not already exist. These options are: auto and autoask. The latter requires confirmation like the ask option.

ControlPath

Specify the path to the control socket used for connection sharing as described in the ControlMaster section above or the string none to disable connection sharing. Arguments to ControlPath may use the tilde syntax to refer to a user’s home directory or the tokens described in the TOKENS section. It is recommended that any ControlPath used for opportunistic connection sharing include at least %h, %p, and %r (or alternatively %C) and be placed in a directory that is not writable by other users. This ensures that shared connections are uniquely identified.

ControlPersist

When used in conjunction with ControlMaster, specifies that the master connection should remain open in the background (waiting for future client connections) after the initial client connection has been closed. If set to no, then the master connection will not be placed into the background, and will close as soon as the initial client connection is closed. If set to yes or 0, then the master connection will remain in the background indefinitely (until killed or closed via a mechanism such as the "ssh -O exit"). If set to a time in seconds, or a time in any of the formats documented in sshd_config(5), then the backgrounded master connection will automatically terminate after it has remained idle (with no client connections) for the specified time.

DynamicForward

Specifies that a TCP port on the local machine be forwarded over the secure channel, and the application protocol is then used to determine where to connect to from the remote machine.

The argument must be [

bind_address: ]port. IPv6 addresses can be specified by enclosing addresses in square brackets. By default, the local port is bound in accordance with the GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a specific address. The bind_address of localhost indicates that the listening port be bound for local use only, while an empty address or ’*’ indicates that the port should be available from all interfaces.

Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh(1) will act as a SOCKS server. Multiple forwardings may be specified, and additional forwardings can be given on the command line. Only the superuser can forward privileged ports.

EnableSSHKeysign

Setting this option to yes in the global client configuration file /etc/ssh/ssh_config enables the use of the helper program ssh-keysign(8) during HostbasedAuthentication. The argument must be yes or no (the default). This option should be placed in the non-hostspecific section. See ssh-keysign(8) for more information.

EscapeChar

Sets the escape character (default: ’~’). The escape character can also be set on the command line. The argument should be a single character, ’^’ followed by a letter, or none to disable the escape character entirely (making the connection transparent for binary data).

ExitOnForwardFailure

Specifies whether ssh(1) should terminate the connection if it cannot set up all requested dynamic, tunnel, local, and remote port forwardings, (e.g. if either end is unable to bind and listen on a specified port). Note that ExitOnForwardFailure does not apply to connections made over port forwardings and will not, for example, cause ssh(1) to exit if TCP connections to the ultimate forwarding destination fail. The argument must be yes or no (the default).

FingerprintHash

Specifies the hash algorithm used when displaying key fingerprints. Valid options are: md5 and sha256 (the default).

ForwardAgent

Specifies whether the connection to the authentication agent (if any) will be forwarded to the remote machine. The argument must be yes or no (the default).

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

ForwardX11

Specifies whether X11 connections will be automatically redirected over the secure channel and DISPLAY set. The argument must be yes or no (the default).

X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user’s X11 authorization database) can access the local X11 display through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring if the ForwardX11Trusted option is also enabled.

ForwardX11Timeout

Specify a timeout for untrusted X11 forwarding using the format described in the TIME FORMATS section of sshd_config(5). X11 connections received by ssh(1) after this time will be refused. Setting ForwardX11Timeout to zero will disable the timeout and permit X11 forwarding for the life of the connection. The default is to disable untrusted X11 forwarding after twenty minutes has elapsed.

ForwardX11Trusted

If this option is set to yes, (the Debian-specific default), remote X11 clients will have full access to the original X11 display.

If this option is set to no (the upstream default), remote X11 clients will be considered untrusted and prevented from stealing or tampering with data belonging to trusted X11 clients. Furthermore, the xauth(1) token used for the session will be set to expire after 20 minutes. Remote clients will be refused access after this time.

See the X11 SECURITY extension specification for full details on the restrictions imposed on untrusted clients.

GatewayPorts

Specifies whether remote hosts are allowed to connect to local forwarded ports. By default, ssh(1) binds local port forwardings to the loopback address. This prevents other remote hosts from connecting to forwarded ports. GatewayPorts can be used to specify that ssh should bind local port forwardings to the wildcard address, thus allowing remote hosts to connect to forwarded ports. The argument must be yes or no (the default).

GlobalKnownHostsFile

Specifies one or more files to use for the global host key database, separated by whitespace. The default is /etc/ssh/ssh_known_hosts, /etc/ssh/ssh_known_hosts2.

GSSAPIAuthentication

Specifies whether user authentication based on GSSAPI is allowed. The default is no.

GSSAPIKeyExchange

Specifies whether key exchange based on GSSAPI may be used. When using GSSAPI key exchange the server need not have a host key. The default is no.

GSSAPIClientIdentity

If set, specifies the GSSAPI client identity that ssh should use when connecting to the server. The default is unset, which means that the default identity will be used.

GSSAPIServerIdentity

If set, specifies the GSSAPI server identity that ssh should expect when connecting to the server. The default is unset, which means that the expected GSSAPI server identity will be determined from the target hostname.

GSSAPIDelegateCredentials

Forward (delegate) credentials to the server. The default is no.

GSSAPIRenewalForcesRekey

If set to yes then renewal of the client’s GSSAPI credentials will force the rekeying of the ssh connection. With a compatible server, this can delegate the renewed credentials to a session on the server. The default is no.

GSSAPITrustDns

Set to yes to indicate that the DNS is trusted to securely canonicalize the name of the host being connected to. If no, the hostname entered on the command line will be passed untouched to the GSSAPI library. The default is no.

HashKnownHosts

Indicates that ssh(1) should hash host names and addresses when they are added to ~/.ssh/known_hosts. These hashed names may be used normally by ssh(1) and sshd(8), but they do not reveal identifying information should the file’s contents be disclosed. The default is no. Note that existing names and addresses in known hosts files will not be converted automatically, but may be manually hashed using ssh-keygen(1). Use of this option may break facilities such as tab-completion that rely on being able to read unhashed host names from ~/.ssh/known_hosts.

HostbasedAuthentication

Specifies whether to try rhosts based authentication with public key authentication. The argument must be yes or no (the default).

HostbasedKeyTypes

Specifies the key types that will be used for hostbased authentication as a comma-separated list of patterns. Alternately if the specified value begins with a ’+’ character, then the specified key types will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified key types (including wildcards) will be removed from the default set instead of replacing them. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The -Q option of ssh(1) may be used to list supported key types.

HostKeyAlgorithms

Specifies the host key algorithms that the client wants to use in order of preference. Alternately if the specified value begins with a ’+’ character, then the specified key types will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified key types (including wildcards) will be removed from the default set instead of replacing them. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

If hostkeys are known for the destination host then this default is modified to prefer their algorithms.

The list of available key types may also be obtained using "ssh -Q key".

HostKeyAlias

Specifies an alias that should be used instead of the real host name when looking up or saving the host key in the host key database files and when validating host certificates. This option is useful for tunneling SSH connections or for multiple servers running on a single host.

HostName

Specifies the real host name to log into. This can be used to specify nicknames or abbreviations for hosts. Arguments to HostName accept the tokens described in the TOKENS section. Numeric IP addresses are also permitted (both on the command line and in HostName specifications). The default is the name given on the command line.

IdentitiesOnly

Specifies that ssh(1) should only use the authentication identity and certificate files explicitly configured in the ssh_config files or passed on the ssh(1) command-line, even if ssh-agent(1) or a PKCS11Provider offers more identities. The argument to this keyword must be yes or no (the default). This option is intended for situations where ssh-agent offers many different identities.

IdentityAgent

Specifies the UNIX-domain socket used to communicate with the authentication agent.

This option overrides the SSH_AUTH_SOCK environment variable and can be used to select a specific agent. Setting the socket name to none disables the use of an authentication agent. If the string "SSH_AUTH_SOCK" is specified, the location of the socket will be read from the SSH_AUTH_SOCK environment variable. Otherwise if the specified value begins with a ’$’ character, then it will be treated as an environment variable containing the location of the socket.

Arguments to IdentityAgent may use the tilde syntax to refer to a user’s home directory or the tokens described in the TOKENS section.

IdentityFile

Specifies a file from which the user’s DSA, ECDSA, Ed25519 or RSA authentication identity is read. The default is ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa. Additionally, any identities represented by the authentication agent will be used for authentication unless IdentitiesOnly is set. If no certificates have been explicitly specified by CertificateFile, ssh(1) will try to load certificate information from the filename obtained by appending -cert.pub to the path of a specified IdentityFile.

Arguments to IdentityFile may use the tilde syntax to refer to a user’s home directory or the tokens described in the TOKENS section.

It is possible to have multiple identity files specified in configuration files; all these identities will be tried in sequence. Multiple IdentityFile directives will add to the list of identities tried (this behaviour differs from that of other configuration directives).

IdentityFile may be used in conjunction with IdentitiesOnly to select which identities in an agent are offered during authentication. IdentityFile may also be used in conjunction with CertificateFile in order to provide any certificate also needed for authentication with the identity.

IgnoreUnknown

Specifies a pattern-list of unknown options to be ignored if they are encountered in configuration parsing. This may be used to suppress errors if ssh_config contains options that are unrecognised by ssh(1). It is recommended that IgnoreUnknown be listed early in the configuration file as it will not be applied to unknown options that appear before it.

Include

Include the specified configuration file(s). Multiple pathnames may be specified and each pathname may contain glob(7) wildcards and, for user configurations, shell-like ’~’ references to user home directories. Files without absolute paths are assumed to be in ~/.ssh if included in a user configuration file or /etc/ssh if included from the system configuration file. Include directive may appear inside a Match or Host block to perform conditional inclusion.

IPQoS

Specifies the IPv4 type-of-service or DSCP class for connections. Accepted values are af11, af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, ef, lowdelay, throughput, reliability, a numeric value, or none to use the operating system default. This option may take one or two arguments, separated by whitespace. If one argument is specified, it is used as the packet class unconditionally. If two values are specified, the first is automatically selected for interactive sessions and the second for non-interactive sessions. The default is af21 (Low-Latency Data) for interactive sessions and cs1 (Lower Effort) for non-interactive sessions.

KbdInteractiveAuthentication

Specifies whether to use keyboard-interactive authentication. The argument to this keyword must be yes (the default) or no.

KbdInteractiveDevices

Specifies the list of methods to use in keyboard-interactive authentication. Multiple method names must be comma-separated. The default is to use the server specified list. The methods available vary depending on what the server supports. For an OpenSSH server, it may be zero or more of: bsdauth and pam.

KexAlgorithms

Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must be comma-separated. Alternately if the specified value begins with a ’+’ character, then the specified methods will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified methods (including wildcards) will be removed from the default set instead of replacing them. The default is:

curve25519-sha256,curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512,
diffie-hellman-group-exchange-sha1,
diffie-hellman-group14-sha256,
diffie-hellman-group14-sha1

The list of available key exchange algorithms may also be obtained using "ssh -Q kex".

LocalCommand

Specifies a command to execute on the local machine after successfully connecting to the server. The command string extends to the end of the line, and is executed with the user’s shell. Arguments to LocalCommand accept the tokens described in the TOKENS section.

The command is run synchronously and does not have access to the session of the ssh(1) that spawned it. It should not be used for interactive commands.

This directive is ignored unless PermitLocalCommand has been enabled.

LocalForward

Specifies that a TCP port on the local machine be forwarded over the secure channel to the specified host and port from the remote machine. The first argument must be [

bind_address: ]port and the second argument must be host:hostport. IPv6 addresses can be specified by enclosing addresses in square brackets. Multiple forwardings may be specified, and additional forwardings can be given on the command line. Only the superuser can forward privileged ports. By default, the local port is bound in accordance with the GatewayPorts setting. However, an explicit bind_address may be used to bind the connection to a specific address. The bind_address of localhost indicates that the listening port be bound for local use only, while an empty address or ’*’ indicates that the port should be available from all interfaces.

LogLevel

Gives the verbosity level that is used when logging messages from ssh(1). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output.

MACs

Specifies the MAC (message authentication code) algorithms in order of preference. The MAC algorithm is used for data integrity protection. Multiple algorithms must be comma-separated. If the specified value begins with a ’+’ character, then the specified algorithms will be appended to the default set instead of replacing them. If the specified value begins with a ’-’ character, then the specified algorithms (including wildcards) will be removed from the default set instead of replacing them.

The algorithms that contain "-etm" calculate the MAC after encryption (encrypt-then-mac). These are considered safer and their use recommended.

The default is:

umac-64-etm@openssh.com,umac-128-etm@openssh.com,
hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,
hmac-sha2-256,hmac-sha2-512,hmac-sha1

The list of available MAC algorithms may also be obtained using "ssh -Q mac".

NoHostAuthenticationForLocalhost

Disable host authentication for localhost (loopback addresses). The argument to this keyword must be yes or no (the default).

NumberOfPasswordPrompts

Specifies the number of password prompts before giving up. The argument to this keyword must be an integer. The default is 3.

PasswordAuthentication

Specifies whether to use password authentication. The argument to this keyword must be yes (the default) or no.

PermitLocalCommand

Allow local command execution via the LocalCommand option or using the !command escape sequence in ssh(1). The argument must be yes or no (the default).

PKCS11Provider

Specifies which PKCS#11 provider to use. The argument to this keyword is the PKCS#11 shared library ssh(1) should use to communicate with a PKCS#11 token providing the user’s private RSA key.

Port

Specifies the port number to connect on the remote host. The default is 22.

PreferredAuthentications

Specifies the order in which the client should try authentication methods. This allows a client to prefer one method (e.g. keyboard-interactive) over another method (e.g. password). The default is:

gssapi-with-mic,hostbased,publickey,
keyboard-interactive,password

ProxyCommand

Specifies the command to use to connect to the server. The command string extends to the end of the line, and is executed using the user’s shell ’exec’ directive to avoid a lingering shell process.

Arguments to ProxyCommand accept the tokens described in the TOKENS section. The command can be basically anything, and should read from its standard input and write to its standard output. It should eventually connect an sshd(8) server running on some machine, or execute sshd -i somewhere. Host key management will be done using the HostName of the host being connected (defaulting to the name typed by the user). Setting the command to none disables this option entirely. Note that CheckHostIP is not available for connects with a proxy command.

This directive is useful in conjunction with nc(1) and its proxy support. For example, the following directive would connect via an HTTP proxy at 192.0.2.0:

ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p

ProxyJump

Specifies one or more jump proxies as either

[user@]host[:port] or an ssh URI . Multiple proxies may be separated by comma characters and will be visited sequentially. Setting this option will cause ssh(1) to connect to the target host by first making a ssh(1) connection to the specified ProxyJump host and then establishing a TCP forwarding to the ultimate target from there.

Note that this option will compete with the ProxyCommand option - whichever is specified first will prevent later instances of the other from taking effect.

ProxyUseFdpass

Specifies that ProxyCommand will pass a connected file descriptor back to ssh(1) instead of continuing to execute and pass data. The default is no.

PubkeyAcceptedKeyTypes

Specifies the key types that will be used for public key authentication as a comma-separated list of patterns. Alternately if the specified value begins with a ’+’ character, then the key types after it will be appended to the default instead of replacing it. If the specified value begins with a ’-’ character, then the specified key types (including wildcards) will be removed from the default set instead of replacing them. The default for this option is:

ecdsa-sha2-nistp256-cert-v01@openssh.com,
ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,
ssh-ed25519-cert-v01@openssh.com,
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
ssh-rsa-cert-v01@openssh.com,
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

The list of available key types may also be obtained using "ssh -Q key".

PubkeyAuthentication

Specifies whether to try public key authentication. The argument to this keyword must be yes (the default) or no.

RekeyLimit

Specifies the maximum amount of data that may be transmitted before the session key is renegotiated, optionally followed a maximum amount of time that may pass before the session key is renegotiated. The first argument is specified in bytes and may have a suffix of ’K’, ’M’, or ’G’ to indicate Kilobytes, Megabytes, or Gigabytes, respectively. The default is between ’1G’ and ’4G’, depending on the cipher. The optional second value is specified in seconds and may use any of the units documented in the TIME FORMATS section of sshd_config(5). The default value for RekeyLimit is default none, which means that rekeying is performed after the cipher’s default amount of data has been sent or received and no time based rekeying is done.

RemoteCommand

Specifies a command to execute on the remote machine after successfully connecting to the server. The command string extends to the end of the line, and is executed with the user’s shell. Arguments to RemoteCommand accept the tokens described in the TOKENS section.

RemoteForward

Specifies that a TCP port on the remote machine be forwarded over the secure channel. The remote port may either be forwarded to a specified host and port from the local machine, or may act as a SOCKS 4/5 proxy that allows a remote client to connect to arbitrary destinations from the local machine. The first argument must be [

bind_address: ]port If forwarding to a specific destination then the second argument must be host:hostport, otherwise if no destination argument is specified then the remote forwarding will be established as a SOCKS proxy.

IPv6 addresses can be specified by enclosing addresses in square brackets. Multiple forwardings may be specified, and additional forwardings can be given on the command line. Privileged ports can be forwarded only when logging in as root on the remote machine.

If the port argument is 0, the listen port will be dynamically allocated on the server and reported to the client at run time.

If the bind_address is not specified, the default is to only bind to loopback addresses. If the bind_address is ’*’ or an empty string, then the forwarding is requested to listen on all interfaces. Specifying a remote bind_address will only succeed if the server’s GatewayPorts option is enabled (see sshd_config(5)).

RequestTTY

Specifies whether to request a pseudo-tty for the session. The argument may be one of: no (never request a TTY), yes (always request a TTY when standard input is a TTY), force (always request a TTY) or auto (request a TTY when opening a login session). This option mirrors the -t and -T flags for ssh(1).

RevokedHostKeys

Specifies revoked host public keys. Keys listed in this file will be refused for host authentication. Note that if this file does not exist or is not readable, then host authentication will be refused for all hosts. Keys may be specified as a text file, listing one public key per line, or as an OpenSSH Key Revocation List (KRL) as generated by ssh-keygen(1). For more information on KRLs, see the KEY REVOCATION LISTS section in ssh-keygen(1).

SendEnv

Specifies what variables from the local environ(7) should be sent to the server. The server must also support it, and the server must be configured to accept these environment variables. Note that the TERM environment variable is always sent whenever a pseudo-terminal is requested as it is required by the protocol. Refer to AcceptEnv in sshd_config(5) for how to configure the server. Variables are specified by name, which may contain wildcard characters. Multiple environment variables may be separated by whitespace or spread across multiple SendEnv directives.

See PATTERNS for more information on patterns.

It is possible to clear previously set SendEnv variable names by prefixing patterns with -. The default is not to send any environment variables.

ServerAliveCountMax

Sets the number of server alive messages (see below) which may be sent without ssh(1) receiving any messages back from the server. If this threshold is reached while server alive messages are being sent, ssh will disconnect from the server, terminating the session. It is important to note that the use of server alive messages is very different from TCPKeepAlive (below). The server alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by TCPKeepAlive is spoofable. The server alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive.

The default value is 3. If, for example, ServerAliveInterval (see below) is set to 15 and ServerAliveCountMax is left at the default, if the server becomes unresponsive, ssh will disconnect after approximately 45 seconds.

ServerAliveInterval

Sets a timeout interval in seconds after which if no data has been received from the server, ssh(1) will send a message through the encrypted channel to request a response from the server. The default is 0, indicating that these messages will not be sent to the server, or 300 if the BatchMode option is set (Debian-specific). ProtocolKeepAlives and SetupTimeOut are Debian-specific compatibility aliases for this option.

SetEnv

Directly specify one or more environment variables and their contents to be sent to the server. Similarly to SendEnv, the server must be prepared to accept the environment variable.

StreamLocalBindMask

Sets the octal file creation mode mask (umask) used when creating a Unix-domain socket file for local or remote port forwarding. This option is only used for port forwarding to a Unix-domain socket file.

The default value is 0177, which creates a Unix-domain socket file that is readable and writable only by the owner. Note that not all operating systems honor the file mode on Unix-domain socket files.

StreamLocalBindUnlink

Specifies whether to remove an existing Unix-domain socket file for local or remote port forwarding before creating a new one. If the socket file already exists and StreamLocalBindUnlink is not enabled, ssh will be unable to forward the port to the Unix-domain socket file. This option is only used for port forwarding to a Unix-domain socket file.

The argument must be yes or no (the default).

StrictHostKeyChecking

If this flag is set to yes, ssh(1) will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed. This provides maximum protection against man-in-the-middle (MITM) attacks, though it can be annoying when the /etc/ssh/ssh_known_hosts file is poorly maintained or when connections to new hosts are frequently made. This option forces the user to manually add all new hosts.

If this flag is set to “accept-new” then ssh will automatically add new host keys to the user known hosts files, but will not permit connections to hosts with changed host keys. If this flag is set to “no” or “off”, ssh will automatically add new host keys to the user known hosts files and allow connections to hosts with changed hostkeys to proceed, subject to some restrictions. If this flag is set to ask (the default), new host keys will be added to the user known host files only after the user has confirmed that is what they really want to do, and ssh will refuse to connect to hosts whose host key has changed. The host keys of known hosts will be verified automatically in all cases.

SyslogFacility

Gives the facility code that is used when logging messages from ssh(1). The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is USER.

TCPKeepAlive

Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. This option only uses TCP keepalives (as opposed to using ssh level keepalives), so takes a long time to notice when the connection dies. As such, you probably want the ServerAliveInterval option as well. However, this means that connections will die if the route is down temporarily, and some people find it annoying.

The default is yes (to send TCP keepalive messages), and the client will notice if the network goes down or the remote host dies. This is important in scripts, and many users want it too.

To disable TCP keepalive messages, the value should be set to no. See also ServerAliveInterval for protocol-level keepalives.

Tunnel

Request tun(4) device forwarding between the client and the server. The argument must be yes, point-to-point (layer 3), ethernet (layer 2), or no (the default). Specifying yes requests the default tunnel mode, which is point-to-point.

TunnelDevice

Specifies the tun(4) devices to open on the client (local_tun) and the server (remote_tun).

The argument must be local_tun[:remote_tun]. The devices may be specified by numerical ID or the keyword any, which uses the next available tunnel device. If remote_tun is not specified, it defaults to any. The default is any:any.

UpdateHostKeys

Specifies whether ssh(1) should accept notifications of additional hostkeys from the server sent after authentication has completed and add them to UserKnownHostsFile. The argument must be yes, no (the default) or ask. Enabling this option allows learning alternate hostkeys for a server and supports graceful key rotation by allowing a server to send replacement public keys before old ones are removed. Additional hostkeys are only accepted if the key used to authenticate the host was already trusted or explicitly accepted by the user. If UpdateHostKeys is set to ask, then the user is asked to confirm the modifications to the known_hosts file. Confirmation is currently incompatible with ControlPersist, and will be disabled if it is enabled.

Presently, only sshd(8) from OpenSSH 6.8 and greater support the "hostkeys@openssh.com" protocol extension used to inform the client of all the server’s hostkeys.

User

Specifies the user to log in as. This can be useful when a different user name is used on different machines. This saves the trouble of having to remember to give the user name on the command line.

UserKnownHostsFile

Specifies one or more files to use for the user host key database, separated by whitespace. The default is ~/.ssh/known_hosts, ~/.ssh/known_hosts2.

VerifyHostKeyDNS

Specifies whether to verify the remote key using DNS and SSHFP resource records. If this option is set to yes, the client will implicitly trust keys that match a secure fingerprint from DNS. Insecure fingerprints will be handled as if this option was set to ask. If this option is set to ask, information on fingerprint match will be displayed, but the user will still need to confirm new host keys according to the StrictHostKeyChecking option. The default is no.

See also VERIFYING HOST KEYS in ssh(1).

VisualHostKey

If this flag is set to yes, an ASCII art representation of the remote host key fingerprint is printed in addition to the fingerprint string at login and for unknown host keys. If this flag is set to no (the default), no fingerprint strings are printed at login and only the fingerprint string will be printed for unknown host keys.

XAuthLocation

Specifies the full pathname of the xauth(1) program. The default is /usr/bin/xauth.

PATTERNS

A pattern consists of zero or more non-whitespace characters, ’*’ (a wildcard that matches zero or more characters), or ’?’ (a wildcard that matches exactly one character). For example, to specify a set of declarations for any host in the ".co.uk" set of domains, the following pattern could be used:

Host *.co.uk

The following pattern would match any host in the 192.168.0.[0-9] network range:

Host 192.168.0.?

A pattern-list is a comma-separated list of patterns. Patterns within pattern-lists may be negated by preceding them with an exclamation mark (’!’). For example, to allow a key to be used from anywhere within an organization except from the "dialup" pool, the following entry (in authorized_keys) could be used:

from="!*.dialup.example.com,*.example.com"

Note that a negated match will never produce a positive result by itself. For example, attempting to match "host3" against the following pattern-list will fail:

from="!host1,!host2"

The solution here is to include a term that will yield a positive match, such as a wildcard:

from="!host1,!host2,*"

TOKENS

Arguments to some keywords can make use of tokens, which are expanded at runtime:

%%

A literal ’%’.

%C

Hash of %l%h%p%r.

%d

Local user’s home directory.

%h

The remote hostname.

%i

The local user ID.

%L

The local hostname.

%l

The local hostname, including the domain name.

%n

The original remote hostname, as given on the command line.

%p

The remote port.

%r

The remote username.

%T

The local tun(4) or tap(4) network interface assigned if tunnel forwarding was requested, or "NONE" otherwise.

%u

The local username.

Match exec accepts the tokens %%, %h, %i, %L, %l, %n, %p, %r, and %u.

CertificateFile accepts the tokens %%, %d, %h, %i, %l, %r, and %u.

ControlPath accepts the tokens %%, %C, %h, %i, %L, %l, %n, %p, %r, and %u.

HostName accepts the tokens %% and %h.

IdentityAgent and IdentityFile accept the tokens %%, %d, %h, %i, %l, %r, and %u.

LocalCommand accepts the tokens %%, %C, %d, %h, %i, %l, %n, %p, %r, %T, and %u.

ProxyCommand accepts the tokens %%, %h, %p, and %r.

RemoteCommand accepts the tokens %%, %C, %d, %h, %i, %l, %n, %p, %r, and %u.

FILES
~/.ssh/config

This is the per-user configuration file. The format of this file is described above. This file is used by the SSH client. Because of the potential for abuse, this file must have strict permissions: read/write for the user, and not accessible by others. It may be group-writable provided that the group in question contains only the user.

/etc/ssh/ssh_config

Systemwide configuration file. This file provides defaults for those values that are not specified in the user’s configuration file, and for those users who do not have a configuration file. This file must be world-readable.

SEE ALSO

ssh(1)

AUTHORS

OpenSSH is a derivative of the original and free ssh 1.2.12 release by Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt and Dug Song removed many bugs, re-added newer features and created OpenSSH. Markus Friedl contributed the support for SSH protocol versions 1.5 and 2.0.

BSD October 3, 2018 BSD

Config-Model-OpenSsh-2.8.7.1/xt/parser.t0000644000175000017500000001033214160662115016266 0ustar domidomiuse strict; use warnings; use lib qw(contrib/lib); use 5.22.0; use ParseMan; use Test::More; use Test::Differences; use Path::Tiny; use experimental qw/postderef signatures/ ; use XXX; my $html = path('xt/ssh_config.html')->slurp; my $data = parse_html_man_page($html); subtest "man page transformation" => sub { # test some data items is($data->{element_list}[0],'Host', "first element name"); is($data->{element_list}[5],'BindAddress', "5th element name"); my $param_data=$data->{element_data}{'VerifyHostKeyDNS'}; is($param_data->[0],'B','check B<> transformation in parameter name'); like($param_data->[1],qr/B/,'check B<> transformation in parameter description'); is($param_data->[2],"See also\nI in L.", "check I<> and L<> transformation"); }; subtest "test generation of model string" => sub { my @unilines = qw/ControlPersist GSSAPIClientIdentity IdentityAgent/; my $boolean = sub { return "type=leaf value_type=boolean write_as=no,yes upstream_default=$_[0]"; }; my $enum = sub ($set,$def = undef) { my $str = "type=leaf value_type=enum choice=$set"; $str .= " upstream_default=$def" if defined $def; return $str; }; my %expected_load = ( AddKeysToAgent => $enum->('yes,confirm,ask,no', 'no'), AddressFamily => $enum->('any,inet,inet6', 'any'), BatchMode => $boolean->('no'), CanonicalizeFallbackLocal => $boolean->('yes'), CanonicalizeHostname => $enum->('no,yes,always', 'no'), CanonicalizeMaxDots => 'type=leaf value_type=integer upstream_default=1', CheckHostIP => $boolean->('yes'), ConnectionAttempts => 'type=leaf value_type=integer upstream_default=1', ConnectTimeout => 'type=leaf value_type=integer', ControlMaster => $enum->('auto,autoask,yes,no,ask', 'no'), DynamicForward => 'type=list cargo type=leaf value_type=uniline', ExitOnForwardFailure => $boolean->('no'), ForwardX11Timeout => 'type=leaf value_type=integer', GlobalKnownHostsFile => 'type=leaf value_type=uniline upstream_default=/etc/ssh/ssh_known_hosts', GSSAPIAuthentication => $boolean->('no'), GSSAPITrustDns => $boolean->('no'), Host => 'type=hash index_type=string ordered=1 cargo type=node config_class_name=Ssh::HostElement', IdentitiesOnly => $boolean->('no'), IdentityFile => 'type=list cargo type=leaf value_type=uniline', IPQoS => 'type=leaf value_type=uniline upstream_default="af21 cs1"', Match => 'type=hash index_type=string ordered=1 cargo type=node config_class_name=Ssh::HostElement', NumberOfPasswordPrompts => 'type=leaf value_type=integer upstream_default=3', RequestTTY => $enum->('no,yes,force,auto'), SendEnv => 'type=list cargo type=leaf value_type=uniline', ServerAliveCountMax => 'type=leaf value_type=integer upstream_default=3', ServerAliveInterval => 'type=leaf value_type=integer upstream_default=0', LocalForward => 'type=list cargo type=node config_class_name="Ssh::PortForward"', RemoteForward => 'type=list cargo type=node config_class_name="Ssh::PortForward"', Tunnel => $enum->('yes,point-to-point,ethernet,no','no'), TunnelDevice => 'type=leaf value_type=uniline upstream_default=any:any', LogLevel => $enum->('QUIET,FATAL,ERROR,INFO,VERBOSE,DEBUG,DEBUG1,DEBUG2,DEBUG3', 'INFO'), SyslogFacility => $enum->('DAEMON,USER,AUTH,'.join(',', map { "LOCAL$_" } (0..7)), 'USER'), VerifyHostKeyDNS => $enum->('yes,ask,no', 'no'), XAuthLocation => 'type=leaf value_type=uniline upstream_default=/usr/bin/xauth', ); foreach my $p (@unilines) { $expected_load{$p} = 'type=leaf value_type=uniline'; } foreach my $param ($data->{element_list}->@*) { my @desc = $data->{element_data}{$param}->@*; my $load = create_load_data(ssh => $param => @desc); # check only some of the parameters if (defined $expected_load{$param}) { note("test failed with @desc") unless $load eq $expected_load{$param}; is($load, $expected_load{$param}, "check generated load string of $param"); } } }; done_testing; Config-Model-OpenSsh-2.8.7.1/MANIFEST.SKIP0000644000175000017500000000016114160662115016047 0ustar domidomidebian/ ~$ \.ptkdb$ \.old$ dist.ini libconfig _build \.orig$ ^MYMETA.yml$ blib wr_root wr_test demo/lib demo/etc Config-Model-OpenSsh-2.8.7.1/README.pod0000644000175000017500000000545614160662115015626 0ustar domidomi=head1 Config::Model::OpenSsh - OpenSSH graphical configuration editor This module provides a graphical configuration editor for: =over =item C =item C =item C<~/.ssh/config> =back =head1 Installation =head2 Debian or Ubuntu As root,type: sudo apt install cme libconfig-model-openssh-perl To get the GUI, you should also do: sudo apt install libconfig-model-tkui-perl =head2 On Mac or Windows The easiest way is to: =over =item * install Perl from L, =item * Run PPM =item * Select and install C, C and C =back =head2 Other You can also install these modules from CPAN: cpanm App::Cme cpanm Config::Model::OpenSsh cpanm Config::Model::TkUI =head1 Usage Once this module is installed, you can launch a GUI to edit C with: $ sudo cme edit sshd If L fails to load your C, you can try L with C<-force> option. Likewise, you can edit your C<~/.ssh/config> file with: $ cme edit ssh Or to edit C, run as root: $ sudo cme edit system-ssh More details are given in L wiki page. =head1 Build from git repository See L. =head1 More information For more information, see: =over =item * L wiki page =item * L wiki page =item * L =back =head1 Installation from git L is built with L. Please follow the L to install all modules related to L. Then, make sure that L is installed. On debian or ubuntu, do: sudo apt-get build-dep libconfig-model-openssh-perl Then run: dzil build If you want to install this software without packaging, you can also run: dzil install =head1 Update OpenSSH model To update the model, the easiest way is to use the following command in the git repo: $ cme meta edit This command requires L. On debian or ubuntu, do: sudo apt install libconfig-model-itself-perl Then you can explore the configuration elements in the GUI. For more information on model update, see this L Config-Model-OpenSsh-2.8.7.1/Build.PL0000644000175000017500000000576014160662115015457 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # # Copyright (c) 2008-2013 Dominique Dumont. # # This file is part of Config-Model-OpenSsh. # # Config-Model is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser Public License as # published by the Free Software Foundation; either version 2.1 of # the License, or (at your option) any later version. # # Config-Model is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser Public License for more details. # # You should have received a copy of the GNU Lesser Public License # along with Config-Model; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA # 02110-1301 USA use Module::Build; use warnings FATAL => qw(all) ; use strict ; require 5.010; my %appli_files = map { ( $_, $_ ) } glob("lib/Config/Model/*.d/*"); # check that pod docs are up-to-date this is redundant with work done by # dzil. But this enable to re-build the docs downstream. # Use $^X in there as requested in # https://rt.cpan.org/Public/Bug/Display.html?id=74891 my $class = Module::Build->subclass( class => "Module::Build::Custom", code => <<'SUBCLASS' ); sub ACTION_build { my $self = shift; # below requires Config::Model 2.026 system ($^X, '-MConfig::Model::Utils::GenClassPod', '-e','gen_class_pod();') == 0 or die "gen-class-pod failed: $?"; $self->SUPER::ACTION_build; } SUBCLASS my $build = $class->new ( module_name => 'Config::Model::OpenSsh', license => 'lgpl', dist_author => "Dominique Dumont (ddumont at cpan dot org)", dist_abstract => "OpenSsh configuration files graphical editor", appli_files => \%appli_files , 'build_requires' => { 'Config::Model' => '2.146', 'Config::Model::BackendMgr' => '0', 'Config::Model::Tester' => '4.001', 'Config::Model::Tester::Setup' => '0', 'English' => '0', 'Module::Build' => '0.34', 'Path::Tiny' => '0', 'Test::Differences' => '0', 'Test::More' => '0', 'Test::Pod' => '1.00', 'Test::Warn' => '0' }, 'configure_requires' => { 'Module::Build' => '0.34' }, 'recommends' => { 'App::Cme' => '0', 'Config::Model::TkUI' => '0' }, 'requires' => { 'Carp' => '0', 'Config::Model' => '2.146', 'Config::Model::Backend::Any' => '0', 'File::Copy' => '0', 'File::HomeDir' => '0', 'File::Path' => '0', 'IO::File' => '0', 'Log::Log4perl' => '1.11', 'Mouse' => '0', 'Mouse::Role' => '0', 'perl' => '5.012' }, add_to_cleanup => [qw/wr_root/] , ); $build->add_build_element('pl'); $build->add_build_element('appli'); $build->create_build_script; Config-Model-OpenSsh-2.8.7.1/lib/0000755000175000017500000000000014160662115014721 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/0000755000175000017500000000000014160662115016126 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/0000755000175000017500000000000014160662115017166 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/0000755000175000017500000000000014160662115020515 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/0000755000175000017500000000000014160662115022074 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Ssh.pm0000644000175000017500000001265014160662115023173 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::Backend::OpenSsh::Ssh ; $Config::Model::Backend::OpenSsh::Ssh::VERSION = '2.8.7.1'; use Mouse ; use 5.10.1; extends "Config::Model::Backend::Any" ; with ( 'Config::Model::Backend::OpenSsh::Role::Reader', 'Config::Model::Backend::OpenSsh::Role::Writer', ); use Carp ; use IO::File ; use Log::Log4perl; use File::Copy ; use File::Path ; use File::HomeDir ; my $logger = Log::Log4perl::get_logger("Backend::OpenSsh"); sub write { my $self = shift; $self->ssh_write(@_, ssh_mode => 'custom') ; } sub host { my ($self,$root,$key, $patterns,$comment) = @_; $logger->debug("host: pattern @$patterns # $comment"); my $hash_obj = $root->fetch_element('Host'); $logger->info("ssh: load host patterns '".join("','", @$patterns)."'"); my $hv = $hash_obj->fetch_with_id("@$patterns") ; $hv -> annotation($comment) if $comment ; $self->current_node($hv); } sub forward { my ($self, $root, $key, $args, $comment, $check) = @_; $logger->debug("forward: $key @$args # $comment"); $self->current_node = $root unless defined $self->current_node ; my $elt_name = $key =~ /local/i ? 'Localforward' : 'RemoteForward' ; my $v6 = ($args->[1] =~ m![/\[\]]!) ? 1 : 0; $logger->info("ssh: load $key '".join("','", @$args)."' ". ( $v6 ? 'IPv6' : 'IPv4')); # cleanup possible square brackets used for IPv6 foreach (@$args) { s/[\[\]]+//g; } # reverse enable to assign string to port even if no bind_adress # is specified my $re = $v6 ? qr!/! : qr!:! ; my ($port,$bind_adr ) = reverse split $re,$args->[0] ; my ($host,$host_port) = split $re,$args->[1] ; my $fw_list = $self->current_node->fetch_element($key); my $size = $fw_list->fetch_size; # this creates a new node in the list my $fw_obj = $fw_list->fetch_with_id($size); # $fw_obj->store_element_value( GatewayPorts => 1 ) if $bind_adr ; $fw_obj->annotation($comment) if $comment; $fw_obj->store_element_value( ipv6 => 1) if $v6 ; $fw_obj->store_element_value( check => $check, name => 'bind_address', value => $bind_adr) if defined $bind_adr ; $fw_obj->store_element_value( check => $check, name => 'port', value => $port ); $fw_obj->store_element_value( check => $check, name => 'host', value => $host ); $fw_obj->store_element_value( check => $check, name => 'hostport', value => $host_port ); } sub write_all_host_block { my $self = shift ; my $host_elt = shift ; my $mode = shift || ''; my $result = '' ; foreach my $pattern ( $host_elt->fetch_all_indexes) { my $block_elt = $host_elt->fetch_with_id($pattern) ; $logger->debug("write_all_host_block on ".$block_elt->location." mode $mode"); my $block_data = $self->write_node_content($block_elt,'custom') ; # write data only if custom pattern or custom data is found this # is necessary to avoid writing data from /etc/ssh/ssh_config that # were entered as 'preset' data if ($block_data) { $result .= $self->write_line(Host => $pattern, $block_elt->annotation); $result .= "$block_data\n" ; } } return $result ; } sub write_forward { my $self = shift ; my $forward_elt = shift ; my $mode = shift || ''; my $result = '' ; my $v6 = $forward_elt->grab_value('ipv6') ; my $sep = $v6 ? '/' : ':'; my $line = ''; foreach my $name ($forward_elt->get_element_name() ) { next if $name eq 'ipv6' ; my $elt = $forward_elt->fetch_element($name) ; my $v = $elt->fetch($mode) ; next unless length($v); $line .= $name =~ /bind|host$/ ? "$v$sep" : $name eq 'port' ? "$v " : $v ; } return $self->write_line($forward_elt->element_name,$line,$forward_elt->annotation) ; } no Mouse; 1; # ABSTRACT: Backend for ssh configuration files __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::Backend::OpenSsh::Ssh - Backend for ssh configuration files =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS None =head1 DESCRIPTION This module provides a backend to read and write ssh client configuration files. =head1 STOP The documentation provides details on the module used to read and write OpenSsh configuration files. These details are not needed for the basic usages explained in L. =head1 Methods These read/write functions are part of C read/write backend. They are declared in Ssh configuration model and are called back when needed to read and write the configuration file. =head2 read (object => , config_dir => ...) Reads F in C and load the data in the C configuration tree. =head2 write (object => , config_dir => ...) Write F in C from the data stored in C configuration tree. =head1 SEE ALSO L, L, L =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Sshd.pm0000644000175000017500000000274514160662115023343 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::Backend::OpenSsh::Sshd ; $Config::Model::Backend::OpenSsh::Sshd::VERSION = '2.8.7.1'; use Mouse ; extends "Config::Model::Backend::Any" ; with ( 'Config::Model::Backend::OpenSsh::Role::Reader', 'Config::Model::Backend::OpenSsh::Role::Writer', ); use Carp ; use IO::File ; use Log::Log4perl; use File::Copy ; use File::Path ; my $logger = Log::Log4perl::get_logger("Backend::OpenSsh"); # now the write part sub write { my $self = shift; $self->ssh_write(@_) ; } sub _write_line { return sprintf("%-20s %s\n",@_) ; } no Mouse; 1; # ABSTRACT: Backend for sshd configuration files __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::Backend::OpenSsh::Sshd - Backend for sshd configuration files =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS None =head1 DESCRIPTION This class provides a backend to read and write sshd client configuration files. This class is a plugin for L. =head1 SEE ALSO L, L, =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Role/0000755000175000017500000000000014160662115022775 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Role/Reader.pm0000644000175000017500000001123614160662115024540 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::Backend::OpenSsh::Role::Reader ; $Config::Model::Backend::OpenSsh::Role::Reader::VERSION = '2.8.7.1'; use 5.10.1; use Config::Model 2.128; use Mouse::Role ; requires qw(read_global_comments associates_comments_with_data); # sub stub known as "forward" declaration # required for Role consistency checks # See Moose::Manual::Roles for details sub current_node; has 'current_node' => ( is => 'rw', isa => 'Config::Model::Node', weak_ref => 1 ) ; use Carp ; use Log::Log4perl 1.11; my $logger = Log::Log4perl::get_logger("Backend::OpenSsh"); my @dispatch = ( qr/match/i => 'match', qr/host\b/i => 'host', qr/(local|remote)forward/i => 'forward', qr/^PreferredAuthentications$/ => 'comma_list', qr/localcommand/i => 'assign', qr/\w/ => 'assign', ); sub read { my $self = shift ; my %args = @_ ; my $config_root = $args{object} || croak __PACKAGE__," read_ssh_file: undefined config root object"; return 0 unless $args{file_path}->is_file; $logger->info("loading config file ".$args{file_path}); my @lines = $args{file_path}->lines_utf8 ; # try to get global comments (comments before a blank line) $self->read_global_comments(\@lines,'#') ; # need to reset this when reading user ssh file after system ssh file $self->current_node($config_root) ; my @assoc = $self->associates_comments_with_data( \@lines, '#' ) ; foreach my $item (@assoc) { my ( $vdata, $comment ) = @$item; my ( $k, @v ) = split /\s+/, $vdata; my $i = 0; while ( $i < @dispatch ) { my ( $regexp, $sub ) = @dispatch[ $i++, $i++ ]; if ( $k =~ $regexp and $self->can($sub)) { $logger->trace("read_ssh_file: dispatch calls $sub"); $self->$sub( $config_root, $k, \@v, $comment, $args{check} ); last; } warn __PACKAGE__, " unknown keyword: $k" if $i >= @dispatch; } } return 1; } sub comma_list { my ($self,$root, $raw_key,$arg,$comment, $check) = @_ ; $logger->debug("assign: $raw_key @$arg # $comment"); my @list = map { split /\s*,\s*/ } @$arg; $self->assign($root, $raw_key,\@list,$comment, $check); } sub assign { my ($self,$root, $raw_key,$arg,$comment, $check) = @_ ; $logger->debug("assign: $raw_key @$arg # $comment"); # keys are case insensitive, try to find a match my $key = $self->current_node->find_element ($raw_key, case => 'any') ; if (not defined $key) { if ($check eq 'yes') { # drop if -force is not set die "Error: unknown parameter: '$raw_key'. Use -force option to drop this parameter\n"; } else { say "Dropping parameter '$raw_key'" ; } return; } my $elt = $self->current_node->fetch_element($key) ; my $type = $elt->get_type; #print "got $key type $type and ",join('+',@$arg),"\n"; $elt->annotation($comment) if $comment and $type ne 'hash'; if ($type eq 'leaf') { $elt->store( value => join(' ',@$arg), check => $check ) ; } elsif ($type eq 'list') { $elt->push_x ( values => $arg, check => $check ) ; } elsif ($type eq 'hash') { my $hv = $elt->fetch_with_id($arg->[0]); $hv->store( value => $arg->[1], check => $check ); $hv->annotation($comment) if $comment; } elsif ($type eq 'check_list') { my @check = split /\s*,\s*/,$arg->[0] ; $elt->set_checked_list (\@check, check => 'skip') ; } else { die "OpenSsh::assign did not expect $type for $key\n"; } } no Mouse; 1; # ABSTRACT: Role to read OpenSsh config files __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::Backend::OpenSsh::Role::Reader - Role to read OpenSsh config files =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS None. Consumed by L and L. =head1 DESCRIPTION Read methods used by both L and L. =head1 SEE ALSO L, L, L =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Role/Writer.pm0000644000175000017500000001056014160662115024611 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::Backend::OpenSsh::Role::Writer ; $Config::Model::Backend::OpenSsh::Role::Writer::VERSION = '2.8.7.1'; use Mouse::Role ; with 'Config::Model::Backend::OpenSsh::Role::MatchBlock'; requires qw(write_global_comments write_data_and_comments); use 5.10.1; use Config::Model 2.128; use Carp ; use IO::File ; use Log::Log4perl 1.11; my $logger = Log::Log4perl::get_logger("Backend::OpenSsh"); sub ssh_write { my $self = shift ; my %args = @_ ; my $config_root = $args{object} || croak __PACKAGE__," ssh_write: undefined config root object"; $logger->info("writing config file $args{file_path}"); my $comment = $self->write_global_comment('#') ; my $result = $self->write_node_content($config_root,$args{ssh_mode}); if ($result) { $args{file_path}->spew_utf8($comment.$result); return 1; } return 0; } sub write_line { my ($self, $k, $v, $note) = @_ ; return '' unless length($v) ; return $self->write_data_and_comments('#',sprintf("%-20s %s",$k,$v),$note) ; } sub write_list { my ($self,$name,$mode,$elt) = @_; my @r = map { $self->write_line($name,$_->fetch($mode), $_->annotation) ;} $elt->fetch_all() ; return join('',@r) ; } sub write_list_in_one_line { my ($self,$name,$mode,$elt) = @_; my @v = $elt->fetch_all_values(mode => $mode) ; return $self->write_line($name,join(' ',@v)) ; } # list there list element that must be written on one line with items # separated by a white space my %list_as_one_line = ( 'AuthorizedKeysFile' => 1 , ) ; sub write_node_content { my $self= shift ; my $node = shift ; my $mode = shift || ''; my $result = '' ; my $match = '' ; foreach my $name ($node->get_element_name() ) { next unless $node->is_element_defined($name) ; my $elt = $node->fetch_element($name) ; my $type = $elt->get_type; my $note = $elt->annotation ; #print "got $key type $type and ",join('+',@arg),"\n"; if ($name eq 'Match') { $match .= $self->write_all_match_block($elt,$mode) ; } elsif ($name eq 'Host') { $match .= $self->write_all_host_block($elt,$mode) ; } elsif ($name =~ /^(Local|Remote)Forward$/) { foreach ($elt->fetch_all()) { $result .= $self->write_forward($_,$mode); } } elsif ($type eq 'leaf') { my $v = $elt->fetch($mode) ; $result .= $self->write_line($name,$v,$note); } elsif ($type eq 'check_list') { my $v = $elt->fetch($mode) ; $result .= $self->write_line($name,$v,$note); } elsif ($type eq 'list') { $result .= $self->write_data_and_comments('#', undef, $note) ; $result .= $list_as_one_line{$name} ? $self->write_list_in_one_line($name,$mode,$elt) : $self->write_list($name,$mode,$elt) ; } elsif ($type eq 'hash') { foreach my $k ( $elt->fetch_all_indexes ) { my $o = $elt->fetch_with_id($k); my $v = $o->fetch($mode) ; $result .= $self->write_line($name,"$k $v", $o->annotation) ; } } else { die "OpenSsh::write did not expect $type for $name\n"; } } return $result.$match ; } no Mouse; 1; # ABSTRACT: Role to write OpenSsh config files __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::Backend::OpenSsh::Role::Writer - Role to write OpenSsh config files =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS None. Consumed by L and L. =head1 DESCRIPTION Write methods used by both L and L. =head1 SEE ALSO L, L, L =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/Backend/OpenSsh/Role/MatchBlock.pm0000644000175000017500000000630514160662115025346 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::Backend::OpenSsh::Role::MatchBlock ; $Config::Model::Backend::OpenSsh::Role::MatchBlock::VERSION = '2.8.7.1'; use Mouse::Role ; requires qw(current_node write_node_content write_line); use Carp ; use IO::File ; use Log::Log4perl; use File::Copy ; use File::Path ; my $logger = Log::Log4perl::get_logger("Backend::OpenSsh"); sub match { my ($self, $root, $key, $pairs, $comment, $check) = @_ ; $logger->debug("match: @$pairs # $comment"); my $list_obj = $root->fetch_element('Match'); # create new match block my $nb_of_elt = $list_obj->fetch_size; my $block_obj = $list_obj->fetch_with_id($nb_of_elt) ; $block_obj->annotation($comment) ; while (@$pairs) { my $criteria = shift @$pairs; my $pattern = shift @$pairs; $block_obj->load( steps => qq!Condition $criteria="$pattern"!, check => $check, ); } $self->current_node( $block_obj->fetch_element('Settings') ); } sub write_all_match_block { my $self = shift ; my $match_elt = shift ; my $mode = shift || ''; my $result = ''; foreach my $elt ($match_elt->fetch_all($mode) ) { $result .= $self->write_match_block($elt,$mode) ; } return $result ; } sub write_match_block { my $self = shift ; my $match_elt = shift ; my $mode = shift || ''; my $match_line ; my $match_body ; foreach my $name ($match_elt->get_element_name() ) { my $elt = $match_elt->fetch_element($name) ; if ($name eq 'Settings') { $match_body .= $self->write_node_content($elt,$mode)."\n" ; } elsif ($name eq 'Condition') { $match_line = $self->write_line( Match => $self->write_match_condition($elt,$mode) , $match_elt -> annotation ) ; } else { die "write_match_block: unexpected element: $name"; } } return $match_line.$match_body ; } sub write_match_condition { my $self = shift ; my $cond_elt = shift ; my $mode = shift || ''; my $result = '' ; foreach my $name ($cond_elt->get_element_name() ) { my $elt = $cond_elt->fetch_element($name) ; my $v = $elt->fetch($mode) ; $result .= " $name $v" if defined $v; } return $result ; } no Mouse; 1; # ABSTRACT: Backend role for Ssh Match blocks __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::Backend::OpenSsh::Role::MatchBlock - Backend role for Ssh Match blocks =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS None =head1 DESCRIPTION This class provides a backend role to read and write C blocks in OpenSsh configuration files. =head1 SEE ALSO L, =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/system.d/0000755000175000017500000000000014160662115020734 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/system.d/system-ssh0000644000175000017500000000002214160662115022770 0ustar domidomimodel = SystemSsh Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/system.d/sshd0000644000175000017500000000001514160662115021614 0ustar domidomimodel = Sshd Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/OpenSsh.pm0000644000175000017500000001000214160662115021074 0ustar domidomi# # This file is part of Config-Model-OpenSsh # # This software is Copyright (c) 2008-2021 by Dominique Dumont. # # This is free software, licensed under: # # The GNU Lesser General Public License, Version 2.1, February 1999 # use strict; use warnings; package Config::Model::OpenSsh ; $Config::Model::OpenSsh::VERSION = '2.8.7.1'; use Config::Model 2.111; 1; # ABSTRACT: OpenSSH config editor __END__ =pod =encoding UTF-8 =head1 NAME Config::Model::OpenSsh - OpenSSH config editor =head1 VERSION version 2.8.7.1 =head1 SYNOPSIS =head2 invoke editor The following launches a graphical editor (if L is installed): sudo cme edit sshd =head2 command line This command adds a C section in C<~/.ssh/config>: cme modify ssh Host:Foo ForwardX11=yes =head2 programmatic This code snippet removes the C section added above: use Config::Model ; my $model = Config::Model->new() ; my $inst = $model->instance (root_class_name => 'Ssh'); $inst -> config_root->load("Host~Foo") ; $inst->write_back() ; =head1 DESCRIPTION This module provides a configuration editor (and models) for the configuration files of OpenSSH. (C, C and C<~/.ssh/config>). This module can also be used to modify safely the content of these configuration files from a Perl program. Once this module is installed, you can edit C with (as root) : # cme edit sshd To edit F, run (as root): # cme edit ssh To edit F<~/.ssh/config>, run as a normal user: $ cme edit ssh =head1 user interfaces As mentioned in L, several user interfaces are available with C subcommand: =over =item * A graphical interface is proposed by default if L is installed. =item * A Curses interface with option C if L is installed. =item * A Shell like interface with option C. =back =head1 SEE ALSO L, L, =head1 AUTHOR Dominique Dumont =head1 COPYRIGHT AND LICENSE This software is Copyright (c) 2008-2021 by Dominique Dumont. This is free software, licensed under: The GNU Lesser General Public License, Version 2.1, February 1999 =for :stopwords cpan testmatrix url bugtracker rt cpants kwalitee diff irc mailto metadata placeholders metacpan =head1 SUPPORT =head2 Websites The following websites have more information about this module, and may be of help to you. As always, in addition to those websites please use your favorite search engine to discover more resources. =over 4 =item * CPANTS The CPANTS is a website that analyzes the Kwalitee ( code metrics ) of a distribution. L =item * CPAN Testers The CPAN Testers is a network of smoke testers who run automated tests on uploaded CPAN distributions. L =item * CPAN Testers Matrix The CPAN Testers Matrix is a website that provides a visual overview of the test results for a distribution on various Perls/platforms. L =item * CPAN Testers Dependencies The CPAN Testers Dependencies is a website that shows a chart of the test results of all dependencies for a distribution. L =back =head2 Bugs / Feature Requests Please report any bugs or feature requests by email to C, or through the web interface at L. You will be automatically notified of any progress on the request by the system. =head2 Source Code The code is open to the world, and available for you to hack on. Please feel free to browse it and play with it, or whatever. If you want to contribute patches, please send me a diff or prod me to pull from your repository :) L git clone git://github.com/dod38fr/config-model-openssh.git =cut Config-Model-OpenSsh-2.8.7.1/lib/Config/Model/models/0000755000175000017500000000000014160662115020451 5ustar domidomiConfig-Model-OpenSsh-2.8.7.1/lib/Config/Model/models/SystemSsh.pod0000644000175000017500000017450614160662115023134 0ustar domidomi# PODNAME: Config::Model::models::SystemSsh # ABSTRACT: Configuration class SystemSsh =encoding utf8 =head1 NAME Config::Model::models::SystemSsh - Configuration class SystemSsh =head1 DESCRIPTION Configuration classes used by L Configuration class used by L to edit or validate /etc/ssh/ssh_config (as root) =head1 Elements =head2 Host Restricts the following declarations (up to the next B or B keyword) to be only for those hosts that match one of the patterns given after the keyword. If more than one pattern is provided, they should be separated by whitespace. A single '*' as a pattern can be used to provide global defaults for all hosts. The host is usually the I argument given on the command line (see the B keyword for exceptions). A pattern entry may be negated by prefixing it with an exclamation mark ('!'). If a negated entry is matched, then the B entry is ignored, regardless of whether any other patterns on the line match. Negated matches are therefore useful to provide exceptions for wildcard matches. See I for more information on patterns. I< Optional. Type hash of node of class L . > =head2 AddKeysToAgent Specifies whether keys should be automatically added to a running L. If this option is set to B and a key is loaded from a file, the key and its passphrase are added to the agent with the default lifetime, as if by L. If this option is set to B, L will require confirmation using the SSH_ASKPASS program before adding a key (see L for details). If this option is set to B, each use of the key must be confirmed, as if the B<-c> option was specified to L. If this option is set to B, no keys are added to the agent. Alternately, this option may be specified as a time interval using the format described in the I