SSH2_CONFIG(5)

NAME
ssh2_config - format of configuration file for ssh2

CONFIGURATION FILES

Ssh2 obtains configuration data from the following sources (in this order): system's global configuration file (typically /etc/ssh2/ssh2_config), user's configuration file ($HOME/.ssh2/ssh2_config) and the command line options. For each parameter, the last obtained value will be effective.

Configuration file can begin with "metaconfig", that is, configuration for the configuration. If the configuration file starts with a line matching the following egrep style regex
  #.*VERSION[ \t\f]+[0-9]+.[0-9]+ it is interpreted as the version of the configuration style. If this kind of line is not found, the version is considered to be "1.1" . The version string can be followed by one or more metaconfiguration parameters. The lines have to start with '#', and they have to match the following egrep style regex
  #[# \t]+[A-Z0-9]+[ \t]+.* Parsing of metaconfig directives stops with the first non-recognized line. Version 1.1 and newer recognize the following parameter:

REGEX-SYNTAX
    This denotes the regex syntax used to parse the configuration file in question. The regex syntax is used in parsing the labels, lists, and so on, and when matching stuff with regex patterns specified in the configuration file. This can have one of `egrep', `ssh', `zsh_fileglob' or `traditional' as parameter (the arguments are not case-sensitive). `zsh_fileglob' and `traditional' are synonymous.

The configuration file has the following format:

    `expression:' denotes the start of a per-host configuration block, where `expression' is an arbitrary string which distinguishes this block from others. The `expression' can contain wildcards. The `expression' will be compared with the hostname obtained from the command-line, and if it matches, the block will be evaluated. Evaluation stops at the next `expression:' statement. If more than one match is found, all will be evaluated and the last obtained values for parameters will be effective. Note that the `expression' does not have to be a real hostname, as long as the `expression' block contains a "Host" configuration parameter, where the real hostname to connect is defined.

    Empty lines and lines starting with '#' are ignored as comments.

    Otherwise a line is of the format "keyword arguments". Note that it is possible to enclose arguments in quotes, and use the standard C convention. The possible keywords and their meanings are as follows (note that the configuration files are case-sensitive, but the keywords are not case-sensitive):

AllowedAuthentications
    This keyword specifies the authentications methods that are allowed. This is a comma-separated list currently consisting of the following words: password, publickey, pam-1@ssh.com, kerberos-1@ssh.com, kerberos-tgt-1@ssh.com, kerberos-2@ssh.com, kerberos-tgt-2@ssh.com, securid-1@ssh.com, and hostbased. Each specifies an authentication method. The default is "publickey,password". The authentication methods are tried in the order in which they are specified with this configuration parameter. That means that the least interactive methods should be placed first in this list, for example "hostbased, publickey,password" (because public-key authentication can be automated by the user, with ssh-agent).

AuthenticationSuccessMsg
    Specifies whether to display "Authentication successful." after authentication has completed successfully. This is mainly to prevent malicious servers from getting information from the user by displaying additional password or passphrase prompts. The argument must be The default is "yes".

AuthorizationFile
    Specifies the name of the user's authorization file.

BatchMode
    If set to "yes", ssh2 disables password/passhphrase querying. This is useful in scripts and other batch jobs where you do not have a user to supply the password. If the "StrictHostKeyChecking" parameter is set to "ask", ssh2 assumes a "no" answer to queries (this is because ssh does not even try to get user input when invoked with "BatchMode yes"). The argument must be

Ciphers
    Specifies the ciphers to use for encrypting the session. Currently, aes, blowfish, twofish, arcfour, cast, 3des, and des are supported. Multiple ciphers can be specified as a comma-separated list. Special values to this option are any, anystd, that allows only standard (see below) ciphers (and 'none'), and anycipher that allows either any available cipher or excludes non-encrypting cipher mode none but allows all others. anystdcipher is the same as anycipher above, but includes only those ciphers mentioned in the IETF-SecSH-draft (excluding 'none').

ClearAllForwardings
    Specifies whether to clear all remote and local forwarded ports defined so far. The argument must be Note that scp always automatically clears all forwarded ports.

Compression
    Specifies whether to use compression. The argument must be

DebugLogFile
    Write debug messages to specified file. (you also have to enable debugging)

DefaultDomain
    This option is only useful if set in the global configuration file. This is used by ssh2 and ssh-signer2 to find out the system name, if only the base part of the system name is available by normal means (those used by, for example, hostname(1)). This is appended to the found system name, if the system name returned does not contain a dot ('.').

DontReadStdin
    Redirect input from /dev/null, that is, do not read stdin. The argument must be

EscapeChar
    Sets the escape character (default: ~). The escape character can also be set on the command line. The argument should be a single character, '^' followed by a letter, or "none" to disable the escape character entirely (making the connection transparent for binary data).

ForcePTTYAllocation
    For tty allocation. Ie. allocate a tty even if a command is given. The argument must be

ForwardAgent
    Specifies whether the connection to the authentication agent (if any) will be forwarded to the remote machine. The argument must be

ForwardX11
    Specifies whether X11 connections will be automatically redirected over the secure channel and DISPLAY set. The argument must be

GatewayPorts
    Specifies that also remote hosts may connect to locally forwarded ports. The argument must be The default is "no".

GoBackground
    Requests ssh2 to go to background after authentication is done and the forwardings have been established. This is useful if ssh2 is going to ask for passwords or passphrases, but the user wants it in the background. The argument must be "yes", "no" or "oneshot". With "oneshot", ssh2 behaves the same way as with `-f o' command-line arguments. The default is "no".

Host
    Specifies the real host name to log into. With `expression' above, this can be used to specify nicknames or abbreviations for hosts. The default is the name given on the command line. Numeric IP addresses are also permitted (both on the command line and in HostName specifications).

IdentityFile
    Specifies the name of the user's identification file.

KeepAlive
    Specifies whether the system should send keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find this annoying. The default is "yes" (to send keepalives), and the client will notice if the network goes down or the remote host dies. This is important when using scripts, and many users want it too. To disable keepalives, the value should be set to "no" in both the server and the client configuration files.

LocalForward
    Specifies that a TCP/IP port on the local machine is forwarded over the secure channel to given host:port from the remote machine. The argument should be enclosed in double-quotes (""). The argument format is port:remotehost:remoteport .

MACs
    Specifies the MAC (Message Authentication Code) algorithm to use for data integrity verification. Currently, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160 and hmac-ripemd160-96 are supported, of which hmac-sha1, hmac-sha1-96, hmac-md5 and hmac-md5-96 are included in all distributions. Multiple MACs can be specified as a comma-separated list. Special values to this option are any, anystd, that allows only standard (see below) MACs (and 'none'), and anymac that allows either any available MAC or excludes none but allows all others. anystdmac is the same as anymac above, but includes only those MACs mentioned in the IETF-SecSH-draft (excluding 'none').

NoDelay
    If "yes", enable socket option TCP_NODELAY. The argument must be Default is "no".

NumberofPasswordPrompts
    Specifies the number of password prompts before giving up. The argument must be an integer. Note that the server also limits the number of attempts, so setting this value larger than the server's value does not have any effect. Default value is three (3).

PasswordPrompt
    Sets the password prompt that the user sees when connecting to a host. Variables '%U' and '%H' can be used to give the user's login name and host, respectively.

Port
    Specifies the port number to connect on the remote host. The default port number is 22.

QuietMode
    Quiet mode. Causes all warnings and diagnostic messages to be suppressed. Only fatal errors are displayed. The argument must be

RandomSeedFile
    Specifies the name of the user's random-seed file.

RekeyIntervalSeconds
    Specifies the number of seconds that the key exchange is done again. The default is 3600 seconds. A value of '0' turns rekey requests off. This does not prevent the server from requesting rekeys. Other servers may not have rekey capabilities implemented correctly, and your connection may be cut off if you are connecting to a server other than sshd2. (The server may also possibly crash, but that is no fault of ssh2).

RemoteForward
    Specifies that a TCP/IP port on the remote machine be forwarded over the secure channel to given host:port from the local machine. The argument should be enclosed in double-quotes (""). The argument format is port:remotehost:remoteport .

SetRemoteEnv
    Specify an environment variable to set in the server before executing a shell or command. The value should be of form "VAR=val". ``val'' can be empty. You can specify multiple variables by using multiple options. Setting the variable may fail on the server end because of policy decisions (see SettableEnvironmentVars in sshd2_config(5)) etc. (Also, sshd2 versions 3.0.x and earlier don't set environment variables (this feature was unimplemented), and so setting any variable will fail.)

Ssh1AgentCompatibility
    Specifies whether to forward also an SSH1 agent connection. Legal values for this option are "none", "traditional" and "ssh2". With value "none" (default), the SSH1 agent connection is not forwarded at all. With value "traditional", SSH1 agent connection is forwarded transparently like in SSH1. Value "traditional" can always be used, but it constitutes a security risk, because the agent does not get the information about the forwarding path. Value "ssh2" makes SSH1 agent forwarding similar to SSH2 agent forwarding and with this mode agent gets the information about the agent forwarding path. Note that value "ssh2" can only be used, if you use ssh-agent2 in SSH1 compatibility mode.

Ssh1Compatibility
    Specifies whether to use SSH1 compatibility code. With this option, ssh1 is executed when the server supports only SSH 1.x protocols. The argument must be

Ssh1InternalEmulation
    Specifies whether to use SSH1 internal emulation code. With this option, ssh2 can also communicate with ssh1 servers, without using an external ssh1 program. The argument must be

Ssh1MaskPasswordLength
    Specifies whether to send SSH_MSG_IGNORE packets to mask the password length (otherwise, it is very easy to get, as SSH1 protocol doesn't encrypt the length fields of packets). Default is "yes", the argument must be

Ssh1Path
    Specifies the path to ssh1 client, which is executed if the server supports only SSH 1.x protocols. The arguments for ssh2 are passed to the ssh1 client.

SocksServer
    Overrides the value of SSH_SOCKS_SERVER environment variable. Otherwise, functions completely equivalently.

StrictHostKeyChecking
    If this flag is set to "yes", ssh2 will never automatically add host keys to the $HOME/.ssh2/hostkeys directory, and refuses to connect hosts whose host key has changed. This provides maximum protection against Trojan horse attacks. However, it can be somewhat annoying if you do not have the necessary keys in /etc/ssh2/hostkeys and you frequently connect new hosts. Basically this option forces the user to manually add any new hosts. Normally this option is set to "ask", and new hosts will automatically be added to the known host files after you have confirmed that you really want to do that. If this is set to "no" then the new host will automatically be added to the known host files. The host keys of known hosts will be verified automatically in either case. If this value is set to "ask", the user also has the option to change the key on the disk on the fly. The argument must be "yes", "no" or "ask".

User
    Specifies the user to log in as. This can be useful if you have a different user name in different machines. This saves the trouble of having to remember to specify the user name on the command line.

VerboseMode
    Verbose mode. Causes ssh2 to print debugging messages about its progress. This is helpful when debugging connection, authentication, and configuration problems.

AUTHORS

SSH Communications Security Corp For more information, see http://www.ssh.com.

SEE ALSO
ssh2(1)