SSH2_CONFIG(5)

NAME
ssh2_config - format of configuration file for ssh2

CONFIGURATION FILES
Ssh2 obtains all configuration data from the following sources (in this order): the system's global configuration file (typically /usr/local/etc/ssh2/ssh2_config), the user's configuration file ($HOME/.ssh2/ssh2_config), and the command-line options. For each parameter, the last obtained value will be effective. A configuration file can begin with "metaconfig" information, that is, information configuring the configuration language itself. If the configuration file starts with a line matching the following egrep style regex
  #.*VERSION[ \t\f]+[0-9]+.[0-9]+ it is interpreted as the version of the configuration style. If this kind of line is not found, the version is considered to be "1.0". The version string can be followed by one or more metaconfiguration parameters. The lines have to start with '#', and they have to match the following egrep style regex
  #[# \t]+[A-Z0-9]+[ \t]+.* Parsing of metaconfig directives stops with the first non-recognized line. Version 1.1 and newer recognize the following parameter:

REGEX-SYNTAX
    This denotes the regex syntax used to parse the configuration file in question. The regex syntax is used in parsing the labels, lists, and so on, and when matching stuff with regex patterns specified in the configuration file. The value can be egrep, ssh, zsh_fileglob or traditional (the arguments are not case-sensitive). zsh_fileglob and traditional are synonymous.

The configuration file has the following format:

    'expression' denotes the start of a per-host configuration block, where 'expression' is an arbitrary string which distinguishes this block from others. The 'expression' can contain wildcards. The 'expression' will be compared with the hostname obtained from the command line, and if it matches, the block will be evaluated. Evaluation stops at the next 'expression:' statement. If more than one match is found, all will be evaluated and the last obtained values for parameters will be effective. Note that the 'expression' does not have to be a real hostname, as long as the 'expression' block contains a "Host" configuration parameter, where the real hostname to connect is defined.

    Empty lines and lines starting with '#' are ignored as comments.

    Otherwise a line is of the format 'keyword arguments'. Note that it is possible to enclose arguments in quotes, and use the standard C convention. The possible keywords and their meanings are as follows (note that the configuration files are case-sensitive but the keywords are not case-sensitive):

AllowedAuthentications
    This keyword specifies the authentication methods that are allowed. This is a comma-separated list currently consisting of the following words: keyboard-interactive, password, publickey, pam-1@ssh.com, kerberos-2@ssh.com, kerberos-tgt-2@ssh.com, securid-1@ssh.com, and hostbased. Each specifies an authentication method. The default is 'publickey, keyboard-interactive, password'. The authentication methods are tried in the order in which they are specified with this configuration parameter. This means that the least interactive methods should be placed first in this list, for example 'hostbased, publickey, keyboard-interactive' (because public-key authentication can be automated by the user, with ssh-agent).

AuthenticationSuccessMsg
    Specifies whether to print "Authentication successful." after authentication has completed successfully. This is mainly to prevent malicious servers from getting information from the user by displaying additional password or passphrase prompts. The argument must be The default is "yes".

BatchMode
    If set to "yes", ssh2 disables password/passhphrase querying. This is useful in scripts and other batch jobs where there is no user to supply the password. If the "StrictHostKeyChecking" parameter is set to "ask", ssh2 assumes a "no" answer to queries (this is because ssh does not even try to get user input when invoked with "BatchMode yes"). The argument must be The default is "no".

Ciphers
    Specifies the ciphers to use for encrypting the session. Currently, aes, blowfish, twofish, arcfour, cast, 3des, and des are supported. Multiple ciphers can be specified as a comma-separated list. Special values to this option are Any, AnyStd that allows only standard (see below) ciphers (and 'none'), and AnyCipher that allows either any available cipher or excludes non-encrypting cipher mode none but allows all others. AnyStdCipher is the same as AnyCipher above, but includes only those ciphers mentioned in the IETF-SecSH-draft (excluding 'none'). AnyStdCipher is the default value.

ClearAllForwardings
    Specifies whether to clear all remote and local forwarded ports defined so far. The argument must be Note that scp always automatically clears all forwarded ports.

Compression
    Specifies whether to use compression. The argument must be

DebugLogFile
    Write debug messages to specified file. (Remember to enable debugging.)

DefaultDomain
    This option is only useful if set in the global configuration file. This is used by ssh2 and ssh-signer2 to find out the system name, if only the base part of the system name is available by normal means (those used by, for example, hostname(1)). This is appended to the found system name, if the system name returned does not contain a dot ('.').

DisableVersionFallback
    Whether to disable fallback compatibility code for older, or otherwise incompatible versions of software. Don't disable unless you know what you're doing. The argument must be The default is "no".

DontReadStdin
    Redirect input from /dev/null, that is, do not read stdin. The argument must be The default is "no".

EkInitString
    Specifies the initialization string for the external key provider for accessing external keys for user authentication. See ssh-externalkeys(5) for further information. This feature is only available when external key support is included in the software.

EkProvider
    Specifies the external key provider for accessing external keys for user authentication. See ssh-externalkeys(5) for further information. This feature is only available when external key support is included in the software.

EscapeChar
    Sets the escape character (default: ~). The escape character can also be set on the command line. The argument should be a single character, '^' followed by a letter, or "none" to disable the escape character entirely (making the connection transparent for binary data).

ForcePTTYAllocation
    Allocate a tty even if a command is given. The argument must be The default is "no".

ForwardAgent
    Specifies whether the connection to the authentication agent (if any) will be forwarded to the remote machine. The argument must be The default is "yes".

ForwardX11
    Specifies whether X11 connections will be automatically redirected over the secure channel and DISPLAY set. The argument must be The default is "yes".

GatewayPorts
    Specifies that also remote hosts may connect to locally forwarded ports. The argument must be The default is "no".

GoBackground
    Requests ssh2 to go to the background after authentication is done and the forwardings have been established. This is useful if ssh2 is going to ask for passwords or passphrases but the user wants it in the background. The argument must be "yes", "no" or "oneshot". With "oneshot", ssh2 behaves the same way as with '-fo' command-line arguments. The default is "no".

Host
    The real host name to log into. With 'expression' above, this can be used to specify nicknames or abbreviations for hosts. The default is the name given on the command line. Numeric IP addresses are also permitted (both on the command line and in HostName specifications).

IdentityFile
    The name of the user's identification file.

KeepAlive
    Specifies whether the system should send keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find this annoying. The default is "yes" (to send keepalives), and the client will notice if the network goes down or the remote host dies. This is important when using scripts, and many users want it. To disable keepalives, the value should be set to "no" in both the server and the client configuration files.

LocalForward
    The argument format is port:host:hostport. See "-L" in ssh2(1) for more detailed information on forward definitions.

MACs
    Specifies the MAC (Message Authentication Code) algorithm to use for data integrity verification. Currently, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160, and hmac-ripemd160-96 are supported, of which hmac-sha1, hmac-sha1-96, hmac-md5, and hmac-md5-96 are included in all distributions. Multiple MACs can be specified as a comma-separated list. Special values for this option are Any, AnyStd, none, AnyMac, and AnyStdMac. Any allows all MACs including none; AnyStd allows only those mentioned in the IETF-SecSH draft and none; none forbids any use of MACs; AnyMac and AnyStdMac are analogous to the first two cases but exclude none. AnyStdMac is the default.

NoDelay
    If "yes", enable socket option TCP_NODELAY. The argument must be The default is "no".

NumberofPasswordPrompts
    Specifies the number of password prompts before giving up. The argument must be an integer. Note that the server also limits the number of attempts, so setting this value larger than the server's value does not have any effect. The default value is three (3).

PasswordPrompt
    Sets the password prompt that the user sees when connecting to a host. Variables '%U' and '%H' can be used to give the user's login name and host, respectively.

Port
    Specifies the port number to connect on the remote host. The default is 22.

QuietMode
    All warnings and diagnostic messages are suppressed. Only fatal errors are displayed. The argument must be The default is "no".

RandomSeedFile
    The name of the user's random-seed file.

RekeyIntervalSeconds
    The number of seconds after which the key exchange is done again. The default is 3600 seconds (1 hour). Value '0' turns rekey requests off. This does not prevent the server from requesting rekeys. Other servers may not have rekey capabilities implemented correctly, and your connection may be cut off if you are connecting to a server other than sshd2. (The server may also crash, but this is not the fault of ssh2.)

RemoteForward
    The argument format is port:host:hostport. See "-R" in ssh2(1) for more detailed information on forward definitions.

SetRemoteEnv
    Specify an environment variable to set in the server before executing a shell or command. The value should be of form 'VAR=val'. 'val' can be empty. You can specify multiple variables by using multiple options. Setting the variable may fail on the server end, e.g. because of policy decisions (see SettableEnvironmentVars in sshd2_config(5)). NOTE: this feature is not implemented in sshd2 versions 3.0.x and earlier.

Ssh1AgentCompatibility
    Specifies whether to also forward an SSH1 agent connection. Legal values for this option are "none", "traditional", and "ssh2". With value "none" (default), the SSH1 agent connection is not forwarded at all. With value "traditional", SSH1 agent connection is forwarded transparently like in SSH1. Value "traditional" can always be used but it constitutes a security risk, because the agent does not get the information about the forwarding path. Value "ssh2" makes SSH1 agent forwarding similar to SSH2 agent forwarding and with this mode agent gets the information about the agent forwarding path. Note that value "ssh2" can only be used if you use ssh-agent2 in SSH1 compatibility mode.

Ssh1Compatibility
    Specifies whether to use SSH1 compatibility code. With this option, ssh1 is executed when the server supports only SSH 1.x protocols. The argument must be

Ssh1InternalEmulation
    Specifies whether to use SSH1 internal emulation code. With this option, ssh2 can also communicate with ssh1 servers, without using an external ssh1 program. The argument must be

Ssh1MaskPasswordLength
    Specifies whether to send SSH_MSG_IGNORE packets to mask the password length (otherwise, it is very easy to get, as the SSH1 protocol does not encrypt the length fields of packets). The argument must be The default is "yes".

Ssh1Path
    Specifies the path to ssh1 client, which is executed if the server supports only SSH 1.x protocols. The arguments for ssh2 are passed to the ssh1 client.

SocksServer
    Overrides the value of SSH_SOCKS_SERVER environment variable. The argument syntax is described in the ssh2(1) manpage.

StrictHostKeyChecking
    If this flag is set to "yes", ssh2 will never automatically add host keys to the $HOME/.ssh2/hostkeys directory, and refuses to connect to hosts whose key has changed. This provides maximum protection against man-in-the-middle attacks. However, it can be somewhat annoying if you frequently connect new hosts. The argument must be "yes", "no", or "ask". The default is "ask", which means that new hosts will automatically be added to the known host files after you have acknowledged this. If a host key has changed, you will be asked whether you want to accept the new host key as the only valid one. If set to "no", the new host will automatically be added to $HOME/.ssh2/hostkeys. "yes" forces the user to add all new hosts manually. The host keys of known hosts will be verified automatically in any case.

TrustX11Applications
    Specifies whether the Xserver should treat X11 client applications as trusted (with forwarding X11). Treating X11 applications as "untrusted" avoids the problem that logging into a compromised host allows applications on that host to "sniff" any input operations (e.g. key strokes, mouse movements, drag and drop and clipboard data transfers etc.) via the forwarded X11 connection (unless the security policy for this X server allows these operations for untrusted clients). You should only need this option if the X client program you are running needs exceptional privileges for the Xserver. Note that ssh1 internal emulation mode does not support the SECURITY extension. The argument must be The default is "no".

User
    Specifies who the user will log in as. This can be useful if you have a different user name in different machines. This saves the trouble of having to remember to specify the user name on the command line.

UseSocks5
    Use SOCKS5 instead of SOCKS4 when connecting to remote host. Note that you have to set SocksServer to a meaningful value. The argument must be Default is "no" (i.e. use SOCKS4).

VerboseMode
    Causes ssh2 to print debugging messages about its progress. This is helpful when debugging connection, authentication, and configuration problems. The argument must be The default is "no".

XauthPath
    Specifies where to find the "xauth" program. This option is mostly useful if you are using binaries and your X11 programs are installed to somewhere that ssh2 does not know about. The default is set by the configure script.

AUTHORS

SSH Communications Security Corp. For more information, see http://www.ssh.com.

SEE ALSO
ssh2(1)