|
 |
f32b842 |
diff -up openssh-8.6p1/ssh_config.5.crypto-policies openssh-8.6p1/ssh_config.5
|
|
|
f32b842 |
--- openssh-8.6p1/ssh_config.5.crypto-policies 2021-04-19 15:18:32.071920379 +0200
|
|
|
f32b842 |
+++ openssh-8.6p1/ssh_config.5 2021-04-19 15:21:18.400179265 +0200
|
|
|
f32b842 |
@@ -368,15 +368,13 @@ or
|
|
 |
a848054 |
.Qq *.c.example.com
|
|
|
a848054 |
domains.
|
|
|
51f5c1c |
.It Cm CASignatureAlgorithms
|
|
|
a848054 |
+The default is handled system-wide by
|
|
|
a848054 |
+.Xr crypto-policies 7 .
|
|
|
a848054 |
+To see the defaults and how to modify this default, see manual page
|
|
|
a848054 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
51f5c1c |
Specifies which algorithms are allowed for signing of certificates
|
|
|
51f5c1c |
by certificate authorities (CAs).
|
|
|
51f5c1c |
-The default is:
|
|
|
51f5c1c |
-.Bd -literal -offset indent
|
|
|
f32b842 |
-ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
f32b842 |
-sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
f32b842 |
-rsa-sha2-512,rsa-sha2-256
|
|
|
51f5c1c |
-.Ed
|
|
|
51f5c1c |
-.Pp
|
|
|
51f5c1c |
.Xr ssh 1
|
|
|
51f5c1c |
will not accept host certificates signed using algorithms other than those
|
|
|
51f5c1c |
specified.
|
|
|
f32b842 |
@@ -436,20 +434,25 @@ If the option is set to
|
|
|
25c16c6 |
(the default),
|
|
|
a848054 |
the check will not be executed.
|
|
|
a848054 |
.It Cm Ciphers
|
|
|
51f5c1c |
+The default is handled system-wide by
|
|
|
51f5c1c |
+.Xr crypto-policies 7 .
|
|
|
51f5c1c |
+To see the defaults and how to modify this default, see manual page
|
|
|
51f5c1c |
+.Xr update-crypto-policies 8 .
|
|
|
51f5c1c |
+.Pp
|
|
|
a848054 |
Specifies the ciphers allowed and their order of preference.
|
|
|
a848054 |
Multiple ciphers must be comma-separated.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified ciphers will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified ciphers will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified ciphers (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq ^
|
|
|
a848054 |
character, then the specified ciphers will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
a848054 |
.Pp
|
|
|
a848054 |
The supported ciphers are:
|
|
|
a848054 |
.Bd -literal -offset indent
|
|
|
f32b842 |
@@ -465,13 +468,6 @@ aes256-gcm@openssh.com
|
|
|
6caa973 |
chacha20-poly1305@openssh.com
|
|
|
6caa973 |
.Ed
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-chacha20-poly1305@openssh.com,
|
|
|
6caa973 |
-aes128-ctr,aes192-ctr,aes256-ctr,
|
|
|
6caa973 |
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
a848054 |
The list of available ciphers may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q cipher .
|
|
|
a848054 |
.It Cm ClearAllForwardings
|
|
|
f32b842 |
@@ -826,6 +822,11 @@ command line will be passed untouched to
|
|
|
a848054 |
The default is
|
|
|
a848054 |
.Dq no .
|
|
|
a848054 |
.It Cm GSSAPIKexAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
The list of key exchange algorithms that are offered for GSSAPI
|
|
|
a848054 |
key exchange. Possible values are
|
|
|
a848054 |
.Bd -literal -offset 3n
|
|
|
f32b842 |
@@ -838,10 +839,8 @@ gss-nistp256-sha256-,
|
|
|
6caa973 |
gss-curve25519-sha256-
|
|
|
6caa973 |
.Ed
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is
|
|
|
1cc7c87 |
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
|
|
|
1cc7c87 |
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
|
|
|
a848054 |
This option only applies to connections using GSSAPI.
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
.It Cm HashKnownHosts
|
|
|
a848054 |
Indicates that
|
|
|
a848054 |
.Xr ssh 1
|
|
|
f32b842 |
@@ -1169,29 +1168,25 @@ it may be zero or more of:
|
|
|
a848054 |
and
|
|
|
a848054 |
.Cm pam .
|
|
|
a848054 |
.It Cm KexAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
Specifies the available KEX (Key Exchange) algorithms.
|
|
|
a848054 |
Multiple algorithms must be comma-separated.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified methods will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified methods will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified methods (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
36fef56 |
character, then the specified methods will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-curve25519-sha256,curve25519-sha256@libssh.org,
|
|
|
6caa973 |
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
|
|
6caa973 |
-diffie-hellman-group-exchange-sha256,
|
|
|
6caa973 |
-diffie-hellman-group16-sha512,
|
|
|
6caa973 |
-diffie-hellman-group18-sha512,
|
|
|
51f5c1c |
-diffie-hellman-group14-sha256
|
|
|
6caa973 |
-.Ed
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
a848054 |
.Pp
|
|
|
a848054 |
The list of available key exchange algorithms may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q kex .
|
|
|
f32b842 |
@@ -1301,37 +1296,33 @@ function, and all code in the
|
|
|
25c16c6 |
file.
|
|
|
25c16c6 |
This option is intended for debugging and no overrides are enabled by default.
|
|
|
a848054 |
.It Cm MACs
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
Specifies the MAC (message authentication code) algorithms
|
|
|
a848054 |
in order of preference.
|
|
|
a848054 |
The MAC algorithm is used for data integrity protection.
|
|
|
a848054 |
Multiple algorithms must be comma-separated.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified algorithms will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified algorithms will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified algorithms (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq ^
|
|
|
a848054 |
character, then the specified algorithms will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
6caa973 |
.Pp
|
|
|
a848054 |
The algorithms that contain
|
|
|
a848054 |
.Qq -etm
|
|
|
6caa973 |
calculate the MAC after encryption (encrypt-then-mac).
|
|
|
6caa973 |
These are considered safer and their use recommended.
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha1-etm@openssh.com,
|
|
|
6caa973 |
-umac-64@openssh.com,umac-128@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
a848054 |
The list of available MAC algorithms may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q mac .
|
|
|
a848054 |
.It Cm NoHostAuthenticationForLocalhost
|
|
|
f32b842 |
@@ -1503,37 +1494,25 @@ instead of continuing to execute and pas
|
|
|
a848054 |
The default is
|
|
|
a848054 |
.Cm no .
|
|
|
25c16c6 |
.It Cm PubkeyAcceptedAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
25c16c6 |
Specifies the signature algorithms that will be used for public key
|
|
|
25c16c6 |
authentication as a comma-separated list of patterns.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
25c16c6 |
-character, then the algorithms after it will be appended to the default
|
|
|
9c88962 |
-instead of replacing it.
|
|
|
25c16c6 |
+character, then the algorithms after it will be appended to the built-in
|
|
|
9c88962 |
+openssh default instead of replacing it.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
25c16c6 |
character, then the specified algorithms (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
25c16c6 |
character, then the specified algorithms will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
25c16c6 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
25c16c6 |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
25c16c6 |
-ssh-ed25519,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
25c16c6 |
-sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
6caa973 |
.Pp
|
|
|
25c16c6 |
The list of available signature algorithms may also be obtained using
|
|
|
25c16c6 |
.Qq ssh -Q PubkeyAcceptedAlgorithms .
|
|
|
f32b842 |
diff -up openssh-8.6p1/sshd_config.5.crypto-policies openssh-8.6p1/sshd_config.5
|
|
|
f32b842 |
--- openssh-8.6p1/sshd_config.5.crypto-policies 2021-04-19 15:18:32.062920311 +0200
|
|
|
f32b842 |
+++ openssh-8.6p1/sshd_config.5 2021-04-19 15:20:42.591908243 +0200
|
|
|
f32b842 |
@@ -373,15 +373,13 @@ If the argument is
|
|
|
a848054 |
then no banner is displayed.
|
|
|
a848054 |
By default, no banner is displayed.
|
|
|
51f5c1c |
.It Cm CASignatureAlgorithms
|
|
|
a848054 |
+The default is handled system-wide by
|
|
|
a848054 |
+.Xr crypto-policies 7 .
|
|
|
a848054 |
+To see the defaults and how to modify this default, see manual page
|
|
|
a848054 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
51f5c1c |
Specifies which algorithms are allowed for signing of certificates
|
|
|
51f5c1c |
by certificate authorities (CAs).
|
|
|
51f5c1c |
-The default is:
|
|
|
51f5c1c |
-.Bd -literal -offset indent
|
|
|
f32b842 |
-ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
f32b842 |
-sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
f32b842 |
-rsa-sha2-512,rsa-sha2-256
|
|
|
51f5c1c |
-.Ed
|
|
|
51f5c1c |
-.Pp
|
|
|
51f5c1c |
Certificates signed using other algorithms will not be accepted for
|
|
|
51f5c1c |
public key or host-based authentication.
|
|
|
a848054 |
.It Cm ChallengeResponseAuthentication
|
|
|
f32b842 |
@@ -445,20 +443,25 @@ The default is
|
|
|
a848054 |
indicating not to
|
|
|
a848054 |
.Xr chroot 2 .
|
|
|
a848054 |
.It Cm Ciphers
|
|
|
51f5c1c |
+The default is handled system-wide by
|
|
|
51f5c1c |
+.Xr crypto-policies 7 .
|
|
|
51f5c1c |
+To see the defaults and how to modify this default, see manual page
|
|
|
51f5c1c |
+.Xr update-crypto-policies 8 .
|
|
|
51f5c1c |
+.Pp
|
|
|
a848054 |
Specifies the ciphers allowed.
|
|
|
a848054 |
Multiple ciphers must be comma-separated.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified ciphers will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified ciphers will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified ciphers (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq ^
|
|
|
a848054 |
character, then the specified ciphers will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
a848054 |
.Pp
|
|
|
a848054 |
The supported ciphers are:
|
|
|
a848054 |
.Pp
|
|
|
f32b842 |
@@ -485,13 +488,6 @@ aes256-gcm@openssh.com
|
|
|
6caa973 |
chacha20-poly1305@openssh.com
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-chacha20-poly1305@openssh.com,
|
|
|
6caa973 |
-aes128-ctr,aes192-ctr,aes256-ctr,
|
|
|
6caa973 |
-aes128-gcm@openssh.com,aes256-gcm@openssh.com
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
a848054 |
The list of available ciphers may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q cipher .
|
|
|
a848054 |
.It Cm ClientAliveCountMax
|
|
|
f32b842 |
@@ -680,21 +676,22 @@ For this to work
|
|
|
a848054 |
.Cm GSSAPIKeyExchange
|
|
|
a848054 |
needs to be enabled in the server and also used by the client.
|
|
|
a848054 |
.It Cm GSSAPIKexAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
The list of key exchange algorithms that are accepted by GSSAPI
|
|
|
a848054 |
key exchange. Possible values are
|
|
|
a848054 |
.Bd -literal -offset 3n
|
|
|
a848054 |
-gss-gex-sha1-,
|
|
|
a848054 |
-gss-group1-sha1-,
|
|
|
a848054 |
-gss-group14-sha1-,
|
|
|
a848054 |
-gss-group14-sha256-,
|
|
|
a848054 |
-gss-group16-sha512-,
|
|
|
a848054 |
-gss-nistp256-sha256-,
|
|
|
a848054 |
+gss-gex-sha1-
|
|
|
a848054 |
+gss-group1-sha1-
|
|
|
a848054 |
+gss-group14-sha1-
|
|
|
a848054 |
+gss-group14-sha256-
|
|
|
a848054 |
+gss-group16-sha512-
|
|
|
a848054 |
+gss-nistp256-sha256-
|
|
|
6caa973 |
gss-curve25519-sha256-
|
|
|
6caa973 |
.Ed
|
|
|
a848054 |
-.Pp
|
|
|
6caa973 |
-The default is
|
|
|
1cc7c87 |
-.Dq gss-group14-sha256-,gss-group16-sha512-,gss-nistp256-sha256-,
|
|
|
1cc7c87 |
-gss-curve25519-sha256-,gss-group14-sha1-,gss-gex-sha1- .
|
|
|
1cc7c87 |
This option only applies to connections using GSSAPI.
|
|
|
25c16c6 |
.It Cm HostbasedAcceptedAlgorithms
|
|
|
25c16c6 |
Specifies the signature algorithms that will be accepted for hostbased
|
|
|
f32b842 |
@@ -794,26 +791,13 @@ is specified, the location of the socket
|
|
|
a848054 |
.Ev SSH_AUTH_SOCK
|
|
|
a848054 |
environment variable.
|
|
|
6caa973 |
.It Cm HostKeyAlgorithms
|
|
|
a848054 |
+The default is handled system-wide by
|
|
|
a848054 |
+.Xr crypto-policies 7 .
|
|
|
a848054 |
+To see the defaults and how to modify this default, see manual page
|
|
|
a848054 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
25c16c6 |
Specifies the host key signature algorithms
|
|
|
6caa973 |
that the server offers.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
25c16c6 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
25c16c6 |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
25c16c6 |
-ssh-ed25519,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
25c16c6 |
-sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
25c16c6 |
The list of available signature algorithms may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q HostKeyAlgorithms .
|
|
|
a848054 |
.It Cm IgnoreRhosts
|
|
|
f32b842 |
@@ -958,20 +942,25 @@ Specifies whether to look at .k5login fi
|
|
|
a848054 |
The default is
|
|
|
a848054 |
.Cm yes .
|
|
|
a848054 |
.It Cm KexAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
Specifies the available KEX (Key Exchange) algorithms.
|
|
|
a848054 |
Multiple algorithms must be comma-separated.
|
|
|
a848054 |
Alternately if the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified methods will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified methods will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified methods (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq ^
|
|
|
a848054 |
character, then the specified methods will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
a848054 |
The supported algorithms are:
|
|
|
6caa973 |
.Pp
|
|
|
a848054 |
.Bl -item -compact -offset indent
|
|
|
f32b842 |
@@ -1003,15 +992,6 @@ ecdh-sha2-nistp521
|
|
|
25c16c6 |
sntrup761x25519-sha512@openssh.com
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-curve25519-sha256,curve25519-sha256@libssh.org,
|
|
|
6caa973 |
-ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
|
|
|
6caa973 |
-diffie-hellman-group-exchange-sha256,
|
|
|
6caa973 |
-diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
|
|
|
51f5c1c |
-diffie-hellman-group14-sha256
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
a848054 |
The list of available key exchange algorithms may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q KexAlgorithms .
|
|
|
a848054 |
.It Cm ListenAddress
|
|
|
f32b842 |
@@ -1097,21 +1077,26 @@ function, and all code in the
|
|
|
25c16c6 |
file.
|
|
|
25c16c6 |
This option is intended for debugging and no overrides are enabled by default.
|
|
|
a848054 |
.It Cm MACs
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
a848054 |
Specifies the available MAC (message authentication code) algorithms.
|
|
|
a848054 |
The MAC algorithm is used for data integrity protection.
|
|
|
a848054 |
Multiple algorithms must be comma-separated.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
a848054 |
-character, then the specified algorithms will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
9c88962 |
+character, then the specified algorithms will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
a848054 |
character, then the specified algorithms (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq ^
|
|
|
a848054 |
character, then the specified algorithms will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
6caa973 |
.Pp
|
|
|
a848054 |
The algorithms that contain
|
|
|
a848054 |
.Qq -etm
|
|
|
f32b842 |
@@ -1154,15 +1139,6 @@ umac-64-etm@openssh.com
|
|
|
6caa973 |
umac-128-etm@openssh.com
|
|
|
6caa973 |
.El
|
|
|
6caa973 |
.Pp
|
|
|
6caa973 |
-The default is:
|
|
|
6caa973 |
-.Bd -literal -offset indent
|
|
|
6caa973 |
-umac-64-etm@openssh.com,umac-128-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
|
|
|
6caa973 |
-hmac-sha1-etm@openssh.com,
|
|
|
6caa973 |
-umac-64@openssh.com,umac-128@openssh.com,
|
|
|
6caa973 |
-hmac-sha2-256,hmac-sha2-512,hmac-sha1
|
|
|
6caa973 |
-.Ed
|
|
|
a848054 |
-.Pp
|
|
|
a848054 |
The list of available MAC algorithms may also be obtained using
|
|
|
a848054 |
.Qq ssh -Q mac .
|
|
|
a848054 |
.It Cm Match
|
|
|
f32b842 |
@@ -1541,37 +1517,25 @@ or equivalent.)
|
|
|
a848054 |
The default is
|
|
|
a848054 |
.Cm yes .
|
|
|
25c16c6 |
.It Cm PubkeyAcceptedAlgorithms
|
|
|
6caa973 |
+The default is handled system-wide by
|
|
|
6caa973 |
+.Xr crypto-policies 7 .
|
|
|
fdbd5bc |
+To see the defaults and how to modify this default, see manual page
|
|
|
6caa973 |
+.Xr update-crypto-policies 8 .
|
|
|
a848054 |
+.Pp
|
|
|
25c16c6 |
Specifies the signature algorithms that will be accepted for public key
|
|
|
25c16c6 |
authentication as a list of comma-separated patterns.
|
|
|
a848054 |
Alternately if the specified list begins with a
|
|
|
a848054 |
.Sq +
|
|
|
25c16c6 |
-character, then the specified algorithms will be appended to the default set
|
|
|
9c88962 |
-instead of replacing them.
|
|
|
25c16c6 |
+character, then the specified algorithms will be appended to the built-in
|
|
|
9c88962 |
+openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
a848054 |
.Sq -
|
|
|
25c16c6 |
character, then the specified algorithms (including wildcards) will be removed
|
|
|
a848054 |
-from the default set instead of replacing them.
|
|
|
9c88962 |
+from the built-in openssh default set instead of replacing them.
|
|
|
a848054 |
If the specified list begins with a
|
|
|
36fef56 |
.Sq ^
|
|
|
25c16c6 |
character, then the specified algorithms will be placed at the head of the
|
|
|
a848054 |
-default set.
|
|
|
6caa973 |
-The default for this option is:
|
|
|
6caa973 |
-.Bd -literal -offset 3n
|
|
|
25c16c6 |
-ssh-ed25519-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
|
|
6caa973 |
-ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
|
|
51f5c1c |
-sk-ssh-ed25519-cert-v01@openssh.com,
|
|
|
25c16c6 |
-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512-cert-v01@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-256-cert-v01@openssh.com,
|
|
|
6caa973 |
-ssh-rsa-cert-v01@openssh.com,
|
|
|
25c16c6 |
-ssh-ed25519,
|
|
|
6caa973 |
-ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
|
|
25c16c6 |
-sk-ssh-ed25519@openssh.com,
|
|
|
51f5c1c |
-sk-ecdsa-sha2-nistp256@openssh.com,
|
|
|
51f5c1c |
-rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
|
|
6caa973 |
-.Ed
|
|
|
9c88962 |
+built-in openssh default set.
|
|
|
6caa973 |
.Pp
|
|
|
25c16c6 |
The list of available signature algorithms may also be obtained using
|
|
|
25c16c6 |
.Qq ssh -Q PubkeyAcceptedAlgorithms .
|