SSH2_CONFIG(5) SSH2 SSH2_CONFIG(5)
NAME
ssh2_config - configuration file format for ssh2 on z/OS
CONFIGURATION FILES
ssh2 obtains all configuration data from the following
sources (in this order): the system's global configuration
file (typically /etc/ssh2/ssh2_config), the user's config-
uration file ($HOME/.ssh2/ssh2_config), and the command-
line options. For each parameter, the last obtained value
will be effective.
A configuration file can begin with "metaconfiguration"
information, that is, information configuring the configu-
ration language itself.
If the configuration file starts with a line matching the
following egrep-style regex
#.*VERSION[ \t\f]+[0-9]+.[0-9]+
it is interpreted as the version of the configuration
style. If this kind of line is not found, the version is
considered to be "1.0".
The version string can be followed by one or more metacon-
figuration parameters. The lines have to start with '#',
and they have to match the following egrep style regex:
#[# \t]+[A-Z0-9]+[ \t]+.*
The parsing of metaconfiguration directives stops with the
first non-recognized line.
Version 1.1 and later recognize the following parameter:
REGEX-SYNTAX
This denotes the regex syntax used to parse the
configuration file in question. The regex syntax
is used in parsing the labels, lists, and so on,
and when matching something with the regex patterns
specified in the configuration file.
The value can be egrep, ssh, zsh_fileglob or tradi-
tional (the arguments are not case-sensitive).
zsh_fileglob and traditional are synonymous.
The configuration file has the following format:
'expression' denotes the start of a per-host con-
figuration block, where 'expression' is an arbi-
trary string which distinguishes this block from
others. 'expression' can contain wildcards. The
'expression' will be compared with the hostname
obtained from the command line, and if it matches,
the block will be evaluated. Evaluation stops at
the next 'expression:' statement. If more than one
match is found, all will be evaluated and the last
obtained values for parameters will be effective.
Note that 'expression' does not have to be a real
hostname, as long as the 'expression' block con-
tains a Host configuration parameter where the real
hostname to connect to is defined.
Empty lines and lines starting with '#' are ignored
as comments.
Otherwise a line is of the format 'keyword argu-
ments'. Note that it is possible to enclose argu-
ments in quotes, and use the standard C convention.
The possible keywords and their meanings are as
follows (note that the configuration files are
case-sensitive but the keywords are not case-sensi-
tive):
AllowedAuthentications
This keyword specifies the authentication methods
that are allowed. This is a comma-separated list
currently consisting of the following words:
keyboard-interactive, password, publickey, and
hostbased.
Each specifies an authentication method. The
default is "publickey,keyboard-interactive,pass-
word". The authentication methods are tried in the
order in which they are specified in this configu-
ration parameter. This means that the least inter-
active methods should be placed first in this list,
for example "hostbased,publickey,keyboard-interac-
tive" (because public-key authentication can be
automated by the user with ssh-agent).
AuthenticationSuccessMsg
Specifies whether to print "Authentication success-
ful." after authentication has completed success-
fully. This is mainly to prevent malicious servers
from getting information from the user by display-
ing additional password or passphrase prompts. The
argument must be yes or no. The default is yes.
BatchMode
If set to yes, ssh2 disables password/passhphrase
querying. This is useful in scripts and other
batch jobs where there is no user to supply the
password. If the StrictHostKeyChecking parameter
is set to ask, ssh2 assumes a no answer to queries
(this is because ssh does not even try to get user
input when invoked with BatchMode yes). The argu-
ment must be yes or no. The default is no.
Ciphers
Specifies the ciphers to use for encrypting the
session. The supported ciphers are aes128-cbc,
aes192-cbc, aes256-cbc, 3des-cbc, blowfish-cbc,
cast128-cbc, twofish-cbc, twofish128-cbc,
twofish192-cbc, twofish256-cbc, arcfour, rijndael-
cbc@ssh.com, des-cbc@ssh.com, and
cast128-12-cbc@ssh.com.
Multiple ciphers can be specified as a comma-sepa-
rated list. Special values for this option are
Any, AnyStd, none, AnyCipher, and AnyStdCipher.
Any allows all ciphers including none; AnyStd
allows only those mentioned in the IETF-SecSh draft
plus none; none forbids any use of encryption; Any-
Cipher and AnyStdCipher are analogous to the first
two cases but exclude none. AnyStdCipher is the
default.
ClearAllForwardings
Specifies whether to clear all remote and local
forwarded ports defined so far. The argument must
be yes or no. Note that scp always automatically
clears all forwarded ports.
Compression
Specifies whether to use compression. The argument
must be yes or no.
DebugLogFile
Writes debug messages to a specified file. (Remem-
ber to enable debugging.)
DefaultDomain
This option is only useful if set in the global
configuration file. This is used by ssh2 and ssh-
signer2 to find out the system name, if only the
base part of the system name is available by normal
means (those used by, for example, hostname(1)).
This is appended to the found system name, if the
returned system name does not contain a dot ('.').
DisableVersionFallback
Selects whether to disable fallback compatibility
code for earlier, or otherwise incompatible ver-
sions of software. Do not disable this unless you
know what you are doing. The argument must be yes
or no. The default is no.
DontReadStdin
Redirects input from /dev/null, that is, do not
read stdin. The argument must be yes or no. The
default is no.
EscapeChar
Sets the escape character (default: ~). The escape
character can also be set on the command line. The
argument should be a single character, '^' followed
by a letter, or none to disable the escape charac-
ter entirely (making the connection transparent for
binary data).
ForcePTTYAllocation
Allocates a tty even if a command is given. The
argument must be yes or no. The default is no.
ForwardAgent
Specifies whether the connection to the authentica-
tion agent (if any) will be forwarded to the remote
machine. The argument must be yes or no. The
default is yes.
ForwardX11
Specifies whether X11 connections will be automati-
cally redirected over the secure channel and DIS-
PLAY will be set. The argument must be yes or no.
The default is yes.
GatewayPorts
Specifies that also remote hosts may connect to
locally forwarded ports. The argument must be yes
GoBackground
Requests ssh2 to go to the background after authen-
tication is done and the forwardings have been
established. This is useful if ssh2 is going to
ask for passwords or passphrases but the user wants
it in the background. The argument must be yes, no
or oneshot. With oneshot, ssh2 behaves the same
way as with -fo command-line arguments. The
default is no.
Host The real hostname to log in to. With 'expression'
above, this can be used to specify nicknames or
abbreviations for hosts. The default is the name
given on the command line. Numeric IP addresses
are also permitted (both on the command line and in
HostName specifications).
IdentityFile
The name of the user's identification file.
KeepAlive
Specifies whether the system should send keepalive
messages to the other side. If they are sent, a
broken connection or crash of one of the machines
will be properly noticed. However, this means that
connections will die if the route is down temporar-
ily, and some people find this annoying.
The default is yes (to send keepalives), and the
client will notice if the network goes down or the
remote host dies. This is important when using
scripts, and many users want it.
To disable keepalives, the value should be set to
no in both the server and the client configuration
files.
LocalForward
The argument format is port:host:hostport. See -L
in ssh2(1) for more detailed information on forward
definitions.
MACs Specifies the MAC (Message Authentication Code)
algorithm to use for data integrity verification.
The supported algorithms are hmac-md5, hmac-md5-96,
hmac-sha1, hmac-sha1-96, hmac-sha256@ssh.com, and
hmac-sha256-96@ssh.com.
Multiple MACs can be specified as a comma-separated
list. Special values for this option are Any,
AnyStd, none, AnyMac, and AnyStdMac. Any allows
all MACs including none; AnyStd allows only those
mentioned in the IETF-SecSh draft and none; none
forbids any use of MACs; AnyMac and AnyStdMac are
analogous to the first two cases but exclude none.
AnyStdMac is the default.
NoDelay
If yes, enables socket option TCP_NODELAY. The
argument must be yes or no. The default is no.
PasswordPrompt
Sets the password prompt that the user sees when
connecting to a host. Variables %U and %H can be
used to give the user's login name and host,
respectively.
PidFile
Specifies the file where the process ID of the
client is written. The default is none.
Port Specifies the port number to connect to on the
remote host. The default is 22.
ProxyServer
With this option, the client can connect using
SOCKS or HTTP proxy. With SOCKS, you can specify
whether to use SOCKS5 with the option UseSocks5.
Overrides the value of the SSH_SOCKS_SERVER
environment variable.
The format of the variable is socks://user-
name@socks_server:port/network/netmask,network/net-
mask ... (with SOCKS proxy) or http://user-
name@socks_server:port/network/netmask,network/net-
mask ... (with HTTP proxy).
For instance, by setting ProxyServer to
socks://mylo-
gin@socks.ssh.com:1080/203.123.0.0/16,198.74.23.0/24,
host socks.ssh.com and port 1080 are used as your
SOCKS server for connections outside of networks
203.123.0.0 (16-bit domain) and 198.74.23.0 (8-bit
domain). Those networks are connected directly.
If this option is set, it should almost always con-
tain the local loopback network (127.0.0.0/8) as a
network that is connected directly.
This option and the option SocksServer behave iden-
tically. Specifying both will cause the later defi-
nition to override the first.
|
