# Default SSH Client Configuration

The default configuration of the SSH client can be configured as follows:

## Allow X-Forwarding
Due to security reasons X-Forwarding is disabled by default. But you can enable it with

```
ssh_client::forward_x11: true
```

## Known Hosts
You may configure the public keys of host you often work with:
```
ssh_client::known_hosts:
  - 'bitbucket.org ecdsa-sha2-nistp256 AAAAE2...'
  - 'bitbucket.org ssh-ed25519 AAAAC3...'
```

## Host Trust (Host-based Authentication)

If SSH host trust should be tried by default, enable it with
```
ssh_client::try_host_trust: true
```
For details on how to make the target host accept this host trust for root, check out the [SSH Host Hopping as Root guide](../access/ssh_host_hopping).

Here is a more [generic guide](https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Host-based_Authentication#Server-side_Configurations_for_Host-based_Authentication) on how to allow this on server side.
Note that for host-based authentication to work the clients host ssh key must be known/trusted by the server.
Our puppet managed RHEL nodes have a certificate for their host key which makes them trust each other automatically.

## Hostname Canonicalization

This feature automatically turns short hostnames into fully qualified `*.psi.ch` names.
It will then also reapply the configuration again on the fully qualified hostname.


```
ssh_client::canonicalize_hostname: true
```
By default this is disabled.