forked from linux/documentation
42 lines
1.4 KiB
Markdown
42 lines
1.4 KiB
Markdown
# Default SSH Client Configuration
|
|
|
|
The default configuration of the SSH client can be configured as follows:
|
|
|
|
## Allow X-Forwarding
|
|
Due to security reasons X-Forwarding is disabled by default. But you can enable it with
|
|
|
|
```
|
|
ssh_client::forward_x11: true
|
|
```
|
|
|
|
## Known Hosts
|
|
You may configure the public keys of host you often work with:
|
|
```
|
|
ssh_client::known_hosts:
|
|
- 'bitbucket.org ecdsa-sha2-nistp256 AAAAE2...'
|
|
- 'bitbucket.org ssh-ed25519 AAAAC3...'
|
|
```
|
|
|
|
## Host Trust (Host-based Authentication)
|
|
|
|
If SSH host trust should be tried by default, enable it with
|
|
```
|
|
ssh_client::try_host_trust: true
|
|
```
|
|
For details on how to make the target host accept this host trust for root, check out the [SSH Host Hopping as Root guide](../access/ssh_host_hopping).
|
|
|
|
Here is a more [generic guide](https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Host-based_Authentication#Server-side_Configurations_for_Host-based_Authentication) on how to allow this on server side.
|
|
Note that for host-based authentication to work the clients host ssh key must be known/trusted by the server.
|
|
Our puppet managed RHEL nodes have a certificate for their host key which makes them trust each other automatically.
|
|
|
|
## Hostname Canonicalization
|
|
|
|
This feature automatically turns short hostnames into fully qualified `*.psi.ch` names.
|
|
It will then also reapply the configuration again on the fully qualified hostname.
|
|
|
|
|
|
```
|
|
ssh_client::canonicalize_hostname: true
|
|
```
|
|
By default this is disabled.
|