RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2024-12-26 20:02:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: clarify conditions for UpdateHostkeys

Browse Source 
OpenBSD-Commit-ID: 9cba714cf6aeed769f998ccbe8c483077a618e27
This commit is contained in:
djm@openbsd.org 2020-10-08 00:31:05 +00:00 committed by Damien Miller
parent e8dfca9bfe
commit 3205eaa3f8
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ssh_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $OpenBSD: ssh_config.5,v 1.335 2020/10/07 02:18:45 djm Exp $
.Dd $Mdocdate: October 7 2020 $
.\" $OpenBSD: ssh_config.5,v 1.336 2020/10/08 00:31:05 djm Exp $
.Dd $Mdocdate: October 8 2020 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@ -1717,8 +1717,14 @@ or
This option allows learning alternate hostkeys for a server
and supports graceful key rotation by allowing a server to send replacement
public keys before old ones are removed.
.Pp
Additional hostkeys are only accepted if the key used to authenticate the
host was already trusted or explicitly accepted by the user.
host was already trusted or explicitly accepted by the user, the host was
authenticated via
.Cm UserKnownHostsFile
(i.e. not
.Cm GlobalKnownHostsFile )
and the host was authenticated using a plain key and not a certificate.
.Pp
.Cm UpdateHostKeys
is enabled by default if the user has not overridden the default