diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2014-12-22 08:51:30 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2014-12-22 09:06:52 +0100 |
| commit | f69b69b8625be447b8826b21d87713874dac25a6 (patch) | |
| tree | ad29e7621445860c76e02f7f2384b0198bfc27e5 /sshd_config.5 | |
| parent | upstream commit (diff) | |
| download | openssh-f69b69b8625be447b8826b21d87713874dac25a6.tar.xz openssh-f69b69b8625be447b8826b21d87713874dac25a6.zip | |
upstream commit
remember which public keys have been used for
authentication and refuse to accept previously-used keys.
This allows AuthenticationMethods=publickey,publickey to require
that users authenticate using two _different_ pubkeys.
ok markus@
Diffstat (limited to 'sshd_config.5')
| -rw-r--r-- | sshd_config.5 | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/sshd_config.5 b/sshd_config.5 index 938ba2f1a..d2ab28136 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.184 2014/12/21 23:35:14 jmc Exp $ -.Dd $Mdocdate: December 21 2014 $ +.\" $OpenBSD: sshd_config.5,v 1.185 2014/12/22 07:51:30 djm Exp $ +.Dd $Mdocdate: December 22 2014 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -210,6 +210,18 @@ would restrict keyboard interactive authentication to the .Dq bsdauth device. .Pp +If the +.Dq publickey +method is listed more than one, +.Xr sshd 8 +verifies that keys that have been used successfully are not reused for +subsequent authentications. +For example, an +.Cm AuthenticationMethods +of +.Dq publickey,publickey +will require successful authentication using two different public keys. +.Pp This option is only available for SSH protocol 2 and will yield a fatal error if enabled if protocol 1 is also enabled. Note that each authentication method listed should also be explicitly enabled |