3 ms·

What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config. Tim

by agwa 11y ago

What's more, it was not documented in the ssh_config(5) man page. If it had been, I probably would have disabled it long ago when hardening my SSH config. Time to head to the source to look for other undocumented options... Update: my findings are here (scroll to bottom for the upshot): https://gist.github.com/AGWA/e92d4f5343be1f7a941d https://gist.github.com/AGWA/e92d4f5343be1f7a941d UseRoaming is the only one to be concerned about. There are many other undocumented options, but they're all aliases for a documented option or are deprecated/unsupported.

noja 11y ago
Please report back what you find!
ryanlol 11y ago
https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c https://github.com/openssh/openssh-portable/blob/e6c85f8889c... Here you go
- ryanlol 11y ago
  Actually, I quickly generated a list of undocumented config options: http://sprunge.us/QDSE http://sprunge.us/QDSE Edit: Fixed version http://sprunge.us/LVYB http://sprunge.us/LVYB
  - vesinisa 11y ago
    most of those seem to be documented: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/ssh_config.5?query=ssh_config&sec=5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/... I did a quick comparison between the OpCodes enum and the latest man page, and `UseRoaming` is the only real undocumented option.
    - ryanlol 11y ago
      Weird, my manpages didn't get updated despite man claiming they did. Fixing that now. Edit: fixed, http://sprunge.us/LVYB http://sprunge.us/LVYB
  - jlgaddis 11y ago
    I believe "kerberosauthentication" and "rhostsauthentication" are documented as well. I'd check the "official" OpenBSD man page instead of whatever you have on your system. Regardless, thanks.
    - ryanlol 11y ago
      Neither of those are mentioned on the latest manpage from git.
    - agwa 11y ago
      In the latest OpenSSH-portable source, those are considered "unsupported" and "deprecated," respectively (which means they're ignored, essentially). See https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undocumented_client_options https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undoc... as well as the source https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c#L191 https://github.com/openssh/openssh-portable/blob/e6c85f8889c...

by agwa 11y ago

noja 11y ago

Please report back what you find!

ryanlol 11y ago

https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c https://github.com/openssh/openssh-portable/blob/e6c85f8889c... Here you go

ryanlol 11y ago
Actually, I quickly generated a list of undocumented config options: http://sprunge.us/QDSE http://sprunge.us/QDSE Edit: Fixed version http://sprunge.us/LVYB http://sprunge.us/LVYB
- vesinisa 11y ago
  most of those seem to be documented: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/ssh_config.5?query=ssh_config&sec=5 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/... I did a quick comparison between the OpCodes enum and the latest man page, and `UseRoaming` is the only real undocumented option.
  - ryanlol 11y ago
    Weird, my manpages didn't get updated despite man claiming they did. Fixing that now. Edit: fixed, http://sprunge.us/LVYB http://sprunge.us/LVYB
- jlgaddis 11y ago
  I believe "kerberosauthentication" and "rhostsauthentication" are documented as well. I'd check the "official" OpenBSD man page instead of whatever you have on your system. Regardless, thanks.
  - ryanlol 11y ago
    Neither of those are mentioned on the latest manpage from git.
  - agwa 11y ago
    In the latest OpenSSH-portable source, those are considered "unsupported" and "deprecated," respectively (which means they're ignored, essentially). See https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undocumented_client_options https://gist.github.com/AGWA/e92d4f5343be1f7a941d#file-undoc... as well as the source https://github.com/openssh/openssh-portable/blob/e6c85f8889c5c9eb04796fdb76d2807636b9eef5/readconf.c#L191 https://github.com/openssh/openssh-portable/blob/e6c85f8889c...