X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=blobdiff_plain;f=doc%2Fconfig.but;h=04c9cd7065d64294f8d71bed88899d75d03fc375;hb=359b5c8eb45ff56c62032cf147fcdb3723d54324;hp=f0ccc1503b1abff2e066496eebbb7f0333c4e242;hpb=28f67586f568a3ec0388f58b5a87fa5cfed1a637;p=PuTTY.git diff --git a/doc/config.but b/doc/config.but index f0ccc150..04c9cd70 100644 --- a/doc/config.but +++ b/doc/config.but @@ -934,6 +934,15 @@ setting you want if you have no better ideas. \dd PuTTY responds with the actual window title. This is dangerous for the reasons described above. +\S{config-features-clearscroll} Disabling remote \i{scrollback clearing} + +\cfg{winhelp-topic}{features.clearscroll} + +PuTTY has the ability to clear the terminal's scrollback buffer in +response to a command from the server. If you find PuTTY is doing this +unexpectedly or inconveniently, you can tell PuTTY not to respond to +that server command. + \S{config-features-dbackspace} Disabling \i{destructive backspace} \cfg{winhelp-topic}{features.dbackspace} @@ -1667,7 +1676,7 @@ Keepalives are only supported in Telnet and SSH; the Rlogin and Raw protocols offer no way of implementing them. (For an alternative, see \k{config-tcp-keepalives}.) -Note that if you are using \i{SSH-1} and the server has a bug that makes +Note that if you are using SSH-1 and the server has a bug that makes it unable to deal with SSH-1 ignore messages (see \k{config-ssh-bug-ignore1}), enabling keepalives will have no effect. @@ -1946,6 +1955,9 @@ If you want your local proxy command to make a secondary SSH connection to a proxy host and then tunnel the primary connection over that, you might well want the \c{-nc} command-line option in Plink. See \k{using-cmdline-ncmode} for more information. + +You can also enable this mode on the command line; see +\k{using-cmdline-proxycmd}. } \S{config-proxy-exclude} Excluding parts of the network from proxying @@ -2091,6 +2103,25 @@ port. Note that if you do not include the \c{%user} or \c{%pass} tokens in the Telnet command, then the \q{Username} and \q{Password} configuration fields will be ignored. +\S{config-proxy-logging} Controlling \i{proxy logging} + +\cfg{winhelp-topic}{proxy.logging} + +Often the proxy interaction has its own diagnostic output; this is +particularly the case for local proxy commands. + +The setting \q{Print proxy diagnostics in the terminal window} lets +you control how much of the proxy's diagnostics are printed to the main +terminal window, along with output from your main session. + +By default (\q{No}), proxy diagnostics are only sent to the Event Log; +with \q{Yes} they are also printed to the terminal, where they may get +mixed up with your main session. \q{Only until session starts} is a +compromise; proxy messages will go to the terminal window until the main +session is deemed to have started (in a protocol-dependent way), which +is when they're most likely to be interesting; any further proxy-related +messages during the session will only go to the Event Log. + \H{config-telnet} The \i{Telnet} panel The Telnet panel allows you to configure options that only apply to @@ -2267,30 +2298,28 @@ client end. Likewise, data sent by PuTTY to the server is compressed first and the server decompresses it at the other end. This can help make the most of a low-\i{bandwidth} connection. -\S{config-ssh-prot} \q{Preferred \i{SSH protocol version}} +\S{config-ssh-prot} \q{\i{SSH protocol version}} \cfg{winhelp-topic}{ssh.protocol} -This allows you to select whether you would prefer to use \i{SSH protocol -version 1} or \I{SSH-2}version 2, and whether to permit falling back -to the other version. +This allows you to select whether to use \i{SSH protocol version 2} +or the older \I{SSH-1}version 1. -With the settings \q{1} and \q{2}, PuTTY will attempt to use protocol 1 -if the server you connect to does not offer protocol 2, and vice versa. +You should normally leave this at the default of \q{2}. As well as +having fewer features, the older SSH-1 protocol is no longer +developed, has many known cryptographic weaknesses, and is generally +not considered to be secure. PuTTY's protocol 1 implementation is +provided mainly for compatibility, and is no longer being enhanced. -If you select \q{1 only} or \q{2 only} here, PuTTY will only connect -if the server you connect to offers the SSH protocol version you -have specified. +If a server offers both versions, prefer \q{2}. If you have some +server or piece of equipment that only talks SSH-1, select \q{1} +here, and do not treat the resulting connection as secure. -You should normally leave this at the default, \q{2 only}. The older -SSH-1 protocol is no longer developed, has many known cryptographic -weaknesses, and is generally not considered to be secure. If you -permit use of SSH-1 by selecting \q{2} instead of \q{2 only}, an -active attacker can force downgrade to SSH-1 even if the server -you're connecting to supports SSH-2. - -PuTTY's protocol 1 implementation is provided mainly for -compatibility, and is no longer being enhanced. +PuTTY will not automatically fall back to the other version of the +protocol if the server turns out not to match your selection here; +instead, it will put up an error message and abort the connection. +This prevents an active attacker downgrading an intended SSH-2 +connection to SSH-1. \S{config-ssh-sharing} Sharing an SSH connection between PuTTY tools @@ -2396,15 +2425,16 @@ PuTTY currently supports the following key exchange methods: 2048-bit group. \b \q{Group 1}: Diffie-Hellman key exchange with a well-known -1024-bit group. This is less secure \#{FIXME better words} than -group 14, but may be faster with slow client or server machines, -and may be the only method supported by older server software. +1024-bit group. We no longer recommend using this method, and it's +not used by default in new installations; however, it may be the +only method supported by very old server software. \b \q{\ii{Group exchange}}: with this method, instead of using a fixed group, PuTTY requests that the server suggest a group to use for key exchange; the server can avoid groups known to be weak, and possibly invent new ones over time, without any changes required to PuTTY's -configuration. We recommend use of this method, if possible. +configuration. We recommend use of this method instead of the +well-known groups, if possible. \b \q{\i{RSA key exchange}}: this requires much less computational effort on the part of the client, and somewhat less on the part of @@ -2483,6 +2513,53 @@ when the SSH connection is idle, so they shouldn't cause the same problems. The SSH-1 protocol, incidentally, has even weaker integrity protection than SSH-2 without rekeys. +\H{config-ssh-hostkey} The Host Keys panel + +The Host Keys panel allows you to configure options related to SSH-2 +\i{host key management}. + +Host keys are used to prove the server's identity, and assure you that +the server is not being spoofed (either by a man-in-the-middle attack +or by completely replacing it on the network). See \k{gs-hostkey} for +a basic introduction to host keys. + +This entire panel is only relevant to SSH protocol version 2; none of +these settings affect SSH-1 at all. + +\S{config-ssh-hostkey-order} \ii{Host key type} selection + +\cfg{winhelp-topic}{ssh.hostkey.order} + +PuTTY supports a variety of SSH-2 host key types, and allows you to +choose which one you prefer to use to identify the server. +Configuration is similar to cipher selection (see +\k{config-ssh-encryption}). + +PuTTY currently supports the following host key types: + +\b \q{Ed25519}: \i{Edwards-curve} \i{DSA} using a twisted Edwards +curve with modulus \cw{2^255-19}. + +\b \q{ECDSA}: \i{elliptic curve} \i{DSA} using one of the +NIST-standardised elliptic curves. + +\b \q{DSA}: straightforward \i{DSA} using modular exponentiation. + +\b \q{RSA}: the ordinary \i{RSA} algorithm. + +If PuTTY already has one or more host keys stored for the server, +it will prefer to use one of those, even if the server has a key +type that is higher in the preference order. You can add such a +key to PuTTY's cache from within an existing session using the +\q{Special Commands} menu; see \k{using-specials}. + +Otherwise, PuTTY will choose a key type based purely on the +preference order you specify in the configuration. + +If the first key type PuTTY finds is below the \q{warn below here} +line, you will see a warning box when you make the connection, similar +to that for cipher selection (see \k{config-ssh-encryption}). + \S{config-ssh-kex-manual-hostkeys} \ii{Manually configuring host keys} \cfg{winhelp-topic}{ssh.kex.manualhostkeys} @@ -2821,6 +2898,13 @@ the \q{User-supplied GSSAPI library path} field, and move the \q{User-supplied GSSAPI library} option in the preference list to make sure it is selected before anything else. +On Windows, such libraries are files with a \I{DLL}\cw{.dll} +extension, and must have been built in the same way as the PuTTY +executable you're running; if you have a 32-bit DLL, you must run a +32-bit version of PuTTY, and the same with 64-bit (see +\k{faq-32bit-64bit}). On Unix, shared libraries generally have a +\cw{.so} extension. + \H{config-ssh-tty} The TTY panel The TTY panel lets you configure the remote pseudo-terminal. @@ -2876,8 +2960,9 @@ a sensible value. \lcont{ PuTTY proper will send modes that it has an opinion on (currently only -the code for the Backspace key, \cw{ERASE}). Plink on Unix -will propagate appropriate modes from the local terminal, if any. +the code for the Backspace key, \cw{ERASE}, and whether the character +set is UTF-8, \cw{IUTF8}). Plink on Unix will propagate appropriate +modes from the local terminal, if any. } @@ -2925,6 +3010,17 @@ character or turn it off entirely. PuTTY in a variety of ways, such as \cw{true}/\cw{false}, \cw{yes}/\cw{no}, and \cw{0}/\cw{1}. +\b The boolean mode \I{IUTF8 terminal mode}\cw{IUTF8} signals to the +server whether the terminal character set is \i{UTF-8} or not. +If this is set incorrectly, actions like backspace may behave +incorrectly in some circumstances. However, setting this is not usually +sufficient to cause servers to expect the terminal to be in UTF-8 mode; +POSIX servers will generally require the locale to be set (by some +server-dependent means), although many default to UTF-8. Also, +\#{circa 2016} many servers (particularly older servers) do not honour +this mode sent over SSH. When set to \q{Auto}, this follows the +local configured character set (see \k{config-charset}). + \b Terminal speeds are configured elsewhere; see \k{config-termspeed}. \H{config-ssh-x11} The X11 panel