File Coverage

blib/lib/Config/Model/models/Sshd.pl

Criterion	Covered	Total	%
statement	6	6	100.0
branch			n/a
condition			n/a
subroutine	2	2	100.0
pod			n/a
total	8	8	100.0

#
# This file is part of Config-Model-OpenSsh
#
# This software is Copyright (c) 2008-2022 by Dominique Dumont.
#
# This is free software, licensed under:
#
#   The GNU Lesser General Public License, Version 2.1, February 1999
#
use strict;
use warnings;

return [
  {
    'accept' => [
      '.*',
      {
        'summary' => 'boilerplate parameter that may hide a typo',
        'type' => 'leaf',
        'value_type' => 'uniline',
        'warn' => 'Unknown parameter. Please make sure there\'s no typo and contact the author'
      }
    ],
    'class_description' => 'This configuration class was generated from sshd_system documentation.
by L<parse-man.pl|https://github.com/dod38fr/config-model-openssh/contrib/parse-man.pl>
',
    'element' => [
      'AddressFamily',
      {
        'choice' => [
          'any',
          'inet',
          'inet6'
        ],
        'description' => 'Specifies which address family should be used by L<sshd(8)>. Valid arguments
are B<any> (the default), B<inet> (use IPv4 only), or B<inet6> (use IPv6 only).',
        'type' => 'leaf',
        'upstream_default' => 'any',
        'value_type' => 'enum'
      },
      'Ciphers',
      {
        'description' => 'Specifies the ciphers allowed. Multiple ciphers must be comma-separated. If the
specified list begins with a \'+\' character, then the specified ciphers will be
appended to the default set instead of replacing them. If the specified list
begins with a \'-\' character, then the specified ciphers (including wildcards)
will be removed from the default set instead of replacing them. If the
specified list begins with a \'^\' character, then the specified ciphers will be
placed at the head of the default set.

The supported ciphers are:

B<3des-cbc> B<aes128-cbc> B<aes192-cbc> B<aes256-cbc> B<aes128-ctr>
B<aes192-ctr> B<aes256-ctr> B<[e-mail]> B<[e-mail]>
B<[e-mail]>

The default is: [e-mail], aes128-ctr, aes192-ctr,
aes256-ctr, [e-mail], [e-mail]

The list of available ciphers may also be obtained using Qq ssh -Q cipher .',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'Compression',
      {
        'choice' => [
          'delayed',
          'no',
          'yes'
        ],
        'description' => 'Specifies whether compression is enabled after the user has authenticated
successfully. The argument must be B<yes> B<delayed> (a legacy synonym for
B<yes> or B<no> The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'enum'
      },
      'DebianBanner',
      {
        'description' => 'Specifies whether the distribution-specified extra version suffix is included
during initial protocol handshake. The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'FingerprintHash',
      {
        'choice' => [
          'md5',
          'sha256'
        ],
        'description' => 'Specifies the hash algorithm used when logging key fingerprints. Valid options
are: B<md5> and B<sha256> The default is B<sha256>',
        'type' => 'leaf',
        'upstream_default' => 'sha256',
        'value_type' => 'enum'
      },
      'GSSAPICleanupCredentials',
      {
        'description' => 'Specifies whether to automatically destroy the user\'s credentials cache on
logout. The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'GSSAPIKeyExchange',
      {
        'description' => 'Specifies whether key exchange based on GSSAPI is allowed. GSSAPI key exchange
doesn\'t rely on ssh keys to verify host identity. The default is B<no>',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'GSSAPIStrictAcceptorCheck',
      {
        'description' => 'Determines whether to be strict about the identity of the GSSAPI acceptor a
client authenticates against. If set to B<yes> then the client must
authenticate against the host service on the current hostname. If set to B<no>
then the client may authenticate against any service key stored in the
machine\'s default store. This facility is provided to assist with operation on
multi homed machines. The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'GSSAPIStoreCredentialsOnRekey',
      {
        'description' => 'Controls whether the user\'s GSSAPI credentials should be updated following a
successful connection rekeying. This option can be used to accepted renewed or
updated credentials from a compatible client. The default is \'\'no\'\'

For this to work B<GSSAPIKeyExchange> needs to be enabled in the server and
also used by the client.',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'GSSAPIKexAlgorithms',
      {
        'description' => 'The list of key exchange algorithms that are accepted by GSSAPI key exchange.
Possible values are gss-gex-sha1-, gss-group1-sha1-, gss-group14-sha1-,
gss-group14-sha256-, gss-group16-sha512-, gss-nistp256-sha256-,
gss-curve25519-sha256-

The default is \'\'gss-group14-sha256-, gss-group16-sha512-,
gss-nistp256-sha256-, gss-curve25519-sha256-, gss-gex-sha1-,
gss-group14-sha1-\'\' This option only applies to connections using GSSAPI.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'HostCertificate',
      {
        'description' => 'Specifies a file containing a public host certificate. The certificate\'s public
key must match a private host key already specified by B<HostKey> The default
behaviour of L<sshd(8)> is not to load any certificates.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'HostKey',
      {
        'description' => 'Specifies a file containing a private host key used by SSH. The defaults are
/etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key and
/etc/ssh/ssh_host_rsa_key

Note that L<sshd(8)> will refuse to use a file if it is group/world-accessible
and that the B<HostKeyAlgorithms> option restricts which of the keys are
actually used by L<sshd(8)>.

It is possible to have multiple host key files. It is also possible to specify
public host key files instead. In this case operations on the private key will
be delegated to an ssh-agent1.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'HostKeyAgent',
      {
        'description' => 'Identifies the UNIX-domain socket used to communicate with an agent that has
access to the private host keys. If the string Qq SSH_AUTH_SOCK is specified,
the location of the socket will be read from the B<SSH_AUTH_SOCK> environment
variable.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'HostKeyAlgorithms',
      {
        'description' => 'Specifies the host key signature algorithms that the server offers. The default
for this option is: [e-mail],
[e-mail],
[e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], ssh-ed25519, ecdsa-sha2-nistp256,
ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, [e-mail],
[e-mail], rsa-sha2-512, rsa-sha2-256

The list of available signature algorithms may also be obtained using Qq ssh -Q
HostKeyAlgorithms .',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'IgnoreUserKnownHosts',
      {
        'description' => 'Specifies whether L<sshd(8)> should ignore the user\'s ~/.ssh/known_hosts during
B<HostbasedAuthentication> and use only the system-wide known hosts file
/etc/ssh/ssh_known_hosts The default is \'\'no\'\'',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'KerberosGetAFSToken',
      {
        'description' => 'If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire an AFS
token before accessing the user\'s home directory. The default is B<no>',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'KerberosOrLocalPasswd',
      {
        'description' => 'If password authentication through Kerberos fails then the password will be
validated via any additional local mechanism such as /etc/passwd The default is
B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'KerberosTicketCleanup',
      {
        'description' => 'Specifies whether to automatically destroy the user\'s ticket cache file on
logout. The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'KexAlgorithms',
      {
        'description' => 'Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must
be comma-separated. Alternately if the specified list begins with a \'+\'
character, then the specified algorithms will be appended to the default set
instead of replacing them. If the specified list begins with a \'-\' character,
then the specified algorithms (including wildcards) will be removed from the
default set instead of replacing them. If the specified list begins with a \'^\'
character, then the specified algorithms will be placed at the head of the
default set. The supported algorithms are:

B<curve25519-sha256> B<[e-mail]>
B<diffie-hellman-group1-sha1> B<diffie-hellman-group14-sha1>
B<diffie-hellman-group14-sha256> B<diffie-hellman-group16-sha512>
B<diffie-hellman-group18-sha512> B<diffie-hellman-group-exchange-sha1>
B<diffie-hellman-group-exchange-sha256> B<ecdh-sha2-nistp256>
B<ecdh-sha2-nistp384> B<ecdh-sha2-nistp521>
B<[e-mail]>

The default is: [e-mail], curve25519-sha256,
[e-mail], ecdh-sha2-nistp256, ecdh-sha2-nistp384,
ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512, diffie-hellman-group18-sha512,
diffie-hellman-group14-sha256

The list of available key exchange algorithms may also be obtained using Qq ssh
-Q KexAlgorithms .',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'ListenAddress',
      {
        'description' => 'Specifies the local addresses L<sshd(8)> should listen on. The following forms
may be used:

B<ListenAddress> I<hostname | address> B<ListenAddress> I<hostname : port>
B<ListenAddress> I<IPv4_address : port> B<ListenAddress> [I<hostname | address
: port> ]

If I<port> is not specified, sshd will listen on the address and all B<Port>
options specified. The default is to listen on all local addresses. Multiple
B<ListenAddress> options are permitted.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'LoginGraceTime',
      {
        'description' => 'The server disconnects after this time if the user has not successfully logged
in. If the value is 0, there is no time limit. The default is 120 seconds.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'LogVerbose',
      {
        'description' => 'Specify one or more overrides to LogLevel. An override consists of a pattern
lists that matches the source file, function and line number to force detailed
logging for. For example, an override pattern of:
kex.c:*:1000,*:kex_exchange_identification():*, packet.c:*

would enable detailed logging for line 1000 of kex.c everything in the Fn
kex_exchange_identification function, and all code in the packet.c file. This
option is intended for debugging and no overrides are enabled by default.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'MACs',
      {
        'description' => 'Specifies the available MAC (message authentication code) algorithms.

The MAC algorithm is used for data integrity protection. Multiple algorithms
must be comma-separated. If the specified list begins with a \'+\' character,
then the specified algorithms will be appended to the default set instead of
replacing them. If the specified list begins with a \'-\' character, then the
specified algorithms (including wildcards) will be removed from the default set
instead of replacing them. If the specified list begins with a \'^\' character,
then the specified algorithms will be placed at the head of the default set.

The algorithms that contain Qq -etm calculate the MAC after encryption
(encrypt-then-mac). These are considered safer and their use recommended. The
supported MACs are:

B<hmac-md5> B<hmac-md5-96> B<hmac-sha1> B<hmac-sha1-96> B<hmac-sha2-256>
B<hmac-sha2-512> B<[e-mail]> B<[e-mail]>
B<[e-mail]> B<[e-mail]>
B<[e-mail]> B<[e-mail]>
B<[e-mail]> B<[e-mail]>
B<[e-mail]> B<[e-mail]>

The default is: [e-mail], [e-mail],
[e-mail], [e-mail],
[e-mail], [e-mail], [e-mail],
hmac-sha2-256, hmac-sha2-512, hmac-sha1

The list of available MAC algorithms may also be obtained using Qq ssh -Q mac .',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'Match',
      {
        'cargo' => {
          'config_class_name' => 'Sshd::MatchBlock',
          'type' => 'node'
        },
        'description' => 'Introduces a conditional block. If all of the criteria on the B<Match> line are
satisfied, the keywords on the following lines override those set in the global
section of the config file, until either another B<Match> line or the end of
the file. If a keyword appears in multiple B<Match> blocks that are satisfied,
only the first instance of the keyword is applied.

The arguments to B<Match> are one or more criteria-pattern pairs or the single
token B<All> which matches all criteria. The available criteria are B<User>
B<Group> B<Host> B<LocalAddress> B<LocalPort> and B<Address>

The match patterns may consist of single entries or comma-separated lists and
may use the wildcard and negation operators described in the I<PATTERNS>
section of ssh_config5.

The patterns in an B<Address> criteria may additionally contain addresses to
match in CIDR address/masklen format, such as 192.0.2.0/24 or 2001:db8::/32.
Note that the mask length provided must be consistent with the address - it is
an error to specify a mask length that is too long for the address or one with
bits set in this host portion of the address. For example, 192.0.2.0/33 and
192.0.2.0/8, respectively.

Only a subset of keywords may be used on the lines following a B<Match>
keyword. Available keywords are B<AcceptEnv> B<AllowAgentForwarding>
B<AllowGroups> B<AllowStreamLocalForwarding> B<AllowTcpForwarding>
B<AllowUsers> B<AuthenticationMethods> B<AuthorizedKeysCommand>
B<AuthorizedKeysCommandUser> B<AuthorizedKeysFile>
B<AuthorizedPrincipalsCommand> B<AuthorizedPrincipalsCommandUser>
B<AuthorizedPrincipalsFile> B<Banner> B<CASignatureAlgorithms>
B<ChannelTimeout> B<ChrootDirectory> B<ClientAliveCountMax>
B<ClientAliveInterval> B<DenyGroups> B<DenyUsers> B<DisableForwarding>
B<ExposeAuthInfo> B<ForceCommand> B<GatewayPorts> B<GSSAPIAuthentication>
B<HostbasedAcceptedAlgorithms> B<HostbasedAuthentication>
B<HostbasedUsesNameFromPacketOnly> B<IgnoreRhosts> B<Include> B<IPQoS>
B<KbdInteractiveAuthentication> B<KerberosAuthentication> B<LogLevel>
B<MaxAuthTries> B<MaxSessions> B<PasswordAuthentication>
B<PermitEmptyPasswords> B<PermitListen> B<PermitOpen> B<PermitRootLogin>
B<PermitTTY> B<PermitTunnel> B<PermitUserRC> B<PubkeyAcceptedAlgorithms>
B<PubkeyAuthentication> B<PubkeyAuthOptions> B<RekeyLimit> B<RevokedKeys>
B<SetEnv> B<StreamLocalBindMask> B<StreamLocalBindUnlink> B<TrustedUserCAKeys>
B<UnusedConnectionTimeout> B<X11DisplayOffset> B<X11Forwarding> and
B<X11UseLocalhost>',
        'type' => 'list'
      },
      'MaxStartups',
      {
        'description' => 'Specifies the maximum number of concurrent unauthenticated connections to the
SSH daemon. Additional connections will be dropped until authentication
succeeds or the B<LoginGraceTime> expires for a connection. The default is
10:30:100.

Alternatively, random early drop can be enabled by specifying the three colon
separated values start:rate:full (e.g. "10:30:60"). L<sshd(8)> will refuse
connection attempts with a probability of rate/100 (30%) if there are currently
start (10) unauthenticated connections. The probability increases linearly and
all connection attempts are refused if the number of unauthenticated
connections reaches full (60).',
        'type' => 'leaf',
        'upstream_default' => '10',
        'value_type' => 'uniline'
      },
      'ModuliFile',
      {
        'description' => 'Specifies the L<moduli(5)> file that contains the Diffie-Hellman groups used
for the \'\'diffie-hellman-group-exchange-sha1\'\' and
\'\'diffie-hellman-group-exchange-sha256\'\' key exchange methods. The default is
/etc/ssh/moduli',
        'type' => 'leaf',
        'upstream_default' => '/etc/ssh/moduli',
        'value_type' => 'uniline'
      },
      'PermitUserEnvironment',
      {
        'description' => 'Specifies whether ~/.ssh/environment and B<environment=> options in
~/.ssh/authorized_keys are processed by L<sshd(8)>. Valid options are B<yes>
B<no> or a pattern-list specifying which environment variable names to accept
(for example Qq LANG, LC_* ) . The default is B<no> Enabling environment
processing may enable users to bypass access restrictions in some
configurations using mechanisms such as B<LD_PRELOAD>',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'PerSourceMaxStartups',
      {
        'description' => 'Specifies the number of unauthenticated connections allowed from a given source
address, or \'\'none\'\' if there is no limit. This limit is applied in addition to
B<MaxStartups> whichever is lower. The default is B<none>',
        'type' => 'leaf',
        'upstream_default' => 'none',
        'value_type' => 'uniline'
      },
      'PerSourceNetBlockSize',
      {
        'description' => 'Specifies the number of bits of source address that are grouped together for
the purposes of applying PerSourceMaxStartups limits. Values for IPv4 and
optionally IPv6 may be specified, separated by a colon. The default is
B<32:128> which means each address is considered individually.',
        'type' => 'leaf',
        'upstream_default' => '32:128',
        'value_type' => 'uniline'
      },
      'PidFile',
      {
        'description' => 'Specifies the file that contains the process ID of the SSH daemon, or B<none>
to not write one. The default is /run/sshd.pid',
        'type' => 'leaf',
        'upstream_default' => '/run/sshd',
        'value_type' => 'uniline'
      },
      'Port',
      {
        'description' => 'Specifies the port number that L<sshd(8)> listens on. The default is 22.
Multiple options of this type are permitted. See also B<ListenAddress>',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'PrintLastLog',
      {
        'description' => 'Specifies whether L<sshd(8)> should print the date and time of the last user
login when a user logs in interactively. The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'PrintMotd',
      {
        'description' => 'Specifies whether L<sshd(8)> should print /etc/motd when a user logs in
interactively. (On some systems it is also printed by the shell, /etc/profile
or equivalent.) The default is B<yes>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'RequiredRSASize',
      {
        'description' => 'Specifies the minimum RSA key size (in bits) that L<sshd(8)> will accept. User
and host-based authentication keys smaller than this limit will be refused. The
default is B<1024> bits. Note that this limit may only be raised from the
default.',
        'type' => 'leaf',
        'upstream_default' => '1024',
        'value_type' => 'integer'
      },
      'SecurityKeyProvider',
      {
        'description' => 'Specifies a path to a library that will be used when loading FIDO
authenticator-hosted keys, overriding the default of using the built-in USB HID
support.',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'StrictModes',
      {
        'description' => 'Specifies whether L<sshd(8)> should check file modes and ownership of the
user\'s files and home directory before accepting login. This is normally
desirable because novices sometimes accidentally leave their directory or files
world-writable. The default is B<yes> Note that this does not apply to
B<ChrootDirectory> whose permissions and ownership are checked unconditionally.',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'Subsystem',
      {
        'cargo' => {
          'mandatory' => '1',
          'type' => 'leaf',
          'value_type' => 'uniline'
        },
        'description' => 'Configures an external subsystem (e.g. file transfer daemon). Arguments should
be a subsystem name and a command (with optional arguments) to execute upon
subsystem request.

The command B<sftp-server> implements the SFTP file transfer subsystem.

Alternately the name B<internal-sftp> implements an in-process SFTP server.
This may simplify configurations using B<ChrootDirectory> to force a different
filesystem root on clients.

By default no subsystems are defined.',
        'index_type' => 'string',
        'type' => 'hash'
      },
      'SyslogFacility',
      {
        'choice' => [
          'AUTH',
          'DAEMON',
          'LOCAL0',
          'LOCAL1',
          'LOCAL2',
          'LOCAL3',
          'LOCAL4',
          'LOCAL5',
          'LOCAL6',
          'LOCAL7',
          'USER'
        ],
        'description' => 'Gives the facility code that is used when logging messages from L<sshd(8)>. The
possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3,
LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH.',
        'type' => 'leaf',
        'upstream_default' => 'AUTH',
        'value_type' => 'enum'
      },
      'TCPKeepAlive',
      {
        'description' => 'Specifies whether the system should send TCP keepalive messages to the other
side. If they are sent, death of the connection or crash of one of the machines
will be properly noticed. However, this means that connections will die if the
route is down temporarily, and some people find it annoying. On the other hand,
if TCP keepalives are not sent, sessions may hang indefinitely on the server,
leaving Qq ghost users and consuming server resources.

The default is B<yes> (to send TCP keepalive messages), and the server will
notice if the network goes down or the client host crashes. This avoids
infinitely hanging sessions.

To disable TCP keepalive messages, the value should be set to B<no>

This option was formerly called B<KeepAlive>',
        'type' => 'leaf',
        'upstream_default' => 'yes',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'UseDNS',
      {
        'description' => 'Specifies whether L<sshd(8)> should look up the remote host name, and to check
that the resolved host name for the remote IP address maps back to the very
same IP address.

If this option is set to B<no> (the default) then only addresses and not host
names may be used in ~/.ssh/authorized_keys B<from> and B<sshd_config> B<Match>
B<Host> directives.',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'UsePAM',
      {
        'description' => 'Enables the Pluggable Authentication Module interface. If set to B<yes> this
will enable PAM authentication using B<KbdInteractiveAuthentication> and
B<PasswordAuthentication> in addition to PAM account and session module
processing for all authentication types.

Because PAM keyboard-interactive authentication usually serves an equivalent
role to password authentication, you should disable either
B<PasswordAuthentication> or B<KbdInteractiveAuthentication>

If B<UsePAM> is enabled, you will not be able to run L<sshd(8)> as a non-root
user. The default is B<no>',
        'type' => 'leaf',
        'upstream_default' => 'no',
        'value_type' => 'boolean',
        'write_as' => [
          'no',
          'yes'
        ]
      },
      'VersionAddendum',
      {
        'description' => 'Optionally specifies additional text to append to the SSH protocol banner sent
by the server upon connection. The default is B<none>',
        'type' => 'leaf',
        'value_type' => 'uniline'
      },
      'XAuthLocation',
      {
        'description' => 'Specifies the full pathname of the L<xauth(1)> program, or B<none> to not use
one. The default is /usr/bin/xauth',
        'type' => 'leaf',
        'upstream_default' => '/usr/bin/xauth',
        'value_type' => 'uniline'
      }
    ],
    'generated_by' => 'parse-man.pl from sshd_system  9.4p1 doc',
    'include' => [
      'Sshd::MatchElement'
    ],
    'license' => 'LGPL2',
    'name' => 'Sshd',
    'rw_config' => {
      'backend' => 'OpenSsh::Sshd',
      'config_dir' => '/etc/ssh',
      'file' => 'sshd_config',
      'os_config_dir' => {
        'darwin' => '/etc'
      }
    }
  }
]
;