text:
ssh-broker-config — Tectia Connection Broker configuration file format
The Connection Broker configuration file
ssh-broker-config.xml is used by Tectia Client and ConnectSecure on Unix and Windows. The Connection Broker configuration file must be a valid XML file that follows the
ssh-broker-ng-config-1.dtd document type definition.
Connection Broker Files
The Connection Broker reads three configuration files (if all are available):
ssh-broker-config-default.xmlfile is read first. It holds the factory default settings. It is not recommended to edit the file, but you can use it to view the default settings.
This file must be available and correctly formatted for the Connection Broker to start.
Next, the Connection Broker reads the global configuration file. The settings in the global configuration file override the default settings.
If the global configuration file is missing or malformed, the Connection Broker will start normally, and will read the user-specific configuration file, instead. A malformed global configuration file is ignored and the default settings or user-specific settings, if they exist, are used instead.
Last, the Connection Broker reads the user-specific configuration file, if it is available. The settings in the user-specific configuration file override the settings in the global configuration file, with the following exceptions:
The following settings from the user-specific configuration are combined with the settings of the global configuration file:
generalelement, the
profileselement, all settings
static-tunnelselement, all settings.
If a connection profile with the same name has been defined in both the global configuration file and user-specific configuration file, the latter one is used.
If the
filter-enginesettings have been defined in the global configuration file, and the file is valid (not malformed), those settings are used, and any
filter-enginesettings made in the user-specific configuration file are ignored.
If the user-specific configuration file is missing, the Connection Broker will start using the previously read configuration files. However, if a user-specific configuration exists but is malformed, the Connection Broker will not start at all.
On Unix, the default configuration file locations are as follows:
In Tectia Client 6.1 and earlier on Unix the default auxiliary data directory
On Windows, the default configuration file locations are as follows (where
<INSTALLDIR> indicates the default Tectia installation directory on Windows, see Directory Paths):
Default configuration: "
<INSTALLDIR>\SSH Tectia AUX\ssh-broker-ng\ssh-broker-config-default.xml"
Global configuration: "
<INSTALLDIR>\SSH Tectia Broker\ssh-broker-config.xml"
User-specific configuration: "
<INSTALLDIR>\SSH Tectia AUX\ssh-broker-ng\ssh-broker-ng-config-1.dtd"
The following sections describe the options available in the Connection Broker configuration file. For more information on the syntax of the configuration file, see Broker Configuration File Syntax.
Environment Variables
Two kinds of environment variables can be used in the Connection Broker configuration file. In addition to the system-level environment variables, you can use special variables that are Tectia specific. The environment variables take precedence over the special variables. So if an environment variable and a special variable have the same name, the environment variable will be used.
All alphanumeric characters and the underscore '_' sign are allowed in environment variables. The variable name ends to the first character that is not allowed.
You can define for example file or directory paths with environment variables, and they will be expanded to their values as explained below.
Replaced with the value of the environment variable if one has been defined. The variable is matched case-insensitively. If the variable is not defined, the string '
%VARIABLENAME%' is the result.
Replaced with the value of the environment variable if one has been defined. The variable is matched case-sensitively on Unix and case-insensitively on Windows. If the variable is not defined, it is replaced with an empty string.
Replaced with the value defined for '
$VARIABLENAME' with the '
text' appended to it.
Replaced with the value defined for '
$VARIABLENAME', or replaced with the '
default_value' if the variable is not set.
The Tectia specific special variables are:
- %U or %username%
Replaced with the currently logged in user name.
- %username-without-domain%
Replaced with the currently logged in user name in short format, i.e. without the domain part. Available on Windows.
- %G or %groupname%
Replaced with the group name of the currently logged in user.
- %D or %homedir%
Replaced with the home directory defined for the currently logged in user.
- %IU or %userid%
Replaced with the user identifier defined for the currently logged in user.
- %IG or %groupid%
Replaced with the group identifier defined for the currently logged in user.
The special variables can also be entered using the Unix format, for example,
Document Type Declaration and the Root Element
The Connection Broker configuration file is a valid XML file and starts with the Document Type Declaration.
The root element in the configuration file is
secsh-broker. It can include
gui, and
logging elements.
An example of an empty configuration file is shown below:
<!DOCTYPE secsh-broker SYSTEM "ssh-broker-ng-config-1.dtd"> <secsh-broker version="1.0"> <general /> <default-settings /> <profiles /> <static-tunnels /> <gui /> <logging /> </secsh-broker>
general Element
general element contains settings such as the cryptographic library and the key stores to be used.
general element can contain zero or one instance of the following elements:
protocol-parameters; and multiple
known-hosts elements.
- crypto-lib
This element selects the cryptographic library mode to be used. Either the standard version (
standard) or the FIPS 140-2 certified version (
fips) of the cryptographic library can be used. The library name is given as a value of the
modeattribute. By default, standard cryptographic libraries are used. The OpenSSL cryptographic library is used in the FIPS mode.
FIPS mode will be used if it is so specified either in the global or the user configuration file (or both).
<crypto-lib mode="standard" />
In the FIPS mode, the cryptographic operations are performed according to the rules of the FIPS 140-2 standard. The FIPS library includes the
aes256-cbc, and
aes256-ctrciphers, and all the supported HMAC-SHA (both HMAC-SHA1 and HMAC-SHA2) variants of MAC. See cipher and mac.
For a list of platforms on which the FIPS library has been validated or tested, see Tectia Client/Server Product Description.
- cert-validation
This element defines public-key infrastructure (PKI) settings used for validating remote server authentication certificates. The element can have the following attributes:
end-point-identity-checkattribute specifies whether the client will verify the server's host name or IP address against the Subject Name or Subject Alternative Name (DNS Address) specified in the server host certificate. The default value is
yes. If set to
no, the fields in the server host certificate are not verified and the certificate is accepted based on the validity period and CRL check only.
end-point-identity-check="no"is a security risk. Then anyone with a certificate issued by the same trusted certification authority (CA) that issues the server host certificates can perform a man-in-the-middle attack on the server.
Alternatively, if set to
ask, the user can decide to either cancel or continue establishing the connection in case that the server's host name does not match the one in the certificate.
default-domainattribute can be used when the end-point identity check is enabled. It specifies the default domain part of the remote system name and it is used if only the base part of the system name is available. The
default-domainis appended to the system name if it does not contain a dot (
If the default domain is not specified, the end-point identity check will still work with short host names. For example, when a user tries to connect to a host "
rock" giving only the short host name and the certificate contains the full DNS address "
rock.example.com", the connection will be opened and Tectia Client will issue a warning about accepting a connection to "
http-proxy-urlattribute defines an HTTP proxy and the
socks-server-urlattribute defines a SOCKS server for making LDAP or OCSP queries for certificate validity.
The address of the server is given as the value of the attribute. The format of the address is
socks://username@socks_server:port/network/netmask,network/netmask ...(with a SOCKS server) or
http://username@proxy_server:port/network/netmask,network/netmask ...(with an HTTP proxy).
For example, to make the SOCKS server use host
socks.ssh.comand port
1080for connections outside of networks
18.104.22.168(16-bit domain) and
10.100.23.0(8-bit domain), and to get these networks connected directly, set
socks-server-urlas follows:
cache-sizeattribute defines the maximum size (in megabytes) of in-memory cache for the certificates and CRLs. The allowed value range is 1 to 512, and the default value is 35 MB.
max-crl-sizeattribute defines the maximum accepted size (in megabytes) of CRLs. Processing large CRLs can consume a considerable amount of memory and processing power, so in some environments it is advisable to limit their size. The allowed value range is 1 to 512, and the default value is 11 MB.
external-search-timeoutattribute defines the time limit (in seconds) for external HTTP and LDAP searches for CRLs and certificates. The allowed value range is 1 to 3600 seconds, and the default value is 60 seconds.
max-ldap-response-lengthattribute defines the maximum accepted size (in megabytes) of LDAP responses. The allowed value range is 1 to 512, and the default value is 11 MB.
ldap-idle-timeoutattribute defines an idle timeout for LDAP connections. The validation engine retains LDAP connections and reuses them in forthcoming searches. The connection is closed only after the LDAP idle timeout has been reached. The allowed value range is 1 to 3600 seconds, and the default idle timeout is 30 seconds.
max-path-lengthattribute limits the length of the certification paths when validating certificates. It can be used to safeguard the paths or to optimize against the paths getting too long in a deeply hierarchical PKI or when the PKI is heavily cross-certified with other PKIs. Using the attributes requires knowing the upper limit of the paths used in certificate validation. For example:
<cert-validation max-path-length="6"> <ldap-server address="ldap://myldap.com" port="389" /> <dod-pki enable="yes" /> <ca-certificate name="CA 1" file="ca-certificate1.crt" /> </cert-validation>
In the example, the path is limited to six certificates, including the end-entity and root CA certificates. If not specified, the default value is 10. Decrease the value to optimize the validation if the maximum length of the encountered paths in the certificate validation is known.
cert-validationelement can contain multiple
crl-prefetchelements, one
dod-pkielement, and multiple
key-storeelements. The elements have to be in the listed order.
- ldap-server
This element specifies an LDAP server
portused for fetching CRLs and/or subordinate CA certificates based on the issuer name of the certificate being validated. Several LDAP servers can be specified by using several
CRLs are automatically retrieved from the CRL distribution point defined in the certificate to be verified if the point exists.
The default value for
- ocsp-responder
This element specifies an OCSP (Online Certificate Status Protocol) responder service address in URL format with attribute
url. Several OCSP responders can be specified by using several
If the certificate has a valid Authority Info Access extension with an OCSP Responder URL, it will be used instead of this setting. Note that for the OCSP validation to succeed, both the end-entity certificate and the OCSP Responder certificate must be issued by the same CA.
validity-period(in seconds) can be optionally defined. During this time, new OCSP queries for the same certificate are not made but the old result is used. The default validity period is
0(a new query is made every time).
- crl-prefetch
This element instructs Tectia Client to periodically download a CRL from the specified URL. The
urlvalue can be an LDAP or HTTP URL, or it can refer to a local file. The file format must be either binary DER or base64, PEM is not supported.
To download CRLs from the local file system, define the file URL in this format:
To download CRLs from an LDAP server, define the LDAP URL in this format:
ldap://ldap.server.com:389/CN=Root%20CA, OU=certification%20authorities,DC=company, DC=com?certificaterevocationlist
Use the
intervalattribute to specify how often the CRL is downloaded. The default is
- dod-pki
One of the compliance requirements of the US Department of Defense Public-Key Infrastructure (DoD PKI) is to have the Digital Signature bit set in the Key Usage of the certificate. To enforce digital signature in key usage, set the value of the
enableattribute to
yes. The default is
- ca-certificate
This element defines a certification authority (CA) used in server authentication. It can have four attributes:
disable-crls, and
nameattribute must contain the name of the CA.
The element must either contain the path to the X.509 CA certificate file as a value of the
fileattribute, or include the certificate as a base64-encoded ASCII block.
CRL checking can be disabled by setting the
disable-crlsattribute to
yes. The default is
Expired CRLs can be used by setting a numeric value (in seconds) for the
use-expired-crlsattribute. The default is
0(do not use expired CRLs).
- key-store
This element defines CA certificates stored in an external key store for server authentication. Currently it is used only on z/OS for CA certificates stored in System Authorization Facility (SAF).
An example of a certificate validation configuration is shown below:
<cert-validation end-point-identity-check="yes" default-domain="example.com" http-proxy-url="http://proxy.example.com:8080"> <ldap-server address="ldap://ldap.example.com:389" /> <ocsp-responder url="http://ocsp.example.com:8090" validity-period="0" /> <crl-prefetch url="file:///full.path.to.crlfile" interval="1800" /> <dod-pki enable="no" /> <ca-certificate name="ssh_ca1" file="ssh_ca1.crt" disable-crls="no" use-expired-crls="100" /> </cert-validation>
- key-stores
This element defines settings for user public-key and certificate authentication.
Under the
<general>element, there can be one
<key-stores>instance which in turn can have any number of
<user-keys>, and
<identification>elements, and the order of the elements is free.
Special variables and environment variables can be used when defining the values for the elements. The following variables can be used and they will be expanded as follows:
%USERNAME%= user name
%USERNAME-WITHOUT-DOMAIN%= user name without the domain part
%USERID%= user ID (not on Windows)
%GROUPID%= user group ID (not on Windows)
%HOMEDIR%= the user's home directory
%GROUPNAME%= the name of the user's default group
Also environment variables are replaced with their current values. For example it is possible to use strings
%HOME%to expand to user's home directory (if environment variable
HOMEis set).
Short alias names (for example,
%U) are case-sensitive and long alias names (for example,
%USERNAME%) are case-insensitive.
- key-store
Each of the
key-storeelements configures one key store provider. The
key-stores/key-storeelement can take the following attributes:
typeattribute is the key store type. The currently supported types are
"software", and
initattribute is the initialization info specific to the key-store-provider. The initialization string can contain special strings explained above in key-stores.
For key store configuration examples, see the section called "Key Store Configuration Examples".
- user-keys
user-keyselement can be used to override the default directory for the user keys. The
user-keyselement can take the following attributes:
directoryattribute defines the directory where the user private keys are stored. Enter the full path.
passphrase-timeoutattribute defines the time (in seconds) after which the passphrase-protected private key will time out, and the user must enter the passphrase again. The default is
0, meaning that the passphrase does not time out. The value of this element should be longer than the
By default, the Connection Broker keeps the passphrase-protected private keys open once the user has entered the passphrase successfully. This can be changed with the passphrase timeout options. When
passphrase-timeoutis set, the private key stays open (usable without further passphrase prompts) until the timeout expires. The
passphrase-timeoutattribute sets the hard timeout, that is set only once when the key is opened and will not be reset even if the key is used multiple times.
passphrase-idle-timeoutattribute defines the time (in seconds) after which the passphrase-protected private key will time out unless the user accesses or uses the key. The
passphrase-idle-timeoutis reset every time the key is accessed. The default is
0, meaning that the passphrase never times out.
Both of the timeout options can be set simultaneously, but notice that if the idle timeout is set longer than the hard timeout, the idle timeout has no effect.
- identification
identificationelement can be used to override the default location of the identification file that defines the user keys. The
identificationelement can take the following attributes:
fileattribute specifies the location of the identification file. Enter the full path.
base-pathattribute defines the directory where the identification file expects the user private keys to be stored. This element can be used to override the default relative path interpretation of the identification file (paths relative to the identification file directory).
passphrase-timeoutattribute defines the time (in seconds) after which the user must enter the passphrase again. The default is
0, meaning that the passphrase is not re-requested.
passphrase-idle-timeoutattribute defines a time (in seconds) after which the passphrase times out if there are no user actions. The default is
0, meaning that the passphrase does not time out.
The timeout settings affect only those private keys that are listed in the identification file.
- strict-host-key-checking
This element is deprecated starting from Tectia Client version 6.1.4.
This element is supported in configuration for backwards compatibility and used only if the
policyattribute of the
server-authentication-methods/auth-server-publickeyelement under
profiles/profileis not defined. In this case, the host key policy is interpreted based on the values of this option and the
accept-unknown-host-keysoptions. See auth-server-publickey for details.
- host-key-always-ask
This element is deprecated starting from Tectia Client version 6.1.4.
This element is supported in configuration for backwards compatibility and used only if the
policyattribute of the
server-authentication-methods/auth-server-publickeyelement under
profiles/profileis not defined. In this case, the host key policy is interpreted based on the values of this option and the
accept-unknown-host-keysoptions. See auth-server-publickey for details.
- accept-unknown-host-keys
This element is deprecated starting from Tectia Client version 6.1.4.
This element is supported in configuration for backwards compatibility and used only if the
policyattribute of the
server-authentication-methods/auth-server-publickeyelement under
profiles/profileis not defined. In this case, the host key policy is interpreted based on the values of this option and the
host-key-always-askoptions. See auth-server-publickey for details.
Consider carefully before enabling this option. Disabling the host-key checks makes you vulnerable to man-in-the-middle attacks.
- user-config-directory
This element can be used to change the storage location of the user-specific configuration files away from the default which is
$HOME/.ssh2/on Unix, and "
%APPDATA%\SSH" on Windows. It can be used for example, if you want to store all client-side configurations to a centralized location.
When this element is added to the global configuration file, the Connection Broker reads the following user-specific files in the defined location:
User's key file
User's own configuration files
User's known host keys
User's random_seed file
Windows GUI profile files:
1.ssh2, 2.ssh2
The startup batch file for the sftpg3 client:
Stop all existing SSH applications before modifying the
user-config-directorysetting in the Connection Broker configuration.
user-config-directorysetting affects all Tectia products running on the same host, for example Tectia Client and Tectia ConnectSecure.
user-config-directoryoption takes an attribute
path, whose value can be either a directory path or one of the following variables:
%U: The user name.
%username%: The user name.
%username-without-domain%: The user name without domain definition.
%D: The user's home directory.
%homedir%: The user's home directory.
%USER_CONFIG_DIRECTORY%: The user-specific configuration directory.
%IU: The user's ID, on Unix only
%userid%: The user's ID, on Unix only
%IG: The group ID, on Unix only
%groupid%: The group ID, on Unix only
The default is
%USER_CONFIG_DIRECTORY%. This variable refers to the user-specific configuration directory:
$HOME/.ssh2on Unix, and
%APPDATA%\SSHon Windows. The
%USER_CONFIG_DIRECTORY%variable cannot be used in other settings.
- file-access-control
On Unix, this element can be used to enable checking of file access permissions defined for the global and user-specific configuration files, and for the private keys files. If the permissions are not as expected, the Connection Broker will refuse to start, or to use certain private keys.
By default this setting is disabled. On Windows, this element has no effect.
The file permissions are checked differently, if the
file-access-controlelement is set in both the global and user configuration files, or just in one of them. See the following table for details:
Table A.1. Different file-access-control effects
Setting in: Permissions checked in: Global config User config Global config User config Private key files yes yes / - checked checked checked yes no checked checked not checked no / - yes not checked checked checked no / - no / - not checked not checked not checked
In the table:
file-access-control enable="no". The
"-"sign means that the setting is not defined in the file at all.
When the file access permissions are checked, the controls are applied as follows:
Expected permissions for the global configuration file: read rights for all, write rights only for the user and group. If the permissions are any wider, the Connection Broker will not start.
Expected permissions for the user configuration file: only the user has read and write rights. If the permissions are any wider, the Connection Broker will not start.
Expected permissions for the private key files: only the user has read and write rights. If the permissions are any wider, keys that do not pass the check will be ignored.
- protocol-parameters
This element contains protocol-specific values that can be used to tune the performance. It should be used only in very specific environments. In normal situations the default values should be used.
threadsattribute can be used to define the number of threads the protocol library uses (fast path dispatcher threads). This attribute can be used to allow more concurrent cryptographic transforms in the protocol on systems with more than four CPUs. If the value is set to zero, the default value is used.
Example of the
<protocol-parameters threads="8" />
- known-hosts
This element can be used to specify locations for storing the host keys of known server hosts, and to define the storage format of the host key files. If no
known-hostsdirectories are specified, the known host keys are stored to the default directories. See the section called "Files" for the default locations. On z/OS (only), this element can contain
This element can be used:
To specify non-default directories that contain the public-key data or public-key files of known server hosts.
To specify a non-default location for OpenSSH-style known_hosts files that contain the public-key data of known server hosts.
(On z/OS) To specify a SAF key store that contains the certificates of known server hosts.
The server host keys are searched in the
known-hostspaths in the order they are specified in the configuration. The settings of the last defined
known-hostselement are used when storing new host keys.
If you define any
known-hostsfile settings, the default OpenSSH files will be overridden. So if you wish to make the Connection Broker use both the default OpenSSH locations and other locations specified in the configuration, you need to specify all the locations separately.
You can define several
known-hostselements, and each of them can contain one or several attributes:
pathattribute requires a full path to the known-hosts file or directory as the value. For example:
<known-hosts path="/u/username/.ssh/known_hosts" /> <known-hosts path="/etc/ssh2/hostkeys" /> <known-hosts path="/u/username/.ssh2/hostkeys" /> <known-hosts path="/h/username/hostkeys" filename-format="plain" />
directoryattribute is used to define that known host keys are saved to a non-default directory. Enter the complete path to the directory as the value. If the defined directory does not exist, it will be created during the first connection attempt. If a file is found in its place, the connection will be made but the host key will not be stored, and the user gets a warning about it. The
filename-formatattribute can be used together with the
directorysetting to define in which format the host key files will be stored. Example of the
<known-hosts directory="<path_to_dir>/MyKEYS" filename-format="plain" />
directory(whichever is present) defined in the last
known-hostselement in the configuration file will be used when storing new known host keys. If both attributes are present in the last
known-hostselement, the location specified in the
directoryattribute will be used.
fileattribute is used to point to an OpenSSH-style known_hosts file. Enter the complete path to the file as the value. If a directory is found in its place, it is considered an error, and the connection attempt will fail. In case the
known-hostselement only contains the
fileattribute, and the defined OpenSSH known_hosts file exists, the received host keys are searched first in the defined file, and if not found there, the search continues in the default Tectia-specific locations.
Example of the
<known-hosts file="<path_to_file>/.ssh2/openSSH_keys" />
An empty
pathattribute will disable the handling of the OpenSSH known_hosts file:
<known-hosts file="" /> or <known-hosts path="" />
filename-formatattribute defines the format in which new host key files are stored. The
filename-formatattribute is only relevant for the last specified
known-hostselement and for the default directory.
filename-formatattribute takes the values:
plain, and
default(equals to hash).
With value
hash, the host key files will be stored in format:
keys_<hash>, for example "
With value
plain, the file name format will be
key_<port>_<hostname>.pub, where
<port>is the port the Secure Shell server is running on and
<hostname>is the host name you use when connecting to the server; for example "
<known-hosts filename-format="plain" />changes the storage format of host key files for the next
known-hostselements or for the default storage location if no other
known-hostselements are present.
filename-format="default"alternative can be used as the last option when the same
known-hostselement is used to define several locations for the host keys some of which store the keys in plain format.
For more information on the host key storage formats, see Host Key Storage Formats.
- extended
This element is reserved for future use.
Key Store Configuration Examples
Example with Software Provider
The software provider handles key pairs stored on disk in standard Secure Shell v2 or legacy OpenSSH formats and X.509 certificates stored in native X.509, PKCS #7, and PKCS #12 formats.
To add a single key file (for example,
/u/exa/keys/enigma and
/etc/my_key), specify both the private key file and the public key file:
<key-stores> <key-store type="software" init="key_files(/u/exa/keys/enigma.pub,/u/exa/keys/enigma)" /> <key-store type="software" init="key_files(/etc/my_key.pub,/etc/my_key)" /> </key-stores>
To add all keys from a specific directory (for example all keys from
/u/exa/keys and
<key-stores> <key-store type="software" init="directory(path(/u/exa/keys))" /> <key-store type="software" init="directory(path(/etc/keys))" /> </key-stores>
Example with PKCS #11 Provider
The PKCS #11 provider handles keys and certificates stored in PKCS #11 tokens (for example, smart cards or USB tokens).
Specify the dynamic library path for the PKCS provider and all or a specific slot. For example, with all slots:
<key-stores> <key-store type="pkcs11" init="dll(/usr/lib/pkcs.so),slots(all)" /> </key-stores>
For example, with one slot named
<key-stores> <key-store type="pkcs11" init="dll(/usr/local/lib/pkcs.so),slots(sesam)" /> </key-stores>
default-settings Element
default-settings element defines the default connection-related settings. Profile-specific settings can override these settings. See the section called "The
profiles Element".
default-settings element can contain zero or one instance of the following elements in the listed order:
checksum, and
The default-settings element can take one attribute:
user attribute can be used to define a default user name to be used when connecting to remote servers. The value of the
user attribute can be one of the following:
A generic user name that will be used in connections unless another user name is specified in the connection profile settings or in the connection attempt. Note that the user name is treated case sensitively.
%USERNAME%" can be used to apply the user name of the currently logged in user.
In case this option is used but left empty, the Connection Broker will prompt the user for a user name.
The default-settings element can contain the following elements:
- ciphers
This element defines the ciphers that the client will propose to the server. The
cipherselement can contain multiple
The ciphers are tried in the order they are specified.
- cipher
This element selects a cipher
namethat the client requests for data encryption.
The supported ciphers are:
none(no encryption)
The default ciphers used by the Connection Broker are, in order:
email@example.com(on Windows and Linux x86),
The ciphers that can operate in the FIPS mode are
aes256-cbc, and
<ciphers> <cipher name="aes128-cbc" /> <cipher name="3des-cbc" /> </ciphers>
- macs
This element defines the MACs that the client will propose to the server. The
macselement can contain multiple
The MACs are tried in the order they are specified.
- mac
This element selects a MAC
namethat the client requests for data integrity verification.
The supported MAC algorithms are:
none(no data integrity verification)
The default MACs used by the Connection Broker are, in order:
firstname.lastname@example.com(on Windows and Linux x86)
All the supported HMAC-SHA (both HMAC-SHA1 and HMAC-SHA2) algorithm variants can operate in the FIPS mode.
<macs> <mac name="hmac-sha1" /> </macs>
- kexs
This element defines the key exchange methods (KEXs) that the client will propose to the server. The
kexselement can contain multiple
The KEXs are tried in the order they are specified.
- kex
This element selects a KEX
namethat the client requests for the key exchange method.
The supported KEX methods are:
The default KEX methods used by the Connection Broker are, in order:
All the supported KEXs can operate in the FIPS mode on Linux, Windows, Solaris and HP-UX Itanium. However, the following supported KEXs cannot operate in the FIPS mode on HP-UX PA-RISC and IBM AIX due to issues in the OpenSSL cryptographic library version 0.9.8:
For more information on the FIPS-Certified Cryptographic Library, see FIPS-Certified Cryptographic Library.
<kexs> <kex name="diffie-hellman-group14-sha1" /> <kex name="email@example.com" /> </kexs>
- hostkey-algorithms
This element defines the host key signature algorithms used for server authentication. The algorithms that will be used are those that are defined in both Tectia Server and Connection Broker configuration files. This way the use of only certain algorithms, such as SHA-2, can be enforced by the server. The
hostkey-algorithmselement can contain multiple
The hostkey algorithms are tried in the order they are specified. Exception: If a host key of a server already exists in the host key store of the client, its algorithm is preferred.
- hostkey-algorithm
This element selects a host key signature algorithm
nameto be used in server authentication with host keys or certificates.
The supported host key signature algorithms are:
The default host key signature algorithms used by the Connection Broker are, in order:
<hostkey-algorithms> <hostkey-algorithm name="email@example.com" /> <hostkey-algorithm name="email@example.com" /> </hostkey-algorithms>
- rekey
This element specifies the number of transferred
bytesafter which the key exchange is done again. The value
"0"turns rekey requests off. This does not prevent the server from requesting rekeys, however. The default is 1000000000 (1 GB).
<rekey bytes="1000000000" />
- authentication-methods
This element specifies the authentication methods that are requested by the client-side components. The
authentication-methodselement can contain one of each:
auth-gssapi, and
auth-keyboard-interactive. Alternatively, you can specify multiple
authentication-methodelements. The order of these elements is free.
The authentication methods are tried in the order the
authentication-methodelements are listed. This means that the least interactive methods should be placed first.
When several interactive authentication methods are defined as allowed, Tectia Client will alternate between the methods and offers each of them in turn to the server in case the previous method failed.
- authentication-method
This element specifies an authentication method
name. It is included for backwards compatibility. Use the
auth-*elements instead.
The allowed authentication method names are:
password, and
Tectia Client supports host-based authentication only on Unix platforms.
<authentication-methods> <authentication-method name="hostbased" /> <authentication-method name="gssapi-with-mic" /> <authentication-method name="publickey" /> <authentication-method name="keyboard-interactive" /> <authentication-method name="password" /> </authentication-methods>
- auth-hostbased
This element specifies that host-based authentication will be used.
auth-hostbasedelement can include a
- local-hostname
This element specifies the local host name, as the value of the
nameattribute, that is advertised to the remote server during host-based authentication.
The remote server can use the client host name as a hint when locating the public key for the client host. This information is not significant to the authentication result, but makes it faster to find the relevant client host key, if the server has such a big storage of host identities, that trying them all would be infeasible.
- auth-password
This element specifies that password authentication will be used.
- auth-publickey
This element specifies that public-key authentication will be used.
auth-publickeyelement can include a
auth-publickeyelement can include a
signature-algorithmsattribute. The attribute defines the public-key signature algorithms used for client authentication, given as a comma-separated list. The algorithms that will be used are those that are defined in both Tectia Server and Connection Broker configuration files. This way the use of only certain algorithms, such as SHA-2, can be enforced. For a list of the supported algorithms, see hostkey-algorithm.
<authentication-methods> <auth-publickey signature-algorithms="ssh-dss,firstname.lastname@example.com"/> </authentication-methods>
- key-selection
This element specifies the key selection policy the client uses when proposing user public keys to the server. The
policyattribute can take the values
automatic(default) and
In the
automaticmode, the client tries keys in the following order:
Keys with public key available and private key without a passphrase (no user interaction)
Keys with public key available but private key behind a passphrase (one passphrase query)
Keys that need a passphrase to get the public key but private key without passphrase (one user query for each key which is considered and proposed to server, but no user interaction for actual public-key login)
The rest of the keys, that is, keys that need a passphrase to get the public key and also to get the private key
In the
interactive-shymode, the client does not try any keys automatically, but it prompts the user to select the key from a list of available keys. If the authentication with the selected key fails, the client will prompt the user again, removing the already tried key(s) from the list. If there is only one key candidate available, the key will be tried automatically without asking the user.
key-selectionelement can include the
- public-key
This element can be used to specify that only plain public keys or only certificates are tried during public-key authentication. The
typeattribute can take the values
certificate. The default is to try both plain public keys and certificates.
- issuer-name
This element can be used to filter the user certificates that will be included in the list presented to the user. The client-side user certificates can be filtered according to the issuer name that is compared to the certificate issuers requested or accepted by the server. The
match-server-certificateattribute takes values
no. With value
yes, Connection Broker tries matching the user certificate issuer name to the server certificate issuer name. Option
nomeans that the issuer names are not used as a filter. By default, the filtering is not done.
issuer-nameis useful when a user has several certificates with different access rights to the same server, for example for a testing role and for an administrator role. The Connection Broker chooses the relevant certificates that are applicable on the remote host, and the user can choose the correct certificate from the short-listed ones.
- auth-keyboard-interactive
This element specifies that keyboard-interactive methods will be used in authentication.
- auth-gssapi
This element specifies that GSSAPI will be used in authentication.
auth-gssapielement can take the following attributes:
dll-pathattribute specifies where the necessary GSSAPI libraries are located. If this attribute is not specified, the libraries are searched for in a number of common locations. The full path to the libraries should be given, for example,
On AIX, the
dll-pathshould include the archive file, if applicable, for example,
"<path>/libgssapi_krb5.a(libgssapi_krb5.a.so)". The
archive(shared_object)syntax is not necessary if the library is a shared object or has been extracted from the shared object.
On Windows, the
dll-pathattribute is ignored. Tectia Client locates the correct DLL automatically.
allow-ticket-forwardingattribute defines whether Tectia Client allows forwarding the Kerberos ticket over several connections. The attribute can have a value of
no. The default is
An example of authentication-methods configuration is shown below:
<authentication-methods> <auth-hostbased> <local-hostname name="host.example.com" /> </auth-hostbased> <auth-gssapi allow-ticket-forwarding="yes"/> <auth-publickey> <key-selection policy="interactive-shy"> <public-key type="plain" /> </key-selection> </auth-publickey> <auth-keyboard-interactive /> <auth-password> <password file="/path/filename" /> </auth-password> </authentication-methods>
- hostbased-default-domain
This element specifies the host's default domain name (as
name). This element is used to make sure the fully qualified domain name (FQDN) of the client host is transmitted to the server when using host-based user authentication.
The default domain name is appended to the short host name before transmitting it to the server. This is needed because some platforms (Solaris for instance) use the short format of the host name, and with that the signature cannot be created.
The allowed formats of the default domain names are:
example.com(without the leading dot). For example:
<hostbased-default-domain name=".example.com" />
- compression
This element specifies whether the client sends the data compressed (PUT operation). When activated, compression is applied on-the-fly to all data sent out through the connection and on all channels in it.
The name of the compression algorithm and the compression level can be given as attributes. The
nameattribute can be defined as
none(compression not used) or
zlib, currently the only supported algorithm. By default, compression is not used.
For zlib compression, the
levelattribute can be given an integer from
9. The default compression level is
6, when compression is activated but no level is given (or level is set to
Example: to activate maximum level compression of sent data, make the following setting:
<compression name="zlib" level="9" />
Compression can also be activated per connection with command line tools. For information, see the sshg3(1), sftpg3(1) and scpg3(1) man pages.
Note that this
compressionsetting does not affect received data (GET operations), but their compression is defined on the Secure Shell server. Tectia Server always uses compression level 6.
- proxy
This element defines rules for HTTP proxy or SOCKS servers the client will use for connections. It has a single attribute:
The format of the attribute value is a sequence of rules delimited by semicolons (
;). Each rule has a format that resembles the URL format. In a rule, the connection type is given first. The type can be
socks5, or
socksis a synonym for
socks4). This is followed by the server address and port. If the port is not given, the default ports are used: 1080 for SOCKS and 80 for HTTP.
After the address, zero or more conditions delimited by commas (
,) are given. The conditions can specify IP addresses or DNS names.
direct:///[cond[,cond]...]; socks://server/[cond[,cond]...]; socks4://server/[cond[,cond]...]; socks5://server/[cond[,cond]...]; http-connect://server/[cond[,cond]...]
The IP address/port conditions have an address pattern and an optional port range:
ip_patternmay have one of the following forms:
a single IP address
an IP address range of the form
an IP sub-network mask of the form
The DNS name conditions consist of a host name which may be a regular expression containing the characters "*" and "?" and a port range:
An example
proxyelement is shown below. It causes the server to access the loopback address and the
ssh.comdomain directly, access
*.examplewith HTTP CONNECT, and all other destinations with SOCKS4.
<proxy ruleset="direct:///127.0.0.0/8,*.ssh.com; http-connect://http-proxy.ssh.com:8080/*.example; socks://fw.ssh.com:1080/" />
- idle-timeout
This element specifies how long idle time (after all connection channels are closed) is allowed for a connection before automatically closing the connection. The
timeis given in seconds. The
typeis always
The default setting is 5 seconds. Setting a longer time allows the connection to the server to remain open even after a session (for example, sshg3) is closed. During this time, a new session to the server can be initiated without re-authentication. Setting the time to 0 (zero) terminates the connection immediately when the last channel to the server is closed.
<idle-timeout time="5" />
- tcp-connect-timeout
This element specifies a timeout for the TCP connection. When this setting is made, connection attempts to a Secure Shell server are stopped after the defined time if the remote host is down or unreachable. This timeout overrides the default system TCP timeout, and this timeout setting can be overridden by defining a
tcp-connect-timeoutsetting per connection profile (in the
profilessettings) or per connection (on command line).
timeis given in seconds. The factory default is 5 seconds. Value 0 (zero) disables this feature and the default system TCP timeout will be used.
<tcp-connect-timeout time="5" />
- keepalive-interval
This element specifies an interval for sending keepalive messages to the Secure Shell server. The
timevalue is given in seconds. The default setting is 0, meaning that the keepalive messages are disabled.
<keepalive-interval time="0" />
- exclusive-connection
exclusive-connectionelement can be used to specify that a new connection is opened for each new channel. This setting takes one attribute
enable, with value
no. The default is
no, meaning that open connections are reused for new channels requested by a client.
- server-banners
This element defines whether the server banner message file (if it exists) is visible to the user before login. The word
nois given as the value of the
visibleattribute. The default is
To eliminate server banners:
<server-banners visible="no" />
- forwards
This element contains
forwardelements that define whether X11 or agent forwarding (tunneling) are allowed on the client side.
An example forward configuration, which denies X11 forwarding and allows agent forwarding globally, is shown below:
<forwards> <forward type="x11" state="denied" /> <forward type="agent" state="on" /> </forwards>
For more information on using X11 and agent forwarding, see X11 Forwarding and Agent Forwarding.
- extended
This element is reserved for future use.
- remote-environment
This element contains
environmentelements which define the environment variables to be passed to the server from the client side. The environment variables are then set on the server when requesting a command, shell or subsystem.
Note that the server can restrict the setting of environment variables.
- environment
This element defines the name and value of the environment variables, and whether the Connection Broker should process the value. Possible attributes are
value, and
An example remote environment configuration:
<remote-environment> <environment name="FOO" value="bar" /> <environment name="QUX" value="%Ubaz" format="yes" /> <environment name="ZAPPA" value="%Ubaz" /> </remote-environment>
You can use
%Uin the
valueto indicate a user name. When
format="yes"is also defined, the Connection Broker processes the
%Uinto the actual user name before sending it to the server.
Let's assume the user name is
joedoein this example. The example configuration results in the following environment variables on the server side, provided that the server allows setting the environment variables:
FOO=bar QUX=joedoebaz ZAPPA=%Ubaz
You can override the remote environment settings made in the configuration file if you use the sshg3 command with the following arguments on the command-line client:
For information on the command-line options, see sshg3(1).
- server-authentication-methods
server-authentication-methodselement can be used to force the Connection Broker to use only certain methods in server authentication. This element can contain
auth-server-certificateelements (one of each). The order of these elements is free.
If only
auth-server-certificateis specified, server certificate is needed. If no server certificate is received, connection fails.
If only
auth-server-publickeyis specified, (plain) server public key is needed. If no server public key is received, connection fails.
If both
auth-server-publickeyare specified, server certificate is used if present. Otherwise server public key is used.
- auth-server-certificate
auth-server-certificateelement specifies that certificates are used for server authentication.
- auth-server-publickey
auth-server-publickeyelement specifies that public host keys are used for server authentication.
The host key policy settings have changed in version 6.1.4 and are now defined in the
The element takes attribute
policythat defines how unknown server host keys are handled. It can have the following values:
strict: Connect to the server only if the host key is found from the host key store and matches.
If the policy is set to
strict, the Connection Broker never adds host keys to the user's
.ssh2/hostkeysdirectory upon connection, and refuses to connect to hosts whose key has changed. This provides maximum protection against man-in-the-middle attacks. However, it also means you must always obtain host keys via out-of-band means, which can be troublesome if you frequently connect to new hosts.
ask(default): If the server host key is not found from the host key store, the user will be asked if he wants to accept the host key. If the host key has changed, the user is warned about it and asked how to proceed. If the client application is not able to ask the user (for example, sftpg3 in batch mode,
-B), the connection will be disconnected.
tofu: If the server host key is not found, it is stored to the user's
.ssh2/hostkeysdirectory. If the host key has changed, the connection will be disconnected.
advisory: Use of this setting effectively disables server authentication, which makes the connection vulnerable to active attackers.
If the server host key is not found in the host key store, it will be added to the user's
.ssh2/hostkeysdirectory without user interaction. If the host key has changed, the connection will be continued without user interaction. The incident will be audited if logging is enabled.
When the policy is set to
advisory, the keys from new hosts are automatically accepted and stored to the host key database without prompting acceptance from the user. However, changed host keys (from hosts whose keys are already in the database) are not stored, but they are accepted for that connection only.
This setting should be used only if logging is enabled for the Connection Broker.
Consider carefully before setting the policy to
advisory. Disabling the host-key checks makes you vulnerable to man-in-the-middle attacks.
In policy modes other than
strict, if logging is enabled for the Connection Broker, Tectia Client will log information about changed and new host public keys with their fingerprints in the syslog (on Unix) or Event Viewer (on Windows).
When FTP-SFTP conversion is used, accepting the host key cannot be prompted from the user. Either the policy must be set to
tofuor the host keys of the Secure Shell tunneling and SFTP servers must be obtained beforehand and stored based on the IP addresses of the servers.
If the
policyattribute is not defined, the host key policy is interpreted based on the values of the old
host-key-always-ask, and
accept-unknown-host-keysoptions as shown in Table A.2 below.
In version 6.1.4 and later, the host key policy setting in the user-specific configuration file always takes precedence over the setting in the global configuration file.
Table A.2. Interpretation of old host key policy (Tectia Client 5.0.0-6.1.3) to new host key policy (Tectia Client 6.1.4 and later)
strict-host-key-checking accept-unknown-host-keys host-key-always-ask Policy - - - ask (default) enabled - - strict enabled enabled - strict enabled enabled enabled ask enabled - enabled ask - enabled - trust on first use - enabled enabled ask - - enabled ask
- authentication-method
server-authentication-methods/authentication-methodelement specifies an authentication method
name. This element is included for backwards compatibility. Use the
auth-server-*elements instead.
<server-authentication-methods> <authentication-method name="publickey" /> <authentication-method name="certificate" /> </server-authentication-methods>
An example
server-authentication-methodselement is shown below:
<server-authentication-methods> <auth-server-publickey policy="ask" /> <auth-server-certificate /> </server-authentication-methods>
- authentication-success-message
This setting defines whether the
AuthenticationSuccessMsgmessages are output. The
authentication-success-messageelement takes attribute
enablewith value
no. The default is
yes, meaning that the messages are output and logged.
- sftpg3-mode
This setting defines how the sftpg3 client behaves when transferring files. The
sftpg3-modeelement takes attribute
compatibility-modewith the following values:
tectia(the default) - sftpg3 fransfers files recursively, meaning that files from the current directory and all its subdirectories are transferred.
ftp- the get/put commands are executed as sget/sput meaning that they transfer a single file; and commands mget/mput have recursion depth set to 1 meaning that they only transfer files from the specified directory, not from subdirectories.
openssh- commands get/put/mget/mput behave alike, and the recursion depth is set to 1, meaning that only files from the specified directory are transferred, not from subdirectories.
The recursion depth can be overridden by using the sftpg3 client's commands get/put/mget/mput with command-line option
--max-depth="LEVEL". For more information, see sftpg3(1).
- terminal-selection
This element defines how the Tectia terminal behaves when the user selects text with double-clicks. The element takes one attribute:
selection-type, whose value can be:
select-words- double-clicking selects one word at a time, space and all punctuation characters are used as delimiters. This is the default.
select-paths- selects strings of characters between spaces, meaning a selection is extended over characters
\/.-_, so that for example a path to a file can be selected by double-clicking anywhere in the path.
- terminal-bell
This element defines whether Tectia terminal repeats audible notifications from the destination server. This option is only applied to connections with Unix servers. The element takes one attribute,
bell-style, whose value can be:
none- no audible notifications are used
pc-speaker- the user's PC speakers beep when an audible notification is indicated by the destination server
system-default- the Tectia terminal sounds the default alerts defined in the system on the destination server. This is the default.
- close-window-on-disconnect
This element defines that also the Tectia terminal window is to be closed while disconnecting from a server session by pressing CTRL+D. The element takes one attribute,
enable, whose value can be
no. The default is
nomeaning that CTRL+D closes only the server connection but the Tectia terminal window remains open.
- quiet-mode
This setting defines whether the command line clients should suppress warnings, error messages and authentication success messages. The
quiet-modeelement takes attribute
enablewith value
no. The default is
no, meaning that the errors and messages are output and logged.
quiet-modeelement affects command line tools scpg3, sshg3, and sftpg3. Enabling the quiet mode here with setting
quiet-mode enable="yes"is the same as running these clients with option
-q. Note that the
-qcommand line parameter will take priority over the
quiet-modeelement set in this configuration file.
- checksum
checksumelement can be used to define a default setting for comparing checksums. This default overwrites the factory setting that checksums are not checked for files smaller than 32kB.
checksumelement takes attribute
type, whose value can be:
yes|YES- MD5 checksums are checked on files larger than 32kB. This is the default value.
no|NO- checksums are not used.
md5|MD5- only MD5 checksums are checked on files larger than 32kB. When the
--fipsparameter is set with the command line clients scpg3 and sftpg3, this hash is not used.
sha1|SHA1- only SHA1 checksums are checked on files larger than 32kB. When the
--fipsparameter is set with the command line clients scpg3 and sftpg3, this hash is used.
md5-force|MD5-FORCE- MD5 checksums are forced, except when the
--fipsparameter is set with the command line tools scpg3 and sftpg3.
sha1-force|SHA1-FORCE- SHA1 checksums are forced on all files.
checkpoint|CHECKPOINT- checkpointing is forced on large files that are transferred one by one.
If the Connection Broker is started in FIPS mode and the
md5attribute is defined in the configuration file, but scpg3 or sftpg3 are not started with the
--fipsparameter, then
md5is used.
Note that checksums can also be defined with the command line clients scpg3 and sftpg3, or with environment variables. The order of priority of the three checksum settings (in case they are different) is as follows, the later one always overwrites the previous value:
checksumsetting in the configuration file
SSH_SFTP_CHECKSUM_MODEenvironment variable
Command line arguments
- address-family
address-familyelement defines the IP address family. Give the address family as the value of the
typeattribute. Tectia Client will operate using IPv4 (
inet) addressing, IPv6 (
inet6), or both (
any). The default value for
profiles Element
profiles element defines the connection profiles for connecting to the specified servers. Element
profiles can contain multiple
profile elements. Each profile defines the connection rules to one server. The settings in the
profile element override the default connection settings.
When a profile is used for the connection, the settings in the profile override the default settings. See the section called "The
default-settings Element".
- profile
profileelement defines a connection profile. It has the following attributes:
user, and
The profile
idmust be a unique identifier that does not change during the lifetime of the profile.
An additional
namecan be given to the profile. This is a free-form text string. The name can be used for connecting with the profile on the command line, so define a unique name for each profile.
hostattribute defines the address of the Secure Shell server host and it is a mandatory setting. The address can be either an IP address or a domain name. The value
host="*"can be used to prompt the user to enter the host address when starting the session.
portis a mandatory setting. It defines the port number of the Secure Shell server listener. The default port is
protocolis a mandatory setting. It defines the used communications protocol. Currently the only allowed value is
If you want to make the connection specified by the profile automatically when the Connection Broker is started, set the value of the
connect-on-startupattribute to
yes. In this case, give also the
userattribute (the user name the connection is made with). You also need to set up some form of non-interactive authentication for the connection.
host-typeattribute sets the server type for ASCII (text) file transfer. This specifies the line break convention that is used for ASCII files. The default value is
default, meaning that the line break convention is determined by the local platform. If the client is running on Windows, Windows compatible line breaks (CR + LF,
'\r\n') are used. If the client is running on any other platform, Unix compatible line breaks (LF,
'\n') are used. Other possible values for
windows(for Windows remote host) and
unix(for Unix remote host). Define the value if you are using any other server than Tectia Server.
userattribute specifies the user name for opening the connection. The value "
%USERNAME%" can be used to apply the user name of the currently logged in user. The value
user="*"can be used to prompt the user to enter the user name when logging in. When the
userattribute is not defined, the user name defined in the default connection settings will be used.
gateway-profileattribute can be used to create nested tunnels. The tunnels defined under the
local-tunnelelement of the profile, and the tunnels defined under
static-tunnelsthat refer to the profile can be nested. The profile name through which the connection is made is given as the value of the attribute. The first tunnel is created using the gateway host profile and from there the second tunnel is created to the host defined in this profile.
- hostkey
This element gives the path to the remote server host public key file as a value of the
Alternatively, the public key can be included as a base64-encoded ASCII block.
- ciphers
This element defines the ciphers used with this profile. See ciphers for details.
- macs
This element defines the MACs used with this profile. See macs for details.
- kexs
This element defines the KEXs used with this profile. See kexs for details.
- hostkey-algorithms
This element defines the hostkey signature algorithms used with this profile. See hostkey-algorithms for details.
- rekey
This element defines the rekeying settings used with this profile. See rekey for details.
- authentication-methods
This element defines the authentication methods used with this profile. See authentication-methods for details.
- user-identities
This element specifies the identities used in user public-key authentication. In contrast to the
key-storeselement that specifies all the keys that are available for the Connection Broker, this element can be used to control the keys that are attempted in authentication when this connection profile is used and to specify the order in which they are attempted.
user-identitieselement can contain multiple
identityelements. When multiple
identityelements are used, they are tried out in the order they are listed.
- identity
identityelement has the following attributes:
id, and
identity-fileattribute specifies that the user identity is read in the identification file used with public-key authentication. Enter the full path to the file if it is located somewhere else than the default identification file directory which is
$HOME/.ssh2. See also ssh-broker-g3(1).
fileattribute specifies the path to the public-key file (primarily) or to a certificate. Enter the full path and file name as the value.
hashattribute is used to enter the hash of the public key that will be used to identify the related private key. The key must be available for the Connection Broker The public key hashes of the available keys can be listed with the ssh-broker-ctl tool. See also ssh-broker-ctl(1).
idattribute is reserved for future use.
dataattribute is reserved for future use.
An example
user-identitieselement is shown below:
<user-identities> <identity identity-file="C:\\ mykey" /> <identity file="$HOME/user/.ssh2/id_rsa_2048_a" /> <identity file="C:\\private_keys\id_rsa_2048_a" /> <identity hash="#a8edd3845005931aaa658b5573609e7d31e23afd" /> </user-identities>
- compression
This element defines the compression settings used with this profile. See compression for details.
- proxy
This element defines the HTTP proxy and SOCKS server settings used with this profile. See proxy for details.
gateway-profilehas been defined for this profile, the proxy setting is ignored and the default proxy setting or the proxy setting of the gateway profile is used instead.
- idle-timeout
This element defines the idle timeout settings used with this profile. See idle-timeout for details.
- tcp-connect-timeout
This element defines the TCP connection timeout for this profile. The timeout is used to terminate connection attempts to Secure Shell servers that are down or unreachable. The default value is 5 seconds. See tcp-connect-timeout for details.
- keepalive-interval
This element defines an interval for sending keepalive messages to the Secure Shell server. The setting applies to this profile. The default value is 0, meaning that no keepalive messages are sent. See keepalive-interval for details.
- exclusive-connection
This element defines whether a new connection is opened for each new channel when a connection is made with this profile. This setting takes one attribute
enable, with value
no. The default is
no, meaning that open connections are reused for new channels requested by a client. See also exclusive-connection.
- server-banners
This element defines the server banner setting used with this profile. See server-banners for details.
- forwards
This element defines the forwards allowed with this profile. See forwards for details.
- tunnels
tunnelselement defines the tunnels that are opened when a connection with this profile is made. The element can contain multiple
- local-tunnel
This element defines a local tunnel (port forwarding) that is opened automatically when a connection is made with the connection profile. It has five attributes:
dst-port, and
typeattribute defines the type of the tunnel. This can be
tcp(default, no special processing),
ftp(temporary forwarding is created for FTP data channels, effectively securing the whole FTP session), or
socks(Tectia Client will act as a SOCKS server for other applications, creating forwards as requested by the SOCKS transaction).
listen-portattribute defines the listener port number on the local client.
listen-addressattribute can be used to define which network interfaces on the client should be listened. Its value can be an IP address belonging to an interface on the local host. Value
0.0.0.0listens to all interfaces. The default is
127.0.0.1(localhost loopback address on the client). Setting any other value requires setting
inet6, the default listen address is
::1. To listen on all interfaces, specify
::. For
any, the listen address is both
::1by default; to listen on all interfaces, specify
Whenever a connection is made to the specified listener, the connection is tunneled over Secure Shell to the remote server and another connection is made from the server to a specified destination host and port (
dst-port). The connection from the server onwards will not be secure, it is a normal TCP connection.
dst-portattributes define the destination host address and port. The value of
dst-hostcan be either an IP address or a domain name. The default is
127.0.0.1(localhost = server host).
allow-relayattribute defines whether connections to the listened port are allowed from outside the client host. The default is
no. If you use
allow-relay="yes", it will check also the
For more information on using local tunnels, see Local Tunnels.
- remote-tunnel
This element defines a remote tunnel (port forwarding) that is opened automatically when a connection is made with the connection profile. It has four attributes:
dst-port, and
typeattribute defines the type of the tunnel. This can be either
tcp(default, no special processing) or
ftp(temporary forwarding is created for FTP data channels, effectively securing the FTP session between the client and server).
listen-portattribute defines the listener port number on the remote server.
listen-addressattribute can be used to define which network interfaces on the server should be listened. Its value can be an IP address belonging to an interface on the server host. Value
0.0.0.0listens to all interfaces. The default is
127.0.0.1(localhost loopback address on the server). Setting any other value requires that
inet6, the default listen address is
::1. To listen on all interfaces, specify
::. For
any, the listen address is both
::1by default; to listen on all interfaces, specify
Whenever a connection is made to this listener, the connection is tunneled over Secure Shell to the local client and another connection is made from the client to a specified destination host and port (
dst-port). The connection from the client onwards will not be secure, it is a normal TCP connection.
dst-portattributes define the destination host address and port. The value of
dst-hostcan be either an IP address or a domain name. The default is
127.0.0.1(localhost = client host).
allow-relayattribute defines whether connections to the listener port are allowed from outside the server host. The default is
For more information on using remote tunnels, see Remote Tunnels.
- extended
This element is reserved for future use.
- remote-environment
This element defines the remote environment settings used with this profile. Within the
remote-environmentelement, define an
environmentelement for each environment variable to be passed to the server. See remote-environment for details.
- server-authentication-methods
This element defines the server authentication methods allowed with this profile. See server-authentication-methods for details.
- password
This element can be used to specify a user password that the client will send as a response to password authentication.
The password can be given directly in the
stringattribute, or a path to a file containing the password can be given in the
fileattribute, or a path to a program or a script that outputs the password can be given in the
When using the
commandoption to refer to a shell script, make sure the script also defines the user's shell, and outputs the actual password. Otherwise the executed program fails, because it does not know what shell to use for the shell script. For example, if the password string is defined in a file named
my_password.txt, and you want to use the bash shell, include these lines in the script:
#!/usr/bash cat /full/pathname/to/my_password.txt
If the password is given using this option, it is extremely important that the
ssh-broker-config.xmlfile, the password file, or the program are not accessible by anyone else than the intended user.
Any password given with the command-line options will override this setting.
An example connection profile is shown below:
<profile name="rock" id="id1" host="rock.example.com" port="22" connect-on-startup="no" user="doct"> <hostkey file="key_22_rock.pub"> </hostkey> <authentication-methods> <auth-publickey /> <auth-password /> </authentication-methods> <server-authentication-methods> <auth-server-publickey policy="strict" /> </server-authentication-methods> <server-banners visible="yes" /> <forwards> <forward type="agent" state="on" /> <forward type="x11" state="on" /> </forwards> <tunnels> <local-tunnel type="tcp" listen-port="143" dst-host="imap.example.com" dst-port="143" allow-relay="no" /> </tunnels> <remote-environment> <environment name="FOO" value="bar" /> <environment name="QUX" value="%Ubaz" format="yes" /> <environment name="ZAPPA" value="%Ubaz" /> </remote-environment> </profile>
static-tunnels Element
static-tunnels setting is used to configure the behavior of the automatic tunnels. You can create listeners for local tunnels automatically when the Connection Broker starts up. The actual tunnel is formed the first time a connection is made to the listener port. If the connection to the server is not open at that time, it will be opened automatically as well.
static-tunnels element can contain any number of
tunnel elements.
- tunnel
tunnelelement specifies a static tunnel. It has the following attributes:
allow-relay, and
typeattribute defines the type of the tunnel. This can be either
tcpspecifies a listener for generic TCP tunneling
ftpspecifies a listener for FTP tunneling (also the FTP data channels are tunneled)
listen-portattribute defines the listener port number on the local client.
listen-addressattribute can be used to define which network interfaces on the client should be listened. Its value can be an IP address belonging to an interface on the local host. Value
0.0.0.0listens to all interfaces. The default is
127.0.0.1(localhost loopback address on the client). Setting any other value requires that
inet6, the default listen address is
::1. To listen on all interfaces, specify
::. For
any, the listen address is both
::1by default; to listen on all interfaces, specify
dst-portattributes define the destination host address and port. The value of
dst-hostcan be either an IP address or a domain name. The default is
127.0.0.1(localhost = server host).
allow-relayattribute defines whether connections to the listened port are allowed from outside the client host. The default is
profileattribute specifies the connection profile ID that is used for the tunnel.
<static-tunnels> <tunnel type="tcp" listen-address="127.0.0.1" listen-port="9000" dst-host="st.example.com" dst-port="9000" allow-relay="no" profile="id1" /> </static-tunnels>
gui Element
gui element is used to adjust the Tectia terminal GUI settings. The
gui element takes the following attributes:
show-exit-button, and
show-admin. All of these must have
yes or
no as the value.
hide-tray-icon attribute controls whether the Tectia icon is displayed in the notification area of the Windows taskbar (also known as the system tray). The default is
no (the tray icon is displayed).
show-exit-button attribute controls whether the Exit command is displayed in the shortcut menu of the Tectia icon. The default is
show-admin attribute defines whether the Configuration command is displayed in the Tectia icon shortcut menu. The default is
yes. If the button is not displayed, the Tectia Connections Configuration GUI can be started by running
ssh-tectia-configuration.exe, located by default in directory "
<INSTALLDIR>\SSH Tectia Broker".
<gui hide-tray-icon="no" show-exit-button="yes" show-admin="yes"
logging Element
logging element changes the logging settings that define the log event severities and logging facilities. The element contains one or more
log-target and
log-events elements.
- log-target
This element specifies the log target for auditing. By default, the broker does not log anything. This element can be used to direct log data to a file or syslog.
log-targetelement can have
typeas attributes.
typeattribute specifies the logging facility where the audit data is output to. The value can be
fileattribute sets the file system path where the audit data is written to. If the
typeattribute has
discardset, the
fileattribute is not allowed.
- log-events
This element sets the severity and facility of different logging events. The events have reasonable default values, which are used if no explicit logging settings are made. This setting allows customizing the default values.
The element can also contain one or more
log-targetelements. When defined here, the
log-targetelement will override the definition given in the
For the events,
severitycan be set as attributes. The events itself should be listed inside the
The facility can be
local7, or
discard. Setting the facility to
discardcauses the server to ignore the specified log events.
On Windows, only the
discardfacilities are used.
The severity can be
security-success, or
Any events that are not specifically defined in the configuration file will use the default values. The defaults can be overridden for all remaining events by giving an empty
log-eventselement after all other definitions and by setting a severity value for it.
In the names of log events, the characters '*' and '?' can be used as wildcards.
For a complete list of log events, see Appendix E.
An example logging configuration that logs all events, which are programmed to be logged by default, both to
/tmp/foo and to
<logging> <log-target file="/tmp/foo" /> <log-target type="syslog" /> </logging>
An example logging configuration in which events are logged to
/tmp/foo, except those whose event name matches "
Key_store_*", which will be discarded.
<logging> <log-target file="/tmp/foo" /> <log-events facility="discard"> Key_store_* </log-events> </logging>


text:
Yolo CountyHome Sitemap Contact
Misdemeanor Offenses
A misdemeanor is a criminal offense for which the maximum punishment is up to one year in county jail and/or a fine. Certain misdemeanors also carry collateral consequences such as a ten year prohibition from owning or possessing firearms. Your attorney will explain potential collateral consequences to you.Typically you will be appointed a Public Defender at your first court appearance.
If you have been charged with a misdemeanor in Yolo County, your case will proceed in the following manner:
Arraignment is your first appearance in court. You will be advised of your charges and asked if you have a private attorney or the funds to hire your own attorney or request the services of the Public Defender. You also have the right to represent yourself, however, in most circumstances this is not a wise decision.
The judge will advise you of the offer from the District Attorney's Office to resolve your case. An offer typically results in you pleading guilty to a less serious offense or to a single offense, and as a result other offenses will be dismissed.
Typically, you must enter a plea at your arraignment. A plea is when you plead "Not Guilty", "Nolo Contendere" (No Contest) or "Guilty." Your attorney can explain the differences to you.
If you enter a plea of not guilty, and you are not in custody, you have the right to have a trial within forty-five days of your arraignment/plea. If it is necessary to continue your case beyond that deadline in order to prepare your case, you may be asked to "waive time." Waiving time is common for those clients who are out of custody as it allows you and your attorney more time to be flexible with your schedules in setting future court dates and appointments. If you agree to waive time, you are not giving up your right to go to trial, just the right to have the trial within forty-five days. If you are in custody, you have a right to go to trial within thirty days of your arraignment/plea.
Pre-Trial Conference
The purpose of the Pre-Trial Conference is simply to determine if a resolution can be reached short of proceeding to trial. After discussing your case with you, your attorney will discuss your case with the District Attorney and the Court to see whether an agreeable resolution can be reached.
Trial Setting Conference
After you have elected to set your matter for a jury trial, your case will proceed for a trial setting conference. At this court appearance the court will set the date for your trial to commence as well as a trial confirmation conference.
Trial Confirmation Conference
The next court appearance is your trial confirmation conference. At this time your attorney will discuss your case to see if it can resolve. If not then they will discuss whether or not both parties are ready for trial.
Jury Trial
This is a court proceeding to determine whether or not the charges against you can be proven. At a jury trial twelve members of the community listen to evidence and decide whether or not the charges have been proven.You are presumed innocent and cannot be found guilty unless the prosecution has proven to the jury that each element of each charge has been proven by proof beyond a reasonable doubt.
If you are are found not guilty your case ends. If you are found guilty then the court will set a further date for judgment and sentencing.
Judgment and Sentencing
If an individual is found guilty at trial or has resolved his or her case short of trial, the court will proceed to judgment and sentencing. Judgment and sentencing is the stage in which the judge imposes the consequence for a law violation.
In a misdemeanor case judgment and sentencing must be held no less than six hours or no more than five calendar days after a verdict, a finding, or a guilty plea. This can be extended in certain circumstances. However, in most instances you may elect to be sentenced just after a guilty verdict is returned and not elect to come back for a further court appearance.
Each offense has its own maximum sentence, your attorney will explain this to you.
Questions or comments?
Email Public Defender's Office
Last Updated: 10/2014

subset: commoncrawl


text:
- Heat the oven to 350°F.
- Brown meat with onions in large skillet. Meanwhile, mix Neufchatel, cottage cheese, 1-1/2 cups mozzarella, 1/4 cup Parmesan and egg until blended.
- Drain meat; return to skillet. Stir in spaghetti sauce, tomatoes and oregano; simmer 5 min. Remove from heat. Spoon 1 cup meat sauce onto bottom of 13x9-inch baking dish; top with layers of 3 lasagna noodles, 1 cup cheese mixture and 1 cup meat sauce. Repeat layers twice. Top with remaining noodles, meat sauce, mozzarella and Parmesan; cover.
- Bake 50 minutes or until heated through, uncovering after 40 min. Let stand 10 min. before cutting to serve.


text:
PRIVACY POLICYAccording to the European data protection act (Art. 13, European Regulation 2016/679) the User acknowledges that BAXTER S.r.l. commits to process the User's personal data according to the principles of propriety, lawfulness and transparency and the protection of confidentiality. Therefore, the User is hereby informed that:A. CATEGORIES OF DATA: The object of the processing may be your personal data like identification data, personal data and contact data.B. DATA CONTROLLER: The data controller is BAXTER S.r.l., VAT number 00913080966, Via Costone 8, 22040 Lurago d'Erba (CO), telephone +39 031.35999, email firstname.lastname@example.com. SOURCE OF PERSONAL DATA: The personal data held by the Data Controller are collected directly from the data subject.D. DATA PROCESSING PURPOSES AND LEGAL BASIS: The processing of your data, collected and stored upon completion of this form, has as its legal basis your consent and is carried out for the following purposes: commercial profiling, statistics, newsletter subscription.E. DATA RECIPIENTS: Within the limits established by the purposes specified for processing, your data may be disclosed to partners, consulting companies and private companies that have been appointed as Data Processors by the Data Controller. Your data will not be disseminated in any way.F. TRANSFER OF DATA ABROAD: the data collected is not transferred to third countries outside the European Community.G. STORAGE PERIOD: The data collected will be kept for a period of time not exceeding what is necessary for the fulfilment of the purposes for which it is processed ("storage limitation principle", art. 5, GDPR) or on the basis of the expiries established by law. The verification of the obsolescence of the data stored in relation to the purposes for which they were collected is carried out periodically.H. RIGHTS OF THE DATA SUBJECT: The data subject is always entitled to request access to his/her data, to correct or erase it, restrict its processing, or the possibility of objecting to its processing, requesting data portability, withdrawing consent to the processing of the data, asserting these and other rights provided by the GDPR, through a simple communication to the Data Controller. The data subject can also lodge a complaint with a supervisory authority.I. MANDATORY NATURE OF CONSENT OR OTHERWISE: We inform you that the provision of data is optional for some fields and required for others (specified by an asterisk), and the lack of required data will make it impossible to perform the requested service.J. METHOD OF DATA PROCESSING: The personal data you provide will be processed in compliance with the aforementioned regulations and the confidentiality obligations adopted by the Data Controller. The data will be processed both with computer tools and on paper and using any other type of suitable support in compliance with security measures pursuant to the GDPR.
(*) Mandatory fields
TO UNSUBSCRIBE, PLEASE WRITE AN E-MAIL TO firstname.lastname@example.com
Vittorio Marrucco - CEO
Massimiliano Travaglini - STORE MANAGER
Ivan Salis - FURNITURE CONSULTANT


text:
After the Bush administration went to war based on charges of WMD programs that were later found to have been nonexistent, you would think there would be a strong demand for a thorough examination of the strategic rationale the next time an administration proposes a new war or a major escalation of an existing one.
Yet there has been no public examination of the Obama administration strategic argument that the United States must do whatever is necessary in Afghanistan to ensure that al Qaeda cannot have a safe haven there. The assumption seems to be that that there is no need to inquire about the soundness of that premise, because al Qaeda planned the 9/11 terrorist attacks from Afghanistan.
But the rationale for U.S. military engagement in Afghanistan that seemed obvious in the aftermath of the 9/11 attacks no longer applies today. Osama bin Laden and the central al Qaeda organization left Afghanistan in late 2001 for Pakistan, where they have now established an even more secure base than they had in Afghanistan, thanks to the strong organization of Islamic militants in the Northwest tribal region of Pakistan. So the real al Qaeda safe haven problem is not about Afghanistan but about Pakistan.
Instead of candidly acknowledging that the al Qaeda safe haven problem is located in Pakistan, however, Barack Obama's first major statement on the war in Afghanistan sought to obscure that problem. Obama said, "[W]e have a clear and focused goal: to disrupt, dismantle, and defeat al Qaeda in Pakistan and Afghanistan, and to prevent their return to either country in the future."
That made it sound like al Qaeda still has a base in Afghanistan. The "White Paper" of his Interagency Policy Group, however, contradicts that formulation. It states the U.S. goal as "to disrupt, dismantle, and defeat al Qaeda and its safe havens in Pakistan, and to prevent their return to Pakistan or Afghanistan." Obama's suggestion that U.S. forces are somehow fighting to defeat al Qaeda in Afghanistan marks the first clear instance of playing fast and loose with the facts in order to increase the very weak public support for the war.
If the real problem is ending an al Qaeda safe haven in Pakistan, then going to war in Afghanistan makes sense only if one assumes that al Qaeda is going to be pushed out Pakistan or in danger of being destroyed there. The real question, therefore, is whether there is any realistic possibility that the Pakistan government can shut down al Qaeda's safe haven.
The honest answer must be that the possibility is vanishingly small -- at least for next generation. A report on Pakistan by a panel of experts headed by John Kerry and Chuck Hagel and published by the Atlantic Council last month provides a detailed analysis that suggests why it is so unlikely. It describes a Pakistani army that is demoralized and lacking a viable strategy for dealing with the burgeoning jihadi movement in the Northwest tribal region which has sheltered al Qaeda. It recalls how Pakistan was on the brink of economic collapse last fall, and was forced by the IMF to accept a crippling austerity plan. And it warns that a military takeover is likely if dramatic steps are not taken in the coming year, and that the military leadership is no better prepared than civilian politicians to cope with the country's problems.
Never Miss a Beat.
Get our best delivered to your inbox.
Pakistan is not even on the U.S. side in its war against al Qaeda and the Taliban, as was confirmed by a report in the The New York Times March 25. Despite previous pledges that ISI, the Pakistani military's intelligence agency, had ended its covert assistance to the Taliban, The Times detaiIs ISI 's continuing provision of "money, military supplies and strategic planning guidance" to Taliban commanders fighting U.S. troops in Afghanistan. Ambassador Richard Holbrooke and CENTCOM chief Gen. David Petraeus conceded in an interviews with PBS that Pakistani assistance to the Taliban is a central problem and that trying to get the Pakistani military to end its support for the Taliban is their highest priority.
But the idea that the Obama administration's "regional strategy" is going to change a Pakistani strategic fixation on India that has persisted ever since the Pakistani military was created is nothing but wishful thinking. No less an enthusiast for war in Afghanistan than neoconservative military analyst Fred Kagan of the American Enterprise Institute testified at a House subcommittee hearing Thursday that the Pakistani Army actually defines itself in terms of the threat from India and opined that It would require "a multi-generational effort" to change that perspective.
As for closing down al Qaeda's sanctuary in Pakistan, a report by Craig Whitlock of the Washington Post from Pakistan last September showed that U.S. intelligence had no human assets in the tribal region, and that Pakistani military was doing nothing to change that. CIA Director Leon Panetta's statement that drone bombing attacks "are probably the most effective weapon we have to try to disrupt al Qaeda right now" is a pretty good indication that there is little chance of the United States rolling up al Qaeda in Pakistan unilaterally.
The war in Afghanistan is being justified, in effect, as a "preventive war," but the contingency it is supposed to prevent -- an al Qaeda base in Afghanistan -- is one that that isn't going to occur, regardless of the U.S. war in Afghanistan. In that regard, the rationale for this war is very much like the rationale for the invasion of Iraq, which was that the United States had to prevent the acquisition by Saddam Hussein of a nuclear weapon.
Although the war in Afghanistan cannot solve the al Qaeda problem in Pakistan, it can accelerate the destabilization of Pakistan and strengthening the jihadi movement there. Even air attacks by drone aircraft in Pakistan, which is now settled U.S. policy, create a powerful political backlash in favor of the militants in Pakistan. But once the administration's "regional" approach to changing Pakistani policy stalls, we can expect growing pressure from the military to resume U.S. Special Operations forces cross-border raids against Taliban sanctuaries inside Pakistan. And that would certainly lead to more serious destabilizing developments, such as increased ideological splits within the Pakistani military. The National Intelligence Council warned the Bush administration about the near certainty of such consequences last August, as I reported for IPS September 9.
The administration's rationale for escalating war in Afghanistan does not stand up to careful examination. Not only is Afghanistan not a war of necessity, as it is being portrayed by the administration; it is a war that is very likely to make the terrible mess in Pakistan substantially worse and increase the likelihood of spreading chaos in that country.


text:
The luxurious Alykanas Beach Apart Hotel is set in idyllic, well-kept landscaped gardens and has a large parking area. The reception area which is open 24 hours a day, is spacious with comfortable sofas for you to relax in, a television and an internet corner.
Money exchange, maps, postcards and any information about the hotel and surrounding area you may need are available. The large swimming pool and terrace are literally on the edge of the shore offering breathtaking views and plenty of sunbeds and umbrellas for you to relax in.
There is also a separate children's pool and Jacuzzi as well as shower and toilet facilities. In front of the pool there are a couple of steps which lead onto the beautiful sandy beach of Alykanas where you will find sunbeds and umbrellas next to the sea for a small extra charge.
Behind the pool you will find a large spacious snack bar serving delicious breakfast and various snacks from 8:00am until 5:00pm. Ice creams, crisps, cold cans of drink can all be purchased here. The snack bar stays open until late into the night as a bar. To the side of the pool is a children's play area almost like a mini adventure playground complete with swings, climbing frames and high slide to keep the children entertained.
Come and enjoy the many facilities and friendly atmosphere of our hotel!
We promise your stay will be unforgettable!


text:
BIRMINGHAM, Ala. – April Terry and Dani Walker set school records at the Southern Invitational hosted by Birmingham Southern College on Friday.
Terry set two new school records. She set a new outdoor record in the women's shot put with a throw of 12.88 meters, which placed her second in the event. She was 0.02 meters short of first place Katelyn Poole of Samford who threw 12.90 meters.
The sophomore broke her own school record in the hammer throw with a throw of 44.27 meters, which placed her third in the event.
"April Terry performed impressively in the shot and hammer," Bill Taylor, Lipscomb director of cross country and track and field, said.
Walker also set a new school record by 0.02 seconds in the women's 3,000-meter steeplechase. The junior ran in a time of 10:32.95, about 12 seconds over second place teammate freshman Madelin Talbert, who had a time of 10:44.70.
"Dani ran great," Taylor said. "It's funny because I've wanted her to run the steeple since her freshman season. I've believed she can be a top national steepler. It hasn't worked out until now.
"She was pretty nervous this week. Then the race started and she just ran. She looked great. Her time today would have qualified for the NCAA National Championship Preliminary round last season. So, it's really impressive for a first-ever race and this early in the season."
Lipscomb placed a runner in each of the top five positions in the women's 3,000-meter steeplechase. Sophomore Kendra Lobley finished third with a time of 10:47.39, junior Tessa Hoefle finished fourth with a time of 11:01.44 and sophomore Minna Fields rounded out the top five with a time of 11:23.52.
"Madi, Kendra and Tessa also ran great," Taylor said. "All four girls ran faster than Kendra did in this race last year and she went on to win conference and qualify for the nationals prelims."
The top three spots broke the meet record.
Senior Ashton Fisher won the men's 3,000-meter steeplechase with a time of 9:35.32. Senior Ben Wright finished third with a time of 9:47.21.
Freshman Max McBride won the first heat of the men's 3,000-meter steeplechase in his collegiate debut with a time of 10:02.01. McBride finished eighth overall.
"Ashton ran great," Taylor said. "It was a nice win for him. Ben Ashley made a huge improvement. Max McBride looked terrific winning the first heat."
The men's and women's track and field teams finish the Southern Invitational on Saturday.


text:
Featured News - Current News - Archived News - News Categories
The Buffalo Philharmonic is embarking on its second tour of Florida under the baton of Music Director JoAnn Falletta. The five-city, six-concert tour of Florida take place Feb.7-12.
In 2010, the Buffalo Philharmonic mounted its first Florida tour since 1979 to both critical acclaim and financial success. The BPO has planned to return to the "Sunshine State" ever since.
"This tour is special for so many reasons. Few orchestras of our size are able to mount a multi-city tour, and it's a very valuable experience for our musicians," Falletta said. "It's also a wonderful chance for the orchestra to reconnect with our former patrons who have moved south, or spend the winter in a warmer climate. As with any out-of-town trip, whether it's to Carnegie Hall, to Saratoga, or to Florida, it's always a thrill to perform for those who have never heard us before."
For five of the concerts, Pianist Philippe Bianconi joins the orchestra in performing Rachmaninoff's Piano Concerto No. 3. Bianconi is a Van Cliburn Competition silver medal winner, and has a thriving international career as a soloist. Also on the program is Dvorak's Symphony No. 6. The BPO will preview the tour program in Buffalo on Feb. 1 and 2.
The tour schedule is as follows:
•Daytona Beach: 7 p.m. Friday, Feb. 7, at Peabody Auditorium (www.peabodyauditorium.org).
•St. Augustine: 7:30 p.m. Saturday, Feb. 8, at Flagler College (www.emmaconcerts.com).
•West Palm Beach: 8 p.m. Sunday Feb. 9, and 2 p.m. Monday, Feb. 10, at the Kravis Center (www.kravis.org).
•Vero Beach: 7:30 p.m. Tuesday, Feb. 11, Indian River Concert Association (www.irsymphonic.org).
•Gainesville: 7:30 p.m. Wednesday, Feb. 12, University of Florida at Gainesville (www.performingarts.ufl.edu/events).
The Monday performance at the Kravis Center will feature Philadelphia Orchestra principal clarinet Ricardo Morales performing Mozart's Clarinet Concerto. In addition, the orchestra will perform Jacques Ibert's Hommage a Mozart and Dvorak Symphony No. 6.
The Feb. 11 concert has already sold out, and both performances in West Palm Beach are nearly sold out. All other venues report strong ticket sales.
As Buffalo's cultural ambassador, the Grammy Award-winning BPO, under Falletta's leadership, presents more than 100 concerts each year. Since 1940, the orchestra's home has been Kleinhans Music Hall, a National Historic Landmark with a reputation as one of the finest concert halls in the U.S.
For more information about the Buffalo Philharmonic Orchestra, visit www.bpo.org.