diff --git a/ChangeLog b/ChangeLog
index 1ed4b228c..1ffcdd174 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,9 @@
      [servconf.h servconf.c sshd.8 sshd.c auth.c sshd_config.5]
      Add "Match LocalAddress" and "Match LocalPort" to sshd and adjust tests
      to match.  Feedback and ok djm@ markus@.
+   - dtucker@cvs.openbsd.org 2012/05/19 06:30:30
+     [sshd_config.5]
+     Document PermitOpen none.  bz#2001, patch from Loganaden Velvindron
 
 20120504
  - (dtucker) [configure.ac] Include <sys/param.h> rather than <sys/types.h>
diff --git a/sshd_config.5 b/sshd_config.5
index 17df9e6cd..ddcf51f02 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.139 2012/05/13 01:42:32 dtucker Exp $
-.Dd $Mdocdate: May 13 2012 $
+.\" $OpenBSD: sshd_config.5,v 1.140 2012/05/19 06:30:30 dtucker Exp $
+.Dd $Mdocdate: May 19 2012 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -802,6 +802,9 @@ Multiple forwards may be specified by separating them with whitespace.
 An argument of
 .Dq any
 can be used to remove all restrictions and permit any forwarding requests.
+An argument of
+.Dq none
+can be used to prohibit all forwarding requests.
 By default all port forwarding requests are permitted.
 .It Cm PermitRootLogin
 Specifies whether root can log in using