Annotation of src/usr.bin/ssh/ssh-add.1, Revision 1.53
1.53 ! djm 1: .\" $OpenBSD: ssh-add.1,v 1.52 2010/03/05 10:28:21 djm Exp $
1.20 niklas 2: .\"
1.1 deraadt 3: .\" -*- nroff -*-
4: .\"
5: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
6: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
7: .\" All rights reserved
8: .\"
1.17 deraadt 9: .\" As far as I am concerned, the code I have written for this software
10: .\" can be used freely for any purpose. Any derived versions of this
11: .\" software must be clearly marked as such, and if the derived work is
12: .\" incompatible with the protocol description in the RFC file, it must be
13: .\" called by a name other than "ssh" or "Secure Shell".
14: .\"
15: .\"
1.22 deraadt 16: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
17: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
18: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
1.17 deraadt 19: .\"
20: .\" Redistribution and use in source and binary forms, with or without
21: .\" modification, are permitted provided that the following conditions
22: .\" are met:
23: .\" 1. Redistributions of source code must retain the above copyright
24: .\" notice, this list of conditions and the following disclaimer.
25: .\" 2. Redistributions in binary form must reproduce the above copyright
26: .\" notice, this list of conditions and the following disclaimer in the
27: .\" documentation and/or other materials provided with the distribution.
1.1 deraadt 28: .\"
1.17 deraadt 29: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
30: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
31: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
32: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
33: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
34: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
38: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.1 deraadt 39: .\"
1.53 ! djm 40: .Dd $Mdocdate: March 5 2010 $
1.2 deraadt 41: .Dt SSH-ADD 1
42: .Os
43: .Sh NAME
44: .Nm ssh-add
1.53 ! djm 45: .Nd adds private key identities to the authentication agent
1.2 deraadt 46: .Sh SYNOPSIS
47: .Nm ssh-add
1.42 jmc 48: .Op Fl cDdLlXx
1.33 markus 49: .Op Fl t Ar life
1.2 deraadt 50: .Op Ar
1.26 jakob 51: .Nm ssh-add
1.50 jmc 52: .Fl s Ar pkcs11
1.26 jakob 53: .Nm ssh-add
1.50 jmc 54: .Fl e Ar pkcs11
1.12 aaron 55: .Sh DESCRIPTION
1.2 deraadt 56: .Nm
1.53 ! djm 57: adds private key identities to the authentication agent,
1.2 deraadt 58: .Xr ssh-agent 1 .
1.28 djm 59: When run without arguments, it adds the files
1.43 djm 60: .Pa ~/.ssh/id_rsa ,
1.53 ! djm 61: .Pa ~/.ssh/id_dsa ,
! 62: .Pa ~/.ssh/id_ecdsa
1.28 djm 63: and
1.43 djm 64: .Pa ~/.ssh/identity .
1.52 djm 65: After loading a private key,
66: .Nm
67: will try to load corresponding certificate information from the
68: filename obtained by appending
69: .Pa -cert.pub
70: to the name of the private key file.
1.11 aaron 71: Alternative file names can be given on the command line.
1.52 djm 72: .Pp
1.11 aaron 73: If any file requires a passphrase,
1.2 deraadt 74: .Nm
1.12 aaron 75: asks for the passphrase from the user.
1.25 stevesk 76: The passphrase is read from the user's tty.
1.23 markus 77: .Nm
78: retries the last passphrase if multiple identity files are given.
1.2 deraadt 79: .Pp
1.40 matthieu 80: The authentication agent must be running and the
81: .Ev SSH_AUTH_SOCK
82: environment variable must contain the name of its socket for
1.2 deraadt 83: .Nm
1.1 deraadt 84: to work.
1.2 deraadt 85: .Pp
86: The options are as follows:
87: .Bl -tag -width Ds
1.36 markus 88: .It Fl c
89: Indicates that added identities should be subject to confirmation before
1.38 jmc 90: being used for authentication.
91: Confirmation is performed by the
1.36 markus 92: .Ev SSH_ASKPASS
1.38 jmc 93: program mentioned below.
94: Successful confirmation is signaled by a zero exit status from the
1.36 markus 95: .Ev SSH_ASKPASS
96: program, rather than text entered into the requester.
1.42 jmc 97: .It Fl D
98: Deletes all identities from the agent.
99: .It Fl d
1.46 jmc 100: Instead of adding identities, removes identities from the agent.
1.45 djm 101: If
102: .Nm
1.46 jmc 103: has been run without arguments, the keys for the default identities will
1.45 djm 104: be removed.
105: Otherwise, the argument list will be interpreted as a list of paths to
106: public key files and matching keys will be removed from the agent.
107: If no public key is found at a given path,
108: .Nm
109: will append
110: .Pa .pub
111: and retry.
1.49 markus 112: .It Fl e Ar pkcs11
1.51 markus 113: Remove keys provided by the PKCS#11 shared library
1.49 markus 114: .Ar pkcs11 .
1.42 jmc 115: .It Fl L
116: Lists public key parameters of all identities currently represented
117: by the agent.
118: .It Fl l
119: Lists fingerprints of all identities currently represented by the agent.
1.49 markus 120: .It Fl s Ar pkcs11
1.51 markus 121: Add keys provided by the PKCS#11 shared library
1.49 markus 122: .Ar pkcs11 .
1.42 jmc 123: .It Fl t Ar life
124: Set a maximum lifetime when adding identities to an agent.
125: The lifetime may be specified in seconds or in a time format
126: specified in
127: .Xr sshd_config 5 .
128: .It Fl X
129: Unlock the agent.
130: .It Fl x
131: Lock the agent with a password.
1.2 deraadt 132: .El
1.9 markus 133: .Sh ENVIRONMENT
134: .Bl -tag -width Ds
135: .It Ev "DISPLAY" and "SSH_ASKPASS"
1.1 deraadt 136: If
1.2 deraadt 137: .Nm
1.1 deraadt 138: needs a passphrase, it will read the passphrase from the current
1.11 aaron 139: terminal if it was run from a terminal.
140: If
1.2 deraadt 141: .Nm
1.1 deraadt 142: does not have a terminal associated with it but
1.2 deraadt 143: .Ev DISPLAY
1.8 markus 144: and
145: .Ev SSH_ASKPASS
146: are set, it will execute the program specified by
147: .Ev SSH_ASKPASS
1.11 aaron 148: and open an X11 window to read the passphrase.
149: This is particularly useful when calling
1.2 deraadt 150: .Nm
151: from a
1.41 jmc 152: .Pa .xsession
1.11 aaron 153: or related script.
154: (Note that on some machines it
1.2 deraadt 155: may be necessary to redirect the input from
156: .Pa /dev/null
157: to make this work.)
1.31 markus 158: .It Ev SSH_AUTH_SOCK
1.47 sobrado 159: Identifies the path of a
1.48 sobrado 160: .Ux Ns -domain
161: socket used to communicate with the agent.
1.16 itojun 162: .El
1.39 jmc 163: .Sh FILES
164: .Bl -tag -width Ds
1.43 djm 165: .It Pa ~/.ssh/identity
1.39 jmc 166: Contains the protocol version 1 RSA authentication identity of the user.
1.43 djm 167: .It Pa ~/.ssh/id_dsa
1.39 jmc 168: Contains the protocol version 2 DSA authentication identity of the user.
1.53 ! djm 169: .It Pa ~/.ssh/id_ecdsa
! 170: Contains the protocol version 2 ECDSA authentication identity of the user.
1.43 djm 171: .It Pa ~/.ssh/id_rsa
1.39 jmc 172: Contains the protocol version 2 RSA authentication identity of the user.
173: .El
174: .Pp
175: Identity files should not be readable by anyone but the user.
176: Note that
177: .Nm
178: ignores identity files if they are accessible by others.
1.29 markus 179: .Sh DIAGNOSTICS
180: Exit status is 0 on success, 1 if the specified command fails,
181: and 2 if
182: .Nm
183: is unable to contact the authentication agent.
1.39 jmc 184: .Sh SEE ALSO
185: .Xr ssh 1 ,
186: .Xr ssh-agent 1 ,
187: .Xr ssh-keygen 1 ,
188: .Xr sshd 8
1.18 aaron 189: .Sh AUTHORS
1.19 markus 190: OpenSSH is a derivative of the original and free
191: ssh 1.2.12 release by Tatu Ylonen.
192: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
193: Theo de Raadt and Dug Song
194: removed many bugs, re-added newer features and
195: created OpenSSH.
196: Markus Friedl contributed the support for SSH
197: protocol versions 1.5 and 2.0.
![[BACK]](/icons/back.gif){kind=icon}
Return to ssh-add.1 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh