Annotation of src/usr.bin/ssh/ssh-add.1, Revision 1.60
1.60 ! sobrado 1: .\" $OpenBSD: ssh-add.1,v 1.59 2013/12/07 11:58:46 naddy Exp $
1.1 deraadt 2: .\"
3: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5: .\" All rights reserved
6: .\"
1.17 deraadt 7: .\" As far as I am concerned, the code I have written for this software
8: .\" can be used freely for any purpose. Any derived versions of this
9: .\" software must be clearly marked as such, and if the derived work is
10: .\" incompatible with the protocol description in the RFC file, it must be
11: .\" called by a name other than "ssh" or "Secure Shell".
12: .\"
13: .\"
1.22 deraadt 14: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
15: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
16: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
1.17 deraadt 17: .\"
18: .\" Redistribution and use in source and binary forms, with or without
19: .\" modification, are permitted provided that the following conditions
20: .\" are met:
21: .\" 1. Redistributions of source code must retain the above copyright
22: .\" notice, this list of conditions and the following disclaimer.
23: .\" 2. Redistributions in binary form must reproduce the above copyright
24: .\" notice, this list of conditions and the following disclaimer in the
25: .\" documentation and/or other materials provided with the distribution.
1.1 deraadt 26: .\"
1.17 deraadt 27: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
28: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
29: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
30: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
31: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
32: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
33: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
34: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
35: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.1 deraadt 37: .\"
1.60 ! sobrado 38: .Dd $Mdocdate: December 7 2013 $
1.2 deraadt 39: .Dt SSH-ADD 1
40: .Os
41: .Sh NAME
42: .Nm ssh-add
1.53 djm 43: .Nd adds private key identities to the authentication agent
1.2 deraadt 44: .Sh SYNOPSIS
45: .Nm ssh-add
1.56 djm 46: .Op Fl cDdkLlXx
1.33 markus 47: .Op Fl t Ar life
1.2 deraadt 48: .Op Ar
1.26 jakob 49: .Nm ssh-add
1.50 jmc 50: .Fl s Ar pkcs11
1.26 jakob 51: .Nm ssh-add
1.50 jmc 52: .Fl e Ar pkcs11
1.12 aaron 53: .Sh DESCRIPTION
1.2 deraadt 54: .Nm
1.53 djm 55: adds private key identities to the authentication agent,
1.2 deraadt 56: .Xr ssh-agent 1 .
1.28 djm 57: When run without arguments, it adds the files
1.43 djm 58: .Pa ~/.ssh/id_rsa ,
1.53 djm 59: .Pa ~/.ssh/id_dsa ,
1.59 naddy 60: .Pa ~/.ssh/id_ecdsa ,
61: .Pa ~/.ssh/id_ed25519
1.28 djm 62: and
1.43 djm 63: .Pa ~/.ssh/identity .
1.52 djm 64: After loading a private key,
65: .Nm
66: will try to load corresponding certificate information from the
67: filename obtained by appending
68: .Pa -cert.pub
69: to the name of the private key file.
1.11 aaron 70: Alternative file names can be given on the command line.
1.52 djm 71: .Pp
1.11 aaron 72: If any file requires a passphrase,
1.2 deraadt 73: .Nm
1.12 aaron 74: asks for the passphrase from the user.
1.25 stevesk 75: The passphrase is read from the user's tty.
1.23 markus 76: .Nm
77: retries the last passphrase if multiple identity files are given.
1.2 deraadt 78: .Pp
1.40 matthieu 79: The authentication agent must be running and the
80: .Ev SSH_AUTH_SOCK
81: environment variable must contain the name of its socket for
1.2 deraadt 82: .Nm
1.1 deraadt 83: to work.
1.2 deraadt 84: .Pp
85: The options are as follows:
86: .Bl -tag -width Ds
1.36 markus 87: .It Fl c
88: Indicates that added identities should be subject to confirmation before
1.38 jmc 89: being used for authentication.
90: Confirmation is performed by the
1.36 markus 91: .Ev SSH_ASKPASS
1.38 jmc 92: program mentioned below.
93: Successful confirmation is signaled by a zero exit status from the
1.36 markus 94: .Ev SSH_ASKPASS
95: program, rather than text entered into the requester.
1.42 jmc 96: .It Fl D
97: Deletes all identities from the agent.
98: .It Fl d
1.46 jmc 99: Instead of adding identities, removes identities from the agent.
1.45 djm 100: If
101: .Nm
1.57 djm 102: has been run without arguments, the keys for the default identities and
1.58 jmc 103: their corresponding certificates will be removed.
1.45 djm 104: Otherwise, the argument list will be interpreted as a list of paths to
1.57 djm 105: public key files to specify keys and certificates to be removed from the agent.
1.45 djm 106: If no public key is found at a given path,
107: .Nm
108: will append
109: .Pa .pub
110: and retry.
1.49 markus 111: .It Fl e Ar pkcs11
1.51 markus 112: Remove keys provided by the PKCS#11 shared library
1.49 markus 113: .Ar pkcs11 .
1.56 djm 114: .It Fl k
1.57 djm 115: When loading keys into or deleting keys from the agent, process plain private
116: keys only and skip certificates.
1.42 jmc 117: .It Fl L
118: Lists public key parameters of all identities currently represented
119: by the agent.
120: .It Fl l
121: Lists fingerprints of all identities currently represented by the agent.
1.49 markus 122: .It Fl s Ar pkcs11
1.51 markus 123: Add keys provided by the PKCS#11 shared library
1.49 markus 124: .Ar pkcs11 .
1.42 jmc 125: .It Fl t Ar life
126: Set a maximum lifetime when adding identities to an agent.
127: The lifetime may be specified in seconds or in a time format
128: specified in
129: .Xr sshd_config 5 .
130: .It Fl X
131: Unlock the agent.
132: .It Fl x
133: Lock the agent with a password.
1.2 deraadt 134: .El
1.9 markus 135: .Sh ENVIRONMENT
136: .Bl -tag -width Ds
137: .It Ev "DISPLAY" and "SSH_ASKPASS"
1.1 deraadt 138: If
1.2 deraadt 139: .Nm
1.1 deraadt 140: needs a passphrase, it will read the passphrase from the current
1.11 aaron 141: terminal if it was run from a terminal.
142: If
1.2 deraadt 143: .Nm
1.1 deraadt 144: does not have a terminal associated with it but
1.2 deraadt 145: .Ev DISPLAY
1.8 markus 146: and
147: .Ev SSH_ASKPASS
148: are set, it will execute the program specified by
149: .Ev SSH_ASKPASS
1.11 aaron 150: and open an X11 window to read the passphrase.
151: This is particularly useful when calling
1.2 deraadt 152: .Nm
153: from a
1.41 jmc 154: .Pa .xsession
1.11 aaron 155: or related script.
156: (Note that on some machines it
1.2 deraadt 157: may be necessary to redirect the input from
158: .Pa /dev/null
159: to make this work.)
1.31 markus 160: .It Ev SSH_AUTH_SOCK
1.47 sobrado 161: Identifies the path of a
1.48 sobrado 162: .Ux Ns -domain
163: socket used to communicate with the agent.
1.16 itojun 164: .El
1.39 jmc 165: .Sh FILES
166: .Bl -tag -width Ds
1.43 djm 167: .It Pa ~/.ssh/identity
1.39 jmc 168: Contains the protocol version 1 RSA authentication identity of the user.
1.43 djm 169: .It Pa ~/.ssh/id_dsa
1.39 jmc 170: Contains the protocol version 2 DSA authentication identity of the user.
1.53 djm 171: .It Pa ~/.ssh/id_ecdsa
172: Contains the protocol version 2 ECDSA authentication identity of the user.
1.59 naddy 173: .It Pa ~/.ssh/id_ed25519
1.60 ! sobrado 174: Contains the protocol version 2 Ed25519 authentication identity of the user.
1.43 djm 175: .It Pa ~/.ssh/id_rsa
1.39 jmc 176: Contains the protocol version 2 RSA authentication identity of the user.
177: .El
178: .Pp
179: Identity files should not be readable by anyone but the user.
180: Note that
181: .Nm
182: ignores identity files if they are accessible by others.
1.54 jmc 183: .Sh EXIT STATUS
1.29 markus 184: Exit status is 0 on success, 1 if the specified command fails,
185: and 2 if
186: .Nm
187: is unable to contact the authentication agent.
1.39 jmc 188: .Sh SEE ALSO
189: .Xr ssh 1 ,
190: .Xr ssh-agent 1 ,
191: .Xr ssh-keygen 1 ,
192: .Xr sshd 8
1.18 aaron 193: .Sh AUTHORS
1.19 markus 194: OpenSSH is a derivative of the original and free
195: ssh 1.2.12 release by Tatu Ylonen.
196: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
197: Theo de Raadt and Dug Song
198: removed many bugs, re-added newer features and
199: created OpenSSH.
200: Markus Friedl contributed the support for SSH
201: protocol versions 1.5 and 2.0.