version 1.9, 2000/01/22 02:17:50 |
version 1.10, 2000/03/23 21:10:10 |
|
|
.Oc |
.Oc |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
.Nm |
.Nm |
is a program to hold authentication private keys. The |
is a program to hold authentication private keys. |
idea is that |
The idea is that |
.Nm |
.Nm |
is started in the beginning of an X-session or a login session, and |
is started in the beginning of an X-session or a login session, and |
all other windows or programs are started as clients to the ssh-agent |
all other windows or programs are started as clients to the ssh-agent |
program. Through use of environment variables the agent can be located |
program. |
|
Through use of environment variables the agent can be located |
and automatically used for RSA authentication when logging in to other |
and automatically used for RSA authentication when logging in to other |
machines using |
machines using |
.Xr ssh 1 . |
.Xr ssh 1 . |
|
|
If a commandline is given, this is executed as a subprocess of the agent. |
If a commandline is given, this is executed as a subprocess of the agent. |
When the command dies, so does the agent. |
When the command dies, so does the agent. |
.Pp |
.Pp |
The agent initially does not have any private keys. Keys are added |
The agent initially does not have any private keys. |
using |
Keys are added using |
.Xr ssh-add 1 . |
.Xr ssh-add 1 . |
When executed without arguments, |
When executed without arguments, |
.Xr ssh-add 1 |
.Xr ssh-add 1 |
adds the |
adds the |
.Pa $HOME/.ssh/identity |
.Pa $HOME/.ssh/identity |
file. If the identity has a passphrase, |
file. |
|
If the identity has a passphrase, |
.Xr ssh-add 1 |
.Xr ssh-add 1 |
asks for the passphrase (using a small X11 application if running |
asks for the passphrase (using a small X11 application if running |
under X11, or from the terminal if running without X). It then sends |
under X11, or from the terminal if running without X). |
the identity to the agent. Several identities can be stored in the |
It then sends the identity to the agent. |
|
Several identities can be stored in the |
agent; the agent can automatically use any of these identities. |
agent; the agent can automatically use any of these identities. |
.Ic ssh-add -l |
.Ic ssh-add -l |
displays the identities currently held by the agent. |
displays the identities currently held by the agent. |
.Pp |
.Pp |
The idea is that the agent is run in the user's local PC, laptop, or |
The idea is that the agent is run in the user's local PC, laptop, or |
terminal. Authentication data need not be stored on any other |
terminal. |
|
Authentication data need not be stored on any other |
machine, and authentication passphrases never go over the network. |
machine, and authentication passphrases never go over the network. |
However, the connection to the agent is forwarded over SSH |
However, the connection to the agent is forwarded over SSH |
remote logins, and the user can thus use the privileges given by the |
remote logins, and the user can thus use the privileges given by the |
identities anywhere in the network in a secure way. |
identities anywhere in the network in a secure way. |
.Pp |
.Pp |
There are two main ways to get an agent setup: Either you let the agent |
There are two main ways to get an agent setup: |
|
Either you let the agent |
start a new subcommand into which some environment variables are exported, or |
start a new subcommand into which some environment variables are exported, or |
you let the agent print the needed shell commands (either |
you let the agent print the needed shell commands (either |
.Xr sh 1 |
.Xr sh 1 |
|
|
and the name of this socket is stored in the |
and the name of this socket is stored in the |
.Ev SSH_AUTH_SOCK |
.Ev SSH_AUTH_SOCK |
environment |
environment |
variable. The socket is made accessible only to the current user. |
variable. |
|
The socket is made accessible only to the current user. |
This method is easily abused by root or another instance of the same |
This method is easily abused by root or another instance of the same |
user. |
user. |
.Pp |
.Pp |
|
|
.Sh FILES |
.Sh FILES |
.Bl -tag -width Ds |
.Bl -tag -width Ds |
.It Pa $HOME/.ssh/identity |
.It Pa $HOME/.ssh/identity |
Contains the RSA authentication identity of the user. This file |
Contains the RSA authentication identity of the user. |
should not be readable by anyone but the user. It is possible to |
This file should not be readable by anyone but the user. |
|
It is possible to |
specify a passphrase when generating the key; that passphrase will be |
specify a passphrase when generating the key; that passphrase will be |
used to encrypt the private part of this file. This file |
used to encrypt the private part of this file. |
is not used by |
This file is not used by |
.Nm |
.Nm |
but is normally added to the agent using |
but is normally added to the agent using |
.Xr ssh-add 1 |
.Xr ssh-add 1 |
at login time. |
at login time. |
.It Pa /tmp/ssh-XXXX/agent.<pid> , |
.It Pa /tmp/ssh-XXXX/agent.<pid> , |
Unix-domain sockets used to contain the connection to the |
Unix-domain sockets used to contain the connection to the |
authentication agent. These sockets should only be readable by the |
authentication agent. |
owner. The sockets should get automatically removed when the agent |
These sockets should only be readable by the owner. |
exits. |
The sockets should get automatically removed when the agent exits. |
.Sh AUTHOR |
.Sh AUTHOR |
Tatu Ylonen <ylo@cs.hut.fi> |
Tatu Ylonen <ylo@cs.hut.fi> |
.Pp |
.Pp |
OpenSSH |
OpenSSH |
is a derivative of the original (free) ssh 1.2.12 release, but with bugs |
is a derivative of the original (free) ssh 1.2.12 release, but with bugs |
removed and newer features re-added. Rapidly after the 1.2.12 release, |
removed and newer features re-added. |
newer versions bore successively more restrictive licenses. This version |
Rapidly after the 1.2.12 release, |
of OpenSSH |
newer versions bore successively more restrictive licenses. |
|
This version of OpenSSH |
.Bl -bullet |
.Bl -bullet |
.It |
.It |
has all components of a restrictive nature (i.e., patents, see |
has all components of a restrictive nature (i.e., patents, see |