src/usr.bin/ssh/ssh-keygen.1 - diff

Return to ssh-keygen.1 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.1 between version 1.136 and 1.137

version 1.136, 2017/04/30 23:18:44

version 1.137, 2017/05/02 07:13:31

Line 422

.It Fl O Ar option

Specify a certificate option when signing a key.

This option may be specified multiple times.

Please see the

See also the

.Sx CERTIFICATES

section for details.

section for further details.

At present, no standard options are valid for host keys.

The options that are valid for user certificates are:

.Bl -tag -width Ds

.Pp

.Bl -tag -width Ds -compact

.It Ic clear

Clear all enabled permissions.

This is useful for clearing the default set of permissions so permissions may

be added individually.

.Pp

.It Ic critical : Ns Ar name Ns Op Ns = Ns Ar contents

.It Ic extension : Ns Ar name Ns Op Ns = Ns Ar contents

Includes an arbitrary certificate critical option or extension.

The specified

.Ar name

should include a domain suffix, e.g.\&

.Dq name@example.com .

.Ar contents

is specified then it is included as the contents of the extension/option

encoded as a string, otherwise the extension/option is created with no

contents (usually indicating a flag).

Extensions may be ignored by a client or server that does not recognise them,

whereas unknown critical options will cause the certificate to be refused.

.Pp

.It Ic force-command Ns = Ns Ar command

Forces the execution of

.Ar command

instead of any shell or command specified by the user when

the certificate is used for authentication.

.Pp

.It Ic no-agent-forwarding

Disable

.Xr ssh-agent 1

forwarding (permitted by default).

.Pp

.It Ic no-port-forwarding

Disable port forwarding (permitted by default).

.Pp

.It Ic no-pty

Disable PTY allocation (permitted by default).

.Pp

.It Ic no-user-rc

Disable execution of

.Pa ~/.ssh/rc

.Xr sshd 8

(permitted by default).

.Pp

.It Ic no-x11-forwarding

Disable X11 forwarding (permitted by default).

.Pp

.It Ic permit-agent-forwarding

Allows

.Xr ssh-agent 1

forwarding.

.Pp

.It Ic permit-port-forwarding

Allows port forwarding.

.Pp

.It Ic permit-pty

Allows PTY allocation.

.Pp

.It Ic permit-user-rc

Allows execution of

.Pa ~/.ssh/rc

.Xr sshd 8 .

.Pp

.It Ic permit-x11-forwarding

Allows X11 forwarding.

.Pp

.It Ic source-address Ns = Ns Ar address_list

Restrict the source addresses from which the certificate is considered valid.

The

.Ar address_list

is a comma-separated list of one or more address/netmask pairs in CIDR

format.

.It Ic extension : Ns Ar name Ns Op Ns = Ns Ar contents

Includes an arbitrary certificate extension.

.It Ic critical : Ns Ar name Ns Op Ns = Ns Ar contents

Includes an arbitrary certificate critical option.

.El

.Pp

At present, no standard options are valid for host keys.

.Pp

For non-standard certificate extensions or options included using

.Ic extension

.Ic option ,

the specified