Annotation of src/usr.bin/ssh/ssh-keygen.1, Revision 1.14
1.1 deraadt 1: .\" -*- nroff -*-
2: .\"
3: .\" ssh-keygen.1
4: .\"
5: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
6: .\"
7: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
8: .\" All rights reserved
9: .\"
10: .\" Created: Sat Apr 22 23:55:14 1995 ylo
11: .\"
1.14 ! deraadt 12: .\" $Id: ssh-keygen.1,v 1.13 2000/04/12 21:47:51 aaron Exp $
1.1 deraadt 13: .\"
1.2 deraadt 14: .Dd September 25, 1999
15: .Dt SSH-KEYGEN 1
16: .Os
17: .Sh NAME
18: .Nm ssh-keygen
19: .Nd authentication key generation
20: .Sh SYNOPSIS
21: .Nm ssh-keygen
1.5 aaron 22: .Op Fl q
1.2 deraadt 23: .Op Fl b Ar bits
24: .Op Fl N Ar new_passphrase
25: .Op Fl C Ar comment
1.9 markus 26: .Op Fl f Ar keyfile
1.2 deraadt 27: .Nm ssh-keygen
28: .Fl p
29: .Op Fl P Ar old_passphrase
30: .Op Fl N Ar new_passphrase
1.9 markus 31: .Op Fl f Ar keyfile
1.2 deraadt 32: .Nm ssh-keygen
33: .Fl c
34: .Op Fl P Ar passphrase
35: .Op Fl C Ar comment
1.9 markus 36: .Op Fl f Ar keyfile
37: .Nm ssh-keygen
38: .Fl l
39: .Op Fl f Ar keyfile
1.14 ! deraadt 40: .Nm ssh-keygen
! 41: .Fl R
1.13 aaron 42: .Sh DESCRIPTION
1.2 deraadt 43: .Nm
1.13 aaron 44: generates and manages authentication keys for
1.2 deraadt 45: .Xr ssh 1 .
46: Normally each user wishing to use SSH
1.1 deraadt 47: with RSA authentication runs this once to create the authentication
48: key in
1.2 deraadt 49: .Pa $HOME/.ssh/identity .
1.1 deraadt 50: Additionally, the system administrator may use this to generate host keys.
1.2 deraadt 51: .Pp
1.1 deraadt 52: Normally this program generates the key and asks for a file in which
1.12 aaron 53: to store the private key.
54: The public key is stored in a file with the same name but
1.2 deraadt 55: .Dq .pub
1.12 aaron 56: appended.
57: The program also asks for a passphrase.
58: The passphrase may be empty to indicate no passphrase
1.1 deraadt 59: (host keys must have empty passphrase), or it may be a string of
1.12 aaron 60: arbitrary length.
61: Good passphrases are 10-30 characters long and are
1.1 deraadt 62: not simple sentences or otherwise easily guessable (English
63: prose has only 1-2 bits of entropy per word, and provides very bad
1.12 aaron 64: passphrases).
65: The passphrase can be changed later by using the
1.2 deraadt 66: .Fl p
1.1 deraadt 67: option.
1.2 deraadt 68: .Pp
1.12 aaron 69: There is no way to recover a lost passphrase.
70: If the passphrase is
1.1 deraadt 71: lost or forgotten, you will have to generate a new key and copy the
72: corresponding public key to other machines.
1.2 deraadt 73: .Pp
1.1 deraadt 74: There is also a comment field in the key file that is only for
1.12 aaron 75: convenience to the user to help identify the key.
76: The comment can tell what the key is for, or whatever is useful.
77: The comment is initialized to
1.2 deraadt 78: .Dq user@host
79: when the key is created, but can be changed using the
80: .Fl c
1.1 deraadt 81: option.
1.2 deraadt 82: .Pp
83: The options are as follows:
84: .Bl -tag -width Ds
85: .It Fl b Ar bits
1.12 aaron 86: Specifies the number of bits in the key to create.
87: Minimum is 512 bits.
88: Generally 1024 bits is considered sufficient, and key sizes
89: above that no longer improve security but make things slower.
90: The default is 1024 bits.
1.2 deraadt 91: .It Fl c
1.1 deraadt 92: Requests changing the comment in the private and public key files.
93: The program will prompt for the file containing the private keys, for
94: passphrase if the key has one, and for the new comment.
1.9 markus 95: .It Fl f
96: Specifies the filename of the key file.
97: .It Fl l
98: Show fingerprint of specified private or public key file.
1.2 deraadt 99: .It Fl p
1.1 deraadt 100: Requests changing the passphrase of a private key file instead of
1.12 aaron 101: creating a new private key.
102: The program will prompt for the file
1.1 deraadt 103: containing the private key, for the old passphrase, and twice for the
104: new passphrase.
1.5 aaron 105: .It Fl q
106: Silence
107: .Nm ssh-keygen .
108: Used by
109: .Pa /etc/rc
110: when creating a new key.
1.2 deraadt 111: .It Fl C Ar comment
1.1 deraadt 112: Provides the new comment.
1.2 deraadt 113: .It Fl N Ar new_passphrase
1.1 deraadt 114: Provides the new passphrase.
1.2 deraadt 115: .It Fl P Ar passphrase
1.1 deraadt 116: Provides the (old) passphrase.
1.14 ! deraadt 117: .It Fl R
! 118: If RSA support is functional, immediately exits with code 0. If RSA
! 119: support is not functional, exits with code 1. This flag will be
! 120: removed once the RSA patent expires.
1.2 deraadt 121: .El
122: .Sh FILES
123: .Bl -tag -width Ds
124: .It Pa $HOME/.ssh/identity
1.12 aaron 125: Contains the RSA authentication identity of the user.
126: This file should not be readable by anyone but the user.
127: It is possible to
1.1 deraadt 128: specify a passphrase when generating the key; that passphrase will be
1.12 aaron 129: used to encrypt the private part of this file using 3DES.
130: This file is not automatically accessed by
1.2 deraadt 131: .Nm
1.1 deraadt 132: but it is offered as the default file for the private key.
1.2 deraadt 133: .It Pa $HOME/.ssh/identity.pub
1.12 aaron 134: Contains the public key for authentication.
135: The contents of this file should be added to
1.2 deraadt 136: .Pa $HOME/.ssh/authorized_keys
137: on all machines
1.12 aaron 138: where you wish to log in using RSA authentication.
139: There is no need to keep the contents of this file secret.
1.2 deraadt 140: .Sh AUTHOR
1.1 deraadt 141: Tatu Ylonen <ylo@cs.hut.fi>
1.4 deraadt 142: .Pp
1.6 deraadt 143: OpenSSH
144: is a derivative of the original (free) ssh 1.2.12 release, but with bugs
1.12 aaron 145: removed and newer features re-added.
146: Rapidly after the 1.2.12 release,
147: newer versions bore successively more restrictive licenses.
148: This version of OpenSSH
1.6 deraadt 149: .Bl -bullet
150: .It
1.11 aaron 151: has all components of a restrictive nature (i.e., patents, see
1.6 deraadt 152: .Xr ssl 8 )
153: directly removed from the source code; any licensed or patented components
154: are chosen from
155: external libraries.
156: .It
157: has been updated to support ssh protocol 1.5.
158: .It
1.13 aaron 159: contains added support for
1.6 deraadt 160: .Xr kerberos 8
161: authentication and ticket passing.
162: .It
163: supports one-time password authentication with
164: .Xr skey 1 .
165: .El
166: .Pp
167: The libraries described in
1.4 deraadt 168: .Xr ssl 8
169: are required for proper operation.
1.2 deraadt 170: .Sh SEE ALSO
171: .Xr ssh 1 ,
172: .Xr ssh-add 1 ,
1.8 ericj 173: .Xr ssh-agent 1 ,
1.4 deraadt 174: .Xr sshd 8 ,
175: .Xr ssl 8