Annotation of src/usr.bin/ssh/ssh-keygen.1, Revision 1.18.2.4
1.18.2.4! jason 1: .\" $OpenBSD: ssh-keygen.1,v 1.35 2001/03/11 22:33:23 markus Exp $
1.18.2.3 jason 2: .\"
1.1 deraadt 3: .\" -*- nroff -*-
4: .\"
5: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
6: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
7: .\" All rights reserved
8: .\"
1.18.2.2 jason 9: .\" As far as I am concerned, the code I have written for this software
10: .\" can be used freely for any purpose. Any derived versions of this
11: .\" software must be clearly marked as such, and if the derived work is
12: .\" incompatible with the protocol description in the RFC file, it must be
13: .\" called by a name other than "ssh" or "Secure Shell".
14: .\"
15: .\"
1.18.2.4! jason 16: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
! 17: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
! 18: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
1.18.2.2 jason 19: .\"
20: .\" Redistribution and use in source and binary forms, with or without
21: .\" modification, are permitted provided that the following conditions
22: .\" are met:
23: .\" 1. Redistributions of source code must retain the above copyright
24: .\" notice, this list of conditions and the following disclaimer.
25: .\" 2. Redistributions in binary form must reproduce the above copyright
26: .\" notice, this list of conditions and the following disclaimer in the
27: .\" documentation and/or other materials provided with the distribution.
1.1 deraadt 28: .\"
1.18.2.2 jason 29: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
30: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
31: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
32: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
33: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
34: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
38: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.1 deraadt 39: .\"
1.2 deraadt 40: .Dd September 25, 1999
41: .Dt SSH-KEYGEN 1
42: .Os
43: .Sh NAME
44: .Nm ssh-keygen
45: .Nd authentication key generation
46: .Sh SYNOPSIS
47: .Nm ssh-keygen
1.18.2.3 jason 48: .Op Fl q
1.2 deraadt 49: .Op Fl b Ar bits
1.18.2.3 jason 50: .Op Fl t Ar type
1.2 deraadt 51: .Op Fl N Ar new_passphrase
52: .Op Fl C Ar comment
1.18.2.1 jason 53: .Op Fl f Ar output_keyfile
1.2 deraadt 54: .Nm ssh-keygen
55: .Fl p
56: .Op Fl P Ar old_passphrase
57: .Op Fl N Ar new_passphrase
1.9 markus 58: .Op Fl f Ar keyfile
1.2 deraadt 59: .Nm ssh-keygen
1.16 deraadt 60: .Fl x
1.18.2.1 jason 61: .Op Fl f Ar input_keyfile
1.16 deraadt 62: .Nm ssh-keygen
63: .Fl X
1.18.2.1 jason 64: .Op Fl f Ar input_keyfile
1.16 deraadt 65: .Nm ssh-keygen
1.17 markus 66: .Fl y
1.18.2.1 jason 67: .Op Fl f Ar input_keyfile
1.17 markus 68: .Nm ssh-keygen
1.2 deraadt 69: .Fl c
70: .Op Fl P Ar passphrase
71: .Op Fl C Ar comment
1.9 markus 72: .Op Fl f Ar keyfile
73: .Nm ssh-keygen
74: .Fl l
1.18.2.1 jason 75: .Op Fl f Ar input_keyfile
1.18.2.4! jason 76: .Nm ssh-keygen
! 77: .Fl B
! 78: .Op Fl f Ar input_keyfile
1.13 aaron 79: .Sh DESCRIPTION
1.2 deraadt 80: .Nm
1.13 aaron 81: generates and manages authentication keys for
1.2 deraadt 82: .Xr ssh 1 .
1.15 deraadt 83: .Nm
84: defaults to generating an RSA key for use by protocols 1.3 and 1.5;
85: specifying the
1.18.2.3 jason 86: .Fl t
87: option allows you to create a key for use by protocol 2.0.
1.15 deraadt 88: .Pp
1.2 deraadt 89: Normally each user wishing to use SSH
1.15 deraadt 90: with RSA or DSA authentication runs this once to create the authentication
1.1 deraadt 91: key in
1.15 deraadt 92: .Pa $HOME/.ssh/identity
93: or
94: .Pa $HOME/.ssh/id_dsa .
95: Additionally, the system administrator may use this to generate host keys,
96: as seen in
97: .Pa /etc/rc .
1.2 deraadt 98: .Pp
1.1 deraadt 99: Normally this program generates the key and asks for a file in which
1.12 aaron 100: to store the private key.
101: The public key is stored in a file with the same name but
1.2 deraadt 102: .Dq .pub
1.12 aaron 103: appended.
104: The program also asks for a passphrase.
105: The passphrase may be empty to indicate no passphrase
1.18.2.3 jason 106: (host keys must have an empty passphrase), or it may be a string of
1.12 aaron 107: arbitrary length.
108: Good passphrases are 10-30 characters long and are
1.1 deraadt 109: not simple sentences or otherwise easily guessable (English
110: prose has only 1-2 bits of entropy per word, and provides very bad
1.12 aaron 111: passphrases).
112: The passphrase can be changed later by using the
1.2 deraadt 113: .Fl p
1.1 deraadt 114: option.
1.2 deraadt 115: .Pp
1.12 aaron 116: There is no way to recover a lost passphrase.
117: If the passphrase is
1.1 deraadt 118: lost or forgotten, you will have to generate a new key and copy the
119: corresponding public key to other machines.
1.2 deraadt 120: .Pp
1.15 deraadt 121: For RSA, there is also a comment field in the key file that is only for
1.12 aaron 122: convenience to the user to help identify the key.
123: The comment can tell what the key is for, or whatever is useful.
124: The comment is initialized to
1.2 deraadt 125: .Dq user@host
126: when the key is created, but can be changed using the
127: .Fl c
1.1 deraadt 128: option.
1.2 deraadt 129: .Pp
1.15 deraadt 130: After a key is generated, instructions below detail where the keys
131: should be placed to be activated.
132: .Pp
1.2 deraadt 133: The options are as follows:
134: .Bl -tag -width Ds
135: .It Fl b Ar bits
1.12 aaron 136: Specifies the number of bits in the key to create.
137: Minimum is 512 bits.
138: Generally 1024 bits is considered sufficient, and key sizes
139: above that no longer improve security but make things slower.
140: The default is 1024 bits.
1.2 deraadt 141: .It Fl c
1.1 deraadt 142: Requests changing the comment in the private and public key files.
143: The program will prompt for the file containing the private keys, for
144: passphrase if the key has one, and for the new comment.
1.9 markus 145: .It Fl f
146: Specifies the filename of the key file.
147: .It Fl l
148: Show fingerprint of specified private or public key file.
1.2 deraadt 149: .It Fl p
1.1 deraadt 150: Requests changing the passphrase of a private key file instead of
1.12 aaron 151: creating a new private key.
152: The program will prompt for the file
1.1 deraadt 153: containing the private key, for the old passphrase, and twice for the
154: new passphrase.
1.5 aaron 155: .It Fl q
156: Silence
157: .Nm ssh-keygen .
158: Used by
159: .Pa /etc/rc
160: when creating a new key.
1.18.2.3 jason 161: .It Fl t Ar type
162: Specifies the type of the key to create.
163: The possible values are
164: .Dq rsa1
165: for protocol version 1 and
166: .Dq rsa
167: or
168: .Dq dsa
169: for protocol version 2.
170: The default is
1.18.2.4! jason 171: .Dq rsa1 .
! 172: .It Fl B
! 173: Show the bubblebabble digest of specified private or public key file.
1.2 deraadt 174: .It Fl C Ar comment
1.1 deraadt 175: Provides the new comment.
1.2 deraadt 176: .It Fl N Ar new_passphrase
1.1 deraadt 177: Provides the new passphrase.
1.2 deraadt 178: .It Fl P Ar passphrase
1.1 deraadt 179: Provides the (old) passphrase.
1.16 deraadt 180: .It Fl x
1.17 markus 181: This option will read a private
1.18 hugh 182: OpenSSH DSA format file and print a SSH2-compatible public key to stdout.
1.16 deraadt 183: .It Fl X
1.18.2.2 jason 184: This option will read a unencrypted
185: SSH2-compatible private (or public) key file and
186: print an OpenSSH compatible private (or public) key to stdout.
1.17 markus 187: .It Fl y
188: This option will read a private
1.18.2.3 jason 189: OpenSSH format file and print an OpenSSH public key to stdout.
1.2 deraadt 190: .El
191: .Sh FILES
192: .Bl -tag -width Ds
193: .It Pa $HOME/.ssh/identity
1.12 aaron 194: Contains the RSA authentication identity of the user.
195: This file should not be readable by anyone but the user.
196: It is possible to
1.1 deraadt 197: specify a passphrase when generating the key; that passphrase will be
1.12 aaron 198: used to encrypt the private part of this file using 3DES.
199: This file is not automatically accessed by
1.2 deraadt 200: .Nm
1.1 deraadt 201: but it is offered as the default file for the private key.
1.15 deraadt 202: .Xr sshd 8
203: will read this file when a login attempt is made.
1.2 deraadt 204: .It Pa $HOME/.ssh/identity.pub
1.12 aaron 205: Contains the public key for authentication.
206: The contents of this file should be added to
1.2 deraadt 207: .Pa $HOME/.ssh/authorized_keys
208: on all machines
1.12 aaron 209: where you wish to log in using RSA authentication.
1.15 deraadt 210: There is no need to keep the contents of this file secret.
211: .It Pa $HOME/.ssh/id_dsa
212: Contains the DSA authentication identity of the user.
213: This file should not be readable by anyone but the user.
214: It is possible to
215: specify a passphrase when generating the key; that passphrase will be
216: used to encrypt the private part of this file using 3DES.
217: This file is not automatically accessed by
218: .Nm
219: but it is offered as the default file for the private key.
220: .Xr sshd 8
221: will read this file when a login attempt is made.
222: .It Pa $HOME/.ssh/id_dsa.pub
223: Contains the public key for authentication.
224: The contents of this file should be added to
225: .Pa $HOME/.ssh/authorized_keys2
226: on all machines
1.18.2.3 jason 227: where you wish to log in using public key authentication.
1.12 aaron 228: There is no need to keep the contents of this file secret.
1.18.2.1 jason 229: .El
1.18.2.3 jason 230: .Sh AUTHORS
231: OpenSSH is a derivative of the original and free
232: ssh 1.2.12 release by Tatu Ylonen.
233: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
234: Theo de Raadt and Dug Song
235: removed many bugs, re-added newer features and
236: created OpenSSH.
237: Markus Friedl contributed the support for SSH
238: protocol versions 1.5 and 2.0.
1.2 deraadt 239: .Sh SEE ALSO
240: .Xr ssh 1 ,
241: .Xr ssh-add 1 ,
1.8 ericj 242: .Xr ssh-agent 1 ,
1.18.2.3 jason 243: .Xr sshd 8
![[BACK]](/icons/back.gif){kind=icon}
Return to ssh-keygen.1 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh