Annotation of src/usr.bin/ssh/ssh-keygen.1, Revision 1.57
1.57 ! jakob 1: .\" $OpenBSD: ssh-keygen.1,v 1.56 2003/03/28 10:11:43 jmc Exp $
1.29 niklas 2: .\"
1.1 deraadt 3: .\" -*- nroff -*-
4: .\"
5: .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
6: .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
7: .\" All rights reserved
8: .\"
1.22 deraadt 9: .\" As far as I am concerned, the code I have written for this software
10: .\" can be used freely for any purpose. Any derived versions of this
11: .\" software must be clearly marked as such, and if the derived work is
12: .\" incompatible with the protocol description in the RFC file, it must be
13: .\" called by a name other than "ssh" or "Secure Shell".
14: .\"
15: .\"
1.33 deraadt 16: .\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
17: .\" Copyright (c) 1999 Aaron Campbell. All rights reserved.
18: .\" Copyright (c) 1999 Theo de Raadt. All rights reserved.
1.22 deraadt 19: .\"
20: .\" Redistribution and use in source and binary forms, with or without
21: .\" modification, are permitted provided that the following conditions
22: .\" are met:
23: .\" 1. Redistributions of source code must retain the above copyright
24: .\" notice, this list of conditions and the following disclaimer.
25: .\" 2. Redistributions in binary form must reproduce the above copyright
26: .\" notice, this list of conditions and the following disclaimer in the
27: .\" documentation and/or other materials provided with the distribution.
1.1 deraadt 28: .\"
1.22 deraadt 29: .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
30: .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
31: .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
32: .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
33: .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
34: .\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35: .\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36: .\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37: .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
38: .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.1 deraadt 39: .\"
1.2 deraadt 40: .Dd September 25, 1999
41: .Dt SSH-KEYGEN 1
42: .Os
43: .Sh NAME
44: .Nm ssh-keygen
1.37 markus 45: .Nd authentication key generation, management and conversion
1.2 deraadt 46: .Sh SYNOPSIS
47: .Nm ssh-keygen
1.56 jmc 48: .Bk -words
1.25 markus 49: .Op Fl q
1.2 deraadt 50: .Op Fl b Ar bits
1.53 stevesk 51: .Fl t Ar type
1.2 deraadt 52: .Op Fl N Ar new_passphrase
53: .Op Fl C Ar comment
1.20 markus 54: .Op Fl f Ar output_keyfile
1.56 jmc 55: .Ek
1.2 deraadt 56: .Nm ssh-keygen
57: .Fl p
58: .Op Fl P Ar old_passphrase
59: .Op Fl N Ar new_passphrase
1.9 markus 60: .Op Fl f Ar keyfile
1.2 deraadt 61: .Nm ssh-keygen
1.37 markus 62: .Fl i
1.20 markus 63: .Op Fl f Ar input_keyfile
1.16 deraadt 64: .Nm ssh-keygen
1.37 markus 65: .Fl e
1.20 markus 66: .Op Fl f Ar input_keyfile
1.16 deraadt 67: .Nm ssh-keygen
1.17 markus 68: .Fl y
1.20 markus 69: .Op Fl f Ar input_keyfile
1.17 markus 70: .Nm ssh-keygen
1.2 deraadt 71: .Fl c
72: .Op Fl P Ar passphrase
73: .Op Fl C Ar comment
1.9 markus 74: .Op Fl f Ar keyfile
75: .Nm ssh-keygen
76: .Fl l
1.35 markus 77: .Op Fl f Ar input_keyfile
78: .Nm ssh-keygen
79: .Fl B
1.20 markus 80: .Op Fl f Ar input_keyfile
1.48 jakob 81: .Nm ssh-keygen
82: .Fl D Ar reader
83: .Nm ssh-keygen
84: .Fl U Ar reader
85: .Op Fl f Ar input_keyfile
1.57 ! jakob 86: .Nm ssh-keygen
! 87: .Fl r Ar hostname
! 88: .Op Fl f Ar input_keyfile
! 89: .Op Fl g
1.13 aaron 90: .Sh DESCRIPTION
1.2 deraadt 91: .Nm
1.37 markus 92: generates, manages and converts authentication keys for
1.2 deraadt 93: .Xr ssh 1 .
1.15 deraadt 94: .Nm
1.54 deraadt 95: can create RSA keys for use by SSH protocol version 1 and RSA or DSA
1.52 djm 96: keys for use by SSH protocol version 2. The type of key to be generated
97: is specified with the
1.25 markus 98: .Fl t
1.52 djm 99: option.
1.15 deraadt 100: .Pp
1.2 deraadt 101: Normally each user wishing to use SSH
1.15 deraadt 102: with RSA or DSA authentication runs this once to create the authentication
1.1 deraadt 103: key in
1.36 itojun 104: .Pa $HOME/.ssh/identity ,
105: .Pa $HOME/.ssh/id_dsa
1.15 deraadt 106: or
1.36 itojun 107: .Pa $HOME/.ssh/id_rsa .
1.15 deraadt 108: Additionally, the system administrator may use this to generate host keys,
109: as seen in
110: .Pa /etc/rc .
1.2 deraadt 111: .Pp
1.1 deraadt 112: Normally this program generates the key and asks for a file in which
1.12 aaron 113: to store the private key.
114: The public key is stored in a file with the same name but
1.2 deraadt 115: .Dq .pub
1.12 aaron 116: appended.
117: The program also asks for a passphrase.
118: The passphrase may be empty to indicate no passphrase
1.26 markus 119: (host keys must have an empty passphrase), or it may be a string of
1.12 aaron 120: arbitrary length.
1.51 stevesk 121: A passphrase is similar to a password, except it can be a phrase with a
122: series of words, punctuation, numbers, whitespace, or any string of
123: characters you want.
124: Good passphrases are 10-30 characters long, are
1.1 deraadt 125: not simple sentences or otherwise easily guessable (English
1.42 markus 126: prose has only 1-2 bits of entropy per character, and provides very bad
1.51 stevesk 127: passphrases), and contain a mix of upper and lowercase letters,
128: numbers, and non-alphanumeric characters.
1.12 aaron 129: The passphrase can be changed later by using the
1.2 deraadt 130: .Fl p
1.1 deraadt 131: option.
1.2 deraadt 132: .Pp
1.12 aaron 133: There is no way to recover a lost passphrase.
134: If the passphrase is
1.49 deraadt 135: lost or forgotten, a new key must be generated and copied to the
1.1 deraadt 136: corresponding public key to other machines.
1.2 deraadt 137: .Pp
1.37 markus 138: For RSA1 keys,
139: there is also a comment field in the key file that is only for
1.12 aaron 140: convenience to the user to help identify the key.
141: The comment can tell what the key is for, or whatever is useful.
142: The comment is initialized to
1.2 deraadt 143: .Dq user@host
144: when the key is created, but can be changed using the
145: .Fl c
1.1 deraadt 146: option.
1.2 deraadt 147: .Pp
1.15 deraadt 148: After a key is generated, instructions below detail where the keys
149: should be placed to be activated.
150: .Pp
1.2 deraadt 151: The options are as follows:
152: .Bl -tag -width Ds
153: .It Fl b Ar bits
1.12 aaron 154: Specifies the number of bits in the key to create.
155: Minimum is 512 bits.
1.55 stevesk 156: Generally, 1024 bits is considered sufficient.
1.12 aaron 157: The default is 1024 bits.
1.2 deraadt 158: .It Fl c
1.1 deraadt 159: Requests changing the comment in the private and public key files.
1.50 markus 160: This operation is only supported for RSA1 keys.
1.1 deraadt 161: The program will prompt for the file containing the private keys, for
1.41 stevesk 162: the passphrase if the key has one, and for the new comment.
1.37 markus 163: .It Fl e
1.40 markus 164: This option will read a private or public OpenSSH key file and
165: print the key in a
1.37 markus 166: .Sq SECSH Public Key File Format
167: to stdout.
168: This option allows exporting keys for use by several commercial
169: SSH implementations.
1.57 ! jakob 170: .It Fl g
! 171: Use generic DNS resource record format.
1.48 jakob 172: .It Fl f Ar filename
1.9 markus 173: Specifies the filename of the key file.
1.37 markus 174: .It Fl i
175: This option will read an unencrypted private (or public) key file
176: in SSH2-compatible format and print an OpenSSH compatible private
177: (or public) key to stdout.
178: .Nm
1.38 markus 179: also reads the
1.37 markus 180: .Sq SECSH Public Key File Format .
181: This option allows importing keys from several commercial
182: SSH implementations.
1.9 markus 183: .It Fl l
1.50 markus 184: Show fingerprint of specified public key file.
185: Private RSA1 keys are also supported.
186: For RSA and DSA keys
187: .Nm
188: tries to find the matching public key file and prints its fingerprint.
1.2 deraadt 189: .It Fl p
1.1 deraadt 190: Requests changing the passphrase of a private key file instead of
1.12 aaron 191: creating a new private key.
192: The program will prompt for the file
1.1 deraadt 193: containing the private key, for the old passphrase, and twice for the
194: new passphrase.
1.5 aaron 195: .It Fl q
196: Silence
197: .Nm ssh-keygen .
198: Used by
199: .Pa /etc/rc
200: when creating a new key.
1.37 markus 201: .It Fl y
202: This option will read a private
203: OpenSSH format file and print an OpenSSH public key to stdout.
1.25 markus 204: .It Fl t Ar type
205: Specifies the type of the key to create.
206: The possible values are
207: .Dq rsa1
208: for protocol version 1 and
209: .Dq rsa
210: or
211: .Dq dsa
212: for protocol version 2.
1.35 markus 213: .It Fl B
214: Show the bubblebabble digest of specified private or public key file.
1.2 deraadt 215: .It Fl C Ar comment
1.1 deraadt 216: Provides the new comment.
1.48 jakob 217: .It Fl D Ar reader
218: Download the RSA public key stored in the smartcard in
219: .Ar reader .
1.2 deraadt 220: .It Fl N Ar new_passphrase
1.1 deraadt 221: Provides the new passphrase.
1.2 deraadt 222: .It Fl P Ar passphrase
1.1 deraadt 223: Provides the (old) passphrase.
1.48 jakob 224: .It Fl U Ar reader
225: Upload an existing RSA private key into the smartcard in
226: .Ar reader .
1.57 ! jakob 227: .It Fl r Ar hostname
! 228: Print DNS resource record with the specified
! 229: .Ar hostname .
1.2 deraadt 230: .El
231: .Sh FILES
232: .Bl -tag -width Ds
233: .It Pa $HOME/.ssh/identity
1.36 itojun 234: Contains the protocol version 1 RSA authentication identity of the user.
1.12 aaron 235: This file should not be readable by anyone but the user.
236: It is possible to
1.1 deraadt 237: specify a passphrase when generating the key; that passphrase will be
1.12 aaron 238: used to encrypt the private part of this file using 3DES.
239: This file is not automatically accessed by
1.2 deraadt 240: .Nm
1.1 deraadt 241: but it is offered as the default file for the private key.
1.46 markus 242: .Xr ssh 1
1.15 deraadt 243: will read this file when a login attempt is made.
1.2 deraadt 244: .It Pa $HOME/.ssh/identity.pub
1.36 itojun 245: Contains the protocol version 1 RSA public key for authentication.
1.12 aaron 246: The contents of this file should be added to
1.2 deraadt 247: .Pa $HOME/.ssh/authorized_keys
248: on all machines
1.49 deraadt 249: where the user wishes to log in using RSA authentication.
1.15 deraadt 250: There is no need to keep the contents of this file secret.
251: .It Pa $HOME/.ssh/id_dsa
1.36 itojun 252: Contains the protocol version 2 DSA authentication identity of the user.
1.15 deraadt 253: This file should not be readable by anyone but the user.
254: It is possible to
255: specify a passphrase when generating the key; that passphrase will be
256: used to encrypt the private part of this file using 3DES.
257: This file is not automatically accessed by
258: .Nm
259: but it is offered as the default file for the private key.
1.46 markus 260: .Xr ssh 1
1.15 deraadt 261: will read this file when a login attempt is made.
262: .It Pa $HOME/.ssh/id_dsa.pub
1.36 itojun 263: Contains the protocol version 2 DSA public key for authentication.
264: The contents of this file should be added to
1.43 markus 265: .Pa $HOME/.ssh/authorized_keys
1.36 itojun 266: on all machines
1.49 deraadt 267: where the user wishes to log in using public key authentication.
1.36 itojun 268: There is no need to keep the contents of this file secret.
269: .It Pa $HOME/.ssh/id_rsa
270: Contains the protocol version 2 RSA authentication identity of the user.
271: This file should not be readable by anyone but the user.
272: It is possible to
273: specify a passphrase when generating the key; that passphrase will be
274: used to encrypt the private part of this file using 3DES.
275: This file is not automatically accessed by
276: .Nm
277: but it is offered as the default file for the private key.
1.46 markus 278: .Xr ssh 1
1.36 itojun 279: will read this file when a login attempt is made.
280: .It Pa $HOME/.ssh/id_rsa.pub
281: Contains the protocol version 2 RSA public key for authentication.
1.15 deraadt 282: The contents of this file should be added to
1.43 markus 283: .Pa $HOME/.ssh/authorized_keys
1.15 deraadt 284: on all machines
1.49 deraadt 285: where the user wishes to log in using public key authentication.
1.12 aaron 286: There is no need to keep the contents of this file secret.
1.19 aaron 287: .El
1.24 aaron 288: .Sh AUTHORS
1.28 markus 289: OpenSSH is a derivative of the original and free
290: ssh 1.2.12 release by Tatu Ylonen.
291: Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
292: Theo de Raadt and Dug Song
293: removed many bugs, re-added newer features and
294: created OpenSSH.
295: Markus Friedl contributed the support for SSH
296: protocol versions 1.5 and 2.0.
1.2 deraadt 297: .Sh SEE ALSO
298: .Xr ssh 1 ,
299: .Xr ssh-add 1 ,
1.8 ericj 300: .Xr ssh-agent 1 ,
1.30 itojun 301: .Xr sshd 8
1.37 markus 302: .Rs
1.45 deraadt 303: .%A J. Galbraith
304: .%A R. Thayer
1.37 markus 305: .%T "SECSH Public Key File Format"
306: .%N draft-ietf-secsh-publickeyfile-01.txt
307: .%D March 2001
308: .%O work in progress material
309: .Re
![[BACK]](/icons/back.gif){kind=icon}
Return to ssh-keygen.1 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh