src/usr.bin/ssh/ssh.1 - diff

Return to ssh.1 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh.1 between version 1.182.2.1 and 1.182.2.2

version 1.182.2.1, 2004/08/19 04:13:27

version 1.182.2.2, 2005/03/10 17:15:05

Line 43

.Nd OpenSSH SSH client (remote login program)

.Sh SYNOPSIS

.Nm ssh

.Bk -words

.Op Fl 1246AaCfgkMNnqsTtVvXxY

.Op Fl b Ar bind_address

.Op Fl c Ar cipher_spec

.Bk -words

.Op Fl D Ar port

.Op Fl e Ar escape_char

.Op Fl F Ar configfile

.Op Fl i Ar identity_file

.Oo Fl L Xo

.Oo Fl L\ \&

.Sm off

.Ar port :

.Oo Ar bind_address : Oc

.Ar host :

.Ar port : host : hostport

.Ar hostport

.Sm on

.Xc

.Oc

.Ek

.Op Fl l Ar login_name

.Op Fl m Ar mac_spec

.Op Fl O Ar ctl_cmd

.Op Fl o Ar option

.Bk -words

.Op Fl p Ar port

.Ek

.Oo Fl R\ \&

.Oo Fl R Xo

.Sm off

.Ar port :

.Oo Ar bind_address : Oc

.Ar host :

.Ar port : host : hostport

.Ar hostport

.Sm on

.Xc

.Oc

.Op Fl S Ar ctl

.Op Fl S Ar ctl_path

.Oo Ar user Ns @ Oc Ns Ar hostname

.Op Ar command

.Ek

.Sh DESCRIPTION

.Nm

(SSH client) is a program for logging into a remote machine and for

Line 103

Line 98

.Ar command

is executed on the remote host instead of a login shell.

.Ss SSH protocol version 1

First, if the machine the user logs in from is listed in

The first authentication method is the

.Em rhosts

.Em hosts.equiv

method combined with RSA-based host authentication.

If the machine the user logs in from is listed in

.Pa /etc/hosts.equiv

.Pa /etc/shosts.equiv

on the remote machine, and the user names are

the same on both sides, the user is immediately permitted to log in.

the same on both sides, or if the files

Second, if

.Pa $HOME/.rhosts

.Pa .rhosts

.Pa .shosts

.Pa $HOME/.shosts

exists in the user's home directory on the

exist in the user's home directory on the

remote machine and contains a line containing the name of the client

remote machine and contain a line containing the name of the client

machine and the name of the user on that machine, the user is

permitted to log in.

considered for log in.

This form of authentication alone is normally not

Additionally, if the server can verify the client's

allowed by the server because it is not secure.

.Pp

The second authentication method is the

.Em rhosts

.Em hosts.equiv

method combined with RSA-based host authentication.

It means that if the login would be permitted by

.Pa $HOME/.rhosts ,

.Pa $HOME/.shosts ,

.Pa /etc/hosts.equiv ,

.Pa /etc/shosts.equiv ,

and if additionally the server can verify the client's

host key (see

.Pa /etc/ssh/ssh_known_hosts

and

Line 147

Line 132

and the rlogin/rsh protocol in general, are inherently insecure and should be

disabled if security is desired.]

.Pp

As a third authentication method,

As a second authentication method,

.Nm

supports RSA based authentication.

The scheme is based on public-key cryptography: there are cryptosystems

Line 195

Line 180

file, and has one key

per line, though the lines can be very long).

After this, the user can log in without giving the password.

RSA authentication is much more secure than

.Em rhosts

authentication.

.Pp

The most convenient way to use RSA authentication may be with an

authentication agent.

Line 582

Line 564

Disables forwarding (delegation) of GSSAPI credentials to the server.

.It Fl L Xo

.Sm off

.Oo Ar bind_address : Oc

.Ar port : host : hostport

.Sm on

.Xc

Line 589

Line 572

forwarded to the given host and port on the remote side.

This works by allocating a socket to listen to

.Ar port

on the local side, and whenever a connection is made to this port, the

on the local side, optionally bound to the specified

.Ar bind_address .

Whenever a connection is made to this port, the

connection is forwarded over the secure channel, and a connection is

made to

.Ar host

Line 597

Line 582

.Ar hostport

from the remote machine.

Port forwardings can also be specified in the configuration file.

Only root can forward privileged ports.

IPv6 addresses can be specified with an alternative syntax:

.Sm off

.Xo

.Op Ar bind_address No /

.Ar port No / Ar host No /

.Ar hostport .

.Ar hostport

.Xc

.Sm on

or by enclosing the address in square brackets.

Only the superuser can forward privileged ports.

By default, the local port is bound in accordance with the

.Cm GatewayPorts

setting.

However, an explicit

.Ar bind_address

may be used to bind the connection to a specific address.

The

.Ar bind_address

.Dq localhost

indicates that the listening port be bound for local use only, while an

empty address or

.Sq *

indicates that the port should be available from all interfaces.

.It Fl l Ar login_name

Specifies the user to log in as on the remote machine.

This also may be specified on a per-host basis in the configuration file.

Line 650

Line 651

needs to ask for a password or passphrase; see also the

.Fl f

option.)

.It Fl O Ar ctl_cmd

Control an active connection multiplexing master process.

When the

.Fl O

option is specified, the

.Ar ctl_cmd

argument is interpreted and passed to the master process.

Valid commands are:

.Dq check

(check that the master process is running) and

.Dq exit

(request the master to exit).

.It Fl o Ar option

Can be used to give options in the format used in the configuration file.

This is useful for specifying options for which there is no separate

Line 681

Line 694

.It GlobalKnownHostsFile

.It GSSAPIAuthentication

.It GSSAPIDelegateCredentials

.It HashKnownHosts

.It Host

.It HostbasedAuthentication

.It HostKeyAlgorithms

Line 688

Line 702

.It HostName

.It IdentityFile

.It IdentitiesOnly

.It KbdInteractiveDevices

.It LocalForward

.It LogLevel

.It MACs

Line 723

Line 738

Causes all warning and diagnostic messages to be suppressed.

.It Fl R Xo

.Sm off

.Oo Ar bind_address : Oc

.Ar port : host : hostport

.Sm on

.Xc

Line 737

Line 753

port

.Ar hostport

from the local machine.

.Pp

Port forwardings can also be specified in the configuration file.

Privileged ports can be forwarded only when

logging in as root on the remote machine.

IPv6 addresses can be specified with an alternative syntax:

IPv6 addresses can be specified by enclosing the address in square braces or

using an alternative syntax:

.Sm off

.Xo

.Ar port No / Ar host No /

.Op Ar bind_address No /

.Ar hostport .

.Ar host No / Ar port No /

.Xc

.Ar hostport

.Xc .

.Sm on

.It Fl S Ar ctl

.Pp

By default, the listening socket on the server will be bound to the loopback

interface only.

This may be overriden by specifying a

.Ar bind_address .

An empty

.Ar bind_address ,

or the address

.Ql * ,

indicates that the remote socket should listen on all interfaces.

Specifying a remote

.Ar bind_address

will only succeed if the server's

.Cm GatewayPorts

option is enabled (see

.Xr sshd_config 5 ) .

.It Fl S Ar ctl_path

Specifies the location of a control socket for connection sharing.

Refer to the description of

.Cm ControlPath

Line 796

Line 831

(for the user's X authorization database)

can access the local X11 display through the forwarded connection.

An attacker may then be able to perform activities such as keystroke monitoring.

.Pp

For this reason, X11 forwarding is subjected to X11 SECURITY extension

restrictions by default.

Please refer to the

.Nm

.Fl Y

option and the

.Cm ForwardX11Trusted

directive in

.Xr ssh_config 5

for more information.

.It Fl x

Disables X11 forwarding.

.It Fl Y

Enables trusted X11 forwarding.

Trusted X11 forwardings are not subjected to the X11 SECURITY extension

controls.

.El

.Sh CONFIGURATION FILES

.Nm

Line 859

Line 907

This is particularly useful when calling

.Nm

from a

.Pa .Xsession

.Pa .xsession

or related script.

(Note that on some machines it

may be necessary to redirect the input from

Line 1012

Line 1060

is not setuid root.

.It Pa $HOME/.rhosts

This file is used in

.Em rhosts

.Cm RhostsRSAAuthentication

and

.Cm HostbasedAuthentication

authentication to list the

host/user pairs that are permitted to log in.

(Note that this file is

Line 1031

Line 1081

permission for most machines is read/write for the user, and not

accessible by others.

.Pp

Note that by default

Note that

.Xr sshd 8

will be installed so that it requires successful RSA host

allows authentication only in combination with client host key

authentication before permitting

authentication before permitting log in.

.Em rhosts

authentication.

If the server machine does not have the client's host key in

.Pa /etc/ssh/ssh_known_hosts ,

it can be stored in

Line 1049

Line 1097

This file is used exactly the same way as

.Pa .rhosts .

The purpose for

having this file is to be able to use rhosts authentication with

having this file is to be able to use

.Nm

.Cm RhostsRSAAuthentication

without permitting login with

and

.Cm HostbasedAuthentication

authentication without permitting login with

.Xr rlogin

.Xr rsh 1 .

.It Pa /etc/hosts.equiv

This file is used during

.Em rhosts

.Cm RhostsRSAAuthentication

and

.Cm HostbasedAuthentication

authentication.

It contains

canonical hosts names, one per line (the full format is described in the

Line 1066

Line 1118

If the client host is found in this file, login is

automatically permitted provided client and server user names are the

same.

Additionally, successful RSA host authentication is normally

Additionally, successful client host key authentication is required.

required.

This file should only be writable by root.

.It Pa /etc/shosts.equiv

This file is processed exactly as