src/usr.bin/ssh/ssh.1 - diff

Return to ssh.1 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh.1 between version 1.196 and 1.196.2.1

version 1.196, 2004/08/30 21:22:49

version 1.196.2.1, 2005/03/10 16:28:28

Line 43

.Nd OpenSSH SSH client (remote login program)

.Sh SYNOPSIS

.Nm ssh

.Bk -words

.Op Fl 1246AaCfgkMNnqsTtVvXxY

.Op Fl b Ar bind_address

.Op Fl c Ar cipher_spec

.Bk -words

.Op Fl D Ar port

.Op Fl e Ar escape_char

.Op Fl F Ar configfile

.Op Fl i Ar identity_file

.Oo Fl L Xo

.Oo Fl L\ \&

.Sm off

.Ar port :

.Oo Ar bind_address : Oc

.Ar host :

.Ar port : host : hostport

.Ar hostport

.Sm on

.Xc

.Oc

.Ek

.Op Fl l Ar login_name

.Op Fl m Ar mac_spec

.Op Fl O Ar ctl_cmd

.Op Fl o Ar option

.Bk -words

.Op Fl p Ar port

.Ek

.Oo Fl R\ \&

.Oo Fl R Xo

.Sm off

.Ar port :

.Oo Ar bind_address : Oc

.Ar host :

.Ar port : host : hostport

.Ar hostport

.Sm on

.Xc

.Oc

.Op Fl S Ar ctl

.Op Fl S Ar ctl_path

.Oo Ar user Ns @ Oc Ns Ar hostname

.Op Ar command

.Ek

.Sh DESCRIPTION

.Nm

(SSH client) is a program for logging into a remote machine and for

Line 569

Line 564

Disables forwarding (delegation) of GSSAPI credentials to the server.

.It Fl L Xo

.Sm off

.Oo Ar bind_address : Oc

.Ar port : host : hostport

.Sm on

.Xc

Line 576

Line 572

forwarded to the given host and port on the remote side.

This works by allocating a socket to listen to

.Ar port

on the local side, and whenever a connection is made to this port, the

on the local side, optionally bound to the specified

.Ar bind_address .

Whenever a connection is made to this port, the

connection is forwarded over the secure channel, and a connection is

made to

.Ar host

Line 584

Line 582

.Ar hostport

from the remote machine.

Port forwardings can also be specified in the configuration file.

Only root can forward privileged ports.

IPv6 addresses can be specified with an alternative syntax:

.Sm off

.Xo

.Op Ar bind_address No /

.Ar port No / Ar host No /

.Ar hostport .

.Ar hostport

.Xc

.Sm on

or by enclosing the address in square brackets.

Only the superuser can forward privileged ports.

By default, the local port is bound in accordance with the

.Cm GatewayPorts

setting.

However, an explicit

.Ar bind_address

may be used to bind the connection to a specific address.

The

.Ar bind_address

.Dq localhost

indicates that the listening port be bound for local use only, while an

empty address or

.Sq *

indicates that the port should be available from all interfaces.

.It Fl l Ar login_name

Specifies the user to log in as on the remote machine.

This also may be specified on a per-host basis in the configuration file.

Line 637

Line 651

needs to ask for a password or passphrase; see also the

.Fl f

option.)

.It Fl O Ar ctl_cmd

Control an active connection multiplexing master process.

When the

.Fl O

option is specified, the

.Ar ctl_cmd

argument is interpreted and passed to the master process.

Valid commands are:

.Dq check

(check that the master process is running) and

.Dq exit

(request the master to exit).

.It Fl o Ar option

Can be used to give options in the format used in the configuration file.

This is useful for specifying options for which there is no separate

Line 668

Line 694

.It GlobalKnownHostsFile

.It GSSAPIAuthentication

.It GSSAPIDelegateCredentials

.It HashKnownHosts

.It Host

.It HostbasedAuthentication

.It HostKeyAlgorithms

Line 675

Line 702

.It HostName

.It IdentityFile

.It IdentitiesOnly

.It KbdInteractiveDevices

.It LocalForward

.It LogLevel

.It MACs

Line 710

Line 738

Causes all warning and diagnostic messages to be suppressed.

.It Fl R Xo

.Sm off

.Oo Ar bind_address : Oc

.Ar port : host : hostport

.Sm on

.Xc

Line 724

Line 753

port

.Ar hostport

from the local machine.

.Pp

Port forwardings can also be specified in the configuration file.

Privileged ports can be forwarded only when

logging in as root on the remote machine.

IPv6 addresses can be specified with an alternative syntax:

IPv6 addresses can be specified by enclosing the address in square braces or

using an alternative syntax:

.Sm off

.Xo

.Ar port No / Ar host No /

.Op Ar bind_address No /

.Ar hostport .

.Ar host No / Ar port No /

.Xc

.Ar hostport

.Xc .

.Sm on

.It Fl S Ar ctl

.Pp

By default, the listening socket on the server will be bound to the loopback

interface only.

This may be overriden by specifying a

.Ar bind_address .

An empty

.Ar bind_address ,

or the address

.Ql * ,

indicates that the remote socket should listen on all interfaces.

Specifying a remote

.Ar bind_address

will only succeed if the server's

.Cm GatewayPorts

option is enabled (see

.Xr sshd_config 5 ) .

.It Fl S Ar ctl_path

Specifies the location of a control socket for connection sharing.

Refer to the description of

.Cm ControlPath

Line 783

Line 831

(for the user's X authorization database)

can access the local X11 display through the forwarded connection.

An attacker may then be able to perform activities such as keystroke monitoring.

.Pp

For this reason, X11 forwarding is subjected to X11 SECURITY extension

restrictions by default.

Please refer to the

.Nm

.Fl Y

option and the

.Cm ForwardX11Trusted

directive in

.Xr ssh_config 5

for more information.

.It Fl x

Disables X11 forwarding.

.It Fl Y

Enables trusted X11 forwarding.

Trusted X11 forwardings are not subjected to the X11 SECURITY extension

controls.

.El

.Sh CONFIGURATION FILES

.Nm