src/usr.bin/ssh/ssh.1 - diff

Return to ssh.1 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh.1 between version 1.43 and 1.44

version 1.43, 2000/03/24 03:04:46

version 1.44, 2000/04/12 21:47:51

Line 49

.Oc

.Op Ar hostname | user@hostname

.Op Ar command

.Sh DESCRIPTION

.Nm

(Secure Shell) is a program for logging into a remote machine and for

executing commands on a remote machine.

Line 60

arbitrary TCP/IP ports can also be forwarded over the secure channel.

.Pp

.Nm

connects and logs into the specified

.Ar hostname .

The user must prove

his/her identity to the remote machine using one of several methods.

Line 71

.Pa /etc/shosts.equiv

on the remote machine, and the user names are

the same on both sides, the user is immediately permitted to log in.

Second, if

.Pa \&.rhosts

.Pa \&.shosts

Line 94

.Pa /etc/shosts.equiv ,

and if additionally the server can verify the client's

host key (see

.Pa /etc/ssh_known_hosts

and

.Pa $HOME/.ssh/known_hosts

Line 109

and the rlogin/rsh protocol in general, are inherently insecure and should be

disabled if security is desired.]

.Pp

As a third authentication method,

.Nm

supports RSA based authentication.

The scheme is based on public-key cryptography: there are cryptosystems

where encryption and decryption are done using separate keys, and it

is not possible to derive the decryption key from the encryption key.

RSA is one such system.

The idea is that each user creates a public/private

key pair for authentication purposes.

The server knows the public key, and only the user knows the private key.

The file

.Pa $HOME/.ssh/authorized_keys

lists the public keys that are permitted for logging

in.

Line 142

implements the RSA authentication protocol automatically.

The user creates his/her RSA key pair by running

.Xr ssh-keygen 1 .

This stores the private key in

.Pa \&.ssh/identity

and the public key in

.Pa \&.ssh/identity.pub

in the user's home directory.

The user should then copy the

.Pa identity.pub

.Pa \&.ssh/authorized_keys

in his/her home directory on the remote machine (the

.Pa authorized_keys

file corresponds to the conventional

.Pa \&.rhosts

file, and has one key

per line, though the lines can be very long).

Line 167

.Xr ssh-agent 1

for more information.

.Pp

If other authentication methods fail,

.Nm

prompts the user for a password.

The password is sent to the remote

Line 188

with

.Ic ~^Z .

All forwarded connections can be listed with

.Ic ~#

and if

the session blocks waiting for forwarded X11 or TCP/IP

connections to terminate, it can be backgrounded with

Line 232

configured on the command line or in configuration files.

.Pp

The

.Ev DISPLAY

value set by

.Nm

will point to the server machine, but with a display number greater

Line 265

.Nm

automatically maintains and checks a database containing RSA-based

identifications for all hosts it has ever been used with.

The database is stored in

.Pa \&.ssh/known_hosts

in the user's home directory.

Additionally, the file

.Pa /etc/ssh_known_hosts

is automatically checked for known hosts.

Any new hosts are automatically added to the user's file.

Line 290

Disables forwarding of the authentication agent connection.

This may also be specified on a per-host basis in the configuration file.

.It Fl c Ar blowfish|3des

Selects the cipher to use for encrypting the session.

.Ar 3des

is used by default.

It is believed to be secure.

.Ar 3des

(triple-des) is an encrypt-decrypt-encrypt triple with three different keys.

It is presumably more secure than the

Line 322

.Nm

is going to ask for passwords or passphrases, but the user

wants it in the background.

This implies

.Fl n .

The recommended way to start X11 programs at a remote site is with

something like

Line 330

.It Fl g

Allows remote hosts to connect to local forwarded ports.

.It Fl i Ar identity_file

Selects the file from which the identity (private key) for

RSA authentication is read.

Default is

.Pa \&.ssh/identity

in the user's home directory.

Identity files may also be specified on

Line 577

to disable the escape

character entirely (making the connection transparent for binary

data).

.It Cm FallBackToRsh

Specifies that if connecting via

.Nm

fails due to a connection refused error (there is no

.Xr sshd 8

listening on the remote host),

.Xr rsh 1

should automatically be used instead (after a suitable warning about

the session being unencrypted).

Line 599

.Dq no .

.It Cm ForwardX11

Specifies whether X11 connections will be automatically redirected

over the secure channel and

.Ev DISPLAY

set.

The argument must be

.Dq yes

.Dq no .

Line 618

The default is

.Dq no .

.It Cm GlobalKnownHostsFile

Specifies a file to use instead of

.Pa /etc/ssh_known_hosts .

.It Cm HostName

Specifies the real host name to log into.

Line 773

.Dq no .

.It Cm StrictHostKeyChecking

If this flag is set to

.Dq yes ,

.Nm

ssh will never automatically add host keys to the

.Pa $HOME/.ssh/known_hosts

Line 839

The

.Ev DISPLAY

variable indicates the location of the X11 server.

It is automatically set by

.Nm

to point to a value of the form

.Dq hostname:n

Line 885

Set to the name of the user logging in.

.El

.Pp

Additionally,

.Nm

reads

.Pa $HOME/.ssh/environment ,

and adds lines of the format

.Dq VARNAME=value

to the environment.

Line 911

It is possible to specify a passphrase when

generating the key; the passphrase will be used to encrypt the

sensitive part of this file using 3DES.

.It Pa $HOME/.ssh/identity.pub

Contains the public key for authentication (public part of the

identity file in human-readable form).

The contents of this file should be added to

Line 1031

required.

This file should only be writable by root.

.It Pa /etc/shosts.equiv

This file is processed exactly as

.Pa /etc/hosts.equiv .

This file may be useful to permit logins using

.Nm

Line 1048

.Nm

when the user logs in just before the user's shell (or command) is

started.

See the

.Xr sshd 8

manual page for more information.

.It Pa $HOME/.ssh/environment

Line 1077

has been updated to support ssh protocol 1.5, making it compatible with

all other ssh protocol 1 clients and servers.

.It

contains added support for

.Xr kerberos 8

authentication and ticket passing.

.It