src/usr.bin/ssh/ssh.1 - diff

Return to ssh.1 CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh.1 between version 1.64 and 1.64.2.3

version 1.64, 2000/10/16 21:46:31

version 1.64.2.3, 2001/03/21 19:46:30

Line 10

.\" incompatible with the protocol description in the RFC file, it must be

.\" called by a name other than "ssh" or "Secure Shell".

.\"

.\" Redistribution and use in source and binary forms, with or without

.\" modification, are permitted provided that the following conditions

Line 40

.Os

.Sh NAME

.Nm ssh

.Nd OpenSSH secure shell client (remote login program)

.Nd OpenSSH SSH client (remote login program)

.Sh SYNOPSIS

.Nm ssh

.Op Fl l Ar login_name

Line 48

.Op Ar command

.Pp

.Nm ssh

.Op Fl afgknqtvxACNPTX246

.Op Fl afgknqstvxACNPTX1246

.Op Fl c Ar cipher_spec

.Op Fl e Ar escape_char

.Op Fl i Ar identity_file

.Op Fl l Ar login_name

.Op Fl m Ar mac_spec

.Op Fl o Ar option

.Op Fl p Ar port

.Oo Fl L Xo

Line 75

Line 76

.Op Ar command

.Sh DESCRIPTION

.Nm

(Secure Shell) is a program for logging into a remote machine and for

(SSH client) is a program for logging into a remote machine and for

executing commands on a remote machine.

It is intended to replace

rlogin and rsh, and provide secure encrypted communications between

Line 209

Line 210

If this method fails password authentication is tried.

.Pp

The public key method is similar to RSA authentication described

in the previous section except that the DSA algorithm is used

in the previous section except that the DSA or RSA algorithm is used

instead of the patented RSA algorithm.

instead.

The client uses his private DSA key

The client uses his private key

.Pa $HOME/.ssh/id_dsa

to sign the session identifier and sends the result to the server.

The server checks whether the matching public key is listed in

Line 227

Line 228

.Pp

Protocol 2 provides additional mechanisms for confidentiality

(the traffic is encrypted using 3DES, Blowfish, CAST128 or Arcfour)

and integrity (hmac-sha1, hmac-md5).

and integrity (hmac-md5, hmac-sha1).

Note that protocol 1 lacks a strong mechanism for ensuring the

integrity of the connection.

.Pp

Line 272

Line 273

.Dq none

will also make the session transparent even if a tty is used.

.Pp

The session terminates when the command or shell in on the remote

The session terminates when the command or shell on the remote

machine exists and all X11 and TCP/IP connections have been closed.

machine exits and all X11 and TCP/IP connections have been closed.

The exit status of the remote program is returned as the exit status

.Nm ssh .

Line 321

Line 322

Forwarding of arbitrary TCP/IP connections over the secure channel can

be specified either on command line or in a configuration file.

One possible application of TCP/IP forwarding is a secure connection to an

electronic purse; another is going trough firewalls.

electronic purse; another is going through firewalls.

.Pp

.Ss Server authentication

.Pp

Line 331

Line 332

RSA host keys are stored in

.Pa $HOME/.ssh/known_hosts

and

DSA host keys are stored in

host keys used in the protocol version 2 are stored in

.Pa $HOME/.ssh/known_hosts2

in the user's home directory.

Additionally, the files

Line 352

Line 353

.Cm StrictHostKeyChecking

option (see below) can be used to prevent logins to machines whose

host key is not known or has changed.

.Sh OPTIONS

.Pp

The options are as follows:

.Bl -tag -width Ds

.It Fl a

Disables forwarding of the authentication agent connection.

Line 373

Line 375

.Ar blowfish

is a fast block cipher, it appears very secure and is much faster than

.Ar 3des .

.It Fl c Ar "3des-cbc,blowfish-cbc,arcfour,cast128-cbc"

.It Fl c Ar cipher_spec

Additionally, for protocol version 2 a comma-separated list of ciphers can

be specified in order of preference.

Protocol version 2 supports 3DES, Blowfish, and CAST128 in CBC mode

See

and Arcfour.

.Cm Ciphers

for more information.

.It Fl e Ar ch|^ch|none

Sets the escape character for sessions with a pty (default:

.Ql ~ ) .

Line 407

Line 410

Allows remote hosts to connect to local forwarded ports.

.It Fl i Ar identity_file

Selects the file from which the identity (private key) for

RSA authentication is read.

RSA or DSA authentication is read.

Default is

.Pa $HOME/.ssh/identity

in the user's home directory.

Line 423

Line 426

.It Fl l Ar login_name

Specifies the user to log in as on the remote machine.

This also may be specified on a per-host basis in the configuration file.

.It Fl m Ar mac_spec

Additionally, for protocol version 2 a comma-separated list of MAC

(message authentication code) algorithms can

be specified in order of preference.

See the

.Cm MACs

keyword for more information.

.It Fl n

Redirects stdin from

.Pa /dev/null

Line 445

Line 455

option.)

.It Fl N

Do not execute a remote command.

This is usefull if you just want to forward ports

This is useful if you just want to forward ports

(protocol version 2 only).

.It Fl o Ar option

Can be used to give options in the format used in the config file.

Line 463

Line 473

Note that this option turns off

.Cm RhostsAuthentication

and

.Cm RhostsRSAAuthentication .

.Cm RhostsRSAAuthentication

for older servers.

.It Fl q

Quiet mode.

Causes all warning and diagnostic messages to be suppressed.

Only fatal errors are displayed.

.It Fl s

May be used to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2 protocol which facilitate the use

of SSH as a secure transport for other application (eg. sftp). The

subsystem is specified as the remote command.

.It Fl t

Force pseudo-tty allocation.

This can be used to execute arbitrary

screen-based programs on a remote machine, which can be very useful,

e.g., when implementing menu services.

Multiple

.Fl t

options force tty allocation, even if

.Nm

has no local tty.

.It Fl T

Disable pseudo-tty allocation (protocol version 2 only).

Disable pseudo-tty allocation.

.It Fl v

Verbose mode.

Causes

Line 482

Line 502

to print debugging messages about its progress.

This is helpful in

debugging connection, authentication, and configuration problems.

The verbose mode is also used to display

Multiple

.Xr skey 1

.Fl v

challenges, if the user entered "s/key" as password.

options increases the verbosity.

Multiple -v options increases the verbosity.

Maximum is 3.

.It Fl x

Disables X11 forwarding.

Line 539

Line 558

Port forwardings can also be specified in the configuration file.

Privileged ports can be forwarded only when

logging in as root on the remote machine.

.It Fl 1

Forces

.Nm

to try protocol version 1 only.

.It Fl 2

Forces

.Nm

Line 642

Line 665

in order of preference.

Multiple ciphers must be comma-separated.

The default is

.Dq 3des-cbc,blowfish-cbc,cast128-cbc,arcfour .

.Pp

.Bd -literal

``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,

aes192-cbc,aes256-cbc,rijndael128-cbc,rijndael192-cbc,

rijndael256-cbc,rijndael-cbc@lysator.liu.se''

.Ed

.It Cm Compression

Specifies whether to use compression.

The argument must be

Line 660

Line 688

back to rsh or exiting.

The argument must be an integer.

This may be useful in scripts if the connection sometimes fails.

.It Cm DSAAuthentication

.It Cm PubkeyAuthentication

Specifies whether to try DSA authentication.

Specifies whether to try public key authentication.

The argument to this keyword must be

.Dq yes

.Dq no .

DSA authentication will only be

attempted if a DSA identity file exists.

Note that this option applies to protocol version 2 only.

.It Cm EscapeChar

Sets the escape character (default:

Line 724

Line 750

The default is

.Dq no .

.It Cm GlobalKnownHostsFile

Specifies a file to use instead of

Specifies a file to use for the protocol version 1 global

host key database instead of

.Pa /etc/ssh_known_hosts .

.It Cm GlobalKnownHostsFile2

Specifies a file to use for the protocol version 2 global

host key database instead of

.Pa /etc/ssh_known_hosts2 .

.It Cm HostKeyAlias

Specifies an alias that should be used instead of the

real host name when looking up or saving the host key

in the known_hosts files.

This option is useful for tunneling ssh connections

or if you have multiple servers running on a single host.

.It Cm HostName

Specifies the real host name to log into.

This can be used to specify nicknames or abbreviations for hosts.

Line 745

Line 782

It is possible to have

multiple identity files specified in configuration files; all these

identities will be tried in sequence.

.It Cm IdentityFile2

Specifies the file from which the user's DSA authentication identity

is read (default

.Pa $HOME/.ssh/id_dsa

in the user's home directory).

The file name may use the tilde

syntax to refer to a user's home directory.

It is possible to have

multiple identity files specified in configuration files; all these

identities will be tried in sequence.

.It Cm KeepAlive

Specifies whether the system should send keepalive messages to the

other side.

Line 800

Line 827

The possible values are:

QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG.

The default is INFO.

.It Cm MACs

Specifies the MAC (message authentication code) algorithms

in order of preference.

The MAC algorithm is used in protocol version 2

for data integrity protection.

Multiple algorithms must be comma-separated.

The default is

.Pp

.Bd -literal

``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,

hmac-sha1-96,hmac-md5-96''

.Ed

.It Cm NumberOfPasswordPrompts

Specifies the number of password prompts before giving up.

The argument to this keyword must be an integer.

Line 814

Line 853

.It Cm Port

Specifies the port number to connect on the remote host.

Default is 22.

.It Cm PreferredAuthentications

Specifies the order in which the client should try protocol 2

authentication methods. This allows a client to prefer one method (e.g.

.Cm keyboard-interactive )

over another method (e.g.

.Cm password )

The default for this option is:

.Dq publickey, password, keyboard-interactive

.It Cm Protocol

Specifies the protocol versions

.Nm

Line 894

Line 941

attempted if the identity file exists, or an authentication agent is

running.

Note that this option applies to protocol version 1 only.

.It Cm SkeyAuthentication

.It Cm ChallengeResponseAuthentication

Specifies whether to use

Specifies whether to use challenge response authentication.

Currently there is only support for

.Xr skey 1

authentication.

The argument to this keyword must be

Line 908

Line 956

If this flag is set to

.Dq yes ,

.Nm

ssh will never automatically add host keys to the

will never automatically add host keys to the

.Pa $HOME/.ssh/known_hosts

and

.Pa $HOME/.ssh/known_hosts2

files, and refuses to connect hosts whose host key has changed.

files, and refuses to connect to hosts whose host key has changed.

This provides maximum protection against trojan horse attacks.

However, it can be somewhat annoying if you don't have good

.Pa /etc/ssh_known_hosts

and

.Pa /etc/ssh_known_hosts2

files installed and frequently

connect new hosts.

connect to new hosts.

Basically this option forces the user to manually

This option forces the user to manually

add any new hosts.

add all new hosts.

Normally this option is disabled, and new hosts

If this flag is set to

will automatically be added to the known host files.

.Dq no ,

.Nm

will automatically add new host keys to the

user known hosts files.

If this flag is set to

.Dq ask ,

new host keys

will be added to the user known host files only after the user

has confirmed that is what they really want to do, and

.Nm

will refuse to connect to hosts whose host key has changed.

The host keys of

known hosts will be verified automatically in either case.

known hosts will be verified automatically in all cases.

The argument must be

.Dq yes

.Dq yes ,

.Dq no

.Dq no .

.Dq ask .

The default is

.Dq ask .

.It Cm UsePrivilegedPort

Specifies whether to use a privileged port for outgoing connections.

The argument must be

Line 937

Line 998

.Dq no .

The default is

.Dq yes .

.Dq no .

Note that setting this option to

.Dq no

turns off

.Cm RhostsAuthentication

and

.Cm RhostsRSAAuthentication .

.Cm RhostsRSAAuthentication

for older servers.

.It Cm User

Specifies the user to log in as.

This can be useful if you have a different user name on different machines.

This saves the trouble of

having to remember to give the user name on the command line.

.It Cm UserKnownHostsFile

Specifies a file to use instead of

Specifies a file to use for the protocol version 1 user

host key database instead of

.Pa $HOME/.ssh/known_hosts .

.It Cm UserKnownHostsFile2

Specifies a file to use for the protocol version 2 user

host key database instead of

.Pa $HOME/.ssh/known_hosts2 .

.It Cm UseRsh

Specifies that rlogin/rsh should be used for this host.

It is possible that the host does not at all support the

Line 1016

Line 1083

The variable contains

three space-separated values: client ip-address, client port number,

and server port number.

.It Ev SSH_ORIGINAL_COMMAND

The variable contains the original command line if a forced command

is executed.

It can be used to extract the original arguments.

.It Ev SSH_TTY

This is set to the name of the tty (path to the device) associated

with the current shell or command.

Line 1038

Line 1109

to the environment.

.Sh FILES

.Bl -tag -width Ds

.It Pa $HOME/.ssh/known_hosts

.It Pa $HOME/.ssh/known_hosts, $HOME/.ssh/known_hosts2

Records host keys for all hosts the user has logged into (that are not

.Pa /etc/ssh_known_hosts ) .

.Pa /etc/ssh_known_hosts

for protocol version 1 or

.Pa /etc/ssh_known_hosts2

for protocol version 2).

See

.Xr sshd 8 .

.It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa

Line 1073

Line 1147

These files are not

sensitive and can (but need not) be readable by anyone.

These files are

never used automatically and are not necessary; they is only provided for

never used automatically and are not necessary; they are only provided for

the convenience of the user.

.It Pa $HOME/.ssh/config

This is the per-user configuration file.

Line 1096

Line 1170

This file is not highly sensitive, but the recommended

permissions are read/write for the user, and not accessible by others.

.It Pa $HOME/.ssh/authorized_keys2

Lists the DSA keys that can be used for logging in as this user.

Lists the public keys (DSA/RSA) that can be used for logging in as this user.

This file is not highly sensitive, but the recommended

permissions are read/write for the user, and not accessible by others.

.It Pa /etc/ssh_known_hosts, /etc/ssh_known_hosts2

Line 1104

Line 1178

.Pa /etc/ssh_known_hosts

contains RSA and

.Pa /etc/ssh_known_hosts2

contains DSA keys.

contains DSA or RSA keys for protocol version 2.

These files should be prepared by the

system administrator to contain the public host keys of all machines in the

organization.

Line 1143

Line 1217

Each line of the file contains a host name (in the canonical form

returned by name servers), and then a user name on that host,

separated by a space.

One some machines this file may need to be

On some machines this file may need to be

world-readable if the user's home directory is on a NFS partition,

because

.Xr sshd 8

Line 1215

Line 1289

Contains additional definitions for environment variables, see section

.Sx ENVIRONMENT

above.

.It Pa libcrypto.so.X.1

A version of this library which includes support for the RSA algorithm

is required for proper operation.

.El

.Sh AUTHOR

.Sh AUTHORS

OpenSSH

OpenSSH is a derivative of the original and free

is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen,

ssh 1.2.12 release by Tatu Ylonen.

but with bugs removed and newer features re-added.

Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,

Rapidly after the

Theo de Raadt and Dug Song

1.2.12 release, newer versions of the original ssh bore successively

removed many bugs, re-added newer features and

more restrictive licenses, and thus demand for a free version was born.

created OpenSSH.

.Pp

Markus Friedl contributed the support for SSH

This version of OpenSSH

protocol versions 1.5 and 2.0.

.Bl -bullet

.It

has all components of a restrictive nature (i.e., patents, see

.Xr ssl 8 )

directly removed from the source code; any licensed or patented components

are chosen from

external libraries.

.It

has been updated to support SSH protocol 1.5 and 2, making it compatible with

all other SSH clients and servers.

.It

contains added support for

.Xr kerberos 8

authentication and ticket passing.

.It

supports one-time password authentication with

.Xr skey 1 .

.El

.Pp

OpenSSH has been created by Aaron Campbell, Bob Beck, Markus Friedl,

Niels Provos, Theo de Raadt, and Dug Song.

.Pp

The support for SSH protocol 2 was written by Markus Friedl.

.Sh SEE ALSO

.Xr rlogin 1 ,

.Xr rsh 1 ,

.Xr scp 1 ,

.Xr sftp 1 ,

.Xr ssh-add 1 ,

.Xr ssh-agent 1 ,

.Xr ssh-keygen 1 ,

.Xr telnet 1 ,

.Xr sshd 8 ,

.Xr sshd 8

.Xr ssl 8