version 1.153, 2001/09/27 17:53:24 |
version 1.153.2.6, 2002/06/22 07:23:18 |
|
|
.Op Fl g Ar login_grace_time |
.Op Fl g Ar login_grace_time |
.Op Fl h Ar host_key_file |
.Op Fl h Ar host_key_file |
.Op Fl k Ar key_gen_time |
.Op Fl k Ar key_gen_time |
|
.Op Fl o Ar option |
.Op Fl p Ar port |
.Op Fl p Ar port |
.Op Fl u Ar len |
.Op Fl u Ar len |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
|
|
because it is fundamentally insecure, but can be enabled in the server |
because it is fundamentally insecure, but can be enabled in the server |
configuration file if desired. |
configuration file if desired. |
System security is not improved unless |
System security is not improved unless |
.Xr rshd 8 , |
.Nm rshd , |
.Xr rlogind 8 , |
.Nm rlogind , |
and |
and |
.Xr rexecd 8 |
.Xr rexecd |
are disabled (thus completely disabling |
are disabled (thus completely disabling |
.Xr rlogin 1 |
.Xr rlogin |
and |
and |
.Xr rsh 1 |
.Xr rsh |
into the machine). |
into the machine). |
.Pp |
.Pp |
.Ss SSH protocol version 2 |
.Ss SSH protocol version 2 |
|
|
this many seconds, the server disconnects and exits. |
this many seconds, the server disconnects and exits. |
A value of zero indicates no limit. |
A value of zero indicates no limit. |
.It Fl h Ar host_key_file |
.It Fl h Ar host_key_file |
Specifies the file from which the host key is read (default |
Specifies a file from which a host key is read. |
.Pa /etc/ssh_host_key ) . |
|
This option must be given if |
This option must be given if |
.Nm |
.Nm |
is not run as root (as the normal |
is not run as root (as the normal |
host file is normally not readable by anyone but root). |
host key files are normally not readable by anyone but root). |
|
The default is |
|
.Pa /etc/ssh_host_key |
|
for protocol version 1, and |
|
.Pa /etc/ssh_host_rsa_key |
|
and |
|
.Pa /etc/ssh_host_dsa_key |
|
for protocol version 2. |
It is possible to have multiple host key files for |
It is possible to have multiple host key files for |
the different protocol versions and host key algorithms. |
the different protocol versions and host key algorithms. |
.It Fl i |
.It Fl i |
|
|
communications even if the machine is cracked into or physically |
communications even if the machine is cracked into or physically |
seized. |
seized. |
A value of zero indicates that the key will never be regenerated. |
A value of zero indicates that the key will never be regenerated. |
|
.It Fl o Ar option |
|
Can be used to give options in the format used in the configuration file. |
|
This is useful for specifying options for which there is no separate |
|
command-line flag. |
.It Fl p Ar port |
.It Fl p Ar port |
Specifies the port on which the server listens for connections |
Specifies the port on which the server listens for connections |
(default 22). |
(default 22). |
|
Multiple port options are permitted. |
|
Ports specified in the configuration file are ignored when a |
|
command-line port is specified. |
.It Fl q |
.It Fl q |
Quiet mode. |
Quiet mode. |
Nothing is sent to the system log. |
Nothing is sent to the system log. |
|
|
.It Fl t |
.It Fl t |
Test mode. |
Test mode. |
Only check the validity of the configuration file and sanity of the keys. |
Only check the validity of the configuration file and sanity of the keys. |
This is useful for updating |
This is useful for updating |
.Nm |
.Nm |
reliably as configuration options may change. |
reliably as configuration options may change. |
.It Fl u Ar len |
.It Fl u Ar len |
|
|
and using a |
and using a |
.Cm from="pattern-list" |
.Cm from="pattern-list" |
option in a key file. |
option in a key file. |
|
Configuration options that require DNS include using a |
|
USER@HOST pattern in |
|
.Cm AllowUsers |
|
or |
|
.Cm DenyUsers . |
.It Fl D |
.It Fl D |
When this option is specified |
When this option is specified |
.Nm |
.Nm |
|
|
(or the file specified with |
(or the file specified with |
.Fl f |
.Fl f |
on the command line). |
on the command line). |
The file contains keyword-argument pairs, one per line. |
The file format and configuration options are described in |
Lines starting with |
.Xr sshd_config 5 . |
.Ql # |
|
and empty lines are interpreted as comments. |
|
.Pp |
|
The possible |
|
keywords and their meanings are as follows (note that |
|
keywords are case-insensitive and arguments are case-sensitive): |
|
.Bl -tag -width Ds |
|
.It Cm AFSTokenPassing |
|
Specifies whether an AFS token may be forwarded to the server. |
|
Default is |
|
.Dq yes . |
|
.It Cm AllowGroups |
|
This keyword can be followed by a list of group names, separated |
|
by spaces. |
|
If specified, login is allowed only for users whose primary |
|
group or supplementary group list matches one of the patterns. |
|
.Ql \&* |
|
and |
|
.Ql ? |
|
can be used as |
|
wildcards in the patterns. |
|
Only group names are valid; a numerical group ID is not recognized. |
|
By default login is allowed regardless of the group list. |
|
.Pp |
|
.It Cm AllowTcpForwarding |
|
Specifies whether TCP forwarding is permitted. |
|
The default is |
|
.Dq yes . |
|
Note that disabling TCP forwarding does not improve security unless |
|
users are also denied shell access, as they can always install their |
|
own forwarders. |
|
.Pp |
|
.It Cm AllowUsers |
|
This keyword can be followed by a list of user names, separated |
|
by spaces. |
|
If specified, login is allowed only for users names that |
|
match one of the patterns. |
|
.Ql \&* |
|
and |
|
.Ql ? |
|
can be used as |
|
wildcards in the patterns. |
|
Only user names are valid; a numerical user ID is not recognized. |
|
By default login is allowed regardless of the user name. |
|
If the pattern takes the form USER@HOST then USER and HOST |
|
are separately checked, restricting logins to particular |
|
users from particular hosts. |
|
.Pp |
|
.It Cm AuthorizedKeysFile |
|
Specifies the file that contains the public keys that can be used |
|
for user authentication. |
|
.Cm AuthorizedKeysFile |
|
may contain tokens of the form %T which are substituted during connection |
|
set-up. The following tokens are defined: %% is replaced by a literal '%', |
|
%h is replaced by the home directory of the user being authenticated and |
|
%u is replaced by the username of that user. |
|
After expansion, |
|
.Cm AuthorizedKeysFile |
|
is taken to be an absolute path or one relative to the user's home |
|
directory. |
|
The default is |
|
.Dq .ssh/authorized_keys |
|
.It Cm Banner |
|
In some jurisdictions, sending a warning message before authentication |
|
may be relevant for getting legal protection. |
|
The contents of the specified file are sent to the remote user before |
|
authentication is allowed. |
|
This option is only available for protocol version 2. |
|
.Pp |
|
.It Cm ChallengeResponseAuthentication |
|
Specifies whether challenge response authentication is allowed. |
|
All authentication styles from |
|
.Xr login.conf 5 |
|
are supported. |
|
The default is |
|
.Dq yes . |
|
.It Cm Ciphers |
|
Specifies the ciphers allowed for protocol version 2. |
|
Multiple ciphers must be comma-separated. |
|
The default is |
|
.Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour. |
|
.It Cm ClientAliveInterval |
|
Sets a timeout interval in seconds after which if no data has been received |
|
from the client, |
|
.Nm |
|
will send a message through the encrypted |
|
channel to request a response from the client. |
|
The default |
|
is 0, indicating that these messages will not be sent to the client. |
|
This option applies to protocol version 2 only. |
|
.It Cm ClientAliveCountMax |
|
Sets the number of client alive messages (see above) which may be |
|
sent without |
|
.Nm |
|
receiving any messages back from the client. If this threshold is |
|
reached while client alive messages are being sent, |
|
.Nm |
|
will disconnect the client, terminating the session. It is important |
|
to note that the use of client alive messages is very different from |
|
.Cm Keepalive |
|
(below). The client alive messages are sent through the |
|
encrypted channel and therefore will not be spoofable. The TCP keepalive |
|
option enabled by |
|
.Cm Keepalive |
|
is spoofable. The client alive mechanism is valuable when the client or |
|
server depend on knowing when a connection has become inactive. |
|
.Pp |
|
The default value is 3. If |
|
.Cm ClientAliveInterval |
|
(above) is set to 15, and |
|
.Cm ClientAliveCountMax |
|
is left at the default, unresponsive ssh clients |
|
will be disconnected after approximately 45 seconds. |
|
.It Cm DenyGroups |
|
This keyword can be followed by a number of group names, separated |
|
by spaces. |
|
Users whose primary group or supplementary group list matches |
|
one of the patterns aren't allowed to log in. |
|
.Ql \&* |
|
and |
|
.Ql ? |
|
can be used as |
|
wildcards in the patterns. |
|
Only group names are valid; a numerical group ID is not recognized. |
|
By default login is allowed regardless of the group list. |
|
.Pp |
|
.It Cm DenyUsers |
|
This keyword can be followed by a number of user names, separated |
|
by spaces. |
|
Login is disallowed for user names that match one of the patterns. |
|
.Ql \&* |
|
and |
|
.Ql ? |
|
can be used as wildcards in the patterns. |
|
Only user names are valid; a numerical user ID is not recognized. |
|
By default login is allowed regardless of the user name. |
|
.It Cm GatewayPorts |
|
Specifies whether remote hosts are allowed to connect to ports |
|
forwarded for the client. |
|
By default, |
|
.Nm |
|
binds remote port forwardings to the loopback addresss. This |
|
prevents other remote hosts from connecting to forwarded ports. |
|
.Cm GatewayPorts |
|
can be used to specify that |
|
.Nm |
|
should bind remote port forwardings to the wildcard address, |
|
thus allowing remote hosts to connect to forwarded ports. |
|
The argument must be |
|
.Dq yes |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq no . |
|
.It Cm HostbasedAuthentication |
|
Specifies whether rhosts or /etc/hosts.equiv authentication together |
|
with successful public key client host authentication is allowed |
|
(hostbased authentication). |
|
This option is similar to |
|
.Cm RhostsRSAAuthentication |
|
and applies to protocol version 2 only. |
|
The default is |
|
.Dq no . |
|
.It Cm HostKey |
|
Specifies the file containing the private host keys (default |
|
.Pa /etc/ssh_host_key ) |
|
used by SSH protocol versions 1 and 2. |
|
Note that |
|
.Nm |
|
will refuse to use a file if it is group/world-accessible. |
|
It is possible to have multiple host key files. |
|
.Dq rsa1 |
|
keys are used for version 1 and |
|
.Dq dsa |
|
or |
|
.Dq rsa |
|
are used for version 2 of the SSH protocol. |
|
.It Cm IgnoreRhosts |
|
Specifies that |
|
.Pa .rhosts |
|
and |
|
.Pa .shosts |
|
files will not be used in |
|
.Cm RhostsAuthentication , |
|
.Cm RhostsRSAAuthentication |
|
or |
|
.Cm HostbasedAuthentication . |
|
.Pp |
|
.Pa /etc/hosts.equiv |
|
and |
|
.Pa /etc/shosts.equiv |
|
are still used. |
|
The default is |
|
.Dq yes . |
|
.It Cm IgnoreUserKnownHosts |
|
Specifies whether |
|
.Nm |
|
should ignore the user's |
|
.Pa $HOME/.ssh/known_hosts |
|
during |
|
.Cm RhostsRSAAuthentication |
|
or |
|
.Cm HostbasedAuthentication . |
|
The default is |
|
.Dq no . |
|
.It Cm KeepAlive |
|
Specifies whether the system should send keepalive messages to the |
|
other side. |
|
If they are sent, death of the connection or crash of one |
|
of the machines will be properly noticed. |
|
However, this means that |
|
connections will die if the route is down temporarily, and some people |
|
find it annoying. |
|
On the other hand, if keepalives are not sent, |
|
sessions may hang indefinitely on the server, leaving |
|
.Dq ghost |
|
users and consuming server resources. |
|
.Pp |
|
The default is |
|
.Dq yes |
|
(to send keepalives), and the server will notice |
|
if the network goes down or the client host reboots. |
|
This avoids infinitely hanging sessions. |
|
.Pp |
|
To disable keepalives, the value should be set to |
|
.Dq no |
|
in both the server and the client configuration files. |
|
.It Cm KerberosAuthentication |
|
Specifies whether Kerberos authentication is allowed. |
|
This can be in the form of a Kerberos ticket, or if |
|
.Cm PasswordAuthentication |
|
is yes, the password provided by the user will be validated through |
|
the Kerberos KDC. |
|
To use this option, the server needs a |
|
Kerberos servtab which allows the verification of the KDC's identity. |
|
Default is |
|
.Dq yes . |
|
.It Cm KerberosOrLocalPasswd |
|
If set then if password authentication through Kerberos fails then |
|
the password will be validated via any additional local mechanism |
|
such as |
|
.Pa /etc/passwd . |
|
Default is |
|
.Dq yes . |
|
.It Cm KerberosTgtPassing |
|
Specifies whether a Kerberos TGT may be forwarded to the server. |
|
Default is |
|
.Dq no , |
|
as this only works when the Kerberos KDC is actually an AFS kaserver. |
|
.It Cm KerberosTicketCleanup |
|
Specifies whether to automatically destroy the user's ticket cache |
|
file on logout. |
|
Default is |
|
.Dq yes . |
|
.It Cm KeyRegenerationInterval |
|
In protocol version 1, the ephemeral server key is automatically regenerated |
|
after this many seconds (if it has been used). |
|
The purpose of regeneration is to prevent |
|
decrypting captured sessions by later breaking into the machine and |
|
stealing the keys. |
|
The key is never stored anywhere. |
|
If the value is 0, the key is never regenerated. |
|
The default is 3600 (seconds). |
|
.It Cm ListenAddress |
|
Specifies the local addresses |
|
.Nm |
|
should listen on. |
|
The following forms may be used: |
|
.Pp |
|
.Bl -item -offset indent -compact |
|
.It |
|
.Cm ListenAddress |
|
.Sm off |
|
.Ar host No | Ar IPv4_addr No | Ar IPv6_addr |
|
.Sm on |
|
.It |
|
.Cm ListenAddress |
|
.Sm off |
|
.Ar host No | Ar IPv4_addr No : Ar port |
|
.Sm on |
|
.It |
|
.Cm ListenAddress |
|
.Sm off |
|
.Oo |
|
.Ar host No | Ar IPv6_addr Oc : Ar port |
|
.Sm on |
|
.El |
|
.Pp |
|
If |
|
.Ar port |
|
is not specified, |
|
.Nm |
|
will listen on the address and all prior |
|
.Cm Port |
|
options specified. The default is to listen on all local |
|
addresses. Multiple |
|
.Cm ListenAddress |
|
options are permitted. Additionally, any |
|
.Cm Port |
|
options must precede this option for non port qualified addresses. |
|
.It Cm LoginGraceTime |
|
The server disconnects after this time if the user has not |
|
successfully logged in. |
|
If the value is 0, there is no time limit. |
|
The default is 600 (seconds). |
|
.It Cm LogLevel |
|
Gives the verbosity level that is used when logging messages from |
|
.Nm sshd . |
|
The possible values are: |
|
QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. |
|
The default is INFO. |
|
Logging with level DEBUG violates the privacy of users |
|
and is not recommended. |
|
.It Cm MACs |
|
Specifies the available MAC (message authentication code) algorithms. |
|
The MAC algorithm is used in protocol version 2 |
|
for data integrity protection. |
|
Multiple algorithms must be comma-separated. |
|
The default is |
|
.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . |
|
.It Cm MaxStartups |
|
Specifies the maximum number of concurrent unauthenticated connections to the |
|
.Nm |
|
daemon. |
|
Additional connections will be dropped until authentication succeeds or the |
|
.Cm LoginGraceTime |
|
expires for a connection. |
|
The default is 10. |
|
.Pp |
|
Alternatively, random early drop can be enabled by specifying |
|
the three colon separated values |
|
.Dq start:rate:full |
|
(e.g., "10:30:60"). |
|
.Nm |
|
will refuse connection attempts with a probability of |
|
.Dq rate/100 |
|
(30%) |
|
if there are currently |
|
.Dq start |
|
(10) |
|
unauthenticated connections. |
|
The probability increases linearly and all connection attempts |
|
are refused if the number of unauthenticated connections reaches |
|
.Dq full |
|
(60). |
|
.It Cm PasswordAuthentication |
|
Specifies whether password authentication is allowed. |
|
The default is |
|
.Dq yes . |
|
.It Cm PermitEmptyPasswords |
|
When password authentication is allowed, it specifies whether the |
|
server allows login to accounts with empty password strings. |
|
The default is |
|
.Dq no . |
|
.It Cm PermitRootLogin |
|
Specifies whether root can login using |
|
.Xr ssh 1 . |
|
The argument must be |
|
.Dq yes , |
|
.Dq without-password , |
|
.Dq forced-commands-only |
|
or |
|
.Dq no . |
|
The default is |
|
.Dq yes . |
|
.Pp |
|
If this option is set to |
|
.Dq without-password |
|
password authentication is disabled for root. |
|
.Pp |
|
If this option is set to |
|
.Dq forced-commands-only |
|
root login with public key authentication will be allowed, |
|
but only if the |
|
.Ar command |
|
option has been specified |
|
(which may be useful for taking remote backups even if root login is |
|
normally not allowed). All other authentication methods are disabled |
|
for root. |
|
.Pp |
|
If this option is set to |
|
.Dq no |
|
root is not allowed to login. |
|
.It Cm PidFile |
|
Specifies the file that contains the process identifier of the |
|
.Nm |
|
daemon. |
|
The default is |
|
.Pa /var/run/sshd.pid . |
|
.It Cm Port |
|
Specifies the port number that |
|
.Nm |
|
listens on. |
|
The default is 22. |
|
Multiple options of this type are permitted. |
|
See also |
|
.Cm ListenAddress . |
|
.It Cm PrintLastLog |
|
Specifies whether |
|
.Nm |
|
should print the date and time when the user last logged in. |
|
The default is |
|
.Dq yes . |
|
.It Cm PrintMotd |
|
Specifies whether |
|
.Nm |
|
should print |
|
.Pa /etc/motd |
|
when a user logs in interactively. |
|
(On some systems it is also printed by the shell, |
|
.Pa /etc/profile , |
|
or equivalent.) |
|
The default is |
|
.Dq yes . |
|
.It Cm Protocol |
|
Specifies the protocol versions |
|
.Nm |
|
should support. |
|
The possible values are |
|
.Dq 1 |
|
and |
|
.Dq 2 . |
|
Multiple versions must be comma-separated. |
|
The default is |
|
.Dq 2,1 . |
|
.It Cm PubkeyAuthentication |
|
Specifies whether public key authentication is allowed. |
|
The default is |
|
.Dq yes . |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm ReverseMappingCheck |
|
Specifies whether |
|
.Nm |
|
should try to verify the remote host name and check that |
|
the resolved host name for the remote IP address maps back to the |
|
very same IP address. |
|
The default is |
|
.Dq no . |
|
.It Cm RhostsAuthentication |
|
Specifies whether authentication using rhosts or /etc/hosts.equiv |
|
files is sufficient. |
|
Normally, this method should not be permitted because it is insecure. |
|
.Cm RhostsRSAAuthentication |
|
should be used |
|
instead, because it performs RSA-based host authentication in addition |
|
to normal rhosts or /etc/hosts.equiv authentication. |
|
The default is |
|
.Dq no . |
|
This option applies to protocol version 1 only. |
|
.It Cm RhostsRSAAuthentication |
|
Specifies whether rhosts or /etc/hosts.equiv authentication together |
|
with successful RSA host authentication is allowed. |
|
The default is |
|
.Dq no . |
|
This option applies to protocol version 1 only. |
|
.It Cm RSAAuthentication |
|
Specifies whether pure RSA authentication is allowed. |
|
The default is |
|
.Dq yes . |
|
This option applies to protocol version 1 only. |
|
.It Cm ServerKeyBits |
|
Defines the number of bits in the ephemeral protocol version 1 server key. |
|
The minimum value is 512, and the default is 768. |
|
.It Cm StrictModes |
|
Specifies whether |
|
.Nm |
|
should check file modes and ownership of the |
|
user's files and home directory before accepting login. |
|
This is normally desirable because novices sometimes accidentally leave their |
|
directory or files world-writable. |
|
The default is |
|
.Dq yes . |
|
.It Cm Subsystem |
|
Configures an external subsystem (e.g., file transfer daemon). |
|
Arguments should be a subsystem name and a command to execute upon subsystem |
|
request. |
|
The command |
|
.Xr sftp-server 8 |
|
implements the |
|
.Dq sftp |
|
file transfer subsystem. |
|
By default no subsystems are defined. |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm SyslogFacility |
|
Gives the facility code that is used when logging messages from |
|
.Nm sshd . |
|
The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, |
|
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. |
|
The default is AUTH. |
|
.It Cm UseLogin |
|
Specifies whether |
|
.Xr login 1 |
|
is used for interactive login sessions. |
|
The default is |
|
.Dq no . |
|
Note that |
|
.Xr login 1 |
|
is never used for remote command execution. |
|
Note also, that if this is enabled, |
|
.Cm X11Forwarding |
|
will be disabled because |
|
.Xr login 1 |
|
does not know how to handle |
|
.Xr xauth 1 |
|
cookies. |
|
.It Cm X11DisplayOffset |
|
Specifies the first display number available for |
|
.Nm sshd Ns 's |
|
X11 forwarding. |
|
This prevents |
|
.Nm |
|
from interfering with real X11 servers. |
|
The default is 10. |
|
.It Cm X11Forwarding |
|
Specifies whether X11 forwarding is permitted. |
|
The default is |
|
.Dq no . |
|
Note that disabling X11 forwarding does not improve security in any |
|
way, as users can always install their own forwarders. |
|
X11 forwarding is automatically disabled if |
|
.Cm UseLogin |
|
is enabled. |
|
.It Cm XAuthLocation |
|
Specifies the location of the |
|
.Xr xauth 1 |
|
program. |
|
The default is |
|
.Pa /usr/X11R6/bin/xauth . |
|
.El |
|
.Ss Time Formats |
|
.Pp |
|
.Nm |
|
command-line arguments and configuration file options that specify time |
|
may be expressed using a sequence of the form: |
|
.Sm off |
|
.Ar time Oo Ar qualifier Oc , |
|
.Sm on |
|
where |
|
.Ar time |
|
is a positive integer value and |
|
.Ar qualifier |
|
is one of the following: |
|
.Pp |
|
.Bl -tag -width Ds -compact -offset indent |
|
.It Cm <none> |
|
seconds |
|
.It Cm s | Cm S |
|
seconds |
|
.It Cm m | Cm M |
|
minutes |
|
.It Cm h | Cm H |
|
hours |
|
.It Cm d | Cm D |
|
days |
|
.It Cm w | Cm W |
|
weeks |
|
.El |
|
.Pp |
|
Each member of the sequence is added together to calculate |
|
the total time value. |
|
.Pp |
|
Time format examples: |
|
.Pp |
|
.Bl -tag -width Ds -compact -offset indent |
|
.It 600 |
|
600 seconds (10 minutes) |
|
.It 10m |
|
10 minutes |
|
.It 1h30m |
|
1 hour 30 minutes (90 minutes) |
|
.El |
|
.Sh LOGIN PROCESS |
.Sh LOGIN PROCESS |
When a user successfully logs in, |
When a user successfully logs in, |
.Nm |
.Nm |
|
|
.Pa id_rsa.pub |
.Pa id_rsa.pub |
file and edit it. |
file and edit it. |
.Pp |
.Pp |
|
.Nm |
|
enforces a minimum RSA key modulus size for protocol 1 |
|
and protocol 2 keys of 768 bits. |
|
.Pp |
The options (if present) consist of comma-separated option |
The options (if present) consist of comma-separated option |
specifications. |
specifications. |
No spaces are permitted, except within double quotes. |
No spaces are permitted, except within double quotes. |
|
|
Environment variables set this way |
Environment variables set this way |
override other default environment values. |
override other default environment values. |
Multiple options of this type are permitted. |
Multiple options of this type are permitted. |
|
This option is automatically disabled if |
|
.Cm UseLogin |
|
is enabled. |
.It Cm no-port-forwarding |
.It Cm no-port-forwarding |
Forbids TCP/IP forwarding when this key is used for authentication. |
Forbids TCP/IP forwarding when this key is used for authentication. |
Any port forward requests by the client will return an error. |
Any port forward requests by the client will return an error. |
|
|
.It Pa /etc/sshd_config |
.It Pa /etc/sshd_config |
Contains configuration data for |
Contains configuration data for |
.Nm sshd . |
.Nm sshd . |
This file should be writable by root only, but it is recommended |
The file format and configuration options are described in |
(though not necessary) that it be world-readable. |
.Xr sshd_config 5 . |
.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key |
.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key |
These three files contain the private parts of the host keys. |
These three files contain the private parts of the host keys. |
These files should only be owned by root, readable only by root, and not |
These files should only be owned by root, readable only by root, and not |
|
|
.It Pa $HOME/.ssh/rc |
.It Pa $HOME/.ssh/rc |
If this file exists, it is run with /bin/sh after reading the |
If this file exists, it is run with /bin/sh after reading the |
environment files but before starting the user's shell or command. |
environment files but before starting the user's shell or command. |
If X11 spoofing is in use, this will receive the "proto cookie" pair in |
It must not produce any output on stdout; stderr must be used |
standard input (and |
instead. |
|
If X11 forwarding is in use, it will receive the "proto cookie" pair in |
|
its standard input (and |
.Ev DISPLAY |
.Ev DISPLAY |
in environment). |
in its environment). |
This must call |
The script must call |
.Xr xauth 1 |
.Xr xauth 1 |
in that case. |
because |
|
.Nm |
|
will not run xauth automatically to add X11 cookies. |
.Pp |
.Pp |
The primary purpose of this file is to run any initialization routines |
The primary purpose of this file is to run any initialization routines |
which may be needed before the user's home directory becomes |
which may be needed before the user's home directory becomes |
|
|
This file will probably contain some initialization code followed by |
This file will probably contain some initialization code followed by |
something similar to: |
something similar to: |
.Bd -literal |
.Bd -literal |
if read proto cookie; then |
if read proto cookie && [ -n "$DISPLAY" ]; then |
echo add $DISPLAY $proto $cookie | xauth -q - |
if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then |
|
# X11UseLocalhost=yes |
|
xauth add unix:`echo $DISPLAY | |
|
cut -c11-` $proto $cookie |
|
else |
|
# X11UseLocalhost=no |
|
xauth add $DISPLAY $proto $cookie |
fi |
fi |
|
fi |
.Ed |
.Ed |
.Pp |
.Pp |
If this file does not exist, |
If this file does not exist, |
.Pa /etc/sshrc |
.Pa /etc/sshrc |
is run, and if that |
is run, and if that |
does not exist either, xauth is used to store the cookie. |
does not exist either, xauth is used to add the cookie. |
.Pp |
.Pp |
This file should be writable only by the user, and need not be |
This file should be writable only by the user, and need not be |
readable by anyone else. |
readable by anyone else. |
|
|
created OpenSSH. |
created OpenSSH. |
Markus Friedl contributed the support for SSH |
Markus Friedl contributed the support for SSH |
protocol versions 1.5 and 2.0. |
protocol versions 1.5 and 2.0. |
|
Niels Provos and Markus Friedl contributed support |
|
for privilege separation. |
.Sh SEE ALSO |
.Sh SEE ALSO |
.Xr scp 1 , |
.Xr scp 1 , |
.Xr sftp 1 , |
.Xr sftp 1 , |
|
|
.Xr ssh-keygen 1 , |
.Xr ssh-keygen 1 , |
.Xr login.conf 5 , |
.Xr login.conf 5 , |
.Xr moduli 5 , |
.Xr moduli 5 , |
|
.Xr sshd_config 5 , |
.Xr sftp-server 8 |
.Xr sftp-server 8 |
.Rs |
.Rs |
.%A T. Ylonen |
.%A T. Ylonen |
|
|
.%A T. Rinne |
.%A T. Rinne |
.%A S. Lehtinen |
.%A S. Lehtinen |
.%T "SSH Protocol Architecture" |
.%T "SSH Protocol Architecture" |
.%N draft-ietf-secsh-architecture-09.txt |
.%N draft-ietf-secsh-architecture-12.txt |
.%D July 2001 |
.%D January 2002 |
.%O work in progress material |
.%O work in progress material |
.Re |
.Re |
.Rs |
.Rs |
|
|
.%A N. Provos |
.%A N. Provos |
.%A W. A. Simpson |
.%A W. A. Simpson |
.%T "Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol" |
.%T "Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol" |
.%N draft-ietf-secsh-dh-group-exchange-01.txt |
.%N draft-ietf-secsh-dh-group-exchange-02.txt |
.%D April 2001 |
.%D January 2002 |
.%O work in progress material |
.%O work in progress material |
.Re |
.Re |