version 1.51, 2000/05/08 17:42:31 |
version 1.51.2.2, 2000/09/01 18:23:24 |
|
|
.Op Fl h Ar host_key_file |
.Op Fl h Ar host_key_file |
.Op Fl k Ar key_gen_time |
.Op Fl k Ar key_gen_time |
.Op Fl p Ar port |
.Op Fl p Ar port |
|
.Op Fl u Ar len |
.Op Fl V Ar client_protocol_id |
.Op Fl V Ar client_protocol_id |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
.Nm |
.Nm |
|
|
.Pp |
.Pp |
.Ss SSH protocol version 2 |
.Ss SSH protocol version 2 |
.Pp |
.Pp |
Version 2 works similar: |
Version 2 works similarly: |
Each host has a host-specific DSA key used to identify the host. |
Each host has a host-specific DSA key used to identify the host. |
However, when the daemon starts, it does not generate a server key. |
However, when the daemon starts, it does not generate a server key. |
Forward security is provided through a Diffie-Hellman key agreement. |
Forward security is provided through a Diffie-Hellman key agreement. |
|
|
Nothing is sent to the system log. |
Nothing is sent to the system log. |
Normally the beginning, |
Normally the beginning, |
authentication, and termination of each connection is logged. |
authentication, and termination of each connection is logged. |
|
.It Fl u Ar len |
|
This option is used to specify the size of the field |
|
in the |
|
.Li utmp |
|
structure that holds the remote host name. |
|
If the resolved host name is longer than |
|
.Ar len , |
|
the dotted decimal value will be used instead. |
|
This allows hosts with very long host names that |
|
overflow this field to still be uniquely identified. |
|
Specifying |
|
.Fl u0 |
|
indicates that only dotted decimal addresses |
|
should be put into the |
|
.Pa utmp |
|
file. |
.It Fl Q |
.It Fl Q |
Do not print an error message if RSA support is missing. |
Do not print an error message if RSA support is missing. |
.It Fl V Ar client_protocol_id |
.It Fl V Ar client_protocol_id |
|
|
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid, a numerical group ID isn't recognized. |
Only group names are valid; a numerical group ID isn't recognized. |
By default login is allowed regardless of the primary group. |
By default login is allowed regardless of the primary group. |
.Pp |
.Pp |
.It Cm AllowUsers |
.It Cm AllowUsers |
|
|
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only user names are valid, a numerical user ID isn't recognized. |
Only user names are valid; a numerical user ID isn't recognized. |
By default login is allowed regardless of the user name. |
By default login is allowed regardless of the user name. |
.Pp |
.Pp |
.It Cm Ciphers |
.It Cm Ciphers |
|
|
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid, a numerical group ID isn't recognized. |
Only group names are valid; a numerical group ID isn't recognized. |
By default login is allowed regardless of the primary group. |
By default login is allowed regardless of the primary group. |
.Pp |
.Pp |
.It Cm DenyUsers |
.It Cm DenyUsers |
|
|
and |
and |
.Ql ? |
.Ql ? |
can be used as wildcards in the patterns. |
can be used as wildcards in the patterns. |
Only user names are valid, a numerical user ID isn't recognized. |
Only user names are valid; a numerical user ID isn't recognized. |
By default login is allowed regardless of the user name. |
By default login is allowed regardless of the user name. |
.It Cm DSAAuthentication |
.It Cm DSAAuthentication |
Specifies whether DSA authentication is allowed. |
Specifies whether DSA authentication is allowed. |
|
|
.Dq no . |
.Dq no . |
The default is |
The default is |
.Dq no . |
.Dq no . |
.It Cm HostDsaKey |
.It Cm HostDSAKey |
Specifies the file containing the private DSA host key (default |
Specifies the file containing the private DSA host key (default |
.Pa /etc/ssh_host_dsa_key ) |
.Pa /etc/ssh_host_dsa_key ) |
used by SSH protocol 2.0. |
used by SSH protocol 2.0. |
|
|
This can be in the form of a Kerberos ticket, or if |
This can be in the form of a Kerberos ticket, or if |
.Cm PasswordAuthentication |
.Cm PasswordAuthentication |
is yes, the password provided by the user will be validated through |
is yes, the password provided by the user will be validated through |
the Kerberos KDC. |
the Kerberos KDC. To use this option, the server needs a |
|
Kerberos servtab which allows the verification of the KDC's identity. |
Default is |
Default is |
.Dq yes . |
.Dq yes . |
.It Cm KerberosOrLocalPasswd |
.It Cm KerberosOrLocalPasswd |
|
|
The default is INFO. |
The default is INFO. |
Logging with level DEBUG violates the privacy of users |
Logging with level DEBUG violates the privacy of users |
and is not recommended. |
and is not recommended. |
|
.It Cm MaxStartups |
|
Specifies the maximum number of concurrent unauthenticated connections to the |
|
.Nm |
|
daemon. |
|
Additional connections will be dropped until authentication succeeds or the |
|
.Cm LoginGraceTime |
|
expires for a connection. |
|
The default is 10. |
|
.Pp |
|
Alternatively, random early drop can be enabled by specifying |
|
the three colon separated values |
|
.Dq start:rate:full |
|
(e.g. "10:30:60"). |
|
.Nm |
|
will refuse connection attempts with a probabillity of |
|
.Dq rate/100 |
|
(30%) |
|
if there are currently |
|
.Dq start |
|
(10) |
|
unauthenticated connections. |
|
The probabillity increases linearly and all connection attempts |
|
are refused if the number of unauthenticated connections reaches |
|
.Dq full |
|
(60). |
.It Cm PasswordAuthentication |
.It Cm PasswordAuthentication |
Specifies whether password authentication is allowed. |
Specifies whether password authentication is allowed. |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
Note that this option applies to both protocol version 1 and 2. |
Note that this option applies to both protocol versions 1 and 2. |
.It Cm PermitEmptyPasswords |
.It Cm PermitEmptyPasswords |
When password authentication is allowed, it specifies whether the |
When password authentication is allowed, it specifies whether the |
server allows login to accounts with empty password strings. |
server allows login to accounts with empty password strings. |
|
|
directory or files world-writable. |
directory or files world-writable. |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
|
.It Cm Subsystem |
|
Configures an external subsystem (e.g. file transfer daemon). |
|
Arguments should be a subsystem name and a command to execute upon subsystem request. |
|
By default no subsystems are defined. |
|
Note that this option applies to protocol version 2 only. |
.It Cm SyslogFacility |
.It Cm SyslogFacility |
Gives the facility code that is used when logging messages from |
Gives the facility code that is used when logging messages from |
.Nm sshd . |
.Nm sshd . |
|
|
.It Cm UseLogin |
.It Cm UseLogin |
Specifies whether |
Specifies whether |
.Xr login 1 |
.Xr login 1 |
is used. |
is used for interactive login sessions. |
|
Note that |
|
.Xr login 1 |
|
is never used for remote command execution. |
The default is |
The default is |
.Dq no . |
.Dq no . |
.It Cm X11DisplayOffset |
.It Cm X11DisplayOffset |
|
|
.Dq no . |
.Dq no . |
Note that disabling X11 forwarding does not improve security in any |
Note that disabling X11 forwarding does not improve security in any |
way, as users can always install their own forwarders. |
way, as users can always install their own forwarders. |
|
.It Cm XAuthLocation |
|
Specifies the location of the |
|
.Xr xauth 1 |
|
program. |
|
The default is |
|
.Pa /usr/X11R6/bin/xauth . |
.El |
.El |
.Sh LOGIN PROCESS |
.Sh LOGIN PROCESS |
When a user successfully logs in, |
When a user successfully logs in, |
|
|
.Pa identity.pub |
.Pa identity.pub |
file and edit it. |
file and edit it. |
.Pp |
.Pp |
The options (if present) consists of comma-separated option |
The options (if present) consist of comma-separated option |
specifications. |
specifications. |
No spaces are permitted, except within double quotes. |
No spaces are permitted, except within double quotes. |
The following option specifications are supported: |
The following option specifications are supported: |
|
|
files contain host public keys for all known hosts. |
files contain host public keys for all known hosts. |
The global file should |
The global file should |
be prepared by the administrator (optional), and the per-user file is |
be prepared by the administrator (optional), and the per-user file is |
maintained automatically: whenever the user connects an unknown host |
maintained automatically: whenever the user connects from an unknown host |
its key is added to the per-user file. |
its key is added to the per-user file. |
.Pp |
.Pp |
Each line in these files contains the following fields: hostnames, |
Each line in these files contains the following fields: hostnames, |
|
|
listening for connections (if there are several daemons running |
listening for connections (if there are several daemons running |
concurrently for different ports, this contains the pid of the one |
concurrently for different ports, this contains the pid of the one |
started last). |
started last). |
The contents of this file are not sensitive; it can be world-readable. |
The content of this file is not sensitive; it can be world-readable. |
.It Pa $HOME/.ssh/authorized_keys |
.It Pa $HOME/.ssh/authorized_keys |
Lists the RSA keys that can be used to log into the user's account. |
Lists the RSA keys that can be used to log into the user's account. |
This file must be readable by root (which may on some machines imply |
This file must be readable by root (which may on some machines imply |
|
|
authentication to check the public key of the host. |
authentication to check the public key of the host. |
The key must be listed in one of these files to be accepted. |
The key must be listed in one of these files to be accepted. |
The client uses the same files |
The client uses the same files |
to verify that the remote host is the one we intended to connect. |
to verify that the remote host is the one it intended to connect. |
These files should be writable only by root/the owner. |
These files should be writable only by root/the owner. |
.Pa /etc/ssh_known_hosts |
.Pa /etc/ssh_known_hosts |
should be world-readable, and |
should be world-readable, and |
|
|
.Pa .rhosts . |
.Pa .rhosts . |
However, this file is |
However, this file is |
not used by rlogin and rshd, so using this permits access using SSH only. |
not used by rlogin and rshd, so using this permits access using SSH only. |
.Pa /etc/hosts.equiv |
.It Pa /etc/hosts.equiv |
This file is used during |
This file is used during |
.Pa .rhosts |
.Pa .rhosts |
authentication. |
authentication. |
|
|
This can be used to specify |
This can be used to specify |
machine-specific login-time initializations globally. |
machine-specific login-time initializations globally. |
This file should be writable only by root, and should be world-readable. |
This file should be writable only by root, and should be world-readable. |
|
.El |
.Sh AUTHOR |
.Sh AUTHOR |
OpenSSH |
OpenSSH |
is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen, |
is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen, |
|
|
supports one-time password authentication with |
supports one-time password authentication with |
.Xr skey 1 . |
.Xr skey 1 . |
.El |
.El |
.Pp |
|
The libraries described in |
|
.Xr ssl 8 |
|
are required for proper operation. |
|
.Pp |
.Pp |
OpenSSH has been created by Aaron Campbell, Bob Beck, Markus Friedl, |
OpenSSH has been created by Aaron Campbell, Bob Beck, Markus Friedl, |
Niels Provos, Theo de Raadt, and Dug Song. |
Niels Provos, Theo de Raadt, and Dug Song. |