version 1.51.2.5, 2001/03/21 18:53:16 |
version 1.52, 2000/05/31 06:36:40 |
|
|
.\" -*- nroff -*- |
.\" -*- nroff -*- |
.\" |
.\" |
|
.\" sshd.8.in |
|
.\" |
.\" Author: Tatu Ylonen <ylo@cs.hut.fi> |
.\" Author: Tatu Ylonen <ylo@cs.hut.fi> |
|
.\" |
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
.\" All rights reserved |
.\" All rights reserved |
.\" |
.\" |
.\" As far as I am concerned, the code I have written for this software |
.\" Created: Sat Apr 22 21:55:14 1995 ylo |
.\" can be used freely for any purpose. Any derived versions of this |
|
.\" software must be clearly marked as such, and if the derived work is |
|
.\" incompatible with the protocol description in the RFC file, it must be |
|
.\" called by a name other than "ssh" or "Secure Shell". |
|
.\" |
.\" |
.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. |
.\" $Id$ |
.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. |
|
.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. |
|
.\" |
.\" |
.\" Redistribution and use in source and binary forms, with or without |
|
.\" modification, are permitted provided that the following conditions |
|
.\" are met: |
|
.\" 1. Redistributions of source code must retain the above copyright |
|
.\" notice, this list of conditions and the following disclaimer. |
|
.\" 2. Redistributions in binary form must reproduce the above copyright |
|
.\" notice, this list of conditions and the following disclaimer in the |
|
.\" documentation and/or other materials provided with the distribution. |
|
.\" |
|
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
|
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
|
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
|
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
|
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
|
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
|
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
|
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
|
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
|
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
|
.\" |
|
.\" $OpenBSD$ |
|
.Dd September 25, 1999 |
.Dd September 25, 1999 |
.Dt SSHD 8 |
.Dt SSHD 8 |
.Os |
.Os |
.Sh NAME |
.Sh NAME |
.Nm sshd |
.Nm sshd |
.Nd OpenSSH ssh daemon |
.Nd secure shell daemon |
.Sh SYNOPSIS |
.Sh SYNOPSIS |
.Nm sshd |
.Nm sshd |
.Op Fl diqD46 |
.Op Fl diqQ46 |
.Op Fl b Ar bits |
.Op Fl b Ar bits |
.Op Fl f Ar config_file |
.Op Fl f Ar config_file |
.Op Fl g Ar login_grace_time |
.Op Fl g Ar login_grace_time |
.Op Fl h Ar host_key_file |
.Op Fl h Ar host_key_file |
.Op Fl k Ar key_gen_time |
.Op Fl k Ar key_gen_time |
.Op Fl p Ar port |
.Op Fl p Ar port |
.Op Fl u Ar len |
|
.Op Fl V Ar client_protocol_id |
.Op Fl V Ar client_protocol_id |
.Sh DESCRIPTION |
.Sh DESCRIPTION |
.Nm |
.Nm |
(SSH Daemon) is the daemon program for |
(Secure Shell Daemon) is the daemon program for |
.Xr ssh 1 . |
.Xr ssh 1 . |
Together these programs replace rlogin and rsh, and |
Together these programs replace rlogin and rsh, and |
provide secure encrypted communications between two untrusted hosts |
provide secure encrypted communications between two untrusted hosts |
|
|
.Pp |
.Pp |
.Ss SSH protocol version 2 |
.Ss SSH protocol version 2 |
.Pp |
.Pp |
Version 2 works similarly: |
Version 2 works similar: |
Each host has a host-specific DSA key used to identify the host. |
Each host has a host-specific DSA key used to identify the host. |
However, when the daemon starts, it does not generate a server key. |
However, when the daemon starts, it does not generate a server key. |
Forward security is provided through a Diffie-Hellman key agreement. |
Forward security is provided through a Diffie-Hellman key agreement. |
This key agreement results in a shared session key. |
This key agreement results in a shared session key. |
The rest of the session is encrypted using a symmetric cipher, currently |
The rest of the session is encrypted |
Blowfish, 3DES, CAST128, Arcfour, 128 bit AES, or 256 bit AES. |
using a symmetric cipher, currently |
|
Blowfish, 3DES or CAST128 in CBC mode or Arcfour. |
The client selects the encryption algorithm |
The client selects the encryption algorithm |
to use from those offered by the server. |
to use from those offered by the server. |
Additionally, session integrity is provided |
Additionally, session integrity is provided |
|
|
(hmac-sha1 or hmac-md5). |
(hmac-sha1 or hmac-md5). |
.Pp |
.Pp |
Protocol version 2 provides a public key based |
Protocol version 2 provides a public key based |
user authentication method (PubkeyAuthentication) |
user authentication method (DSAAuthentication) |
and conventional password authentication. |
and conventional password authentication. |
.Pp |
.Pp |
.Ss Command execution and data forwarding |
.Ss Command execution and data forwarding |
|
|
.Pp |
.Pp |
.Nm |
.Nm |
rereads its configuration file when it receives a hangup signal, |
rereads its configuration file when it receives a hangup signal, |
.Dv SIGHUP , |
.Dv SIGHUP . |
by executing itself with the name it was started as, ie. |
|
.Pa /usr/sbin/sshd . |
|
.Pp |
.Pp |
The options are as follows: |
The options are as follows: |
.Bl -tag -width Ds |
.Bl -tag -width Ds |
|
|
log, and does not put itself in the background. |
log, and does not put itself in the background. |
The server also will not fork and will only process one connection. |
The server also will not fork and will only process one connection. |
This option is only intended for debugging for the server. |
This option is only intended for debugging for the server. |
Multiple -d options increases the debugging level. |
|
Maximum is 3. |
|
.It Fl f Ar configuration_file |
.It Fl f Ar configuration_file |
Specifies the name of the configuration file. |
Specifies the name of the configuration file. |
The default is |
The default is |
|
|
refuses to start if there is no configuration file. |
refuses to start if there is no configuration file. |
.It Fl g Ar login_grace_time |
.It Fl g Ar login_grace_time |
Gives the grace time for clients to authenticate themselves (default |
Gives the grace time for clients to authenticate themselves (default |
600 seconds). |
300 seconds). |
If the client fails to authenticate the user within |
If the client fails to authenticate the user within |
this many seconds, the server disconnects and exits. |
this many seconds, the server disconnects and exits. |
A value of zero indicates no limit. |
A value of zero indicates no limit. |
.It Fl h Ar host_key_file |
.It Fl h Ar host_key_file |
Specifies the file from which the host key is read (default |
Specifies the file from which the RSA host key is read (default |
.Pa /etc/ssh_host_key ) . |
.Pa /etc/ssh_host_key ) . |
This option must be given if |
This option must be given if |
.Nm |
.Nm |
is not run as root (as the normal |
is not run as root (as the normal |
host file is normally not readable by anyone but root). |
host file is normally not readable by anyone but root). |
It is possible to have multiple host key files for |
|
the different protocol versions. |
|
.It Fl i |
.It Fl i |
Specifies that |
Specifies that |
.Nm |
.Nm |
|
|
Nothing is sent to the system log. |
Nothing is sent to the system log. |
Normally the beginning, |
Normally the beginning, |
authentication, and termination of each connection is logged. |
authentication, and termination of each connection is logged. |
.It Fl u Ar len |
.It Fl Q |
This option is used to specify the size of the field |
Do not print an error message if RSA support is missing. |
in the |
|
.Li utmp |
|
structure that holds the remote host name. |
|
If the resolved host name is longer than |
|
.Ar len , |
|
the dotted decimal value will be used instead. |
|
This allows hosts with very long host names that |
|
overflow this field to still be uniquely identified. |
|
Specifying |
|
.Fl u0 |
|
indicates that only dotted decimal addresses |
|
should be put into the |
|
.Pa utmp |
|
file. |
|
.It Fl D |
|
When this option is specified |
|
.Nm |
|
will not detach and does not become a daemon. |
|
This allows easy monitoring of |
|
.Nm sshd . |
|
.It Fl V Ar client_protocol_id |
.It Fl V Ar client_protocol_id |
SSH-2 compatibility mode. |
SSH2 compatibility mode. |
When this option is specified |
When this option is specified |
.Nm |
.Nm |
assumes the client has sent the supplied version string |
assumes the client has sent the supplied version string |
and skips the |
and skips the |
Protocol Version Identification Exchange. |
Protocol Version Identification Exchange. |
This option is not intended to be called directly. |
|
.It Fl 4 |
.It Fl 4 |
Forces |
Forces |
.Nm |
.Nm |
|
|
Default is |
Default is |
.Dq yes . |
.Dq yes . |
.It Cm AllowGroups |
.It Cm AllowGroups |
This keyword can be followed by a list of group names, separated |
This keyword can be followed by a number of group names, separated |
by spaces. |
by spaces. |
If specified, login is allowed only for users whose primary |
If specified, login is allowed only for users whose primary |
group or supplementary group list matches one of the patterns. |
group matches one of the patterns. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid; a numerical group ID isn't recognized. |
Only group names are valid, a numerical group ID isn't recognized. |
By default login is allowed regardless of the group list. |
By default login is allowed regardless of the primary group. |
.Pp |
.Pp |
.It Cm AllowTcpForwarding |
|
Specifies whether TCP forwarding is permitted. |
|
The default is |
|
.Dq yes . |
|
Note that disabling TCP forwarding does not improve security unless |
|
users are also denied shell access, as they can always install their |
|
own forwarders. |
|
.Pp |
|
.It Cm AllowUsers |
.It Cm AllowUsers |
This keyword can be followed by a list of user names, separated |
This keyword can be followed by a number of user names, separated |
by spaces. |
by spaces. |
If specified, login is allowed only for users names that |
If specified, login is allowed only for users names that |
match one of the patterns. |
match one of the patterns. |
|
|
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only user names are valid; a numerical user ID isn't recognized. |
Only user names are valid, a numerical user ID isn't recognized. |
By default login is allowed regardless of the user name. |
By default login is allowed regardless of the user name. |
.Pp |
.Pp |
.It Cm Banner |
|
In some jurisdictions, sending a warning message before authentication |
|
may be relevant for getting legal protection. |
|
The contents of the specified file are sent to the remote user before |
|
authentication is allowed. |
|
This option is only available for protocol version 2. |
|
.Pp |
|
.It Cm ChallengeResponseAuthentication |
|
Specifies whether |
|
challenge response |
|
authentication is allowed. |
|
Currently there is only support for |
|
.Xr skey 1 |
|
authentication. |
|
The default is |
|
.Dq yes . |
|
.It Cm Ciphers |
.It Cm Ciphers |
Specifies the ciphers allowed for protocol version 2. |
Specifies the ciphers allowed for protocol version 2. |
Multiple ciphers must be comma-separated. |
Multiple ciphers must be comma-separated. |
The default is |
The default is |
.Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour. |
.Dq 3des-cbc,blowfish-cbc,arcfour,cast128-cbc . |
.It Cm CheckMail |
.It Cm CheckMail |
Specifies whether |
Specifies whether |
.Nm |
.Nm |
|
|
.It Cm DenyGroups |
.It Cm DenyGroups |
This keyword can be followed by a number of group names, separated |
This keyword can be followed by a number of group names, separated |
by spaces. |
by spaces. |
Users whose primary group or supplementary group list matches |
Users whose primary group matches one of the patterns |
one of the patterns aren't allowed to log in. |
aren't allowed to log in. |
.Ql \&* |
.Ql \&* |
and |
and |
.Ql ? |
.Ql ? |
can be used as |
can be used as |
wildcards in the patterns. |
wildcards in the patterns. |
Only group names are valid; a numerical group ID isn't recognized. |
Only group names are valid, a numerical group ID isn't recognized. |
By default login is allowed regardless of the group list. |
By default login is allowed regardless of the primary group. |
.Pp |
.Pp |
.It Cm DenyUsers |
.It Cm DenyUsers |
This keyword can be followed by a number of user names, separated |
This keyword can be followed by a number of user names, separated |
|
|
and |
and |
.Ql ? |
.Ql ? |
can be used as wildcards in the patterns. |
can be used as wildcards in the patterns. |
Only user names are valid; a numerical user ID isn't recognized. |
Only user names are valid, a numerical user ID isn't recognized. |
By default login is allowed regardless of the user name. |
By default login is allowed regardless of the user name. |
|
.It Cm DSAAuthentication |
|
Specifies whether DSA authentication is allowed. |
|
The default is |
|
.Dq yes . |
|
Note that this option applies to protocol version 2 only. |
.It Cm GatewayPorts |
.It Cm GatewayPorts |
Specifies whether remote hosts are allowed to connect to ports |
Specifies whether remote hosts are allowed to connect to ports |
forwarded for the client. |
forwarded for the client. |
|
|
.Dq no . |
.Dq no . |
The default is |
The default is |
.Dq no . |
.Dq no . |
|
.It Cm HostDsaKey |
|
Specifies the file containing the private DSA host key (default |
|
.Pa /etc/ssh_host_dsa_key ) |
|
used by SSH protocol 2.0. |
|
Note that |
|
.Nm |
|
disables protocol 2.0 if this file is group/world-accessible. |
.It Cm HostKey |
.It Cm HostKey |
Specifies the file containing the private host keys (default |
Specifies the file containing the private RSA host key (default |
.Pa /etc/ssh_host_key ) |
.Pa /etc/ssh_host_key ) |
used by SSH protocol versions 1 and 2. |
used by SSH protocols 1.3 and 1.5. |
Note that |
Note that |
.Nm |
.Nm |
will refuse to use a file if it is group/world-accessible. |
disables protocols 1.3 and 1.5 if this file is group/world-accessible. |
It is possible to have multiple host key files. |
|
.Dq rsa1 |
|
keys are used for version 1 and |
|
.Dq dsa |
|
or |
|
.Dq rsa |
|
are used for version 2 of the SSH protocol. |
|
.It Cm IgnoreRhosts |
.It Cm IgnoreRhosts |
Specifies that |
Specifies that |
.Pa .rhosts |
.Pa .rhosts |
|
|
.Cm PasswordAuthentication |
.Cm PasswordAuthentication |
is yes, the password provided by the user will be validated through |
is yes, the password provided by the user will be validated through |
the Kerberos KDC. |
the Kerberos KDC. |
To use this option, the server needs a |
|
Kerberos servtab which allows the verification of the KDC's identity. |
|
Default is |
Default is |
.Dq yes . |
.Dq yes . |
.It Cm KerberosOrLocalPasswd |
.It Cm KerberosOrLocalPasswd |
If set then if password authentication through Kerberos fails then |
If set then if password authentication through Kerberos fails then |
the password will be validated via any additional local mechanism |
the password will be validated via any additional local mechanism |
such as |
such as |
.Pa /etc/passwd . |
.Pa /etc/passwd |
|
or SecurID. |
Default is |
Default is |
.Dq yes . |
.Dq yes . |
.It Cm KerberosTgtPassing |
.It Cm KerberosTgtPassing |
|
|
The default is INFO. |
The default is INFO. |
Logging with level DEBUG violates the privacy of users |
Logging with level DEBUG violates the privacy of users |
and is not recommended. |
and is not recommended. |
.It Cm MACs |
|
Specifies the available MAC (message authentication code) algorithms. |
|
The MAC algorithm is used in protocol version 2 |
|
for data integrity protection. |
|
Multiple algorithms must be comma-separated. |
|
The default is |
|
.Pp |
|
.Bd -literal |
|
``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com, |
|
hmac-sha1-96,hmac-md5-96'' |
|
.Ed |
|
.It Cm MaxStartups |
|
Specifies the maximum number of concurrent unauthenticated connections to the |
|
.Nm |
|
daemon. |
|
Additional connections will be dropped until authentication succeeds or the |
|
.Cm LoginGraceTime |
|
expires for a connection. |
|
The default is 10. |
|
.Pp |
|
Alternatively, random early drop can be enabled by specifying |
|
the three colon separated values |
|
.Dq start:rate:full |
|
(e.g., "10:30:60"). |
|
.Nm |
|
will refuse connection attempts with a probability of |
|
.Dq rate/100 |
|
(30%) |
|
if there are currently |
|
.Dq start |
|
(10) |
|
unauthenticated connections. |
|
The probability increases linearly and all connection attempts |
|
are refused if the number of unauthenticated connections reaches |
|
.Dq full |
|
(60). |
|
.It Cm PasswordAuthentication |
.It Cm PasswordAuthentication |
Specifies whether password authentication is allowed. |
Specifies whether password authentication is allowed. |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
Note that this option applies to both protocol versions 1 and 2. |
Note that this option applies to both protocol version 1 and 2. |
.It Cm PermitEmptyPasswords |
.It Cm PermitEmptyPasswords |
When password authentication is allowed, it specifies whether the |
When password authentication is allowed, it specifies whether the |
server allows login to accounts with empty password strings. |
server allows login to accounts with empty password strings. |
The default is |
The default is |
.Dq no . |
.Dq no . |
.It Cm PermitRootLogin |
.It Cm PermitRootLogin |
Specifies whether root can login using |
Specifies whether the root can log in using |
.Xr ssh 1 . |
.Xr ssh 1 . |
The argument must be |
The argument must be |
.Dq yes , |
.Dq yes , |
.Dq without-password , |
.Dq without-password |
.Dq forced-commands-only |
|
or |
or |
.Dq no . |
.Dq no . |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
.Pp |
If this options is set to |
If this option is set to |
|
.Dq without-password |
.Dq without-password |
password authentication is disabled for root. |
only password authentication is disabled for root. |
.Pp |
.Pp |
If this option is set to |
Root login with RSA authentication when the |
.Dq forced-commands-only |
|
root login with public key authentication will be allowed, |
|
but only if the |
|
.Ar command |
.Ar command |
option has been specified |
option has been |
|
specified will be allowed regardless of the value of this setting |
(which may be useful for taking remote backups even if root login is |
(which may be useful for taking remote backups even if root login is |
normally not allowed). All other authentication methods are disabled |
normally not allowed). |
for root. |
|
.Pp |
|
If this option is set to |
|
.Dq no |
|
root is not allowed to login. |
|
.It Cm PidFile |
.It Cm PidFile |
Specifies the file that contains the process identifier of the |
Specifies the file that contains the process identifier of the |
.Nm |
.Nm |
|
|
Multiple versions must be comma-separated. |
Multiple versions must be comma-separated. |
The default is |
The default is |
.Dq 1 . |
.Dq 1 . |
.It Cm PubkeyAuthentication |
.It Cm RandomSeed |
Specifies whether public key authentication is allowed. |
Obsolete. |
The default is |
Random number generation uses other techniques. |
.Dq yes . |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm ReverseMappingCheck |
|
Specifies whether |
|
.Nm |
|
should try to verify the remote host name and check that |
|
the resolved host name for the remote IP address maps back to the |
|
very same IP address. |
|
The default is |
|
.Dq no . |
|
.It Cm RhostsAuthentication |
.It Cm RhostsAuthentication |
Specifies whether authentication using rhosts or /etc/hosts.equiv |
Specifies whether authentication using rhosts or /etc/hosts.equiv |
files is sufficient. |
files is sufficient. |
|
|
.It Cm ServerKeyBits |
.It Cm ServerKeyBits |
Defines the number of bits in the server key. |
Defines the number of bits in the server key. |
The minimum value is 512, and the default is 768. |
The minimum value is 512, and the default is 768. |
|
.It Cm SkeyAuthentication |
|
Specifies whether |
|
.Xr skey 1 |
|
authentication is allowed. |
|
The default is |
|
.Dq yes . |
|
Note that s/key authentication is enabled only if |
|
.Cm PasswordAuthentication |
|
is allowed, too. |
.It Cm StrictModes |
.It Cm StrictModes |
Specifies whether |
Specifies whether |
.Nm |
.Nm |
|
|
directory or files world-writable. |
directory or files world-writable. |
The default is |
The default is |
.Dq yes . |
.Dq yes . |
.It Cm Subsystem |
|
Configures an external subsystem (e.g., file transfer daemon). |
|
Arguments should be a subsystem name and a command to execute upon subsystem |
|
request. |
|
The command |
|
.Xr sftp-server 8 |
|
implements the |
|
.Dq sftp |
|
file transfer subsystem. |
|
By default no subsystems are defined. |
|
Note that this option applies to protocol version 2 only. |
|
.It Cm SyslogFacility |
.It Cm SyslogFacility |
Gives the facility code that is used when logging messages from |
Gives the facility code that is used when logging messages from |
.Nm sshd . |
.Nm sshd . |
|
|
.It Cm UseLogin |
.It Cm UseLogin |
Specifies whether |
Specifies whether |
.Xr login 1 |
.Xr login 1 |
is used for interactive login sessions. |
is used. |
Note that |
|
.Xr login 1 |
|
is never used for remote command execution. |
|
The default is |
The default is |
.Dq no . |
.Dq no . |
.It Cm X11DisplayOffset |
.It Cm X11DisplayOffset |
|
|
permitted for RSA authentication in SSH protocols 1.3 and 1.5 |
permitted for RSA authentication in SSH protocols 1.3 and 1.5 |
Similarly, the |
Similarly, the |
.Pa $HOME/.ssh/authorized_keys2 |
.Pa $HOME/.ssh/authorized_keys2 |
file lists the DSA and RSA keys that are |
file lists the DSA keys that are |
permitted for public key authentication (PubkeyAuthentication) |
permitted for DSA authentication in SSH protocol 2.0. |
in SSH protocol 2.0. |
|
.Pp |
|
Each line of the file contains one |
Each line of the file contains one |
key (empty lines and lines starting with a |
key (empty lines and lines starting with a |
.Ql # |
.Ql # |
are ignored as |
are ignored as |
comments). |
comments). |
Each RSA public key consists of the following fields, separated by |
Each line consists of the following fields, separated by |
spaces: options, bits, exponent, modulus, comment. |
spaces: options, bits, exponent, modulus, comment. |
Each protocol version 2 public key consists of: |
The options field |
options, keytype, base64 encoded key, comment. |
is optional; its presence is determined by whether the line starts |
The options fields |
|
are optional; its presence is determined by whether the line starts |
|
with a number or not (the option field never starts with a number). |
with a number or not (the option field never starts with a number). |
The bits, exponent, modulus and comment fields give the RSA key for |
The bits, exponent, modulus and comment fields give the RSA key; the |
protocol version 1; the |
|
comment field is not used for anything (but may be convenient for the |
comment field is not used for anything (but may be convenient for the |
user to identify the key). |
user to identify the key). |
For protocol version 2 the keytype is |
|
.Dq ssh-dss |
|
or |
|
.Dq ssh-rsa . |
|
.Pp |
.Pp |
Note that lines in this file are usually several hundred bytes long |
Note that lines in this file are usually several hundred bytes long |
(because of the size of the RSA key modulus). |
(because of the size of the RSA key modulus). |
You don't want to type them in; instead, copy the |
You don't want to type them in; instead, copy the |
.Pa identity.pub |
.Pa identity.pub |
or the |
|
.Pa id_dsa.pub |
|
file and edit it. |
file and edit it. |
.Pp |
.Pp |
The options (if present) consist of comma-separated option |
The options (if present) consists of comma-separated option |
specifications. |
specifications. |
No spaces are permitted, except within double quotes. |
No spaces are permitted, except within double quotes. |
The following option specifications are supported: |
The following option specifications are supported: |
|
|
The command supplied by the user (if any) is ignored. |
The command supplied by the user (if any) is ignored. |
The command is run on a pty if the connection requests a pty; |
The command is run on a pty if the connection requests a pty; |
otherwise it is run without a tty. |
otherwise it is run without a tty. |
Note that if you want a 8-bit clean channel, |
|
you must not request a pty or should specify |
|
.Cm no-pty . |
|
A quote may be included in the command by quoting it with a backslash. |
A quote may be included in the command by quoting it with a backslash. |
This option might be useful |
This option might be useful |
to restrict certain RSA keys to perform just a specific operation. |
to restrict certain RSA keys to perform just a specific operation. |
|
|
authentication. |
authentication. |
.It Cm no-pty |
.It Cm no-pty |
Prevents tty allocation (a request to allocate a pty will fail). |
Prevents tty allocation (a request to allocate a pty will fail). |
.It Cm permitopen="host:port" |
|
Limit local |
|
.Li ``ssh -L'' |
|
port-forwading such that it may only connect to the specified host and |
|
port. Multiple |
|
.Cm permitopen |
|
options may be applied seperated by commas. No pattern matching is |
|
performed on the specified hostnames, they must be literal domains or |
|
addresses. |
|
.El |
.El |
.Ss Examples |
.Ss Examples |
1024 33 12121.\|.\|.\|312314325 ylo@foo.bar |
1024 33 12121.\|.\|.\|312314325 ylo@foo.bar |
|
|
from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula |
from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula |
.Pp |
.Pp |
command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi |
command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi |
.Pp |
|
permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323 |
|
.Sh SSH_KNOWN_HOSTS FILE FORMAT |
.Sh SSH_KNOWN_HOSTS FILE FORMAT |
The |
The |
.Pa /etc/ssh_known_hosts , |
.Pa /etc/ssh_known_hosts , |
|
|
files contain host public keys for all known hosts. |
files contain host public keys for all known hosts. |
The global file should |
The global file should |
be prepared by the administrator (optional), and the per-user file is |
be prepared by the administrator (optional), and the per-user file is |
maintained automatically: whenever the user connects from an unknown host |
maintained automatically: whenever the user connects an unknown host |
its key is added to the per-user file. |
its key is added to the per-user file. |
.Pp |
.Pp |
Each line in these files contains the following fields: hostnames, |
Each line in these files contains the following fields: hostnames, |
|
|
.Nm sshd . |
.Nm sshd . |
This file should be writable by root only, but it is recommended |
This file should be writable by root only, but it is recommended |
(though not necessary) that it be world-readable. |
(though not necessary) that it be world-readable. |
.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key |
.It Pa /etc/ssh_host_key |
These three files contain the private parts of the |
Contains the private part of the host key. |
(SSH1, SSH2 DSA, and SSH2 RSA) host keys. |
This file should only be owned by root, readable only by root, and not |
These files should only be owned by root, readable only by root, and not |
|
accessible to others. |
accessible to others. |
Note that |
Note that |
.Nm |
.Nm |
does not start if this file is group/world-accessible. |
does not start if this file is group/world-accessible. |
.It Pa /etc/ssh_host_key.pub, /etc/ssh_host_dsa_key.pub, /etc/ssh_host_rsa_key.pub |
.It Pa /etc/ssh_host_key.pub |
There three files contain the public parts of the |
Contains the public part of the host key. |
(SSH1, SSH2 DSA, and SSH2 RSA) host keys. |
This file should be world-readable but writable only by |
These files should be world-readable but writable only by |
|
root. |
root. |
Their contents should match the respective private parts. |
Its contents should match the private part. |
These files are not |
This file is not |
really used for anything; they are provided for the convenience of |
really used for anything; it is only provided for the convenience of |
the user so their contents can be copied to known hosts files. |
the user so its contents can be copied to known hosts files. |
These files are created using |
These two files are created using |
.Xr ssh-keygen 1 . |
.Xr ssh-keygen 1 . |
.It Pa /etc/primes |
|
Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". |
|
.It Pa /var/run/sshd.pid |
.It Pa /var/run/sshd.pid |
Contains the process ID of the |
Contains the process ID of the |
.Nm |
.Nm |
listening for connections (if there are several daemons running |
listening for connections (if there are several daemons running |
concurrently for different ports, this contains the pid of the one |
concurrently for different ports, this contains the pid of the one |
started last). |
started last). |
The content of this file is not sensitive; it can be world-readable. |
The contents of this file are not sensitive; it can be world-readable. |
.It Pa $HOME/.ssh/authorized_keys |
.It Pa $HOME/.ssh/authorized_keys |
Lists the RSA keys that can be used to log into the user's account. |
Lists the RSA keys that can be used to log into the user's account. |
This file must be readable by root (which may on some machines imply |
This file must be readable by root (which may on some machines imply |
|
|
authentication to check the public key of the host. |
authentication to check the public key of the host. |
The key must be listed in one of these files to be accepted. |
The key must be listed in one of these files to be accepted. |
The client uses the same files |
The client uses the same files |
to verify that it is connecting to the correct remote host. |
to verify that the remote host is the one we intended to connect. |
These files should be writable only by root/the owner. |
These files should be writable only by root/the owner. |
.Pa /etc/ssh_known_hosts |
.Pa /etc/ssh_known_hosts |
should be world-readable, and |
should be world-readable, and |
|
|
.Pa .rhosts . |
.Pa .rhosts . |
However, this file is |
However, this file is |
not used by rlogin and rshd, so using this permits access using SSH only. |
not used by rlogin and rshd, so using this permits access using SSH only. |
.It Pa /etc/hosts.equiv |
.Pa /etc/hosts.equiv |
This file is used during |
This file is used during |
.Pa .rhosts |
.Pa .rhosts |
authentication. |
authentication. |
|
|
This can be used to specify |
This can be used to specify |
machine-specific login-time initializations globally. |
machine-specific login-time initializations globally. |
This file should be writable only by root, and should be world-readable. |
This file should be writable only by root, and should be world-readable. |
|
.Sh AUTHOR |
|
OpenSSH |
|
is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen, |
|
but with bugs removed and newer features re-added. |
|
Rapidly after the |
|
1.2.12 release, newer versions of the original ssh bore successively |
|
more restrictive licenses, and thus demand for a free version was born. |
|
.Pp |
|
This version of OpenSSH |
|
.Bl -bullet |
|
.It |
|
has all components of a restrictive nature (i.e., patents, see |
|
.Xr ssl 8 ) |
|
directly removed from the source code; any licensed or patented components |
|
are chosen from |
|
external libraries. |
|
.It |
|
has been updated to support SSH protocol 1.5 and 2, making it compatible with |
|
all other SSH clients and servers. |
|
.It |
|
contains added support for |
|
.Xr kerberos 8 |
|
authentication and ticket passing. |
|
.It |
|
supports one-time password authentication with |
|
.Xr skey 1 . |
.El |
.El |
.Sh AUTHORS |
.Pp |
OpenSSH is a derivative of the original and free |
The libraries described in |
ssh 1.2.12 release by Tatu Ylonen. |
.Xr ssl 8 |
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, |
are required for proper operation. |
Theo de Raadt and Dug Song |
.Pp |
removed many bugs, re-added newer features and |
OpenSSH has been created by Aaron Campbell, Bob Beck, Markus Friedl, |
created OpenSSH. |
Niels Provos, Theo de Raadt, and Dug Song. |
Markus Friedl contributed the support for SSH |
.Pp |
protocol versions 1.5 and 2.0. |
The support for SSH protocol 2 was written by Markus Friedl. |
.Sh SEE ALSO |
.Sh SEE ALSO |
.Xr scp 1 , |
.Xr scp 1 , |
.Xr sftp 1 , |
|
.Xr sftp-server 8 , |
|
.Xr ssh 1 , |
.Xr ssh 1 , |
.Xr ssh-add 1 , |
.Xr ssh-add 1 , |
.Xr ssh-agent 1 , |
.Xr ssh-agent 1 , |
.Xr ssh-keygen 1 , |
.Xr ssh-keygen 1 , |
|
.Xr ssl 8 , |
.Xr rlogin 1 , |
.Xr rlogin 1 , |
.Xr rsh 1 |
.Xr rsh 1 |