summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2003-05-23 18:44:23 +1000
committerDamien Miller <djm@mindrot.org>2003-05-23 18:44:23 +1000
commitfbf486b4a6e0f39b3d6533a2c18d1a120e98b83c (patch)
tree7377adcab2b512e9ab0eddab49554fc2687c6781
parent5067792a7267cd1affe339bf7e9469ecc444eb25 (diff)
- jmc@cvs.openbsd.org 2003/05/20 12:09:31
[ssh.1 ssh_config.5 sshd.8 sshd_config.5 ssh-keygen.1] new sentence, new line
-rw-r--r--ChangeLog5
-rw-r--r--ssh-keygen.16
-rw-r--r--ssh.113
-rw-r--r--ssh_config.525
-rw-r--r--sshd.814
-rw-r--r--sshd_config.538
6 files changed, 57 insertions, 44 deletions
diff --git a/ChangeLog b/ChangeLog
index 00681d3a8..d00d04263 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,9 @@
8 - added .Xr's 8 - added .Xr's
9 - typos 9 - typos
10 ok djm@ 10 ok djm@
11 - jmc@cvs.openbsd.org 2003/05/20 12:09:31
12 [ssh.1 ssh_config.5 sshd.8 sshd_config.5 ssh-keygen.1]
13 new sentence, new line
11 14
1220030520 1520030520
13 - (djm) OpenBSD CVS Sync 16 - (djm) OpenBSD CVS Sync
@@ -1596,4 +1599,4 @@
1596 save auth method before monitor_reset_key_state(); bugzilla bug #284; 1599 save auth method before monitor_reset_key_state(); bugzilla bug #284;
1597 ok provos@ 1600 ok provos@
1598 1601
1599$Id: ChangeLog,v 1.2746 2003/05/23 08:44:04 djm Exp $ 1602$Id: ChangeLog,v 1.2747 2003/05/23 08:44:23 djm Exp $
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 613d71a07..1583384af 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
1.\" $OpenBSD: ssh-keygen.1,v 1.57 2003/05/14 18:16:20 jakob Exp $ 1.\" $OpenBSD: ssh-keygen.1,v 1.58 2003/05/20 12:09:31 jmc Exp $
2.\" 2.\"
3.\" -*- nroff -*- 3.\" -*- nroff -*-
4.\" 4.\"
@@ -93,8 +93,8 @@ generates, manages and converts authentication keys for
93.Xr ssh 1 . 93.Xr ssh 1 .
94.Nm 94.Nm
95can create RSA keys for use by SSH protocol version 1 and RSA or DSA 95can create RSA keys for use by SSH protocol version 1 and RSA or DSA
96keys for use by SSH protocol version 2. The type of key to be generated 96keys for use by SSH protocol version 2.
97is specified with the 97The type of key to be generated is specified with the
98.Fl t 98.Fl t
99option. 99option.
100.Pp 100.Pp
diff --git a/ssh.1 b/ssh.1
index f4b1679e3..d8af4de62 100644
--- a/ssh.1
+++ b/ssh.1
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: ssh.1,v 1.171 2003/05/15 04:08:41 markus Exp $ 37.\" $OpenBSD: ssh.1,v 1.172 2003/05/20 12:09:31 jmc Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSH 1 39.Dt SSH 1
40.Os 40.Os
@@ -488,8 +488,8 @@ It is possible to have multiple
488options (and multiple identities specified in 488options (and multiple identities specified in
489configuration files). 489configuration files).
490.It Fl I Ar smartcard_device 490.It Fl I Ar smartcard_device
491Specifies which smartcard device to use. The argument is 491Specifies which smartcard device to use.
492the device 492The argument is the device
493.Nm 493.Nm
494should use to communicate with a smartcard used for storing the user's 494should use to communicate with a smartcard used for storing the user's
495private RSA key. 495private RSA key.
@@ -542,9 +542,10 @@ per-host basis in the configuration file.
542Quiet mode. 542Quiet mode.
543Causes all warning and diagnostic messages to be suppressed. 543Causes all warning and diagnostic messages to be suppressed.
544.It Fl s 544.It Fl s
545May be used to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2 protocol which facilitate the use 545May be used to request invocation of a subsystem on the remote system.
546of SSH as a secure transport for other applications (eg. sftp). The 546Subsystems are a feature of the SSH2 protocol which facilitate the use
547subsystem is specified as the remote command. 547of SSH as a secure transport for other applications (eg. sftp).
548The subsystem is specified as the remote command.
548.It Fl t 549.It Fl t
549Force pseudo-tty allocation. 550Force pseudo-tty allocation.
550This can be used to execute arbitrary 551This can be used to execute arbitrary
diff --git a/ssh_config.5 b/ssh_config.5
index 67166b758..99050d38a 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: ssh_config.5,v 1.10 2003/05/16 03:27:12 djm Exp $ 37.\" $OpenBSD: ssh_config.5,v 1.11 2003/05/20 12:09:32 jmc Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSH_CONFIG 5 39.Dt SSH_CONFIG 5
40.Os 40.Os
@@ -116,7 +116,8 @@ The host is the
116argument given on the command line (i.e., the name is not converted to 116argument given on the command line (i.e., the name is not converted to
117a canonicalized host name before matching). 117a canonicalized host name before matching).
118.It Cm AddressFamily 118.It Cm AddressFamily
119Specifies which address family to use when connecting. Valid arguments are 119Specifies which address family to use when connecting.
120Valid arguments are
120.Dq any , 121.Dq any ,
121.Dq inet 122.Dq inet
122(Use IPv4 only) or 123(Use IPv4 only) or
@@ -236,9 +237,9 @@ This may be useful in scripts if the connection sometimes fails.
236The default is 1. 237The default is 1.
237.It Cm ConnectTimeout 238.It Cm ConnectTimeout
238Specifies the timeout (in seconds) used when connecting to the ssh 239Specifies the timeout (in seconds) used when connecting to the ssh
239server, instead of using the default system TCP timeout. This value is 240server, instead of using the default system TCP timeout.
240used only when the target is down or really unreachable, not when it 241This value is used only when the target is down or really unreachable,
241refuses the connection. 242not when it refuses the connection.
242.It Cm DynamicForward 243.It Cm DynamicForward
243Specifies that a TCP/IP port on the local machine be forwarded 244Specifies that a TCP/IP port on the local machine be forwarded
244over the secure channel, and the application 245over the secure channel, and the application
@@ -351,7 +352,8 @@ Numeric IP addresses are also permitted (both on the command line and in
351specifications). 352specifications).
352.It Cm IdentityFile 353.It Cm IdentityFile
353Specifies a file from which the user's RSA or DSA authentication identity 354Specifies a file from which the user's RSA or DSA authentication identity
354is read. The default is 355is read.
356The default is
355.Pa $HOME/.ssh/identity 357.Pa $HOME/.ssh/identity
356for protocol version 1, and 358for protocol version 1, and
357.Pa $HOME/.ssh/id_rsa 359.Pa $HOME/.ssh/id_rsa
@@ -448,7 +450,8 @@ Specifies the port number to connect on the remote host.
448Default is 22. 450Default is 22.
449.It Cm PreferredAuthentications 451.It Cm PreferredAuthentications
450Specifies the order in which the client should try protocol 2 452Specifies the order in which the client should try protocol 2
451authentication methods. This allows a client to prefer one method (e.g. 453authentication methods.
454This allows a client to prefer one method (e.g.
452.Cm keyboard-interactive ) 455.Cm keyboard-interactive )
453over another method (e.g. 456over another method (e.g.
454.Cm password ) 457.Cm password )
@@ -561,12 +564,12 @@ The default is
561.Dq yes . 564.Dq yes .
562Note that this option applies to protocol version 1 only. 565Note that this option applies to protocol version 1 only.
563.It Cm SmartcardDevice 566.It Cm SmartcardDevice
564Specifies which smartcard device to use. The argument to this keyword is 567Specifies which smartcard device to use.
565the device 568The argument to this keyword is the device
566.Nm ssh 569.Nm ssh
567should use to communicate with a smartcard used for storing the user's 570should use to communicate with a smartcard used for storing the user's
568private RSA key. By default, no device is specified and smartcard support 571private RSA key.
569is not activated. 572By default, no device is specified and smartcard support is not activated.
570.It Cm StrictHostKeyChecking 573.It Cm StrictHostKeyChecking
571If this flag is set to 574If this flag is set to
572.Dq yes , 575.Dq yes ,
diff --git a/sshd.8 b/sshd.8
index f7464d95b..827f4f77c 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: sshd.8,v 1.196 2003/04/30 20:41:07 david Exp $ 37.\" $OpenBSD: sshd.8,v 1.197 2003/05/20 12:09:32 jmc Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSHD 8 39.Dt SSHD 8
40.Os 40.Os
@@ -497,9 +497,9 @@ IPv6 addresses can be specified with an alternative syntax:
497.Ar host/port . 497.Ar host/port .
498Multiple 498Multiple
499.Cm permitopen 499.Cm permitopen
500options may be applied separated by commas. No pattern matching is 500options may be applied separated by commas.
501performed on the specified hostnames, they must be literal domains or 501No pattern matching is performed on the specified hostnames,
502addresses. 502they must be literal domains or addresses.
503.El 503.El
504.Ss Examples 504.Ss Examples
5051024 33 12121.\|.\|.\|312314325 ylo@foo.bar 5051024 33 12121.\|.\|.\|312314325 ylo@foo.bar
@@ -525,9 +525,9 @@ bits, exponent, modulus, comment.
525The fields are separated by spaces. 525The fields are separated by spaces.
526.Pp 526.Pp
527Hostnames is a comma-separated list of patterns 527Hostnames is a comma-separated list of patterns
528.Pf ( Ql \&* 528.Pf ( Ql \&*
529and 529and
530.Ql \&? 530.Ql \&?
531act as 531act as
532wildcards); each pattern in turn is matched against the canonical host 532wildcards); each pattern in turn is matched against the canonical host
533name (when authenticating a client) or against the user-supplied 533name (when authenticating a client) or against the user-supplied
diff --git a/sshd_config.5 b/sshd_config.5
index 8250be8d6..86b3289a1 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: sshd_config.5,v 1.16 2003/04/30 01:16:20 mouring Exp $ 37.\" $OpenBSD: sshd_config.5,v 1.17 2003/05/20 12:09:32 jmc Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSHD_CONFIG 5 39.Dt SSHD_CONFIG 5
40.Os 40.Os
@@ -107,7 +107,8 @@ Specifies the file that contains the public keys that can be used
107for user authentication. 107for user authentication.
108.Cm AuthorizedKeysFile 108.Cm AuthorizedKeysFile
109may contain tokens of the form %T which are substituted during connection 109may contain tokens of the form %T which are substituted during connection
110set-up. The following tokens are defined: %% is replaced by a literal '%', 110set-up.
111The following tokens are defined: %% is replaced by a literal '%',
111%h is replaced by the home directory of the user being authenticated and 112%h is replaced by the home directory of the user being authenticated and
112%u is replaced by the username of that user. 113%u is replaced by the username of that user.
113After expansion, 114After expansion,
@@ -153,20 +154,24 @@ This option applies to protocol version 2 only.
153Sets the number of client alive messages (see above) which may be 154Sets the number of client alive messages (see above) which may be
154sent without 155sent without
155.Nm sshd 156.Nm sshd
156receiving any messages back from the client. If this threshold is 157receiving any messages back from the client.
157reached while client alive messages are being sent, 158If this threshold is reached while client alive messages are being sent,
158.Nm sshd 159.Nm sshd
159will disconnect the client, terminating the session. It is important 160will disconnect the client, terminating the session.
160to note that the use of client alive messages is very different from 161It is important to note that the use of client alive messages is very
162different from
161.Cm KeepAlive 163.Cm KeepAlive
162(below). The client alive messages are sent through the 164(below).
163encrypted channel and therefore will not be spoofable. The TCP keepalive 165The client alive messages are sent through the encrypted channel
164option enabled by 166and therefore will not be spoofable.
167The TCP keepalive option enabled by
165.Cm KeepAlive 168.Cm KeepAlive
166is spoofable. The client alive mechanism is valuable when the client or 169is spoofable.
170The client alive mechanism is valuable when the client or
167server depend on knowing when a connection has become inactive. 171server depend on knowing when a connection has become inactive.
168.Pp 172.Pp
169The default value is 3. If 173The default value is 3.
174If
170.Cm ClientAliveInterval 175.Cm ClientAliveInterval
171(above) is set to 15, and 176(above) is set to 15, and
172.Cm ClientAliveCountMax 177.Cm ClientAliveCountMax
@@ -369,11 +374,12 @@ is not specified,
369.Nm sshd 374.Nm sshd
370will listen on the address and all prior 375will listen on the address and all prior
371.Cm Port 376.Cm Port
372options specified. The default is to listen on all local 377options specified.
373addresses. 378The default is to listen on all local addresses.
374Multiple 379Multiple
375.Cm ListenAddress 380.Cm ListenAddress
376options are permitted. Additionally, any 381options are permitted.
382Additionally, any
377.Cm Port 383.Cm Port
378options must precede this option for non port qualified addresses. 384options must precede this option for non port qualified addresses.
379.It Cm LoginGraceTime 385.It Cm LoginGraceTime
@@ -454,8 +460,8 @@ but only if the
454.Ar command 460.Ar command
455option has been specified 461option has been specified
456(which may be useful for taking remote backups even if root login is 462(which may be useful for taking remote backups even if root login is
457normally not allowed). All other authentication methods are disabled 463normally not allowed).
458for root. 464All other authentication methods are disabled for root.
459.Pp 465.Pp
460If this option is set to 466If this option is set to
461.Dq no 467.Dq no