diff options
author | Damien Miller <djm@mindrot.org> | 1999-10-28 14:03:14 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 1999-10-28 14:03:14 +1000 |
commit | 062307657e30c9b970514eb53b4b743f9d571231 (patch) | |
tree | 04b1d6b094442720b4197eb442ee53c010cdc1d7 /opensshd.8 | |
parent | 7f6ea0264d01aa40b20df8dc75141631479da054 (diff) |
Big rename ssh* -> openssh*
Diffstat (limited to 'opensshd.8')
-rw-r--r-- | opensshd.8 | 781 |
1 files changed, 781 insertions, 0 deletions
diff --git a/opensshd.8 b/opensshd.8 new file mode 100644 index 000000000..d96ae330c --- /dev/null +++ b/opensshd.8 | |||
@@ -0,0 +1,781 @@ | |||
1 | .\" -*- nroff -*- | ||
2 | .\" | ||
3 | .\" sshd.8.in | ||
4 | .\" | ||
5 | .\" Author: Tatu Ylonen <ylo@cs.hut.fi> | ||
6 | .\" | ||
7 | .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | ||
8 | .\" All rights reserved | ||
9 | .\" | ||
10 | .\" Created: Sat Apr 22 21:55:14 1995 ylo | ||
11 | .\" | ||
12 | .\" $Id: opensshd.8,v 1.1 1999/10/28 04:03:14 damien Exp $ | ||
13 | .\" | ||
14 | .Dd September 25, 1999 | ||
15 | .Dt SSHD 8 | ||
16 | .Os | ||
17 | .Sh NAME | ||
18 | .Nm sshd | ||
19 | .Nd secure shell daemon | ||
20 | .Sh SYNOPSIS | ||
21 | .Nm sshd | ||
22 | .Op Fl diq | ||
23 | .Op Fl b Ar bits | ||
24 | .Op Fl f Ar config_file | ||
25 | .Op Fl g Ar login_grace_time | ||
26 | .Op Fl h Ar host_key_file | ||
27 | .Op Fl k Ar key_gen_time | ||
28 | .Op Fl p Ar port | ||
29 | .Sh DESCRIPTION | ||
30 | .Nm | ||
31 | (Secure Shell Daemon) is the daemon program for | ||
32 | .Xr ssh 1 . | ||
33 | Together these programs replace rlogin and rsh programs, and | ||
34 | provide secure encrypted communications between two untrusted hosts | ||
35 | over an insecure network. The programs are intended to be as easy to | ||
36 | install and use as possible. | ||
37 | .Pp | ||
38 | .Nm | ||
39 | is the daemon that listens for connections from clients. It is | ||
40 | normally started at boot from | ||
41 | .Pa /etc/rc . | ||
42 | It forks a new | ||
43 | daemon for each incoming connection. The forked daemons handle | ||
44 | key exchange, encryption, authentication, command execution, | ||
45 | and data exchange. | ||
46 | .Pp | ||
47 | .Nm | ||
48 | works as follows. Each host has a host-specific RSA key | ||
49 | (normally 1024 bits) used to identify the host. Additionally, when | ||
50 | the daemon starts, it generates a server RSA key (normally 768 bits). | ||
51 | This key is normally regenerated every hour if it has been used, and | ||
52 | is never stored on disk. | ||
53 | .Pp | ||
54 | Whenever a client connects the daemon, the daemon sends its host | ||
55 | and server public keys to the client. The client compares the | ||
56 | host key against its own database to verify that it has not changed. | ||
57 | The client then generates a 256 bit random number. It encrypts this | ||
58 | random number using both the host key and the server key, and sends | ||
59 | the encrypted number to the server. Both sides then start to use this | ||
60 | random number as a session key which is used to encrypt all further | ||
61 | communications in the session. The rest of the session is encrypted | ||
62 | using a conventional cipher, currently Blowfish and 3DES, with 3DES | ||
63 | being is used by default. The client selects the encryption algorithm | ||
64 | to use from those offered by the server. | ||
65 | .Pp | ||
66 | Next, the server and the client enter an authentication dialog. The | ||
67 | client tries to authenticate itself using | ||
68 | .Pa .rhosts | ||
69 | authentication, | ||
70 | .Pa .rhosts | ||
71 | authentication combined with RSA host | ||
72 | authentication, RSA challenge-response authentication, or password | ||
73 | based authentication. | ||
74 | .Pp | ||
75 | Rhosts authentication is normally disabled | ||
76 | because it is fundamentally insecure, but can be enabled in the server | ||
77 | configuration file if desired. System security is not improved unless | ||
78 | .Xr rshd 8 , | ||
79 | .Xr rlogind 8 , | ||
80 | .Xr rexecd 8 , | ||
81 | and | ||
82 | .Xr rexd 8 | ||
83 | are disabled (thus completely disabling | ||
84 | .Xr rlogin 1 | ||
85 | and | ||
86 | .Xr rsh 1 | ||
87 | into that machine). | ||
88 | .Pp | ||
89 | If the client successfully authenticates itself, a dialog for | ||
90 | preparing the session is entered. At this time the client may request | ||
91 | things like allocating a pseudo-tty, forwarding X11 connections, | ||
92 | forwarding TCP/IP connections, or forwarding the authentication agent | ||
93 | connection over the secure channel. | ||
94 | .Pp | ||
95 | Finally, the client either requests a shell or execution of a command. | ||
96 | The sides then enter session mode. In this mode, either side may send | ||
97 | data at any time, and such data is forwarded to/from the shell or | ||
98 | command on the server side, and the user terminal in the client side. | ||
99 | .Pp | ||
100 | When the user program terminates and all forwarded X11 and other | ||
101 | connections have been closed, the server sends command exit status to | ||
102 | the client, and both sides exit. | ||
103 | .Pp | ||
104 | .Nm | ||
105 | can be configured using command-line options or a configuration | ||
106 | file. Command-line options override values specified in the | ||
107 | configuration file. | ||
108 | .Pp | ||
109 | The options are as follows: | ||
110 | .Bl -tag -width Ds | ||
111 | .It Fl b Ar bits | ||
112 | Specifies the number of bits in the server key (default 768). | ||
113 | .Pp | ||
114 | .It Fl d | ||
115 | Debug mode. The server sends verbose debug output to the system | ||
116 | log, and does not put itself in the background. The server also will | ||
117 | not fork and will only process one connection. This option is only | ||
118 | intended for debugging for the server. | ||
119 | .It Fl f Ar configuration_file | ||
120 | Specifies the name of the configuration file. The default is | ||
121 | .Pa /etc/openssh/sshd_config . | ||
122 | .Nm | ||
123 | refuses to start if there is no configuration file. | ||
124 | .It Fl g Ar login_grace_time | ||
125 | Gives the grace time for clients to authenticate themselves (default | ||
126 | 300 seconds). If the client fails to authenticate the user within | ||
127 | this many seconds, the server disconnects and exits. A value of zero | ||
128 | indicates no limit. | ||
129 | .It Fl h Ar host_key_file | ||
130 | Specifies the file from which the host key is read (default | ||
131 | .Pa /etc/openssh/ssh_host_key ) . | ||
132 | This option must be given if | ||
133 | .Nm | ||
134 | is not run as root (as the normal | ||
135 | host file is normally not readable by anyone but root). | ||
136 | .It Fl i | ||
137 | Specifies that | ||
138 | .Nm | ||
139 | is being run from inetd. | ||
140 | .Nm | ||
141 | is normally not run | ||
142 | from inetd because it needs to generate the server key before it can | ||
143 | respond to the client, and this may take tens of seconds. Clients | ||
144 | would have to wait too long if the key was regenerated every time. | ||
145 | However, with small key sizes (e.g. 512) using | ||
146 | .Nm | ||
147 | from inetd may | ||
148 | be feasible. | ||
149 | .It Fl k Ar key_gen_time | ||
150 | Specifies how often the server key is regenerated (default 3600 | ||
151 | seconds, or one hour). The motivation for regenerating the key fairly | ||
152 | often is that the key is not stored anywhere, and after about an hour, | ||
153 | it becomes impossible to recover the key for decrypting intercepted | ||
154 | communications even if the machine is cracked into or physically | ||
155 | seized. A value of zero indicates that the key will never be regenerated. | ||
156 | .It Fl p Ar port | ||
157 | Specifies the port on which the server listens for connections | ||
158 | (default 22). | ||
159 | .It Fl q | ||
160 | Quiet mode. Nothing is sent to the system log. Normally the beginning, | ||
161 | authentication, and termination of each connection is logged. | ||
162 | .It Fl Q | ||
163 | Do not print an error message if RSA support is missing. | ||
164 | .El | ||
165 | .Sh CONFIGURATION FILE | ||
166 | .Nm | ||
167 | reads configuration data from | ||
168 | .Pa /etc/openssh/sshd_config | ||
169 | (or the file specified with | ||
170 | .Fl f | ||
171 | on the command line). The file | ||
172 | contains keyword-value pairs, one per line. Lines starting with | ||
173 | .Ql # | ||
174 | and empty lines are interpreted as comments. | ||
175 | .Pp | ||
176 | The following keywords are possible. | ||
177 | .Bl -tag -width Ds | ||
178 | .It Cm AFSTokenPassing | ||
179 | Specifies whether an AFS token may be forwarded to the server. Default is | ||
180 | .Dq yes . | ||
181 | .It Cm AllowGroups | ||
182 | This keyword can be followed by a number of group names, separated | ||
183 | by spaces. If specified, login is allowed only for users whose primary | ||
184 | group matches one of the patterns. | ||
185 | .Ql \&* | ||
186 | and | ||
187 | .Ql ? | ||
188 | can be used as | ||
189 | wildcards in the patterns. Only group names are valid, a numerical group | ||
190 | id isn't recognized. By default login is allowed regardless of | ||
191 | the primary group. | ||
192 | .Pp | ||
193 | .It Cm AllowUsers | ||
194 | This keyword can be followed by a number of user names, separated | ||
195 | by spaces. If specified, login is allowed only for users names that | ||
196 | match one of the patterns. | ||
197 | .Ql \&* | ||
198 | and | ||
199 | .Ql ? | ||
200 | can be used as | ||
201 | wildcards in the patterns. Only user names are valid, a numerical user | ||
202 | id isn't recognized. By default login is allowed regardless of | ||
203 | the user name. | ||
204 | .Pp | ||
205 | .It Cm CheckMail | ||
206 | Specifies whether | ||
207 | .Nm | ||
208 | should check for new mail for interactive logins. | ||
209 | The default is | ||
210 | .Dq no . | ||
211 | .It Cm DenyGroups | ||
212 | This keyword can be followed by a number of group names, separated | ||
213 | by spaces. Users whose primary group matches one of the patterns | ||
214 | aren't allowed to log in. | ||
215 | .Ql \&* | ||
216 | and | ||
217 | .Ql ? | ||
218 | can be used as | ||
219 | wildcards in the patterns. Only group names are valid, a numerical group | ||
220 | id isn't recognized. By default login is allowed regardless of | ||
221 | the primary group. | ||
222 | .Pp | ||
223 | .It Cm DenyUsers | ||
224 | This keyword can be followed by a number of user names, separated | ||
225 | by spaces. Login is allowed disallowed for user names that match | ||
226 | one of the patterns. | ||
227 | .Ql \&* | ||
228 | and | ||
229 | .Ql ? | ||
230 | can be used as | ||
231 | wildcards in the patterns. Only user names are valid, a numerical user | ||
232 | id isn't recognized. By default login is allowed regardless of | ||
233 | the user name. | ||
234 | .Pp | ||
235 | .It Cm FascistLogging | ||
236 | Specifies whether to use verbose logging. Verbose logging violates | ||
237 | the privacy of users and is not recommended. The argument must be | ||
238 | .Dq yes | ||
239 | or | ||
240 | .Dq no . | ||
241 | The default is | ||
242 | .Dq no . | ||
243 | .It Cm HostKey | ||
244 | Specifies the file containing the private host key (default | ||
245 | .Pa /etc/openssh/ssh_host_key ) . | ||
246 | Note that | ||
247 | .Nm | ||
248 | does not start if this file is group/world-accessible. | ||
249 | .It Cm IgnoreRhosts | ||
250 | Specifies that rhosts and shosts files will not be used in | ||
251 | authentication. | ||
252 | .Pa /etc/hosts.equiv | ||
253 | and | ||
254 | .Pa /etc/openssh/shosts.equiv | ||
255 | are still used. The default is | ||
256 | .Dq no . | ||
257 | .It Cm KeepAlive | ||
258 | Specifies whether the system should send keepalive messages to the | ||
259 | other side. If they are sent, death of the connection or crash of one | ||
260 | of the machines will be properly noticed. However, this means that | ||
261 | connections will die if the route is down temporarily, and some people | ||
262 | find it annoying. On the other hand, if keepalives are not send, | ||
263 | sessions may hang indefinitely on the server, leaving | ||
264 | .Dq ghost | ||
265 | users and consuming server resources. | ||
266 | .Pp | ||
267 | The default is | ||
268 | .Dq yes | ||
269 | (to send keepalives), and the server will notice | ||
270 | if the network goes down or the client host reboots. This avoids | ||
271 | infinitely hanging sessions. | ||
272 | .Pp | ||
273 | To disable keepalives, the value should be set to | ||
274 | .Dq no | ||
275 | in both the server and the client configuration files. | ||
276 | .It Cm KerberosAuthentication | ||
277 | Specifies whether Kerberos authentication is allowed. This can | ||
278 | be in the form of a Kerberos ticket, or if | ||
279 | .Cm PasswordAuthentication | ||
280 | is yes, the password provided by the user will be validated through | ||
281 | the Kerberos KDC. Default is | ||
282 | .Dq yes . | ||
283 | .It Cm KerberosOrLocalPasswd | ||
284 | If set then if password authentication through Kerberos fails then | ||
285 | the password will be validated via any additional local mechanism | ||
286 | such as | ||
287 | .Pa /etc/passwd | ||
288 | or SecurID. Default is | ||
289 | .Dq yes . | ||
290 | .It Cm KerberosTgtPassing | ||
291 | Specifies whether a Kerberos TGT may be forwarded to the server. | ||
292 | Default is | ||
293 | .Dq no , | ||
294 | as this only works when the Kerberos KDC is actually an AFS kaserver. | ||
295 | .It Cm KerberosTicketCleanup | ||
296 | Specifies whether to automatically destroy the user's ticket cache | ||
297 | file on logout. Default is | ||
298 | .Dq yes . | ||
299 | .It Cm KeyRegenerationInterval | ||
300 | The server key is automatically regenerated after this many seconds | ||
301 | (if it has been used). The purpose of regeneration is to prevent | ||
302 | decrypting captured sessions by later breaking into the machine and | ||
303 | stealing the keys. The key is never stored anywhere. If the value is | ||
304 | 0, the key is never regenerated. The default is 3600 | ||
305 | (seconds). | ||
306 | .It Cm ListenAddress | ||
307 | Specifies what local address | ||
308 | .Nm | ||
309 | should listen on. | ||
310 | The default is to listen to all local addresses. | ||
311 | .It Cm LoginGraceTime | ||
312 | The server disconnects after this time if the user has not | ||
313 | successfully logged in. If the value is 0, there is no time limit. | ||
314 | The default is 600 (seconds). | ||
315 | .It Cm PasswordAuthentication | ||
316 | Specifies whether password authentication is allowed. | ||
317 | The default is | ||
318 | .Dq yes . | ||
319 | .It Cm PermitEmptyPasswords | ||
320 | When password authentication is allowed, it specifies whether the | ||
321 | server allows login to accounts with empty password strings. The default | ||
322 | is | ||
323 | .Dq yes . | ||
324 | .It Cm PermitRootLogin | ||
325 | Specifies whether the root can log in using | ||
326 | .Xr ssh 1 . | ||
327 | The argument must be | ||
328 | .Dq yes , | ||
329 | .Dq without-password | ||
330 | or | ||
331 | .Dq no . | ||
332 | The default is | ||
333 | .Dq yes . | ||
334 | If this options is set to | ||
335 | .Dq without-password | ||
336 | only password authentication is disabled for root. | ||
337 | .Pp | ||
338 | Root login with RSA authentication when the | ||
339 | .Ar command | ||
340 | option has been | ||
341 | specified will be allowed regardless of the value of this setting | ||
342 | (which may be useful for taking remote backups even if root login is | ||
343 | normally not allowed). | ||
344 | .It Cm Port | ||
345 | Specifies the port number that | ||
346 | .Nm | ||
347 | listens on. The default is 22. | ||
348 | .It Cm PrintMotd | ||
349 | Specifies whether | ||
350 | .Nm | ||
351 | should print | ||
352 | .Pa /etc/motd | ||
353 | when a user logs in interactively. (On some systems it is also | ||
354 | printed by the shell, | ||
355 | .Pa /etc/profile , | ||
356 | or equivalent.) The default is | ||
357 | .Dq yes . | ||
358 | .It Cm QuietMode | ||
359 | Specifies whether the system runs in quiet mode. In quiet mode, | ||
360 | nothing is logged in the system log, except fatal errors. The default | ||
361 | is | ||
362 | .Dq no . | ||
363 | .It Cm RandomSeed | ||
364 | Obsolete. Random number generation uses other techniques. | ||
365 | .It Cm RhostsAuthentication | ||
366 | Specifies whether authentication using rhosts or /etc/hosts.equiv | ||
367 | files is sufficient. Normally, this method should not be permitted | ||
368 | because it is insecure. | ||
369 | .Cm RhostsRSAAuthentication | ||
370 | should be used | ||
371 | instead, because it performs RSA-based host authentication in addition | ||
372 | to normal rhosts or /etc/hosts.equiv authentication. | ||
373 | The default is | ||
374 | .Dq no . | ||
375 | .It Cm RhostsRSAAuthentication | ||
376 | Specifies whether rhosts or /etc/hosts.equiv authentication together | ||
377 | with successful RSA host authentication is allowed. The default is | ||
378 | .Dq yes . | ||
379 | .It Cm RSAAuthentication | ||
380 | Specifies whether pure RSA authentication is allowed. The default is | ||
381 | .Dq yes . | ||
382 | .It Cm ServerKeyBits | ||
383 | Defines the number of bits in the server key. The minimum value is | ||
384 | 512, and the default is 768. | ||
385 | .It Cm SkeyAuthentication | ||
386 | Specifies whether | ||
387 | .Xr skey 1 | ||
388 | authentication is allowed. The default is | ||
389 | .Dq yes . | ||
390 | Note that s/key authentication is enabled only if | ||
391 | .Cm PasswordAuthentication | ||
392 | is allowed, too. | ||
393 | .It Cm StrictModes | ||
394 | Specifies whether | ||
395 | .Nm | ||
396 | should check file modes and ownership of the | ||
397 | user's files and home directory before accepting login. This | ||
398 | is normally desirable because novices sometimes accidentally leave their | ||
399 | directory or files world-writable. The default is | ||
400 | .Dq yes . | ||
401 | .It Cm SyslogFacility | ||
402 | Gives the facility code that is used when logging messages from | ||
403 | .Nm sshd . | ||
404 | The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, | ||
405 | LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH. | ||
406 | .It Cm UseLogin | ||
407 | Specifies whether | ||
408 | .Xr login 1 | ||
409 | is used. The default is | ||
410 | .Dq no . | ||
411 | .It Cm X11Forwarding | ||
412 | Specifies whether X11 forwarding is permitted. The default is | ||
413 | .Dq yes . | ||
414 | Note that disabling X11 forwarding does not improve security in any | ||
415 | way, as users can always install their own forwarders. | ||
416 | .It Cm X11DisplayOffset | ||
417 | Specifies the first display number available for | ||
418 | .Nm sshd Ns 's | ||
419 | X11 forwarding. This prevents | ||
420 | .Nm | ||
421 | from interfering with real X11 servers. | ||
422 | .El | ||
423 | .Sh LOGIN PROCESS | ||
424 | When a user successfully logs in, | ||
425 | .Nm | ||
426 | does the following: | ||
427 | .Bl -enum -offset indent | ||
428 | .It | ||
429 | If the login is on a tty, and no command has been specified, | ||
430 | prints last login time and | ||
431 | .Pa /etc/motd | ||
432 | (unless prevented in the configuration file or by | ||
433 | .Pa $HOME/.hushlogin ; | ||
434 | see the | ||
435 | .Sx FILES | ||
436 | section). | ||
437 | .It | ||
438 | If the login is on a tty, records login time. | ||
439 | .It | ||
440 | Checks | ||
441 | .Pa /etc/nologin ; | ||
442 | if it exists, prints contents and quits | ||
443 | (unless root). | ||
444 | .It | ||
445 | Changes to run with normal user privileges. | ||
446 | .It | ||
447 | Sets up basic environment. | ||
448 | .It | ||
449 | Reads | ||
450 | .Pa $HOME/.ssh/environment | ||
451 | if it exists. | ||
452 | .It | ||
453 | Changes to user's home directory. | ||
454 | .It | ||
455 | If | ||
456 | .Pa $HOME/.ssh/rc | ||
457 | exists, runs it; else if | ||
458 | .Pa /etc/openssh/sshrc | ||
459 | exists, runs | ||
460 | it; otherwise runs xauth. The | ||
461 | .Dq rc | ||
462 | files are given the X11 | ||
463 | authentication protocol and cookie in standard input. | ||
464 | .It | ||
465 | Runs user's shell or command. | ||
466 | .El | ||
467 | .Sh AUTHORIZED_KEYS FILE FORMAT | ||
468 | The | ||
469 | .Pa $HOME/.ssh/authorized_keys | ||
470 | file lists the RSA keys that are | ||
471 | permitted for RSA authentication. Each line of the file contains one | ||
472 | key (empty lines and lines starting with a | ||
473 | .Ql # | ||
474 | are ignored as | ||
475 | comments). Each line consists of the following fields, separated by | ||
476 | spaces: options, bits, exponent, modulus, comment. The options field | ||
477 | is optional; its presence is determined by whether the line starts | ||
478 | with a number or not (the option field never starts with a number). | ||
479 | The bits, exponent, modulus and comment fields give the RSA key; the | ||
480 | comment field is not used for anything (but may be convenient for the | ||
481 | user to identify the key). | ||
482 | .Pp | ||
483 | Note that lines in this file are usually several hundred bytes long | ||
484 | (because of the size of the RSA key modulus). You don't want to type | ||
485 | them in; instead, copy the | ||
486 | .Pa identity.pub | ||
487 | file and edit it. | ||
488 | .Pp | ||
489 | The options (if present) consists of comma-separated option | ||
490 | specifications. No spaces are permitted, except within double quotes. | ||
491 | The following option specifications are supported: | ||
492 | .Bl -tag -width Ds | ||
493 | .It Cm from="pattern-list" | ||
494 | Specifies that in addition to RSA authentication, the canonical name | ||
495 | of the remote host must be present in the comma-separated list of | ||
496 | patterns ('*' and '?' serve as wildcards). The list may also contain | ||
497 | patterns negated by prefixing them with '!'; if the canonical host | ||
498 | name matches a negated pattern, the key is not accepted. The purpose | ||
499 | of this option is to optionally increase security: RSA authentication | ||
500 | by itself does not trust the network or name servers or anything (but | ||
501 | the key); however, if somebody somehow steals the key, the key | ||
502 | permits an intruder to log in from anywhere in the world. This | ||
503 | additional option makes using a stolen key more difficult (name | ||
504 | servers and/or routers would have to be compromised in addition to | ||
505 | just the key). | ||
506 | .It Cm command="command" | ||
507 | Specifies that the command is executed whenever this key is used for | ||
508 | authentication. The command supplied by the user (if any) is ignored. | ||
509 | The command is run on a pty if the connection requests a pty; | ||
510 | otherwise it is run without a tty. A quote may be included in the | ||
511 | command by quoting it with a backslash. This option might be useful | ||
512 | to restrict certain RSA keys to perform just a specific operation. An | ||
513 | example might be a key that permits remote backups but nothing | ||
514 | else. Notice that the client may specify TCP/IP and/or X11 | ||
515 | forwardings unless they are explicitly prohibited. | ||
516 | .It Cm environment="NAME=value" | ||
517 | Specifies that the string is to be added to the environment when | ||
518 | logging in using this key. Environment variables set this way | ||
519 | override other default environment values. Multiple options of this | ||
520 | type are permitted. | ||
521 | .It Cm no-port-forwarding | ||
522 | Forbids TCP/IP forwarding when this key is used for authentication. | ||
523 | Any port forward requests by the client will return an error. This | ||
524 | might be used, e.g., in connection with the | ||
525 | .Cm command | ||
526 | option. | ||
527 | .It Cm no-X11-forwarding | ||
528 | Forbids X11 forwarding when this key is used for authentication. | ||
529 | Any X11 forward requests by the client will return an error. | ||
530 | .It Cm no-agent-forwarding | ||
531 | Forbids authentication agent forwarding when this key is used for | ||
532 | authentication. | ||
533 | .It Cm no-pty | ||
534 | Prevents tty allocation (a request to allocate a pty will fail). | ||
535 | .El | ||
536 | .Ss Examples | ||
537 | 1024 33 12121.\|.\|.\|312314325 ylo@foo.bar | ||
538 | .Pp | ||
539 | from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula | ||
540 | .Pp | ||
541 | command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi | ||
542 | .Sh SSH_KNOWN_HOSTS FILE FORMAT | ||
543 | The | ||
544 | .Pa /etc/openssh/ssh_known_hosts | ||
545 | and | ||
546 | .Pa $HOME/.ssh/known_hosts | ||
547 | files contain host public keys for all known hosts. The global file should | ||
548 | be prepared by the admistrator (optional), and the per-user file is | ||
549 | maintained automatically: whenever the user connects an unknown host | ||
550 | its key is added to the per-user file. | ||
551 | .Pp | ||
552 | Each line in these files contains the following fields: hostnames, | ||
553 | bits, exponent, modulus, comment. The fields are separated by spaces. | ||
554 | .Pp | ||
555 | Hostnames is a comma-separated list of patterns ('*' and '?' act as | ||
556 | wildcards); each pattern in turn is matched against the canonical host | ||
557 | name (when authenticating a client) or against the user-supplied | ||
558 | name (when authenticating a server). A pattern may also be preceded | ||
559 | by | ||
560 | .Ql ! | ||
561 | to indicate negation: if the host name matches a negated | ||
562 | pattern, it is not accepted (by that line) even if it matched another | ||
563 | pattern on the line. | ||
564 | .Pp | ||
565 | Bits, exponent, and modulus are taken directly from the host key; they | ||
566 | can be obtained, e.g., from | ||
567 | .Pa /etc/openssh/ssh_host_key.pub . | ||
568 | The optional comment field continues to the end of the line, and is not used. | ||
569 | .Pp | ||
570 | Lines starting with | ||
571 | .Ql # | ||
572 | and empty lines are ignored as comments. | ||
573 | .Pp | ||
574 | When performing host authentication, authentication is accepted if any | ||
575 | matching line has the proper key. It is thus permissible (but not | ||
576 | recommended) to have several lines or different host keys for the same | ||
577 | names. This will inevitably happen when short forms of host names | ||
578 | from different domains are put in the file. It is possible | ||
579 | that the files contain conflicting information; authentication is | ||
580 | accepted if valid information can be found from either file. | ||
581 | .Pp | ||
582 | Note that the lines in these files are typically hundreds of characters | ||
583 | long, and you definitely don't want to type in the host keys by hand. | ||
584 | Rather, generate them by a script | ||
585 | or by taking | ||
586 | .Pa /etc/openssh/ssh_host_key.pub | ||
587 | and adding the host names at the front. | ||
588 | .Ss Examples | ||
589 | closenet,closenet.hut.fi,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi | ||
590 | .Sh FILES | ||
591 | .Bl -tag -width Ds | ||
592 | .It Pa /etc/openssh/sshd_config | ||
593 | Contains configuration data for | ||
594 | .Nm sshd . | ||
595 | This file should be writable by root only, but it is recommended | ||
596 | (though not necessary) that it be world-readable. | ||
597 | .It Pa /etc/openssh/ssh_host_key | ||
598 | Contains the private part of the host key. | ||
599 | This file should only be owned by root, readable only by root, and not | ||
600 | accessible to others. | ||
601 | Note that | ||
602 | .Nm | ||
603 | does not start if this file is group/world-accessible. | ||
604 | .It Pa /etc/openssh/ssh_host_key.pub | ||
605 | Contains the public part of the host key. | ||
606 | This file should be world-readable but writable only by | ||
607 | root. Its contents should match the private part. This file is not | ||
608 | really used for anything; it is only provided for the convenience of | ||
609 | the user so its contents can be copied to known hosts files. | ||
610 | These two files are created using | ||
611 | .Xr ssh-keygen 1 . | ||
612 | .It Pa /var/run/sshd.pid | ||
613 | Contains the process ID of the | ||
614 | .Nm | ||
615 | listening for connections (if there are several daemons running | ||
616 | concurrently for different ports, this contains the pid of the one | ||
617 | started last). The contents of this file are not sensitive; it can be | ||
618 | world-readable. | ||
619 | .It Pa $HOME/.ssh/authorized_keys | ||
620 | Lists the RSA keys that can be used to log into the user's account. | ||
621 | This file must be readable by root (which may on some machines imply | ||
622 | it being world-readable if the user's home directory resides on an NFS | ||
623 | volume). It is recommended that it not be accessible by others. The | ||
624 | format of this file is described above. | ||
625 | .It Pa /etc/openssh/ssh_known_hosts | ||
626 | This file is consulted when using rhosts with RSA host | ||
627 | authentication to check the public key of the host. The key must be | ||
628 | listed in this file to be accepted. | ||
629 | .It Pa $HOME/.ssh/known_hosts | ||
630 | The client uses this file | ||
631 | and | ||
632 | .Pa /etc/openssh/ssh_known_hosts | ||
633 | to verify that the remote host is the one we intended to | ||
634 | connect. These files should be writable only by root/the owner. | ||
635 | .Pa /etc/openssh/ssh_known_hosts | ||
636 | should be world-readable, and | ||
637 | .Pa $HOME/.ssh/known_hosts | ||
638 | can but need not be world-readable. | ||
639 | .It Pa /etc/nologin | ||
640 | If this file exists, | ||
641 | .Nm | ||
642 | refuses to let anyone except root log in. The contents of the file | ||
643 | are displayed to anyone trying to log in, and non-root connections are | ||
644 | refused. The file should be world-readable. | ||
645 | .It Pa /etc/hosts.allow, /etc/hosts.deny | ||
646 | If compiled with | ||
647 | .Sy LIBWRAP | ||
648 | support, tcp-wrappers access controls may be defined here as described in | ||
649 | .Xr hosts_access 5 . | ||
650 | .It Pa $HOME/.rhosts | ||
651 | This file contains host-username pairs, separated by a space, one per | ||
652 | line. The given user on the corresponding host is permitted to log in | ||
653 | without password. The same file is used by rlogind and rshd. | ||
654 | The file must | ||
655 | be writable only by the user; it is recommended that it not be | ||
656 | accessible by others. | ||
657 | .Pp | ||
658 | If is also possible to use netgroups in the file. Either host or user | ||
659 | name may be of the form +@groupname to specify all hosts or all users | ||
660 | in the group. | ||
661 | .It Pa $HOME/.shosts | ||
662 | For ssh, | ||
663 | this file is exactly the same as for | ||
664 | .Pa .rhosts . | ||
665 | However, this file is | ||
666 | not used by rlogin and rshd, so using this permits access using SSH only. | ||
667 | .Pa /etc/hosts.equiv | ||
668 | This file is used during | ||
669 | .Pa .rhosts | ||
670 | authentication. In the | ||
671 | simplest form, this file contains host names, one per line. Users on | ||
672 | those hosts are permitted to log in without a password, provided they | ||
673 | have the same user name on both machines. The host name may also be | ||
674 | followed by a user name; such users are permitted to log in as | ||
675 | .Em any | ||
676 | user on this machine (except root). Additionally, the syntax | ||
677 | .Dq +@group | ||
678 | can be used to specify netgroups. Negated entries start with | ||
679 | .Ql \&- . | ||
680 | .Pp | ||
681 | If the client host/user is successfully matched in this file, login is | ||
682 | automatically permitted provided the client and server user names are the | ||
683 | same. Additionally, successful RSA host authentication is normally | ||
684 | required. This file must be writable only by root; it is recommended | ||
685 | that it be world-readable. | ||
686 | .Pp | ||
687 | .Sy "Warning: It is almost never a good idea to use user names in" | ||
688 | .Pa hosts.equiv . | ||
689 | Beware that it really means that the named user(s) can log in as | ||
690 | .Em anybody , | ||
691 | which includes bin, daemon, adm, and other accounts that own critical | ||
692 | binaries and directories. Using a user name practically grants the | ||
693 | user root access. The only valid use for user names that I can think | ||
694 | of is in negative entries. | ||
695 | .Pp | ||
696 | Note that this warning also applies to rsh/rlogin. | ||
697 | .It Pa /etc/openssh/shosts.equiv | ||
698 | This is processed exactly as | ||
699 | .Pa /etc/hosts.equiv . | ||
700 | However, this file may be useful in environments that want to run both | ||
701 | rsh/rlogin and ssh. | ||
702 | .It Pa $HOME/.ssh/environment | ||
703 | This file is read into the environment at login (if it exists). It | ||
704 | can only contain empty lines, comment lines (that start with | ||
705 | .Ql # ) , | ||
706 | and assignment lines of the form name=value. The file should be writable | ||
707 | only by the user; it need not be readable by anyone else. | ||
708 | .It Pa $HOME/.ssh/rc | ||
709 | If this file exists, it is run with /bin/sh after reading the | ||
710 | environment files but before starting the user's shell or command. If | ||
711 | X11 spoofing is in use, this will receive the "proto cookie" pair in | ||
712 | standard input (and | ||
713 | .Ev DISPLAY | ||
714 | in environment). This must call | ||
715 | .Xr xauth 1 | ||
716 | in that case. | ||
717 | .Pp | ||
718 | The primary purpose of this file is to run any initialization routines | ||
719 | which may be needed before the user's home directory becomes | ||
720 | accessible; AFS is a particular example of such an environment. | ||
721 | .Pp | ||
722 | This file will probably contain some initialization code followed by | ||
723 | something similar to: "if read proto cookie; then echo add $DISPLAY | ||
724 | $proto $cookie | xauth -q -; fi". | ||
725 | .Pp | ||
726 | If this file does not exist, | ||
727 | .Pa /etc/openssh/sshrc | ||
728 | is run, and if that | ||
729 | does not exist either, xauth is used to store the cookie. | ||
730 | .Pp | ||
731 | This file should be writable only by the user, and need not be | ||
732 | readable by anyone else. | ||
733 | .It Pa /etc/openssh/sshrc | ||
734 | Like | ||
735 | .Pa $HOME/.ssh/rc . | ||
736 | This can be used to specify | ||
737 | machine-specific login-time initializations globally. This file | ||
738 | should be writable only by root, and should be world-readable. | ||
739 | .Sh AUTHOR | ||
740 | Tatu Ylonen <ylo@cs.hut.fi> | ||
741 | .Pp | ||
742 | Information about new releases, mailing lists, and other related | ||
743 | issues can be found from the SSH WWW home page: | ||
744 | .Pp | ||
745 | .Dl http://www.cs.hut.fi/ssh. | ||
746 | .Pp | ||
747 | OpenSSH | ||
748 | is a derivative of the original (free) ssh 1.2.12 release, but with bugs | ||
749 | removed and newer features re-added. Rapidly after the 1.2.12 release, | ||
750 | newer versions bore successively more restrictive licenses. This version | ||
751 | of OpenSSH | ||
752 | .Bl -bullet | ||
753 | .It | ||
754 | has all components of a restrictive nature (ie. patents, see | ||
755 | .Xr ssl 8 ) | ||
756 | directly removed from the source code; any licensed or patented components | ||
757 | are chosen from | ||
758 | external libraries. | ||
759 | .It | ||
760 | has been updated to support ssh protocol 1.5. | ||
761 | .It | ||
762 | contains added support for | ||
763 | .Xr kerberos 8 | ||
764 | authentication and ticket passing. | ||
765 | .It | ||
766 | supports one-time password authentication with | ||
767 | .Xr skey 1 . | ||
768 | .El | ||
769 | .Pp | ||
770 | The libraries described in | ||
771 | .Xr ssl 8 | ||
772 | are required for proper operation. | ||
773 | .Sh SEE ALSO | ||
774 | .Xr rlogin 1 , | ||
775 | .Xr rsh 1 , | ||
776 | .Xr scp 1 , | ||
777 | .Xr ssh 1 , | ||
778 | .Xr ssh-add 1 , | ||
779 | .Xr ssh-agent 1 , | ||
780 | .Xr ssh-keygen 1 , | ||
781 | .Xr ssl 8 | ||