* New upstream release (LP: #535029).

  - After a transition period of about 10 years, this release disables SSH
    protocol 1 by default.  Clients and servers that need to use the
    legacy protocol must explicitly enable it in ssh_config / sshd_config
    or on the command-line.
  - Remove the libsectok/OpenSC-based smartcard code and add support for
    PKCS#11 tokens.  This support is enabled by default in the Debian
    packaging, since it now doesn't involve additional library
    dependencies (closes: #231472, LP: #16918).
  - Add support for certificate authentication of users and hosts using a
    new, minimal OpenSSH certificate format (closes: #482806).
  - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
  - Add the ability to revoke keys in sshd(8) and ssh(1).  (For the Debian
    package, this overlaps with the key blacklisting facility added in
    openssh 1:4.7p1-9, but with different file formats and slightly
    different scopes; for the moment, I've roughly merged the two.)
  - Various multiplexing improvements, including support for requesting
    port-forwardings via the multiplex protocol (closes: #360151).
  - Allow setting an explicit umask on the sftp-server(8) commandline to
    override whatever default the user has (closes: #496843).
  - Many sftp client improvements, including tab-completion, more options,
    and recursive transfer support for get/put (LP: #33378).  The old
    mget/mput commands never worked properly and have been removed
    (closes: #270399, #428082).
  - Do not prompt for a passphrase if we fail to open a keyfile, and log
    the reason why the open failed to debug (closes: #431538).
  - Prevent sftp from crashing when given a "-" without a command.  Also,
    allow whitespace to follow a "-" (closes: #531561).

1 files changed, 77 insertions, 16 deletions

diff --git a/sftp.1 b/sftp.1
index 37ccb3a38..777b02a58 100644
--- a/sftp.1
+++ b/sftp.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.69 2008/12/09 15:35:00 sobrado Exp $
+.\" $OpenBSD: sftp.1,v 1.83 2010/02/08 10:50:20 markus Exp $
 .\"
 .\" Copyright (c) 2001 Damien Miller.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: December 9 2008 $
+.Dd $Mdocdate: February 8 2010 $
 .Dt SFTP 1
 .Os
 .Sh NAME
@@ -31,12 +31,15 @@
 .Sh SYNOPSIS
 .Nm sftp
 .Bk -words
-.Op Fl 1Cv
+.Op Fl 1246Cpqrv
 .Op Fl B Ar buffer_size
 .Op Fl b Ar batchfile
+.Op Fl c Ar cipher
+.Op Fl D Ar sftp_server_path
 .Op Fl F Ar ssh_config
+.Op Fl i Ar identity_file
 .Op Fl o Ar ssh_option
-.Op Fl P Ar sftp_server_path
+.Op Fl P Ar port
 .Op Fl R Ar num_requests
 .Op Fl S Ar program
 .Op Fl s Ar subsystem | sftp_server
@@ -87,6 +90,16 @@ The options are as follows:
 .Bl -tag -width Ds
 .It Fl 1
 Specify the use of protocol version 1.
+.It Fl 2
+Specify the use of protocol version 2.
+.It Fl 4
+Forces
+.Nm
+to use IPv4 addresses only.
+.It Fl 6
+Forces
+.Nm
+to use IPv6 addresses only.
 .It Fl B Ar buffer_size
 Specify the size of the buffer that
 .Nm
@@ -124,12 +137,26 @@ character (for example,
 Enables compression (via ssh's
 .Fl C
 flag).
+.It Fl c Ar cipher
+Selects the cipher to use for encrypting the data transfers.
+This option is directly passed to
+.Xr ssh 1 .
+.It Fl D Ar sftp_server_path
+Connect directly to a local sftp server
+(rather than via
+.Xr ssh 1 ) .
+This option may be useful in debugging the client and server.
 .It Fl F Ar ssh_config
 Specifies an alternative
 per-user configuration file for
 .Xr ssh 1 .
 This option is directly passed to
 .Xr ssh 1 .
+.It Fl i Ar identity_file
+Selects the file from which the identity (private key) for public key
+authentication is read.
+This option is directly passed to
+.Xr ssh 1 .
 .It Fl o Ar ssh_option
 Can be used to pass options to
 .Nm ssh
@@ -175,6 +202,7 @@ For full details of the options listed below, and their possible values, see
 .It NoHostAuthenticationForLocalhost
 .It NumberOfPasswordPrompts
 .It PasswordAuthentication
+.It PKCS11Provider
 .It Port
 .It PreferredAuthentications
 .It Protocol
@@ -186,7 +214,6 @@ For full details of the options listed below, and their possible values, see
 .It SendEnv
 .It ServerAliveInterval
 .It ServerAliveCountMax
-.It SmartcardDevice
 .It StrictHostKeyChecking
 .It TCPKeepAlive
 .It UsePrivilegedPort
@@ -194,16 +221,25 @@ For full details of the options listed below, and their possible values, see
 .It UserKnownHostsFile
 .It VerifyHostKeyDNS
 .El
-.It Fl P Ar sftp_server_path
-Connect directly to a local sftp server
-(rather than via
-.Xr ssh 1 ) .
-This option may be useful in debugging the client and server.
+.It Fl P Ar port
+Specifies the port to connect to on the remote host.
+.It Fl p
+Preserves modification times, access times, and modes from the
+original files transferred.
+.It Fl q
+Quiet mode: disables the progress meter as well as warning and
+diagnostic messages from
+.Xr ssh 1 .
 .It Fl R Ar num_requests
 Specify how many requests may be outstanding at any one time.
 Increasing this may slightly improve file transfer speed
 but will increase memory usage.
 The default is 64 outstanding requests.
+.It Fl r
+Recursively copy entire directories when uploading and downloading.
+Note that
+.Nm
+does not follow symbolic links encountered in the tree traversal.
 .It Fl S Ar program
 Name of the
 .Ar program
@@ -294,7 +330,7 @@ extension.
 Quit
 .Nm sftp .
 .It Xo Ic get
-.Op Fl P
+.Op Fl Ppr
 .Ar remote-path
 .Op Ar local-path
 .Xc
@@ -313,10 +349,20 @@ If it does and
 is specified, then
 .Ar local-path
 must specify a directory.
-If the
+.Pp
+If either the
 .Fl P
+or
+.Fl p
 flag is specified, then full file permissions and access times are
 copied too.
+.Pp
+If the
+.Fl r
+flag is specified then directories will be copied recursively.
+Note that
+.Nm
+does not follow symbolic links when performing recursive transfers.
 .It Ic help
 Display help text.
 .It Ic lcd Ar path
@@ -347,7 +393,7 @@ to
 .It Ic lpwd
 Print local working directory.
 .It Xo Ic ls
-.Op Fl 1aflnrSt
+.Op Fl 1afhlnrSt
 .Op Ar path
 .Xc
 Display a remote directory listing of either
@@ -372,6 +418,11 @@ List files beginning with a dot
 .It Fl f
 Do not sort the listing.
 The default sort order is lexicographical.
+.It Fl h
+When used with a long format option, use unit suffixes: Byte, Kilobyte,
+Megabyte, Gigabyte, Terabyte, Petabyte, and Exabyte in order to reduce
+the number of digits to four or fewer using powers of 2 for sizes (K=1024,
+M=1048576, etc.).
 .It Fl l
 Display additional details including permissions
 and ownership information.
@@ -394,7 +445,7 @@ Create remote directory specified by
 .It Ic progress
 Toggle display of progress meter.
 .It Xo Ic put
-.Op Fl P
+.Op Fl Ppr
 .Ar local-path
 .Op Ar remote-path
 .Xc
@@ -412,10 +463,20 @@ If it does and
 is specified, then
 .Ar remote-path
 must specify a directory.
-If the
+.Pp
+If ether the
 .Fl P
-flag is specified, then the file's full permission and access time are
+or
+.Fl p
+flag is specified, then full file permissions and access times are
 copied too.
+.Pp
+If the
+.Fl r
+flag is specified then directories will be copied recursively.
+Note that
+.Nm
+does not follow symbolic links when performing recursive transfers.
 .It Ic pwd
 Display remote working directory.
 .It Ic quit