diff options
author | Colin Watson <cjwatson@debian.org> | 2005-03-10 00:24:57 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2005-03-10 00:24:57 +0000 |
commit | 5d05471f6657646d1d6500c7c43134462c407ee6 (patch) | |
tree | c142ff8a5b1fcb1c671ba8c6f023746191124d39 /ssh-keygen.0 | |
parent | 485bab886137bbf8b7ec8df82bd66dc6e5654371 (diff) | |
parent | ebd2ce335af5861020c79fddb1ae35c03bf036cf (diff) |
Import OpenSSH 4.0p1.
Diffstat (limited to 'ssh-keygen.0')
-rw-r--r-- | ssh-keygen.0 | 284 |
1 files changed, 284 insertions, 0 deletions
diff --git a/ssh-keygen.0 b/ssh-keygen.0 new file mode 100644 index 000000000..998b6f1e0 --- /dev/null +++ b/ssh-keygen.0 | |||
@@ -0,0 +1,284 @@ | |||
1 | SSH-KEYGEN(1) OpenBSD Reference Manual SSH-KEYGEN(1) | ||
2 | |||
3 | NAME | ||
4 | ssh-keygen - authentication key generation, management and conversion | ||
5 | |||
6 | SYNOPSIS | ||
7 | ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment] | ||
8 | [-f output_keyfile] | ||
9 | ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile] | ||
10 | ssh-keygen -i [-f input_keyfile] | ||
11 | ssh-keygen -e [-f input_keyfile] | ||
12 | ssh-keygen -y [-f input_keyfile] | ||
13 | ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile] | ||
14 | ssh-keygen -l [-f input_keyfile] | ||
15 | ssh-keygen -B [-f input_keyfile] | ||
16 | ssh-keygen -D reader | ||
17 | ssh-keygen -F hostname [-f known_hosts_file] | ||
18 | ssh-keygen -H [-f known_hosts_file] | ||
19 | ssh-keygen -R hostname [-f known_hosts_file] | ||
20 | ssh-keygen -U reader [-f input_keyfile] | ||
21 | ssh-keygen -r hostname [-f input_keyfile] [-g] | ||
22 | ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point] | ||
23 | ssh-keygen -T output_file -f input_file [-v] [-a num_trials] [-W | ||
24 | generator] | ||
25 | |||
26 | DESCRIPTION | ||
27 | ssh-keygen generates, manages and converts authentication keys for | ||
28 | ssh(1). ssh-keygen can create RSA keys for use by SSH protocol version 1 | ||
29 | and RSA or DSA keys for use by SSH protocol version 2. The type of key | ||
30 | to be generated is specified with the -t option. | ||
31 | |||
32 | ssh-keygen is also used to generate groups for use in Diffie-Hellman | ||
33 | group exchange (DH-GEX). See the MODULI GENERATION section for details. | ||
34 | |||
35 | Normally each user wishing to use SSH with RSA or DSA authentication runs | ||
36 | this once to create the authentication key in $HOME/.ssh/identity, | ||
37 | $HOME/.ssh/id_dsa or $HOME/.ssh/id_rsa. Additionally, the system admin- | ||
38 | istrator may use this to generate host keys, as seen in /etc/rc. | ||
39 | |||
40 | Normally this program generates the key and asks for a file in which to | ||
41 | store the private key. The public key is stored in a file with the same | ||
42 | name but ``.pub'' appended. The program also asks for a passphrase. The | ||
43 | passphrase may be empty to indicate no passphrase (host keys must have an | ||
44 | empty passphrase), or it may be a string of arbitrary length. A | ||
45 | passphrase is similar to a password, except it can be a phrase with a se- | ||
46 | ries of words, punctuation, numbers, whitespace, or any string of charac- | ||
47 | ters you want. Good passphrases are 10-30 characters long, are not sim- | ||
48 | ple sentences or otherwise easily guessable (English prose has only 1-2 | ||
49 | bits of entropy per character, and provides very bad passphrases), and | ||
50 | contain a mix of upper and lowercase letters, numbers, and non-alphanu- | ||
51 | meric characters. The passphrase can be changed later by using the -p | ||
52 | option. | ||
53 | |||
54 | There is no way to recover a lost passphrase. If the passphrase is lost | ||
55 | or forgotten, a new key must be generated and copied to the corresponding | ||
56 | public key to other machines. | ||
57 | |||
58 | For RSA1 keys, there is also a comment field in the key file that is only | ||
59 | for convenience to the user to help identify the key. The comment can | ||
60 | tell what the key is for, or whatever is useful. The comment is initial- | ||
61 | ized to ``user@host'' when the key is created, but can be changed using | ||
62 | the -c option. | ||
63 | |||
64 | After a key is generated, instructions below detail where the keys should | ||
65 | be placed to be activated. | ||
66 | |||
67 | The options are as follows: | ||
68 | |||
69 | -a trials | ||
70 | Specifies the number of primality tests to perform when screening | ||
71 | DH-GEX candidates using the -T command. | ||
72 | |||
73 | -B Show the bubblebabble digest of specified private or public key | ||
74 | file. | ||
75 | |||
76 | -b bits | ||
77 | Specifies the number of bits in the key to create. Minimum is | ||
78 | 512 bits. Generally, 1024 bits is considered sufficient. The | ||
79 | default is 1024 bits. | ||
80 | |||
81 | -C comment | ||
82 | Provides a new comment. | ||
83 | |||
84 | -c Requests changing the comment in the private and public key | ||
85 | files. This operation is only supported for RSA1 keys. The pro- | ||
86 | gram will prompt for the file containing the private keys, for | ||
87 | the passphrase if the key has one, and for the new comment. | ||
88 | |||
89 | -D reader | ||
90 | Download the RSA public key stored in the smartcard in reader. | ||
91 | |||
92 | -e This option will read a private or public OpenSSH key file and | ||
93 | print the key in a `SECSH Public Key File Format' to stdout. | ||
94 | This option allows exporting keys for use by several commercial | ||
95 | SSH implementations. | ||
96 | |||
97 | -F hostname | ||
98 | Search for the specified hostname in a known_hosts file, listing | ||
99 | any occurrences found. This option is useful to find hashed host | ||
100 | names or addresses and may also be used in conjunction with the | ||
101 | -H option to print found keys in a hashed format. | ||
102 | |||
103 | -f filename | ||
104 | Specifies the filename of the key file. | ||
105 | |||
106 | -G output_file | ||
107 | Generate candidate primes for DH-GEX. These primes must be | ||
108 | screened for safety (using the -T option) before use. | ||
109 | |||
110 | -g Use generic DNS format when printing fingerprint resource records | ||
111 | using the -r command. | ||
112 | |||
113 | -H Hash a known_hosts file, printing the result to standard output. | ||
114 | This replaces all hostnames and addresses with hashed representa- | ||
115 | tions. These hashes may be used normally by ssh and sshd, but | ||
116 | they do not reveal identifying information should the file's con- | ||
117 | tents be disclosed. This option will not modify existing hashed | ||
118 | hostnames and is therefore safe to use on files that mix hashed | ||
119 | and non-hashed names. | ||
120 | |||
121 | -i This option will read an unencrypted private (or public) key file | ||
122 | in SSH2-compatible format and print an OpenSSH compatible private | ||
123 | (or public) key to stdout. ssh-keygen also reads the `SECSH | ||
124 | Public Key File Format'. This option allows importing keys from | ||
125 | several commercial SSH implementations. | ||
126 | |||
127 | -l Show fingerprint of specified public key file. Private RSA1 keys | ||
128 | are also supported. For RSA and DSA keys ssh-keygen tries to | ||
129 | find the matching public key file and prints its fingerprint. | ||
130 | |||
131 | -M memory | ||
132 | Specify the amount of memory to use (in megabytes) when generat- | ||
133 | ing candidate moduli for DH-GEX. | ||
134 | |||
135 | -N new_passphrase | ||
136 | Provides the new passphrase. | ||
137 | |||
138 | -P passphrase | ||
139 | Provides the (old) passphrase. | ||
140 | |||
141 | -p Requests changing the passphrase of a private key file instead of | ||
142 | creating a new private key. The program will prompt for the file | ||
143 | containing the private key, for the old passphrase, and twice for | ||
144 | the new passphrase. | ||
145 | |||
146 | -q Silence ssh-keygen. Used by /etc/rc when creating a new key. | ||
147 | |||
148 | -R hostname | ||
149 | Removes all keys belonging to hostname from a known_hosts file. | ||
150 | This option is useful to delete hashed hosts (see the -H option | ||
151 | above). | ||
152 | |||
153 | -r hostname | ||
154 | Print the SSHFP fingerprint resource record named hostname for | ||
155 | the specified public key file. | ||
156 | |||
157 | -S start | ||
158 | Specify start point (in hex) when generating candidate moduli for | ||
159 | DH-GEX. | ||
160 | |||
161 | -T output_file | ||
162 | Test DH group exchange candidate primes (generated using the -G | ||
163 | option) for safety. | ||
164 | |||
165 | -t type | ||
166 | Specifies the type of key to create. The possible values are | ||
167 | ``rsa1'' for protocol version 1 and ``rsa'' or ``dsa'' for proto- | ||
168 | col version 2. | ||
169 | |||
170 | -U reader | ||
171 | Upload an existing RSA private key into the smartcard in reader. | ||
172 | |||
173 | -v Verbose mode. Causes ssh-keygen to print debugging messages | ||
174 | about its progress. This is helpful for debugging moduli genera- | ||
175 | tion. Multiple -v options increase the verbosity. The maximum | ||
176 | is 3. | ||
177 | |||
178 | -W generator | ||
179 | Specify desired generator when testing candidate moduli for DH- | ||
180 | GEX. | ||
181 | |||
182 | -y This option will read a private OpenSSH format file and print an | ||
183 | OpenSSH public key to stdout. | ||
184 | |||
185 | MODULI GENERATION | ||
186 | ssh-keygen may be used to generate groups for the Diffie-Hellman Group | ||
187 | Exchange (DH-GEX) protocol. Generating these groups is a two-step pro- | ||
188 | cess: first, candidate primes are generated using a fast, but memory in- | ||
189 | tensive process. These candidate primes are then tested for suitability | ||
190 | (a CPU-intensive process). | ||
191 | |||
192 | Generation of primes is performed using the -G option. The desired | ||
193 | length of the primes may be specified by the -b option. For example: | ||
194 | |||
195 | # ssh-keygen -G moduli-2048.candidates -b 2048 | ||
196 | |||
197 | By default, the search for primes begins at a random point in the desired | ||
198 | length range. This may be overridden using the -S option, which speci- | ||
199 | fies a different start point (in hex). | ||
200 | |||
201 | Once a set of candidates have been generated, they must be tested for | ||
202 | suitability. This may be performed using the -T option. In this mode | ||
203 | ssh-keygen will read candidates from standard input (or a file specified | ||
204 | using the -f option). For example: | ||
205 | |||
206 | # ssh-keygen -T moduli-2048 -f moduli-2048.candidates | ||
207 | |||
208 | By default, each candidate will be subjected to 100 primality tests. | ||
209 | This may be overridden using the -a option. The DH generator value will | ||
210 | be chosen automatically for the prime under consideration. If a specific | ||
211 | generator is desired, it may be requested using the -W option. Valid | ||
212 | generator values are 2, 3, and 5. | ||
213 | |||
214 | Screened DH groups may be installed in /etc/moduli. It is important that | ||
215 | this file contains moduli of a range of bit lengths and that both ends of | ||
216 | a connection share common moduli. | ||
217 | |||
218 | FILES | ||
219 | $HOME/.ssh/identity | ||
220 | Contains the protocol version 1 RSA authentication identity of | ||
221 | the user. This file should not be readable by anyone but the us- | ||
222 | er. It is possible to specify a passphrase when generating the | ||
223 | key; that passphrase will be used to encrypt the private part of | ||
224 | this file using 3DES. This file is not automatically accessed by | ||
225 | ssh-keygen but it is offered as the default file for the private | ||
226 | key. ssh(1) will read this file when a login attempt is made. | ||
227 | |||
228 | $HOME/.ssh/identity.pub | ||
229 | Contains the protocol version 1 RSA public key for authentica- | ||
230 | tion. The contents of this file should be added to | ||
231 | $HOME/.ssh/authorized_keys on all machines where the user wishes | ||
232 | to log in using RSA authentication. There is no need to keep the | ||
233 | contents of this file secret. | ||
234 | |||
235 | $HOME/.ssh/id_dsa | ||
236 | Contains the protocol version 2 DSA authentication identity of | ||
237 | the user. This file should not be readable by anyone but the us- | ||
238 | er. It is possible to specify a passphrase when generating the | ||
239 | key; that passphrase will be used to encrypt the private part of | ||
240 | this file using 3DES. This file is not automatically accessed by | ||
241 | ssh-keygen but it is offered as the default file for the private | ||
242 | key. ssh(1) will read this file when a login attempt is made. | ||
243 | |||
244 | $HOME/.ssh/id_dsa.pub | ||
245 | Contains the protocol version 2 DSA public key for authentica- | ||
246 | tion. The contents of this file should be added to | ||
247 | $HOME/.ssh/authorized_keys on all machines where the user wishes | ||
248 | to log in using public key authentication. There is no need to | ||
249 | keep the contents of this file secret. | ||
250 | |||
251 | $HOME/.ssh/id_rsa | ||
252 | Contains the protocol version 2 RSA authentication identity of | ||
253 | the user. This file should not be readable by anyone but the us- | ||
254 | er. It is possible to specify a passphrase when generating the | ||
255 | key; that passphrase will be used to encrypt the private part of | ||
256 | this file using 3DES. This file is not automatically accessed by | ||
257 | ssh-keygen but it is offered as the default file for the private | ||
258 | key. ssh(1) will read this file when a login attempt is made. | ||
259 | |||
260 | $HOME/.ssh/id_rsa.pub | ||
261 | Contains the protocol version 2 RSA public key for authentica- | ||
262 | tion. The contents of this file should be added to | ||
263 | $HOME/.ssh/authorized_keys on all machines where the user wishes | ||
264 | to log in using public key authentication. There is no need to | ||
265 | keep the contents of this file secret. | ||
266 | |||
267 | /etc/moduli | ||
268 | Contains Diffie-Hellman groups used for DH-GEX. The file format | ||
269 | is described in moduli(5). | ||
270 | |||
271 | SEE ALSO | ||
272 | ssh(1), ssh-add(1), ssh-agent(1), moduli(5), sshd(8) | ||
273 | |||
274 | J. Galbraith and R. Thayer, SECSH Public Key File Format, draft-ietf- | ||
275 | secsh-publickeyfile-01.txt, March 2001, work in progress material. | ||
276 | |||
277 | AUTHORS | ||
278 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by | ||
279 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo | ||
280 | de Raadt and Dug Song removed many bugs, re-added newer features and | ||
281 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | ||
282 | versions 1.5 and 2.0. | ||
283 | |||
284 | OpenBSD 3.6 September 25, 1999 5 | ||