diff options
author | Colin Watson <cjwatson@debian.org> | 2007-06-12 16:16:35 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2007-06-12 16:16:35 +0000 |
commit | b7e40fa9da0b5491534a429dadb321eab5a77558 (patch) | |
tree | bed1da11e9f829925797aa093e379fc0b5868ecd /sshd.0 | |
parent | 4f84beedf1005e44ff33c854abd6b711ffc0adb7 (diff) | |
parent | 086ea76990b1e6287c24b6db74adffd4605eb3b0 (diff) |
* New upstream release (closes: #395507, #397961, #420035). Important
changes not previously backported to 4.3p2:
- 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
+ On portable OpenSSH, fix a GSSAPI authentication abort that could be
used to determine the validity of usernames on some platforms.
+ Implemented conditional configuration in sshd_config(5) using the
"Match" directive. This allows some configuration options to be
selectively overridden if specific criteria (based on user, group,
hostname and/or address) are met. So far a useful subset of
post-authentication options are supported and more are expected to
be added in future releases.
+ Add support for Diffie-Hellman group exchange key agreement with a
final hash of SHA256.
+ Added a "ForceCommand" directive to sshd_config(5). Similar to the
command="..." option accepted in ~/.ssh/authorized_keys, this forces
the execution of the specified command regardless of what the user
requested. This is very useful in conjunction with the new "Match"
option.
+ Add a "PermitOpen" directive to sshd_config(5). This mirrors the
permitopen="..." authorized_keys option, allowing fine-grained
control over the port-forwardings that a user is allowed to
establish.
+ Add optional logging of transactions to sftp-server(8).
+ ssh(1) will now record port numbers for hosts stored in
~/.ssh/known_hosts when a non-standard port has been requested
(closes: #50612).
+ Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
non-zero exit code) when requested port forwardings could not be
established.
+ Extend sshd_config(5) "SubSystem" declarations to allow the
specification of command-line arguments.
+ Replacement of all integer overflow susceptible invocations of
malloc(3) and realloc(3) with overflow-checking equivalents.
+ Many manpage fixes and improvements.
+ Add optional support for OpenSSL hardware accelerators (engines),
enabled using the --with-ssl-engine configure option.
+ Tokens in configuration files may be double-quoted in order to
contain spaces (closes: #319639).
+ Move a debug() call out of a SIGCHLD handler, fixing a hang when the
session exits very quickly (closes: #307890).
+ Fix some incorrect buffer allocation calculations (closes: #410599).
+ ssh-add doesn't ask for a passphrase if key file permissions are too
liberal (closes: #103677).
+ Likewise, ssh doesn't ask either (closes: #99675).
- 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
+ sshd now allows the enabling and disabling of authentication methods
on a per user, group, host and network basis via the Match directive
in sshd_config.
+ Fixed an inconsistent check for a terminal when displaying scp
progress meter (closes: #257524).
+ Fix "hang on exit" when background processes are running at the time
of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
install ChangeLog.gssapi.
Diffstat (limited to 'sshd.0')
-rw-r--r-- | sshd.0 | 434 |
1 files changed, 206 insertions, 228 deletions
@@ -21,7 +21,7 @@ DESCRIPTION | |||
21 | (by default sshd_config(5)); command-line options override values speci- | 21 | (by default sshd_config(5)); command-line options override values speci- |
22 | fied in the configuration file. sshd rereads its configuration file when | 22 | fied in the configuration file. sshd rereads its configuration file when |
23 | it receives a hangup signal, SIGHUP, by executing itself with the name | 23 | it receives a hangup signal, SIGHUP, by executing itself with the name |
24 | and options it was started with, e.g., /usr/sbin/sshd. | 24 | and options it was started with, e.g. /usr/sbin/sshd. |
25 | 25 | ||
26 | The options are as follows: | 26 | The options are as follows: |
27 | 27 | ||
@@ -69,7 +69,7 @@ DESCRIPTION | |||
69 | not run from inetd because it needs to generate the server key | 69 | not run from inetd because it needs to generate the server key |
70 | before it can respond to the client, and this may take tens of | 70 | before it can respond to the client, and this may take tens of |
71 | seconds. Clients would have to wait too long if the key was re- | 71 | seconds. Clients would have to wait too long if the key was re- |
72 | generated every time. However, with small key sizes (e.g., 512) | 72 | generated every time. However, with small key sizes (e.g. 512) |
73 | using sshd from inetd may be feasible. | 73 | using sshd from inetd may be feasible. |
74 | 74 | ||
75 | -k key_gen_time | 75 | -k key_gen_time |
@@ -161,17 +161,13 @@ AUTHENTICATION | |||
161 | allowing still public-key, then the passwd field should be set to some- | 161 | allowing still public-key, then the passwd field should be set to some- |
162 | thing other than these values (eg `NP' or `*NP*' ). | 162 | thing other than these values (eg `NP' or `*NP*' ). |
163 | 163 | ||
164 | System security is not improved unless rshd, rlogind, and rexecd are dis- | ||
165 | abled (thus completely disabling rlogin and rsh into the machine). | ||
166 | |||
167 | COMMAND EXECUTION AND DATA FORWARDING | ||
168 | If the client successfully authenticates itself, a dialog for preparing | 164 | If the client successfully authenticates itself, a dialog for preparing |
169 | the session is entered. At this time the client may request things like | 165 | the session is entered. At this time the client may request things like |
170 | allocating a pseudo-tty, forwarding X11 connections, forwarding TCP con- | 166 | allocating a pseudo-tty, forwarding X11 connections, forwarding TCP con- |
171 | nections, or forwarding the authentication agent connection over the se- | 167 | nections, or forwarding the authentication agent connection over the se- |
172 | cure channel. | 168 | cure channel. |
173 | 169 | ||
174 | Finally, the client either requests a shell or execution of a command. | 170 | After this, the client either requests a shell or execution of a command. |
175 | The sides then enter session mode. In this mode, either side may send | 171 | The sides then enter session mode. In this mode, either side may send |
176 | data at any time, and such data is forwarded to/from the shell or command | 172 | data at any time, and such data is forwarded to/from the shell or command |
177 | on the server side, and the user terminal in the client side. | 173 | on the server side, and the user terminal in the client side. |
@@ -204,33 +200,60 @@ LOGIN PROCESS | |||
204 | 200 | ||
205 | 8. If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists, | 201 | 8. If ~/.ssh/rc exists, runs it; else if /etc/ssh/sshrc exists, |
206 | runs it; otherwise runs xauth. The ``rc'' files are given the | 202 | runs it; otherwise runs xauth. The ``rc'' files are given the |
207 | X11 authentication protocol and cookie in standard input. | 203 | X11 authentication protocol and cookie in standard input. See |
204 | SSHRC, below. | ||
208 | 205 | ||
209 | 9. Runs user's shell or command. | 206 | 9. Runs user's shell or command. |
210 | 207 | ||
208 | SSHRC | ||
209 | If the file ~/.ssh/rc exists, sh(1) runs it after reading the environment | ||
210 | files but before starting the user's shell or command. It must not pro- | ||
211 | duce any output on stdout; stderr must be used instead. If X11 forward- | ||
212 | ing is in use, it will receive the "proto cookie" pair in its standard | ||
213 | input (and DISPLAY in its environment). The script must call xauth(1) | ||
214 | because sshd will not run xauth automatically to add X11 cookies. | ||
215 | |||
216 | The primary purpose of this file is to run any initialization routines | ||
217 | which may be needed before the user's home directory becomes accessible; | ||
218 | AFS is a particular example of such an environment. | ||
219 | |||
220 | This file will probably contain some initialization code followed by | ||
221 | something similar to: | ||
222 | |||
223 | if read proto cookie && [ -n "$DISPLAY" ]; then | ||
224 | if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then | ||
225 | # X11UseLocalhost=yes | ||
226 | echo add unix:`echo $DISPLAY | | ||
227 | cut -c11-` $proto $cookie | ||
228 | else | ||
229 | # X11UseLocalhost=no | ||
230 | echo add $DISPLAY $proto $cookie | ||
231 | fi | xauth -q - | ||
232 | fi | ||
233 | |||
234 | If this file does not exist, /etc/ssh/sshrc is run, and if that does not | ||
235 | exist either, xauth is used to add the cookie. | ||
236 | |||
211 | AUTHORIZED_KEYS FILE FORMAT | 237 | AUTHORIZED_KEYS FILE FORMAT |
212 | ~/.ssh/authorized_keys is the default file that lists the public keys | 238 | AuthorizedKeysFile specifies the file containing public keys for public |
213 | that are permitted for RSA authentication in protocol version 1 and for | 239 | key authentication; if none is specified, the default is |
214 | public key authentication (PubkeyAuthentication) in protocol version 2. | 240 | ~/.ssh/authorized_keys. Each line of the file contains one key (empty |
215 | AuthorizedKeysFile may be used to specify an alternative file. | 241 | lines and lines starting with a `#' are ignored as comments). Protocol 1 |
216 | 242 | public keys consist of the following space-separated fields: options, | |
217 | Each line of the file contains one key (empty lines and lines starting | 243 | bits, exponent, modulus, comment. Protocol 2 public key consist of: op- |
218 | with a `#' are ignored as comments). Each RSA public key consists of the | 244 | tions, keytype, base64-encoded key, comment. The options field is op- |
219 | following fields, separated by spaces: options, bits, exponent, modulus, | 245 | tional; its presence is determined by whether the line starts with a num- |
220 | comment. Each protocol version 2 public key consists of: options, key- | 246 | ber or not (the options field never starts with a number). The bits, ex- |
221 | type, base64 encoded key, comment. The options field is optional; its | 247 | ponent, modulus, and comment fields give the RSA key for protocol version |
222 | presence is determined by whether the line starts with a number or not | 248 | 1; the comment field is not used for anything (but may be convenient for |
223 | (the options field never starts with a number). The bits, exponent, mod- | 249 | the user to identify the key). For protocol version 2 the keytype is |
224 | ulus and comment fields give the RSA key for protocol version 1; the com- | 250 | ``ssh-dss'' or ``ssh-rsa''. |
225 | ment field is not used for anything (but may be convenient for the user | ||
226 | to identify the key). For protocol version 2 the keytype is ``ssh-dss'' | ||
227 | or ``ssh-rsa''. | ||
228 | 251 | ||
229 | Note that lines in this file are usually several hundred bytes long (be- | 252 | Note that lines in this file are usually several hundred bytes long (be- |
230 | cause of the size of the public key encoding) up to a limit of 8 kilo- | 253 | cause of the size of the public key encoding) up to a limit of 8 kilo- |
231 | bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16 | 254 | bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16 |
232 | kilobits. You don't want to type them in; instead, copy the | 255 | kilobits. You don't want to type them in; instead, copy the |
233 | identity.pub, id_dsa.pub or the id_rsa.pub file and edit it. | 256 | identity.pub, id_dsa.pub, or the id_rsa.pub file and edit it. |
234 | 257 | ||
235 | sshd enforces a minimum RSA key modulus size for protocol 1 and protocol | 258 | sshd enforces a minimum RSA key modulus size for protocol 1 and protocol |
236 | 2 keys of 768 bits. | 259 | 2 keys of 768 bits. |
@@ -240,21 +263,6 @@ AUTHORIZED_KEYS FILE FORMAT | |||
240 | lowing option specifications are supported (note that option keywords are | 263 | lowing option specifications are supported (note that option keywords are |
241 | case-insensitive): | 264 | case-insensitive): |
242 | 265 | ||
243 | from="pattern-list" | ||
244 | Specifies that in addition to public key authentication, the | ||
245 | canonical name of the remote host must be present in the comma- | ||
246 | separated list of patterns (`*' and `?' serve as wildcards). The | ||
247 | list may also contain patterns negated by prefixing them with | ||
248 | `!'; if the canonical host name matches a negated pattern, the | ||
249 | key is not accepted. The purpose of this option is to optionally | ||
250 | increase security: public key authentication by itself does not | ||
251 | trust the network or name servers or anything (but the key); how- | ||
252 | ever, if somebody somehow steals the key, the key permits an in- | ||
253 | truder to log in from anywhere in the world. This additional op- | ||
254 | tion makes using a stolen key more difficult (name servers and/or | ||
255 | routers would have to be compromised in addition to just the | ||
256 | key). | ||
257 | |||
258 | command="command" | 266 | command="command" |
259 | Specifies that the command is executed whenever this key is used | 267 | Specifies that the command is executed whenever this key is used |
260 | for authentication. The command supplied by the user (if any) is | 268 | for authentication. The command supplied by the user (if any) is |
@@ -266,8 +274,10 @@ AUTHORIZED_KEYS FILE FORMAT | |||
266 | lic keys to perform just a specific operation. An example might | 274 | lic keys to perform just a specific operation. An example might |
267 | be a key that permits remote backups but nothing else. Note that | 275 | be a key that permits remote backups but nothing else. Note that |
268 | the client may specify TCP and/or X11 forwarding unless they are | 276 | the client may specify TCP and/or X11 forwarding unless they are |
269 | explicitly prohibited. Note that this option applies to shell, | 277 | explicitly prohibited. The command originally supplied by the |
270 | command or subsystem execution. | 278 | client is available in the SSH_ORIGINAL_COMMAND environment vari- |
279 | able. Note that this option applies to shell, command or subsys- | ||
280 | tem execution. | ||
271 | 281 | ||
272 | environment="NAME=value" | 282 | environment="NAME=value" |
273 | Specifies that the string is to be added to the environment when | 283 | Specifies that the string is to be added to the environment when |
@@ -277,21 +287,35 @@ AUTHORIZED_KEYS FILE FORMAT | |||
277 | default and is controlled via the PermitUserEnvironment option. | 287 | default and is controlled via the PermitUserEnvironment option. |
278 | This option is automatically disabled if UseLogin is enabled. | 288 | This option is automatically disabled if UseLogin is enabled. |
279 | 289 | ||
280 | no-port-forwarding | 290 | from="pattern-list" |
281 | Forbids TCP forwarding when this key is used for authentication. | 291 | Specifies that in addition to public key authentication, the |
282 | Any port forward requests by the client will return an error. | 292 | canonical name of the remote host must be present in the comma- |
283 | This might be used, e.g., in connection with the command option. | 293 | separated list of patterns. The purpose of this option is to op- |
294 | tionally increase security: public key authentication by itself | ||
295 | does not trust the network or name servers or anything (but the | ||
296 | key); however, if somebody somehow steals the key, the key per- | ||
297 | mits an intruder to log in from anywhere in the world. This ad- | ||
298 | ditional option makes using a stolen key more difficult (name | ||
299 | servers and/or routers would have to be compromised in addition | ||
300 | to just the key). | ||
284 | 301 | ||
285 | no-X11-forwarding | 302 | See PATTERNS in ssh_config(5) for more information on patterns. |
286 | Forbids X11 forwarding when this key is used for authentication. | ||
287 | Any X11 forward requests by the client will return an error. | ||
288 | 303 | ||
289 | no-agent-forwarding | 304 | no-agent-forwarding |
290 | Forbids authentication agent forwarding when this key is used for | 305 | Forbids authentication agent forwarding when this key is used for |
291 | authentication. | 306 | authentication. |
292 | 307 | ||
308 | no-port-forwarding | ||
309 | Forbids TCP forwarding when this key is used for authentication. | ||
310 | Any port forward requests by the client will return an error. | ||
311 | This might be used, e.g. in connection with the command option. | ||
312 | |||
293 | no-pty Prevents tty allocation (a request to allocate a pty will fail). | 313 | no-pty Prevents tty allocation (a request to allocate a pty will fail). |
294 | 314 | ||
315 | no-X11-forwarding | ||
316 | Forbids X11 forwarding when this key is used for authentication. | ||
317 | Any X11 forward requests by the client will return an error. | ||
318 | |||
295 | permitopen="host:port" | 319 | permitopen="host:port" |
296 | Limit local ``ssh -L'' port forwarding such that it may only con- | 320 | Limit local ``ssh -L'' port forwarding such that it may only con- |
297 | nect to the specified host and port. IPv6 addresses can be spec- | 321 | nect to the specified host and port. IPv6 addresses can be spec- |
@@ -305,24 +329,24 @@ AUTHORIZED_KEYS FILE FORMAT | |||
305 | next available device will be used if the client requests a tun- | 329 | next available device will be used if the client requests a tun- |
306 | nel. | 330 | nel. |
307 | 331 | ||
308 | Examples | 332 | An example authorized_keys file: |
309 | 1024 33 12121...312314325 ylo@foo.bar | ||
310 | 333 | ||
311 | from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula | 334 | # Comments allowed at start of line |
312 | 335 | ssh-rsa AAAAB3Nza...LiPk== user@example.net | |
313 | command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 back- | 336 | from="*.sales.example.net,!pc.sales.example.net" ssh-rsa |
314 | up.hut.fi | 337 | AAAAB2...19Q== john@example.net |
315 | 338 | command="dump /home",no-pty,no-port-forwarding ssh-dss | |
316 | permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323 | 339 | AAAAC3...51R== example.net |
317 | 340 | permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-dss | |
318 | tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== reyk@openb- | 341 | AAAAB5...21S== |
319 | sd.org | 342 | tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== |
343 | jane@example.net | ||
320 | 344 | ||
321 | SSH_KNOWN_HOSTS FILE FORMAT | 345 | SSH_KNOWN_HOSTS FILE FORMAT |
322 | The /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts files contain host | 346 | The /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts files contain host |
323 | public keys for all known hosts. The global file should be prepared by | 347 | public keys for all known hosts. The global file should be prepared by |
324 | the administrator (optional), and the per-user file is maintained auto- | 348 | the administrator (optional), and the per-user file is maintained auto- |
325 | matically: whenever the user connects from an unknown host its key is | 349 | matically: whenever the user connects from an unknown host, its key is |
326 | added to the per-user file. | 350 | added to the per-user file. |
327 | 351 | ||
328 | Each line in these files contains the following fields: hostnames, bits, | 352 | Each line in these files contains the following fields: hostnames, bits, |
@@ -333,7 +357,9 @@ SSH_KNOWN_HOSTS FILE FORMAT | |||
333 | (when authenticating a client) or against the user-supplied name (when | 357 | (when authenticating a client) or against the user-supplied name (when |
334 | authenticating a server). A pattern may also be preceded by `!' to indi- | 358 | authenticating a server). A pattern may also be preceded by `!' to indi- |
335 | cate negation: if the host name matches a negated pattern, it is not ac- | 359 | cate negation: if the host name matches a negated pattern, it is not ac- |
336 | cepted (by that line) even if it matched another pattern on the line. | 360 | cepted (by that line) even if it matched another pattern on the line. A |
361 | hostname or address may optionally be enclosed within `[' and `]' brack- | ||
362 | ets then followed by `:' and a non-standard port number. | ||
337 | 363 | ||
338 | Alternately, hostnames may be stored in a hashed form which hides host | 364 | Alternately, hostnames may be stored in a hashed form which hides host |
339 | names and addresses should the file's contents be disclosed. Hashed | 365 | names and addresses should the file's contents be disclosed. Hashed |
@@ -342,8 +368,8 @@ SSH_KNOWN_HOSTS FILE FORMAT | |||
342 | tors may be applied. | 368 | tors may be applied. |
343 | 369 | ||
344 | Bits, exponent, and modulus are taken directly from the RSA host key; | 370 | Bits, exponent, and modulus are taken directly from the RSA host key; |
345 | they can be obtained, e.g., from /etc/ssh/ssh_host_key.pub. The optional | 371 | they can be obtained, for example, from /etc/ssh/ssh_host_key.pub. The |
346 | comment field continues to the end of the line, and is not used. | 372 | optional comment field continues to the end of the line, and is not used. |
347 | 373 | ||
348 | Lines starting with `#' and empty lines are ignored as comments. | 374 | Lines starting with `#' and empty lines are ignored as comments. |
349 | 375 | ||
@@ -360,29 +386,115 @@ SSH_KNOWN_HOSTS FILE FORMAT | |||
360 | Rather, generate them by a script or by taking /etc/ssh/ssh_host_key.pub | 386 | Rather, generate them by a script or by taking /etc/ssh/ssh_host_key.pub |
361 | and adding the host names at the front. | 387 | and adding the host names at the front. |
362 | 388 | ||
363 | Examples | 389 | An example ssh_known_hosts file: |
364 | |||
365 | closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi | ||
366 | cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....= | ||
367 | 390 | ||
368 | # A hashed hostname | 391 | # Comments allowed at start of line |
369 | |1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa | 392 | closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net |
370 | AAAA1234.....= | 393 | cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= |
394 | # A hashed hostname | ||
395 | |1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa | ||
396 | AAAA1234.....= | ||
371 | 397 | ||
372 | FILES | 398 | FILES |
373 | /etc/ssh/sshd_config | 399 | ~/.hushlogin |
374 | Contains configuration data for sshd. The file format and con- | 400 | This file is used to suppress printing the last login time and |
375 | figuration options are described in sshd_config(5). | 401 | /etc/motd, if PrintLastLog and PrintMotd, respectively, are en- |
402 | abled. It does not suppress printing of the banner specified by | ||
403 | Banner. | ||
404 | |||
405 | ~/.rhosts | ||
406 | This file is used for host-based authentication (see ssh(1) for | ||
407 | more information). On some machines this file may need to be | ||
408 | world-readable if the user's home directory is on an NFS parti- | ||
409 | tion, because sshd reads it as root. Additionally, this file | ||
410 | must be owned by the user, and must not have write permissions | ||
411 | for anyone else. The recommended permission for most machines is | ||
412 | read/write for the user, and not accessible by others. | ||
413 | |||
414 | ~/.shosts | ||
415 | This file is used in exactly the same way as .rhosts, but allows | ||
416 | host-based authentication without permitting login with | ||
417 | rlogin/rsh. | ||
418 | |||
419 | ~/.ssh/authorized_keys | ||
420 | Lists the public keys (RSA/DSA) that can be used for logging in | ||
421 | as this user. The format of this file is described above. The | ||
422 | content of the file is not highly sensitive, but the recommended | ||
423 | permissions are read/write for the user, and not accessible by | ||
424 | others. | ||
425 | |||
426 | If this file, the ~/.ssh directory, or the user's home directory | ||
427 | are writable by other users, then the file could be modified or | ||
428 | replaced by unauthorized users. In this case, sshd will not al- | ||
429 | low it to be used unless the StrictModes option has been set to | ||
430 | ``no''. The recommended permissions can be set by executing | ||
431 | ``chmod go-w ~/ ~/.ssh ~/.ssh/authorized_keys''. | ||
432 | |||
433 | ~/.ssh/environment | ||
434 | This file is read into the environment at login (if it exists). | ||
435 | It can only contain empty lines, comment lines (that start with | ||
436 | `#'), and assignment lines of the form name=value. The file | ||
437 | should be writable only by the user; it need not be readable by | ||
438 | anyone else. Environment processing is disabled by default and | ||
439 | is controlled via the PermitUserEnvironment option. | ||
440 | |||
441 | ~/.ssh/known_hosts | ||
442 | Contains a list of host keys for all hosts the user has logged | ||
443 | into that are not already in the systemwide list of known host | ||
444 | keys. The format of this file is described above. This file | ||
445 | should be writable only by root/the owner and can, but need not | ||
446 | be, world-readable. | ||
447 | |||
448 | ~/.ssh/rc | ||
449 | Contains initialization routines to be run before the user's home | ||
450 | directory becomes accessible. This file should be writable only | ||
451 | by the user, and need not be readable by anyone else. | ||
452 | |||
453 | /etc/hosts.allow | ||
454 | /etc/hosts.deny | ||
455 | Access controls that should be enforced by tcp-wrappers are de- | ||
456 | fined here. Further details are described in hosts_access(5). | ||
457 | |||
458 | /etc/hosts.equiv | ||
459 | This file is for host-based authentication (see ssh(1)). It | ||
460 | should only be writable by root. | ||
461 | |||
462 | /etc/moduli | ||
463 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group | ||
464 | Exchange". The file format is described in moduli(5). | ||
376 | 465 | ||
377 | /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, | 466 | /etc/motd |
378 | /etc/ssh/ssh_host_rsa_key | 467 | See motd(5). |
468 | |||
469 | /etc/nologin | ||
470 | If this file exists, sshd refuses to let anyone except root log | ||
471 | in. The contents of the file are displayed to anyone trying to | ||
472 | log in, and non-root connections are refused. The file should be | ||
473 | world-readable. | ||
474 | |||
475 | /etc/shosts.equiv | ||
476 | This file is used in exactly the same way as hosts.equiv, but al- | ||
477 | lows host-based authentication without permitting login with | ||
478 | rlogin/rsh. | ||
479 | |||
480 | /etc/ssh/ssh_known_hosts | ||
481 | Systemwide list of known host keys. This file should be prepared | ||
482 | by the system administrator to contain the public host keys of | ||
483 | all machines in the organization. The format of this file is de- | ||
484 | scribed above. This file should be writable only by root/the | ||
485 | owner and should be world-readable. | ||
486 | |||
487 | /etc/ssh/ssh_host_key | ||
488 | /etc/ssh/ssh_host_dsa_key | ||
489 | /etc/ssh/ssh_host_rsa_key | ||
379 | These three files contain the private parts of the host keys. | 490 | These three files contain the private parts of the host keys. |
380 | These files should only be owned by root, readable only by root, | 491 | These files should only be owned by root, readable only by root, |
381 | and not accessible to others. Note that sshd does not start if | 492 | and not accessible to others. Note that sshd does not start if |
382 | this file is group/world-accessible. | 493 | these files are group/world-accessible. |
383 | 494 | ||
384 | /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub, | 495 | /etc/ssh/ssh_host_key.pub |
385 | /etc/ssh/ssh_host_rsa_key.pub | 496 | /etc/ssh/ssh_host_dsa_key.pub |
497 | /etc/ssh/ssh_host_rsa_key.pub | ||
386 | These three files contain the public parts of the host keys. | 498 | These three files contain the public parts of the host keys. |
387 | These files should be world-readable but writable only by root. | 499 | These files should be world-readable but writable only by root. |
388 | Their contents should match the respective private parts. These | 500 | Their contents should match the respective private parts. These |
@@ -390,9 +502,14 @@ FILES | |||
390 | convenience of the user so their contents can be copied to known | 502 | convenience of the user so their contents can be copied to known |
391 | hosts files. These files are created using ssh-keygen(1). | 503 | hosts files. These files are created using ssh-keygen(1). |
392 | 504 | ||
393 | /etc/moduli | 505 | /etc/ssh/sshd_config |
394 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group | 506 | Contains configuration data for sshd. The file format and con- |
395 | Exchange". The file format is described in moduli(5). | 507 | figuration options are described in sshd_config(5). |
508 | |||
509 | /etc/ssh/sshrc | ||
510 | Similar to ~/.ssh/rc, it can be used to specify machine-specific | ||
511 | login-time initializations globally. This file should be | ||
512 | writable only by root, and should be world-readable. | ||
396 | 513 | ||
397 | /var/empty | 514 | /var/empty |
398 | chroot(2) directory used by sshd during privilege separation in | 515 | chroot(2) directory used by sshd during privilege separation in |
@@ -407,160 +524,21 @@ FILES | |||
407 | The content of this file is not sensitive; it can be world-read- | 524 | The content of this file is not sensitive; it can be world-read- |
408 | able. | 525 | able. |
409 | 526 | ||
410 | ~/.ssh/authorized_keys | ||
411 | Lists the public keys (RSA or DSA) that can be used to log into | ||
412 | the user's account. This file must be readable by root (which | ||
413 | may on some machines imply it being world-readable if the user's | ||
414 | home directory resides on an NFS volume). It is recommended that | ||
415 | it not be accessible by others. The format of this file is de- | ||
416 | scribed above. Users will place the contents of their | ||
417 | identity.pub, id_dsa.pub and/or id_rsa.pub files into this file, | ||
418 | as described in ssh-keygen(1). | ||
419 | |||
420 | /etc/ssh/ssh_known_hosts, ~/.ssh/known_hosts | ||
421 | These files are consulted when using rhosts with RSA host authen- | ||
422 | tication or protocol version 2 hostbased authentication to check | ||
423 | the public key of the host. The key must be listed in one of | ||
424 | these files to be accepted. The client uses the same files to | ||
425 | verify that it is connecting to the correct remote host. These | ||
426 | files should be writable only by root/the owner. | ||
427 | /etc/ssh/ssh_known_hosts should be world-readable, and | ||
428 | ~/.ssh/known_hosts can, but need not be, world-readable. | ||
429 | |||
430 | /etc/motd | ||
431 | See motd(5). | ||
432 | |||
433 | ~/.hushlogin | ||
434 | This file is used to suppress printing the last login time and | ||
435 | /etc/motd, if PrintLastLog and PrintMotd, respectively, are en- | ||
436 | abled. It does not suppress printing of the banner specified by | ||
437 | Banner. | ||
438 | |||
439 | /etc/nologin | ||
440 | If this file exists, sshd refuses to let anyone except root log | ||
441 | in. The contents of the file are displayed to anyone trying to | ||
442 | log in, and non-root connections are refused. The file should be | ||
443 | world-readable. | ||
444 | |||
445 | /etc/hosts.allow, /etc/hosts.deny | ||
446 | Access controls that should be enforced by tcp-wrappers are de- | ||
447 | fined here. Further details are described in hosts_access(5). | ||
448 | |||
449 | ~/.rhosts | ||
450 | This file is used during RhostsRSAAuthentication and | ||
451 | HostbasedAuthentication and contains host-username pairs, sepa- | ||
452 | rated by a space, one per line. The given user on the corre- | ||
453 | sponding host is permitted to log in without a password. The | ||
454 | same file is used by rlogind and rshd. The file must be writable | ||
455 | only by the user; it is recommended that it not be accessible by | ||
456 | others. | ||
457 | |||
458 | It is also possible to use netgroups in the file. Either host or | ||
459 | user name may be of the form +@groupname to specify all hosts or | ||
460 | all users in the group. | ||
461 | |||
462 | ~/.shosts | ||
463 | For ssh, this file is exactly the same as for .rhosts. However, | ||
464 | this file is not used by rlogin and rshd, so using this permits | ||
465 | access using SSH only. | ||
466 | |||
467 | /etc/hosts.equiv | ||
468 | This file is used during RhostsRSAAuthentication and | ||
469 | HostbasedAuthentication authentication. In the simplest form, | ||
470 | this file contains host names, one per line. Users on those | ||
471 | hosts are permitted to log in without a password, provided they | ||
472 | have the same user name on both machines. The host name may also | ||
473 | be followed by a user name; such users are permitted to log in as | ||
474 | any user on this machine (except root). Additionally, the syntax | ||
475 | ``+@group'' can be used to specify netgroups. Negated entries | ||
476 | start with `-'. | ||
477 | |||
478 | If the client host/user is successfully matched in this file, lo- | ||
479 | gin is automatically permitted provided the client and server us- | ||
480 | er names are the same. Additionally, successful client host key | ||
481 | authentication is required. This file must be writable only by | ||
482 | root; it is recommended that it be world-readable. | ||
483 | |||
484 | Warning: It is almost never a good idea to use user names in | ||
485 | hosts.equiv. Beware that it really means that the named user(s) | ||
486 | can log in as anybody, which includes bin, daemon, adm, and other | ||
487 | accounts that own critical binaries and directories. Using a us- | ||
488 | er name practically grants the user root access. The only valid | ||
489 | use for user names that I can think of is in negative entries. | ||
490 | |||
491 | Note that this warning also applies to rsh/rlogin. | ||
492 | |||
493 | /etc/shosts.equiv | ||
494 | This is processed exactly as /etc/hosts.equiv. However, this | ||
495 | file may be useful in environments that want to run both | ||
496 | rsh/rlogin and ssh. | ||
497 | |||
498 | ~/.ssh/environment | ||
499 | This file is read into the environment at login (if it exists). | ||
500 | It can only contain empty lines, comment lines (that start with | ||
501 | `#'), and assignment lines of the form name=value. The file | ||
502 | should be writable only by the user; it need not be readable by | ||
503 | anyone else. Environment processing is disabled by default and | ||
504 | is controlled via the PermitUserEnvironment option. | ||
505 | |||
506 | ~/.ssh/rc | ||
507 | If this file exists, it is run with /bin/sh after reading the en- | ||
508 | vironment files but before starting the user's shell or command. | ||
509 | It must not produce any output on stdout; stderr must be used in- | ||
510 | stead. If X11 forwarding is in use, it will receive the "proto | ||
511 | cookie" pair in its standard input (and DISPLAY in its environ- | ||
512 | ment). The script must call xauth(1) because sshd will not run | ||
513 | xauth automatically to add X11 cookies. | ||
514 | |||
515 | The primary purpose of this file is to run any initialization | ||
516 | routines which may be needed before the user's home directory be- | ||
517 | comes accessible; AFS is a particular example of such an environ- | ||
518 | ment. | ||
519 | |||
520 | This file will probably contain some initialization code followed | ||
521 | by something similar to: | ||
522 | |||
523 | if read proto cookie && [ -n "$DISPLAY" ]; then | ||
524 | if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then | ||
525 | # X11UseLocalhost=yes | ||
526 | echo add unix:`echo $DISPLAY | | ||
527 | cut -c11-` $proto $cookie | ||
528 | else | ||
529 | # X11UseLocalhost=no | ||
530 | echo add $DISPLAY $proto $cookie | ||
531 | fi | xauth -q - | ||
532 | fi | ||
533 | |||
534 | If this file does not exist, /etc/ssh/sshrc is run, and if that | ||
535 | does not exist either, xauth is used to add the cookie. | ||
536 | |||
537 | This file should be writable only by the user, and need not be | ||
538 | readable by anyone else. | ||
539 | |||
540 | /etc/ssh/sshrc | ||
541 | Like ~/.ssh/rc. This can be used to specify machine-specific lo- | ||
542 | gin-time initializations globally. This file should be writable | ||
543 | only by root, and should be world-readable. | ||
544 | |||
545 | SEE ALSO | 527 | SEE ALSO |
546 | scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), | 528 | scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), |
547 | chroot(2), hosts_access(5), login.conf(5), moduli(5), sshd_config(5), | 529 | chroot(2), hosts_access(5), login.conf(5), moduli(5), sshd_config(5), |
548 | inetd(8), sftp-server(8) | 530 | inetd(8), sftp-server(8) |
549 | 531 | ||
550 | T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, SSH | ||
551 | Protocol Architecture, draft-ietf-secsh-architecture-12.txt, January | ||
552 | 2002, work in progress material. | ||
553 | |||
554 | M. Friedl, N. Provos, and W. A. Simpson, Diffie-Hellman Group Exchange | ||
555 | for the SSH Transport Layer Protocol, draft-ietf-secsh-dh-group- | ||
556 | exchange-02.txt, January 2002, work in progress material. | ||
557 | |||
558 | AUTHORS | 532 | AUTHORS |
559 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by | 533 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by |
560 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo | 534 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo |
561 | de Raadt and Dug Song removed many bugs, re-added newer features and | 535 | de Raadt and Dug Song removed many bugs, re-added newer features and cre- |
562 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | 536 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol |
563 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support | 537 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support |
564 | for privilege separation. | 538 | for privilege separation. |
565 | 539 | ||
566 | OpenBSD 3.9 September 25, 1999 9 | 540 | CAVEATS |
541 | System security is not improved unless rshd, rlogind, and rexecd are dis- | ||
542 | abled (thus completely disabling rlogin and rsh into the machine). | ||
543 | |||
544 | OpenBSD 4.1 September 25, 1999 9 | ||