Import OpenSSH 3.6p1.

1 files changed, 547 insertions, 0 deletions

diff --git a/sshd.0 b/sshd.0
new file mode 100644
index 000000000..658af69a6
--- /dev/null
+++ b/sshd.0
@@ -0,0 +1,547 @@
+SSHD(8)                   BSD System ManagerM-bM-^@M-^Ys Manual                  SSHD(8)
+
+^[[1mNAME^[[0m
+     ^[[1msshd ^[[22mM-bMM-^R OpenSSH SSH daemon
+
+^[[1mSYNOPSIS^[[0m
+     ^[[1msshd ^[[22m[^[[1mM-bMM-^RdeiqtD46^[[22m] [^[[1mM-bMM-^Rb ^[[4m^[[22mbits^[[24m] [^[[1mM-bMM-^Rf ^[[4m^[[22mconfig_file^[[24m] [^[[1mM-bMM-^Rg ^[[4m^[[22mlogin_grace_time^[[24m]
+          [^[[1mM-bMM-^Rh ^[[4m^[[22mhost_key_file^[[24m] [^[[1mM-bMM-^Rk ^[[4m^[[22mkey_gen_time^[[24m] [^[[1mM-bMM-^Ro ^[[4m^[[22moption^[[24m] [^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[24m] [^[[1mM-bMM-^Ru ^[[4m^[[22mlen^[[24m]
+
+^[[1mDESCRIPTION^[[0m
+     ^[[1msshd ^[[22m(SSH Daemon) is the daemon program for ssh(1).  Together these proM-bM-^@M-^P
+     grams replace rlogin and rsh, and provide secure encrypted communications
+     between two untrusted hosts over an insecure network.  The programs are
+     intended to be as easy to install and use as possible.
+
+     ^[[1msshd ^[[22mis the daemon that listens for connections from clients.  It is norM-bM-^@M-^P
+     mally started at boot from ^[[4m/etc/rc^[[24m.  It forks a new daemon for each
+     incoming connection.  The forked daemons handle key exchange, encryption,
+     authentication, command execution, and data exchange.  This implementaM-bM-^@M-^P
+     tion of ^[[1msshd ^[[22msupports both SSH protocol version 1 and 2 simultaneously.
+     ^[[1msshd ^[[22mworks as follows:
+
+   ^[[1mSSH protocol version 1^[[0m
+
+     Each host has a hostM-bM-^@M-^Pspecific RSA key (normally 1024 bits) used to idenM-bM-^@M-^P
+     tify the host.  Additionally, when the daemon starts, it generates a
+     server RSA key (normally 768 bits).  This key is normally regenerated
+     every hour if it has been used, and is never stored on disk.
+
+     Whenever a client connects, the daemon responds with its public host and
+     server keys.  The client compares the RSA host key against its own
+     database to verify that it has not changed.  The client then generates a
+     256 bit random number.  It encrypts this random number using both the
+     host key and the server key, and sends the encrypted number to the
+     server.  Both sides then use this random number as a session key which is
+     used to encrypt all further communications in the session.  The rest of
+     the session is encrypted using a conventional cipher, currently Blowfish
+     or 3DES, with 3DES being used by default.  The client selects the encrypM-bM-^@M-^P
+     tion algorithm to use from those offered by the server.
+
+     Next, the server and the client enter an authentication dialog.  The
+     client tries to authenticate itself using ^[[4m.rhosts^[[24m authentication, ^[[4m.rhosts^[[0m
+     authentication combined with RSA host authentication, RSA challengeM-bM-^@M-^P
+     response authentication, or password based authentication.
+
+     Rhosts authentication is normally disabled because it is fundamentally
+     insecure, but can be enabled in the server configuration file if desired.
+     System security is not improved unless ^[[1mrshd^[[22m, ^[[1mrlogind^[[22m, and ^[[1mrexecd ^[[22mare disM-bM-^@M-^P
+     abled (thus completely disabling rlogin and rsh into the machine).
+
+   ^[[1mSSH protocol version 2^[[0m
+
+     Version 2 works similarly: Each host has a hostM-bM-^@M-^Pspecific key (RSA or DSA)
+     used to identify the host.  However, when the daemon starts, it does not
+     generate a server key.  Forward security is provided through a DiffieM-bM-^@M-^P
+     Hellman key agreement.  This key agreement results in a shared session
+     key.
+
+     The rest of the session is encrypted using a symmetric cipher, currently
+     128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit
+     AES.  The client selects the encryption algorithm to use from those
+     offered by the server.  Additionally, session integrity is provided
+     through a cryptographic message authentication code (hmacM-bM-^@M-^Psha1 or hmacM-bM-^@M-^P
+     md5).
+
+     Protocol version 2 provides a public key based user (PubkeyAuthenticaM-bM-^@M-^P
+     tion) or client host (HostbasedAuthentication) authentication method,
+     conventional password authentication and challenge response based methM-bM-^@M-^P
+     ods.
+
+   ^[[1mCommand execution and data forwarding^[[0m
+
+     If the client successfully authenticates itself, a dialog for preparing
+     the session is entered.  At this time the client may request things like
+     allocating a pseudoM-bM-^@M-^Ptty, forwarding X11 connections, forwarding TCP/IP
+     connections, or forwarding the authentication agent connection over the
+     secure channel.
+
+     Finally, the client either requests a shell or execution of a command.
+     The sides then enter session mode.  In this mode, either side may send
+     data at any time, and such data is forwarded to/from the shell or command
+     on the server side, and the user terminal in the client side.
+
+     When the user program terminates and all forwarded X11 and other connecM-bM-^@M-^P
+     tions have been closed, the server sends command exit status to the
+     client, and both sides exit.
+
+     ^[[1msshd ^[[22mcan be configured using commandM-bM-^@M-^Pline options or a configuration
+     file.  CommandM-bM-^@M-^Pline options override values specified in the configuraM-bM-^@M-^P
+     tion file.
+
+     ^[[1msshd ^[[22mrereads its configuration file when it receives a hangup signal,
+     SIGHUP, by executing itself with the name it was started as, i.e.,
+     ^[[4m/usr/sbin/sshd^[[24m.
+
+     The options are as follows:
+
+     ^[[1mM-bMM-^Rb ^[[4m^[[22mbits^[[0m
+             Specifies the number of bits in the ephemeral protocol version 1
+             server key (default 768).
+
+     ^[[1mM-bMM-^Rd      ^[[22mDebug mode.  The server sends verbose debug output to the system
+             log, and does not put itself in the background.  The server also
+             will not fork and will only process one connection.  This option
+             is only intended for debugging for the server.  Multiple ^[[1mM-bMM-^Rd^[[0m
+             options increase the debugging level.  Maximum is 3.
+
+     ^[[1mM-bMM-^Re      ^[[22mWhen this option is specified, ^[[1msshd ^[[22mwill send the output to the
+             standard error instead of the system log.
+
+     ^[[1mM-bMM-^Rf ^[[4m^[[22mconfiguration_file^[[0m
+             Specifies the name of the configuration file.  The default is
+             ^[[4m/etc/ssh/sshd_config^[[24m.  ^[[1msshd ^[[22mrefuses to start if there is no conM-bM-^@M-^P
+             figuration file.
+
+     ^[[1mM-bMM-^Rg ^[[4m^[[22mlogin_grace_time^[[0m
+             Gives the grace time for clients to authenticate themselves
+             (default 120 seconds).  If the client fails to authenticate the
+             user within this many seconds, the server disconnects and exits.
+             A value of zero indicates no limit.
+
+     ^[[1mM-bMM-^Rh ^[[4m^[[22mhost_key_file^[[0m
+             Specifies a file from which a host key is read.  This option must
+             be given if ^[[1msshd ^[[22mis not run as root (as the normal host key files
+             are normally not readable by anyone but root).  The default is
+             ^[[4m/etc/ssh/ssh_host_key^[[24m for protocol version 1, and
+             ^[[4m/etc/ssh/ssh_host_rsa_key^[[24m and ^[[4m/etc/ssh/ssh_host_dsa_key^[[24m for proM-bM-^@M-^P
+             tocol version 2.  It is possible to have multiple host key files
+             for the different protocol versions and host key algorithms.
+
+     ^[[1mM-bMM-^Ri      ^[[22mSpecifies that ^[[1msshd ^[[22mis being run from inetd(8).  ^[[1msshd ^[[22mis normally
+             not run from inetd because it needs to generate the server key
+             before it can respond to the client, and this may take tens of
+             seconds.  Clients would have to wait too long if the key was
+             regenerated every time.  However, with small key sizes (e.g.,
+             512) using ^[[1msshd ^[[22mfrom inetd may be feasible.
+
+     ^[[1mM-bMM-^Rk ^[[4m^[[22mkey_gen_time^[[0m
+             Specifies how often the ephemeral protocol version 1 server key
+             is regenerated (default 3600 seconds, or one hour).  The motivaM-bM-^@M-^P
+             tion for regenerating the key fairly often is that the key is not
+             stored anywhere, and after about an hour, it becomes impossible
+             to recover the key for decrypting intercepted communications even
+             if the machine is cracked into or physically seized.  A value of
+             zero indicates that the key will never be regenerated.
+
+     ^[[1mM-bMM-^Ro ^[[4m^[[22moption^[[0m
+             Can be used to give options in the format used in the configuraM-bM-^@M-^P
+             tion file.  This is useful for specifying options for which there
+             is no separate commandM-bM-^@M-^Pline flag.
+
+     ^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[0m
+             Specifies the port on which the server listens for connections
+             (default 22).  Multiple port options are permitted.  Ports speciM-bM-^@M-^P
+             fied in the configuration file are ignored when a commandM-bM-^@M-^Pline
+             port is specified.
+
+     ^[[1mM-bMM-^Rq      ^[[22mQuiet mode.  Nothing is sent to the system log.  Normally the
+             beginning, authentication, and termination of each connection is
+             logged.
+
+     ^[[1mM-bMM-^Rt      ^[[22mTest mode.  Only check the validity of the configuration file and
+             sanity of the keys.  This is useful for updating ^[[1msshd ^[[22mreliably as
+             configuration options may change.
+
+     ^[[1mM-bMM-^Ru ^[[4m^[[22mlen^[[24m  This option is used to specify the size of the field in the utmp
+             structure that holds the remote host name.  If the resolved host
+             name is longer than ^[[4mlen^[[24m, the dotted decimal value will be used
+             instead.  This allows hosts with very long host names that overM-bM-^@M-^P
+             flow this field to still be uniquely identified.  Specifying ^[[1mM-bMM-^Ru0^[[0m
+             indicates that only dotted decimal addresses should be put into
+             the ^[[4mutmp^[[24m file.  ^[[1mM-bMM-^Ru0 ^[[22mmay also be used to prevent ^[[1msshd ^[[22mfrom making
+             DNS requests unless the authentication mechanism or configuration
+             requires it.  Authentication mechanisms that may require DNS
+             include ^[[1mRhostsAuthentication^[[22m, ^[[1mRhostsRSAAuthentication^[[22m,
+             ^[[1mHostbasedAuthentication ^[[22mand using a ^[[1mfrom="patternM-bM-^@M-^Plist" ^[[22moption in
+             a key file.  Configuration options that require DNS include using
+             a USER@HOST pattern in ^[[1mAllowUsers ^[[22mor ^[[1mDenyUsers^[[22m.
+
+     ^[[1mM-bMM-^RD      ^[[22mWhen this option is specified ^[[1msshd ^[[22mwill not detach and does not
+             become a daemon.  This allows easy monitoring of ^[[1msshd^[[22m.
+
+     ^[[1mM-bMM-^R4      ^[[22mForces ^[[1msshd ^[[22mto use IPv4 addresses only.
+
+     ^[[1mM-bMM-^R6      ^[[22mForces ^[[1msshd ^[[22mto use IPv6 addresses only.
+
+^[[1mCONFIGURATION FILE^[[0m
+     ^[[1msshd ^[[22mreads configuration data from ^[[4m/etc/ssh/sshd_config^[[24m (or the file
+     specified with ^[[1mM-bMM-^Rf ^[[22mon the command line).  The file format and configuraM-bM-^@M-^P
+     tion options are described in sshd_config(5).
+
+^[[1mLOGIN PROCESS^[[0m
+     When a user successfully logs in, ^[[1msshd ^[[22mdoes the following:
+
+           1.   If the login is on a tty, and no command has been specified,
+                prints last login time and ^[[4m/etc/motd^[[24m (unless prevented in the
+                configuration file or by ^[[4m$HOME/.hushlogin^[[24m; see the ^[[4mFILES^[[24m secM-bM-^@M-^P
+                tion).
+
+           2.   If the login is on a tty, records login time.
+
+           3.   Checks ^[[4m/etc/nologin^[[24m; if it exists, prints contents and quits
+                (unless root).
+
+           4.   Changes to run with normal user privileges.
+
+           5.   Sets up basic environment.
+
+           6.   Reads ^[[4m$HOME/.ssh/environment^[[24m if it exists and users are
+                allowed to change their environment.  See the
+                ^[[1mPermitUserEnvironment ^[[22moption in sshd_config(5).
+
+           7.   Changes to userM-bM-^@M-^Ys home directory.
+
+           8.   If ^[[4m$HOME/.ssh/rc^[[24m exists, runs it; else if ^[[4m/etc/ssh/sshrc^[[0m
+                exists, runs it; otherwise runs xauth.  The M-bM-^@M-^\rcM-bM-^@M-^] files are
+                given the X11 authentication protocol and cookie in standard
+                input.
+
+           9.   Runs userM-bM-^@M-^Ys shell or command.
+
+^[[1mAUTHORIZED_KEYS FILE FORMAT^[[0m
+     ^[[4m$HOME/.ssh/authorized_keys^[[24m is the default file that lists the public keys
+     that are permitted for RSA authentication in protocol version 1 and for
+     public key authentication (PubkeyAuthentication) in protocol version 2.
+     ^[[1mAuthorizedKeysFile ^[[22mmay be used to specify an alternative file.
+
+     Each line of the file contains one key (empty lines and lines starting
+     with a M-bM-^@M-^X#M-bM-^@M-^Y are ignored as comments).  Each RSA public key consists of the
+     following fields, separated by spaces: options, bits, exponent, modulus,
+     comment.  Each protocol version 2 public key consists of: options, keyM-bM-^@M-^P
+     type, base64 encoded key, comment.  The options field is optional; its
+     presence is determined by whether the line starts with a number or not
+     (the options field never starts with a number).  The bits, exponent, modM-bM-^@M-^P
+     ulus and comment fields give the RSA key for protocol version 1; the comM-bM-^@M-^P
+     ment field is not used for anything (but may be convenient for the user
+     to identify the key).  For protocol version 2 the keytype is M-bM-^@M-^\sshM-bM-^@M-^PdssM-bM-^@M-^] or
+     M-bM-^@M-^\sshM-bM-^@M-^PrsaM-bM-^@M-^].
+
+     Note that lines in this file are usually several hundred bytes long
+     (because of the size of the public key encoding).  You donM-bM-^@M-^Yt want to type
+     them in; instead, copy the ^[[4midentity.pub^[[24m, ^[[4mid_dsa.pub^[[24m or the ^[[4mid_rsa.pub^[[0m
+     file and edit it.
+
+     ^[[1msshd ^[[22menforces a minimum RSA key modulus size for protocol 1 and protocol
+     2 keys of 768 bits.
+
+     The options (if present) consist of commaM-bM-^@M-^Pseparated option specificaM-bM-^@M-^P
+     tions.  No spaces are permitted, except within double quotes.  The folM-bM-^@M-^P
+     lowing option specifications are supported (note that option keywords are
+     caseM-bM-^@M-^Pinsensitive):
+
+     ^[[1mfrom="patternM-bM-^@M-^Plist"^[[0m
+             Specifies that in addition to public key authentication, the
+             canonical name of the remote host must be present in the commaM-bM-^@M-^P
+             separated list of patterns (M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^XM-bM-^@M-^Y?  serve as wildcards).
+             The list may also contain patterns negated by prefixing them with
+             M-bM-^@M-^XM-bM-^@M-^Y!; if the canonical host name matches a negated pattern, the
+             key is not accepted.  The purpose of this option is to optionally
+             increase security: public key authentication by itself does not
+             trust the network or name servers or anything (but the key); howM-bM-^@M-^P
+             ever, if somebody somehow steals the key, the key permits an
+             intruder to log in from anywhere in the world.  This additional
+             option makes using a stolen key more difficult (name servers
+             and/or routers would have to be compromised in addition to just
+             the key).
+
+     ^[[1mcommand="command"^[[0m
+             Specifies that the command is executed whenever this key is used
+             for authentication.  The command supplied by the user (if any) is
+             ignored.  The command is run on a pty if the client requests a
+             pty; otherwise it is run without a tty.  If an 8M-bM-^@M-^Pbit clean chanM-bM-^@M-^P
+             nel is required, one must not request a pty or should specify
+             ^[[1mnoM-bM-^@M-^Ppty^[[22m.  A quote may be included in the command by quoting it
+             with a backslash.  This option might be useful to restrict cerM-bM-^@M-^P
+             tain public keys to perform just a specific operation.  An examM-bM-^@M-^P
+             ple might be a key that permits remote backups but nothing else.
+             Note that the client may specify TCP/IP and/or X11 forwarding
+             unless they are explicitly prohibited.  Note that this option
+             applies to shell, command or subsystem execution.
+
+     ^[[1menvironment="NAME=value"^[[0m
+             Specifies that the string is to be added to the environment when
+             logging in using this key.  Environment variables set this way
+             override other default environment values.  Multiple options of
+             this type are permitted.  Environment processing is disabled by
+             default and is controlled via the ^[[1mPermitUserEnvironment ^[[22moption.
+             This option is automatically disabled if ^[[1mUseLogin ^[[22mis enabled.
+
+     ^[[1mnoM-bM-^@M-^PportM-bM-^@M-^Pforwarding^[[0m
+             Forbids TCP/IP forwarding when this key is used for authenticaM-bM-^@M-^P
+             tion.  Any port forward requests by the client will return an
+             error.  This might be used, e.g., in connection with the ^[[1mcommand^[[0m
+             option.
+
+     ^[[1mnoM-bM-^@M-^PX11M-bM-^@M-^Pforwarding^[[0m
+             Forbids X11 forwarding when this key is used for authentication.
+             Any X11 forward requests by the client will return an error.
+
+     ^[[1mnoM-bM-^@M-^PagentM-bM-^@M-^Pforwarding^[[0m
+             Forbids authentication agent forwarding when this key is used for
+             authentication.
+
+     ^[[1mnoM-bM-^@M-^Ppty  ^[[22mPrevents tty allocation (a request to allocate a pty will fail).
+
+     ^[[1mpermitopen="host:port"^[[0m
+             Limit local M-bM-^@M-^XM-bM-^@M-^Xssh M-bM-^@M-^PLM-bM-^@M-^YM-bM-^@M-^Y port forwarding such that it may only conM-bM-^@M-^P
+             nect to the specified host and port.  IPv6 addresses can be specM-bM-^@M-^P
+             ified with an alternative syntax: ^[[4mhost/port^[[24m.  Multiple ^[[1mpermitopen^[[0m
+             options may be applied separated by commas. No pattern matching
+             is performed on the specified hostnames, they must be literal
+             domains or addresses.
+
+   ^[[1mExamples^[[0m
+     1024 33 12121...312314325 ylo@foo.bar
+
+     from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
+
+     command="dump /home",noM-bM-^@M-^Ppty,noM-bM-^@M-^PportM-bM-^@M-^Pforwarding 1024 33 23...2323
+     backup.hut.fi
+
+     permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
+
+^[[1mSSH_KNOWN_HOSTS FILE FORMAT^[[0m
+     The ^[[4m/etc/ssh/ssh_known_hosts^[[24m and ^[[4m$HOME/.ssh/known_hosts^[[24m files contain
+     host public keys for all known hosts.  The global file should be prepared
+     by the administrator (optional), and the perM-bM-^@M-^Puser file is maintained
+     automatically: whenever the user connects from an unknown host its key is
+     added to the perM-bM-^@M-^Puser file.
+
+     Each line in these files contains the following fields: hostnames, bits,
+     exponent, modulus, comment.  The fields are separated by spaces.
+
+     Hostnames is a commaM-bM-^@M-^Pseparated list of patterns (M-bM-^@M-^Y*M-bM-^@M-^Y and M-bM-^@M-^Y?M-bM-^@M-^Y act as wildM-bM-^@M-^P
+     cards); each pattern in turn is matched against the canonical host name
+     (when authenticating a client) or against the userM-bM-^@M-^Psupplied name (when
+     authenticating a server).  A pattern may also be preceded by M-bM-^@M-^XM-bM-^@M-^Y!  to
+     indicate negation: if the host name matches a negated pattern, it is not
+     accepted (by that line) even if it matched another pattern on the line.
+
+     Bits, exponent, and modulus are taken directly from the RSA host key;
+     they can be obtained, e.g., from ^[[4m/etc/ssh/ssh_host_key.pub^[[24m.  The optional
+     comment field continues to the end of the line, and is not used.
+
+     Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are ignored as comments.
+
+     When performing host authentication, authentication is accepted if any
+     matching line has the proper key.  It is thus permissible (but not recomM-bM-^@M-^P
+     mended) to have several lines or different host keys for the same names.
+     This will inevitably happen when short forms of host names from different
+     domains are put in the file.  It is possible that the files contain conM-bM-^@M-^P
+     flicting information; authentication is accepted if valid information can
+     be found from either file.
+
+     Note that the lines in these files are typically hundreds of characters
+     long, and you definitely donM-bM-^@M-^Yt want to type in the host keys by hand.
+     Rather, generate them by a script or by taking ^[[4m/etc/ssh/ssh_host_key.pub^[[0m
+     and adding the host names at the front.
+
+   ^[[1mExamples^[[0m
+
+     closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
+     cvs.openbsd.org,199.185.137.3 sshM-bM-^@M-^Prsa AAAA1234.....=
+
+^[[1mFILES^[[0m
+     /etc/ssh/sshd_config
+             Contains configuration data for ^[[1msshd^[[22m.  The file format and conM-bM-^@M-^P
+             figuration options are described in sshd_config(5).
+
+     /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key,
+             /etc/ssh/ssh_host_rsa_key
+             These three files contain the private parts of the host keys.
+             These files should only be owned by root, readable only by root,
+             and not accessible to others.  Note that ^[[1msshd ^[[22mdoes not start if
+             this file is group/worldM-bM-^@M-^Paccessible.
+
+     /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub,
+             /etc/ssh/ssh_host_rsa_key.pub
+             These three files contain the public parts of the host keys.
+             These files should be worldM-bM-^@M-^Preadable but writable only by root.
+             Their contents should match the respective private parts.  These
+             files are not really used for anything; they are provided for the
+             convenience of the user so their contents can be copied to known
+             hosts files.  These files are created using sshM-bM-^@M-^Pkeygen(1).
+
+     /etc/moduli
+             Contains DiffieM-bM-^@M-^PHellman groups used for the "DiffieM-bM-^@M-^PHellman Group
+             Exchange".  The file format is described in moduli(5).
+
+     /var/empty
+             chroot(2) directory used by ^[[1msshd ^[[22mduring privilege separation in
+             the preM-bM-^@M-^Pauthentication phase.  The directory should not contain
+             any files and must be owned by root and not group or worldM-bM-^@M-^P
+             writable.
+
+     /var/run/sshd.pid
+             Contains the process ID of the ^[[1msshd ^[[22mlistening for connections (if
+             there are several daemons running concurrently for different
+             ports, this contains the process ID of the one started last).
+             The content of this file is not sensitive; it can be worldM-bM-^@M-^PreadM-bM-^@M-^P
+             able.
+
+     $HOME/.ssh/authorized_keys
+             Lists the public keys (RSA or DSA) that can be used to log into
+             the userM-bM-^@M-^Ys account.  This file must be readable by root (which
+             may on some machines imply it being worldM-bM-^@M-^Preadable if the userM-bM-^@M-^Ys
+             home directory resides on an NFS volume).  It is recommended that
+             it not be accessible by others.  The format of this file is
+             described above.  Users will place the contents of their
+             ^[[4midentity.pub^[[24m, ^[[4mid_dsa.pub^[[24m and/or ^[[4mid_rsa.pub^[[24m files into this file,
+             as described in sshM-bM-^@M-^Pkeygen(1).
+
+     /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts
+             These files are consulted when using rhosts with RSA host authenM-bM-^@M-^P
+             tication or protocol version 2 hostbased authentication to check
+             the public key of the host.  The key must be listed in one of
+             these files to be accepted.  The client uses the same files to
+             verify that it is connecting to the correct remote host.  These
+             files should be writable only by root/the owner.
+             ^[[4m/etc/ssh/ssh_known_hosts^[[24m should be worldM-bM-^@M-^Preadable, and
+             ^[[4m$HOME/.ssh/known_hosts^[[24m can, but need not be, worldM-bM-^@M-^Preadable.
+
+     /etc/nologin
+             If this file exists, ^[[1msshd ^[[22mrefuses to let anyone except root log
+             in.  The contents of the file are displayed to anyone trying to
+             log in, and nonM-bM-^@M-^Proot connections are refused.  The file should be
+             worldM-bM-^@M-^Preadable.
+
+     /etc/hosts.allow, /etc/hosts.deny
+             Access controls that should be enforced by tcpM-bM-^@M-^Pwrappers are
+             defined here.  Further details are described in hosts_access(5).
+
+     $HOME/.rhosts
+             This file contains hostM-bM-^@M-^Pusername pairs, separated by a space, one
+             per line.  The given user on the corresponding host is permitted
+             to log in without a password.  The same file is used by rlogind
+             and rshd.  The file must be writable only by the user; it is recM-bM-^@M-^P
+             ommended that it not be accessible by others.
+
+             If is also possible to use netgroups in the file.  Either host or
+             user name may be of the form +@groupname to specify all hosts or
+             all users in the group.
+
+     $HOME/.shosts
+             For ssh, this file is exactly the same as for ^[[4m.rhosts^[[24m.  However,
+             this file is not used by rlogin and rshd, so using this permits
+             access using SSH only.
+
+     /etc/hosts.equiv
+             This file is used during ^[[4m.rhosts^[[24m authentication.  In the simplest
+             form, this file contains host names, one per line.  Users on
+             those hosts are permitted to log in without a password, provided
+             they have the same user name on both machines.  The host name may
+             also be followed by a user name; such users are permitted to log
+             in as ^[[4many^[[24m user on this machine (except root).  Additionally, the
+             syntax M-bM-^@M-^\+@groupM-bM-^@M-^] can be used to specify netgroups.  Negated
+             entries start with M-bM-^@M-^XM-bM-^@M-^PM-bM-^@M-^Y.
+
+             If the client host/user is successfully matched in this file,
+             login is automatically permitted provided the client and server
+             user names are the same.  Additionally, successful RSA host
+             authentication is normally required.  This file must be writable
+             only by root; it is recommended that it be worldM-bM-^@M-^Preadable.
+
+             ^[[1mWarning: It is almost never a good idea to use user names in^[[0m
+             ^[[4mhosts.equiv^[[24m.  Beware that it really means that the named user(s)
+             can log in as ^[[4manybody^[[24m, which includes bin, daemon, adm, and other
+             accounts that own critical binaries and directories.  Using a
+             user name practically grants the user root access.  The only
+             valid use for user names that I can think of is in negative
+             entries.
+
+             Note that this warning also applies to rsh/rlogin.
+
+     /etc/shosts.equiv
+             This is processed exactly as ^[[4m/etc/hosts.equiv^[[24m.  However, this
+             file may be useful in environments that want to run both
+             rsh/rlogin and ssh.
+
+     $HOME/.ssh/environment
+             This file is read into the environment at login (if it exists).
+             It can only contain empty lines, comment lines (that start with
+             M-bM-^@M-^X#M-bM-^@M-^Y), and assignment lines of the form name=value.  The file
+             should be writable only by the user; it need not be readable by
+             anyone else.  Environment processing is disabled by default and
+             is controlled via the ^[[1mPermitUserEnvironment ^[[22moption.
+
+     $HOME/.ssh/rc
+             If this file exists, it is run with ^[[4m/bin/sh^[[24m after reading the
+             environment files but before starting the userM-bM-^@M-^Ys shell or comM-bM-^@M-^P
+             mand.  It must not produce any output on stdout; stderr must be
+             used instead.  If X11 forwarding is in use, it will receive the
+             "proto cookie" pair in its standard input (and DISPLAY in its
+             environment).  The script must call xauth(1) because ^[[1msshd ^[[22mwill
+             not run xauth automatically to add X11 cookies.
+
+             The primary purpose of this file is to run any initialization
+             routines which may be needed before the userM-bM-^@M-^Ys home directory
+             becomes accessible; AFS is a particular example of such an enviM-bM-^@M-^P
+             ronment.
+
+             This file will probably contain some initialization code followed
+             by something similar to:
+
+             if read proto cookie && [ M-bM-^@M-^Pn "$DISPLAY" ]; then
+                     if [ M-bM-^@M-^Xecho $DISPLAY | cut M-bM-^@M-^Pc1M-bM-^@M-^P10M-bM-^@M-^X = M-bM-^@M-^Ylocalhost:M-bM-^@M-^Y ]; then
+                             # X11UseLocalhost=yes
+                             echo add unix:M-bM-^@M-^Xecho $DISPLAY |
+                                 cut M-bM-^@M-^Pc11M-bM-^@M-^PM-bM-^@M-^X $proto $cookie
+                     else
+                             # X11UseLocalhost=no
+                             echo add $DISPLAY $proto $cookie
+                     fi | xauth M-bM-^@M-^Pq M-bM-^@M-^P
+             fi
+
+             If this file does not exist, ^[[4m/etc/ssh/sshrc^[[24m is run, and if that
+             does not exist either, xauth is used to add the cookie.
+
+             This file should be writable only by the user, and need not be
+             readable by anyone else.
+
+     /etc/ssh/sshrc
+             Like ^[[4m$HOME/.ssh/rc^[[24m.  This can be used to specify machineM-bM-^@M-^Pspecific
+             loginM-bM-^@M-^Ptime initializations globally.  This file should be
+             writable only by root, and should be worldM-bM-^@M-^Preadable.
+
+^[[1mAUTHORS^[[0m
+     OpenSSH is a derivative of the original and free ssh 1.2.12 release by
+     Tatu Ylonen.  Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
+     de Raadt and Dug Song removed many bugs, reM-bM-^@M-^Padded newer features and creM-bM-^@M-^P
+     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
+     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
+     for privilege separation.
+
+^[[1mSEE ALSO^[[0m
+     scp(1), sftp(1), ssh(1), sshM-bM-^@M-^Padd(1), sshM-bM-^@M-^Pagent(1), sshM-bM-^@M-^Pkeygen(1),
+     login.conf(5), moduli(5), sshd_config(5), sftpM-bM-^@M-^Pserver(8)
+
+     T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, ^[[4mSSH^[[0m
+     ^[[4mProtocol^[[24m ^[[4mArchitecture^[[24m, draftM-bM-^@M-^PietfM-bM-^@M-^PsecshM-bM-^@M-^ParchitectureM-bM-^@M-^P12.txt, January
+     2002, work in progress material.
+
+     M. Friedl, N. Provos, and W. A. Simpson, ^[[4mDiffieM-bM-^@M-^PHellman^[[24m ^[[4mGroup^[[24m ^[[4mExchange^[[0m
+     ^[[4mfor^[[24m ^[[4mthe^[[24m ^[[4mSSH^[[24m ^[[4mTransport^[[24m ^[[4mLayer^[[24m ^[[4mProtocol^[[24m, draftM-bM-^@M-^PietfM-bM-^@M-^PsecshM-bM-^@M-^PdhM-bM-^@M-^PgroupM-bM-^@M-^P
+     exchangeM-bM-^@M-^P02.txt, January 2002, work in progress material.
+
+BSD                           September 25, 1999                           BSD