diff options
author | Colin Watson <cjwatson@debian.org> | 2003-09-01 02:05:26 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2003-09-01 02:05:26 +0000 |
commit | 6d5a72bc1d98a42ba42f082e50a22e911c1d82d3 (patch) | |
tree | 1bf23174bdb6fc71e2846dda0eca195a418484e7 /sshd.8 | |
parent | 2ee26b431f98cf1dc0e4fb9809ad1e0c879b8c08 (diff) | |
parent | 58657d96514cd6f16d82add8d6f4adbb36765758 (diff) |
Debian release 3.5p1-1.
Diffstat (limited to 'sshd.8')
-rw-r--r-- | sshd.8 | 40 |
1 files changed, 27 insertions, 13 deletions
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: sshd.8,v 1.186 2002/06/22 16:45:29 stevesk Exp $ | 37 | .\" $OpenBSD: sshd.8,v 1.193 2002/09/24 20:59:44 todd Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSHD 8 | 39 | .Dt SSHD 8 |
40 | .Os | 40 | .Os |
@@ -203,7 +203,7 @@ The default is | |||
203 | refuses to start if there is no configuration file. | 203 | refuses to start if there is no configuration file. |
204 | .It Fl g Ar login_grace_time | 204 | .It Fl g Ar login_grace_time |
205 | Gives the grace time for clients to authenticate themselves (default | 205 | Gives the grace time for clients to authenticate themselves (default |
206 | 600 seconds). | 206 | 120 seconds). |
207 | If the client fails to authenticate the user within | 207 | If the client fails to authenticate the user within |
208 | this many seconds, the server disconnects and exits. | 208 | this many seconds, the server disconnects and exits. |
209 | A value of zero indicates no limit. | 209 | A value of zero indicates no limit. |
@@ -353,7 +353,11 @@ Sets up basic environment. | |||
353 | .It | 353 | .It |
354 | Reads | 354 | Reads |
355 | .Pa $HOME/.ssh/environment | 355 | .Pa $HOME/.ssh/environment |
356 | if it exists. | 356 | if it exists and users are allowed to change their environment. |
357 | See the | ||
358 | .Cm PermitUserEnvironment | ||
359 | option in | ||
360 | .Xr sshd_config 5 . | ||
357 | .It | 361 | .It |
358 | Changes to user's home directory. | 362 | Changes to user's home directory. |
359 | .It | 363 | .It |
@@ -388,9 +392,9 @@ Each RSA public key consists of the following fields, separated by | |||
388 | spaces: options, bits, exponent, modulus, comment. | 392 | spaces: options, bits, exponent, modulus, comment. |
389 | Each protocol version 2 public key consists of: | 393 | Each protocol version 2 public key consists of: |
390 | options, keytype, base64 encoded key, comment. | 394 | options, keytype, base64 encoded key, comment. |
391 | The options fields | 395 | The options field |
392 | are optional; its presence is determined by whether the line starts | 396 | is optional; its presence is determined by whether the line starts |
393 | with a number or not (the option field never starts with a number). | 397 | with a number or not (the options field never starts with a number). |
394 | The bits, exponent, modulus and comment fields give the RSA key for | 398 | The bits, exponent, modulus and comment fields give the RSA key for |
395 | protocol version 1; the | 399 | protocol version 1; the |
396 | comment field is not used for anything (but may be convenient for the | 400 | comment field is not used for anything (but may be convenient for the |
@@ -401,7 +405,7 @@ or | |||
401 | .Dq ssh-rsa . | 405 | .Dq ssh-rsa . |
402 | .Pp | 406 | .Pp |
403 | Note that lines in this file are usually several hundred bytes long | 407 | Note that lines in this file are usually several hundred bytes long |
404 | (because of the size of the RSA key modulus). | 408 | (because of the size of the public key encoding). |
405 | You don't want to type them in; instead, copy the | 409 | You don't want to type them in; instead, copy the |
406 | .Pa identity.pub , | 410 | .Pa identity.pub , |
407 | .Pa id_dsa.pub | 411 | .Pa id_dsa.pub |
@@ -420,7 +424,7 @@ The following option specifications are supported (note | |||
420 | that option keywords are case-insensitive): | 424 | that option keywords are case-insensitive): |
421 | .Bl -tag -width Ds | 425 | .Bl -tag -width Ds |
422 | .It Cm from="pattern-list" | 426 | .It Cm from="pattern-list" |
423 | Specifies that in addition to RSA authentication, the canonical name | 427 | Specifies that in addition to public key authentication, the canonical name |
424 | of the remote host must be present in the comma-separated list of | 428 | of the remote host must be present in the comma-separated list of |
425 | patterns | 429 | patterns |
426 | .Pf ( Ql * | 430 | .Pf ( Ql * |
@@ -432,7 +436,7 @@ patterns negated by prefixing them with | |||
432 | .Ql ! ; | 436 | .Ql ! ; |
433 | if the canonical host name matches a negated pattern, the key is not accepted. | 437 | if the canonical host name matches a negated pattern, the key is not accepted. |
434 | The purpose | 438 | The purpose |
435 | of this option is to optionally increase security: RSA authentication | 439 | of this option is to optionally increase security: public key authentication |
436 | by itself does not trust the network or name servers or anything (but | 440 | by itself does not trust the network or name servers or anything (but |
437 | the key); however, if somebody somehow steals the key, the key | 441 | the key); however, if somebody somehow steals the key, the key |
438 | permits an intruder to log in from anywhere in the world. | 442 | permits an intruder to log in from anywhere in the world. |
@@ -450,7 +454,7 @@ one must not request a pty or should specify | |||
450 | .Cm no-pty . | 454 | .Cm no-pty . |
451 | A quote may be included in the command by quoting it with a backslash. | 455 | A quote may be included in the command by quoting it with a backslash. |
452 | This option might be useful | 456 | This option might be useful |
453 | to restrict certain RSA keys to perform just a specific operation. | 457 | to restrict certain public keys to perform just a specific operation. |
454 | An example might be a key that permits remote backups but nothing else. | 458 | An example might be a key that permits remote backups but nothing else. |
455 | Note that the client may specify TCP/IP and/or X11 | 459 | Note that the client may specify TCP/IP and/or X11 |
456 | forwarding unless they are explicitly prohibited. | 460 | forwarding unless they are explicitly prohibited. |
@@ -461,6 +465,10 @@ logging in using this key. | |||
461 | Environment variables set this way | 465 | Environment variables set this way |
462 | override other default environment values. | 466 | override other default environment values. |
463 | Multiple options of this type are permitted. | 467 | Multiple options of this type are permitted. |
468 | Environment processing is disabled by default and is | ||
469 | controlled via the | ||
470 | .Cm PermitUserEnvironment | ||
471 | option. | ||
464 | This option is automatically disabled if | 472 | This option is automatically disabled if |
465 | .Cm UseLogin | 473 | .Cm UseLogin |
466 | is enabled. | 474 | is enabled. |
@@ -581,6 +589,8 @@ These files are created using | |||
581 | .Xr ssh-keygen 1 . | 589 | .Xr ssh-keygen 1 . |
582 | .It Pa /etc/moduli | 590 | .It Pa /etc/moduli |
583 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". | 591 | Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". |
592 | The file format is described in | ||
593 | .Xr moduli 5 . | ||
584 | .It Pa /var/empty | 594 | .It Pa /var/empty |
585 | .Xr chroot 2 | 595 | .Xr chroot 2 |
586 | directory used by | 596 | directory used by |
@@ -701,6 +711,10 @@ It can only contain empty lines, comment lines (that start with | |||
701 | and assignment lines of the form name=value. | 711 | and assignment lines of the form name=value. |
702 | The file should be writable | 712 | The file should be writable |
703 | only by the user; it need not be readable by anyone else. | 713 | only by the user; it need not be readable by anyone else. |
714 | Environment processing is disabled by default and is | ||
715 | controlled via the | ||
716 | .Cm PermitUserEnvironment | ||
717 | option. | ||
704 | .It Pa $HOME/.ssh/rc | 718 | .It Pa $HOME/.ssh/rc |
705 | If this file exists, it is run with /bin/sh after reading the | 719 | If this file exists, it is run with /bin/sh after reading the |
706 | environment files but before starting the user's shell or command. | 720 | environment files but before starting the user's shell or command. |
@@ -726,12 +740,12 @@ something similar to: | |||
726 | if read proto cookie && [ -n "$DISPLAY" ]; then | 740 | if read proto cookie && [ -n "$DISPLAY" ]; then |
727 | if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then | 741 | if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then |
728 | # X11UseLocalhost=yes | 742 | # X11UseLocalhost=yes |
729 | xauth add unix:`echo $DISPLAY | | 743 | echo add unix:`echo $DISPLAY | |
730 | cut -c11-` $proto $cookie | 744 | cut -c11-` $proto $cookie |
731 | else | 745 | else |
732 | # X11UseLocalhost=no | 746 | # X11UseLocalhost=no |
733 | xauth add $DISPLAY $proto $cookie | 747 | echo add $DISPLAY $proto $cookie |
734 | fi | 748 | fi | xauth -q - |
735 | fi | 749 | fi |
736 | .Ed | 750 | .Ed |
737 | .Pp | 751 | .Pp |