summaryrefslogtreecommitdiff
path: root/sshd.8
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2003-09-01 18:42:19 +0000
committerColin Watson <cjwatson@debian.org>2003-09-01 18:42:19 +0000
commit8d6b7f4c46de3feb66f704ab483e51ea1a3bb0e1 (patch)
tree41fe3dd71501bbec5b0393f1536c925eaee180e9 /sshd.8
parentf045c69060bfdd5cf8759a5f29d7008d02e4de5b (diff)
parent58bfa257481a1c6938ada9bbd38801cc45633fb0 (diff)
Debian release 3.6p1-1.
Diffstat (limited to 'sshd.8')
-rw-r--r--sshd.831
1 files changed, 19 insertions, 12 deletions
diff --git a/sshd.8 b/sshd.8
index 1605922fb..c1ac3343b 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36.\" 36.\"
37.\" $OpenBSD: sshd.8,v 1.193 2002/09/24 20:59:44 todd Exp $ 37.\" $OpenBSD: sshd.8,v 1.194 2003/01/31 21:54:40 jmc Exp $
38.Dd September 25, 1999 38.Dd September 25, 1999
39.Dt SSHD 8 39.Dt SSHD 8
40.Os 40.Os
@@ -43,6 +43,7 @@
43.Nd OpenSSH SSH daemon 43.Nd OpenSSH SSH daemon
44.Sh SYNOPSIS 44.Sh SYNOPSIS
45.Nm sshd 45.Nm sshd
46.Bk -words
46.Op Fl deiqtD46 47.Op Fl deiqtD46
47.Op Fl b Ar bits 48.Op Fl b Ar bits
48.Op Fl f Ar config_file 49.Op Fl f Ar config_file
@@ -52,6 +53,7 @@
52.Op Fl o Ar option 53.Op Fl o Ar option
53.Op Fl p Ar port 54.Op Fl p Ar port
54.Op Fl u Ar len 55.Op Fl u Ar len
56.Ek
55.Sh DESCRIPTION 57.Sh DESCRIPTION
56.Nm 58.Nm
57(SSH Daemon) is the daemon program for 59(SSH Daemon) is the daemon program for
@@ -75,7 +77,7 @@ This implementation of
75.Nm 77.Nm
76supports both SSH protocol version 1 and 2 simultaneously. 78supports both SSH protocol version 1 and 2 simultaneously.
77.Nm 79.Nm
78works as follows. 80works as follows:
79.Pp 81.Pp
80.Ss SSH protocol version 1 82.Ss SSH protocol version 1
81.Pp 83.Pp
@@ -86,7 +88,7 @@ the daemon starts, it generates a server RSA key (normally 768 bits).
86This key is normally regenerated every hour if it has been used, and 88This key is normally regenerated every hour if it has been used, and
87is never stored on disk. 89is never stored on disk.
88.Pp 90.Pp
89Whenever a client connects the daemon responds with its public 91Whenever a client connects, the daemon responds with its public
90host and server keys. 92host and server keys.
91The client compares the 93The client compares the
92RSA host key against its own database to verify that it has not changed. 94RSA host key against its own database to verify that it has not changed.
@@ -119,7 +121,7 @@ System security is not improved unless
119.Nm rshd , 121.Nm rshd ,
120.Nm rlogind , 122.Nm rlogind ,
121and 123and
122.Xr rexecd 124.Nm rexecd
123are disabled (thus completely disabling 125are disabled (thus completely disabling
124.Xr rlogin 126.Xr rlogin
125and 127and
@@ -189,7 +191,9 @@ The server sends verbose debug output to the system
189log, and does not put itself in the background. 191log, and does not put itself in the background.
190The server also will not fork and will only process one connection. 192The server also will not fork and will only process one connection.
191This option is only intended for debugging for the server. 193This option is only intended for debugging for the server.
192Multiple -d options increase the debugging level. 194Multiple
195.Fl d
196options increase the debugging level.
193Maximum is 3. 197Maximum is 3.
194.It Fl e 198.It Fl e
195When this option is specified, 199When this option is specified,
@@ -225,7 +229,8 @@ the different protocol versions and host key algorithms.
225.It Fl i 229.It Fl i
226Specifies that 230Specifies that
227.Nm 231.Nm
228is being run from inetd. 232is being run from
233.Xr inetd 8 .
229.Nm 234.Nm
230is normally not run 235is normally not run
231from inetd because it needs to generate the server key before it can 236from inetd because it needs to generate the server key before it can
@@ -285,7 +290,7 @@ should be put into the
285.Pa utmp 290.Pa utmp
286file. 291file.
287.Fl u0 292.Fl u0
288is also be used to prevent 293may also be used to prevent
289.Nm 294.Nm
290from making DNS requests unless the authentication 295from making DNS requests unless the authentication
291mechanism or configuration requires it. 296mechanism or configuration requires it.
@@ -449,7 +454,7 @@ authentication.
449The command supplied by the user (if any) is ignored. 454The command supplied by the user (if any) is ignored.
450The command is run on a pty if the client requests a pty; 455The command is run on a pty if the client requests a pty;
451otherwise it is run without a tty. 456otherwise it is run without a tty.
452If a 8-bit clean channel is required, 457If an 8-bit clean channel is required,
453one must not request a pty or should specify 458one must not request a pty or should specify
454.Cm no-pty . 459.Cm no-pty .
455A quote may be included in the command by quoting it with a backslash. 460A quote may be included in the command by quoting it with a backslash.
@@ -509,7 +514,7 @@ command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hu
509permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323 514permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323
510.Sh SSH_KNOWN_HOSTS FILE FORMAT 515.Sh SSH_KNOWN_HOSTS FILE FORMAT
511The 516The
512.Pa /etc/ssh/ssh_known_hosts , 517.Pa /etc/ssh/ssh_known_hosts
513and 518and
514.Pa $HOME/.ssh/known_hosts 519.Pa $HOME/.ssh/known_hosts
515files contain host public keys for all known hosts. 520files contain host public keys for all known hosts.
@@ -630,7 +635,7 @@ These files should be writable only by root/the owner.
630.Pa /etc/ssh/ssh_known_hosts 635.Pa /etc/ssh/ssh_known_hosts
631should be world-readable, and 636should be world-readable, and
632.Pa $HOME/.ssh/known_hosts 637.Pa $HOME/.ssh/known_hosts
633can but need not be world-readable. 638can, but need not be, world-readable.
634.It Pa /etc/nologin 639.It Pa /etc/nologin
635If this file exists, 640If this file exists,
636.Nm 641.Nm
@@ -647,7 +652,7 @@ Further details are described in
647This file contains host-username pairs, separated by a space, one per 652This file contains host-username pairs, separated by a space, one per
648line. 653line.
649The given user on the corresponding host is permitted to log in 654The given user on the corresponding host is permitted to log in
650without password. 655without a password.
651The same file is used by rlogind and rshd. 656The same file is used by rlogind and rshd.
652The file must 657The file must
653be writable only by the user; it is recommended that it not be 658be writable only by the user; it is recommended that it not be
@@ -716,7 +721,9 @@ controlled via the
716.Cm PermitUserEnvironment 721.Cm PermitUserEnvironment
717option. 722option.
718.It Pa $HOME/.ssh/rc 723.It Pa $HOME/.ssh/rc
719If this file exists, it is run with /bin/sh after reading the 724If this file exists, it is run with
725.Pa /bin/sh
726after reading the
720environment files but before starting the user's shell or command. 727environment files but before starting the user's shell or command.
721It must not produce any output on stdout; stderr must be used 728It must not produce any output on stdout; stderr must be used
722instead. 729instead.