summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ssh.128
-rw-r--r--sshd.838
2 files changed, 33 insertions, 33 deletions
diff --git a/ssh.1 b/ssh.1
index 36703e205..10054445c 100644
--- a/ssh.1
+++ b/ssh.1
@@ -9,7 +9,7 @@
9.\" 9.\"
10.\" Created: Sat Apr 22 21:55:14 1995 ylo 10.\" Created: Sat Apr 22 21:55:14 1995 ylo
11.\" 11.\"
12.\" $Id: ssh.1,v 1.3 1999/10/28 23:15:50 damien Exp $ 12.\" $Id: ssh.1,v 1.4 1999/10/28 23:17:36 damien Exp $
13.\" 13.\"
14.Dd September 25, 1999 14.Dd September 25, 1999
15.Dt SSH 1 15.Dt SSH 1
@@ -66,7 +66,7 @@ his/her identity to the remote machine using one of several methods.
66First, if the machine the user logs in from is listed in 66First, if the machine the user logs in from is listed in
67.Pa /etc/hosts.equiv 67.Pa /etc/hosts.equiv
68or 68or
69.Pa /etc/shosts.equiv 69.Pa /etc/ssh/shosts.equiv
70on the remote machine, and the user names are 70on the remote machine, and the user names are
71the same on both sides, the user is immediately permitted to log in. 71the same on both sides, the user is immediately permitted to log in.
72Second, if 72Second, if
@@ -89,10 +89,10 @@ means that if the login would be permitted by
89.Pa \&.shosts , 89.Pa \&.shosts ,
90.Pa /etc/hosts.equiv , 90.Pa /etc/hosts.equiv ,
91or 91or
92.Pa /etc/shosts.equiv , 92.Pa /etc/ssh/shosts.equiv ,
93and if additionally the server can verify the client's 93and if additionally the server can verify the client's
94host key (see 94host key (see
95.Pa /etc/ssh_known_hosts 95.Pa /etc/ssh/ssh_known_hosts
96in the 96in the
97.Sx FILES 97.Sx FILES
98section), only then login is 98section), only then login is
@@ -248,7 +248,7 @@ identifications for all hosts it has ever been used with. The
248database is stored in 248database is stored in
249.Pa \&.ssh/known_hosts 249.Pa \&.ssh/known_hosts
250in the user's home directory. Additionally, the file 250in the user's home directory. Additionally, the file
251.Pa /etc/ssh_known_hosts 251.Pa /etc/ssh/ssh_known_hosts
252is automatically checked for known hosts. Any new hosts are 252is automatically checked for known hosts. Any new hosts are
253automatically added to the user's file. If a host's identification 253automatically added to the user's file. If a host's identification
254ever changes, 254ever changes,
@@ -416,7 +416,7 @@ obtains configuration data from the following sources (in this order):
416command line options, user's configuration file 416command line options, user's configuration file
417.Pq Pa $HOME/.ssh/config , 417.Pq Pa $HOME/.ssh/config ,
418and system-wide configuration file 418and system-wide configuration file
419.Pq Pa /etc/ssh_config . 419.Pq Pa /etc/ssh/ssh_config .
420For each parameter, the first obtained value 420For each parameter, the first obtained value
421will be used. The configuration files contain sections bracketed by 421will be used. The configuration files contain sections bracketed by
422"Host" specifications, and that section is only applied for hosts that 422"Host" specifications, and that section is only applied for hosts that
@@ -540,7 +540,7 @@ The default is
540.Dq no . 540.Dq no .
541.It Cm GlobalKnownHostsFile 541.It Cm GlobalKnownHostsFile
542Specifies a file to use instead of 542Specifies a file to use instead of
543.Pa /etc/ssh_known_hosts . 543.Pa /etc/ssh/ssh_known_hosts .
544.It Cm HostName 544.It Cm HostName
545Specifies the real host name to log into. This can be used to specify 545Specifies the real host name to log into. This can be used to specify
546nicnames or abbreviations for hosts. Default is the name given on the 546nicnames or abbreviations for hosts. Default is the name given on the
@@ -672,7 +672,7 @@ ssh will never automatically add host keys to the
672file, and refuses to connect hosts whose host key has changed. This 672file, and refuses to connect hosts whose host key has changed. This
673provides maximum protection against trojan horse attacks. However, it 673provides maximum protection against trojan horse attacks. However, it
674can be somewhat annoying if you don't have good 674can be somewhat annoying if you don't have good
675.Pa /etc/ssh_known_hosts 675.Pa /etc/ssh/ssh_known_hosts
676files installed and frequently 676files installed and frequently
677connect new hosts. Basically this option forces the user to manually 677connect new hosts. Basically this option forces the user to manually
678add any new hosts. Normally this option is disabled, and new hosts 678add any new hosts. Normally this option is disabled, and new hosts
@@ -779,7 +779,7 @@ to the environment.
779.It Pa $HOME/.ssh/known_hosts 779.It Pa $HOME/.ssh/known_hosts
780Records host keys for all hosts the user has logged into (that are not 780Records host keys for all hosts the user has logged into (that are not
781in 781in
782.Pa /etc/ssh_known_hosts ) . 782.Pa /etc/ssh/ssh_known_hosts ) .
783See 783See
784.Xr sshd 8 . 784.Xr sshd 8 .
785.It Pa $HOME/.ssh/random_seed 785.It Pa $HOME/.ssh/random_seed
@@ -824,7 +824,7 @@ identity files (that is, each line contains the number of bits in
824modulus, public exponent, modulus, and comment fields, separated by 824modulus, public exponent, modulus, and comment fields, separated by
825spaces). This file is not highly sensitive, but the recommended 825spaces). This file is not highly sensitive, but the recommended
826permissions are read/write for the user, and not accessible by others. 826permissions are read/write for the user, and not accessible by others.
827.It Pa /etc/ssh_known_hosts 827.It Pa /etc/ssh/ssh_known_hosts
828Systemwide list of known host keys. This file should be prepared by the 828Systemwide list of known host keys. This file should be prepared by the
829system administrator to contain the public host keys of all machines in the 829system administrator to contain the public host keys of all machines in the
830organization. This file should be world-readable. This file contains 830organization. This file should be world-readable. This file contains
@@ -843,7 +843,7 @@ to verify the client host when logging in; other names are needed because
843does not convert the user-supplied name to a canonical name before 843does not convert the user-supplied name to a canonical name before
844checking the key, because someone with access to the name servers 844checking the key, because someone with access to the name servers
845would then be able to fool host authentication. 845would then be able to fool host authentication.
846.It Pa /etc/ssh_config 846.It Pa /etc/ssh/ssh_config
847Systemwide configuration file. This file provides defaults for those 847Systemwide configuration file. This file provides defaults for those
848values that are not specified in the user's configuration file, and 848values that are not specified in the user's configuration file, and
849for those users who do not have a configuration file. This file must 849for those users who do not have a configuration file. This file must
@@ -870,7 +870,7 @@ Note that by default
870will be installed so that it requires successful RSA host 870will be installed so that it requires successful RSA host
871authentication before permitting \s+2.\s0rhosts authentication. If your 871authentication before permitting \s+2.\s0rhosts authentication. If your
872server machine does not have the client's host key in 872server machine does not have the client's host key in
873.Pa /etc/ssh_known_hosts , 873.Pa /etc/ssh/ssh_known_hosts ,
874you can store it in 874you can store it in
875.Pa $HOME/.ssh/known_hosts . 875.Pa $HOME/.ssh/known_hosts .
876The easiest way to do this is to 876The easiest way to do this is to
@@ -897,13 +897,13 @@ manual page). If the client host is found in this file, login is
897automatically permitted provided client and server user names are the 897automatically permitted provided client and server user names are the
898same. Additionally, successful RSA host authentication is normally 898same. Additionally, successful RSA host authentication is normally
899required. This file should only be writable by root. 899required. This file should only be writable by root.
900.It Pa /etc/shosts.equiv 900.It Pa /etc/ssh/shosts.equiv
901This file is processed exactly as 901This file is processed exactly as
902.Pa /etc/hosts.equiv . 902.Pa /etc/hosts.equiv .
903This file may be useful to permit logins using 903This file may be useful to permit logins using
904.Nm 904.Nm
905but not using rsh/rlogin. 905but not using rsh/rlogin.
906.It Pa /etc/sshrc 906.It Pa /etc/ssh/sshrc
907Commands in this file are executed by 907Commands in this file are executed by
908.Nm 908.Nm
909when the user logs in just before the user's shell (or command) is started. 909when the user logs in just before the user's shell (or command) is started.
diff --git a/sshd.8 b/sshd.8
index a5c3f9554..b19880f0e 100644
--- a/sshd.8
+++ b/sshd.8
@@ -9,7 +9,7 @@
9.\" 9.\"
10.\" Created: Sat Apr 22 21:55:14 1995 ylo 10.\" Created: Sat Apr 22 21:55:14 1995 ylo
11.\" 11.\"
12.\" $Id: sshd.8,v 1.3 1999/10/28 23:15:50 damien Exp $ 12.\" $Id: sshd.8,v 1.4 1999/10/28 23:17:36 damien Exp $
13.\" 13.\"
14.Dd September 25, 1999 14.Dd September 25, 1999
15.Dt SSHD 8 15.Dt SSHD 8
@@ -118,7 +118,7 @@ not fork and will only process one connection. This option is only
118intended for debugging for the server. 118intended for debugging for the server.
119.It Fl f Ar configuration_file 119.It Fl f Ar configuration_file
120Specifies the name of the configuration file. The default is 120Specifies the name of the configuration file. The default is
121.Pa /etc/sshd_config . 121.Pa /etc/ssh/sshd_config .
122.Nm 122.Nm
123refuses to start if there is no configuration file. 123refuses to start if there is no configuration file.
124.It Fl g Ar login_grace_time 124.It Fl g Ar login_grace_time
@@ -128,7 +128,7 @@ this many seconds, the server disconnects and exits. A value of zero
128indicates no limit. 128indicates no limit.
129.It Fl h Ar host_key_file 129.It Fl h Ar host_key_file
130Specifies the file from which the host key is read (default 130Specifies the file from which the host key is read (default
131.Pa /etc/ssh_host_key ) . 131.Pa /etc/ssh/ssh_host_key ) .
132This option must be given if 132This option must be given if
133.Nm 133.Nm
134is not run as root (as the normal 134is not run as root (as the normal
@@ -165,7 +165,7 @@ Do not print an error message if RSA support is missing.
165.Sh CONFIGURATION FILE 165.Sh CONFIGURATION FILE
166.Nm 166.Nm
167reads configuration data from 167reads configuration data from
168.Pa /etc/sshd_config 168.Pa /etc/ssh/sshd_config
169(or the file specified with 169(or the file specified with
170.Fl f 170.Fl f
171on the command line). The file 171on the command line). The file
@@ -242,7 +242,7 @@ The default is
242.Dq no . 242.Dq no .
243.It Cm HostKey 243.It Cm HostKey
244Specifies the file containing the private host key (default 244Specifies the file containing the private host key (default
245.Pa /etc/ssh_host_key ) . 245.Pa /etc/ssh/ssh_host_key ) .
246Note that 246Note that
247.Nm 247.Nm
248does not start if this file is group/world-accessible. 248does not start if this file is group/world-accessible.
@@ -251,7 +251,7 @@ Specifies that rhosts and shosts files will not be used in
251authentication. 251authentication.
252.Pa /etc/hosts.equiv 252.Pa /etc/hosts.equiv
253and 253and
254.Pa /etc/shosts.equiv 254.Pa /etc/ssh/shosts.equiv
255are still used. The default is 255are still used. The default is
256.Dq no . 256.Dq no .
257.It Cm KeepAlive 257.It Cm KeepAlive
@@ -455,7 +455,7 @@ Changes to user's home directory.
455If 455If
456.Pa $HOME/.ssh/rc 456.Pa $HOME/.ssh/rc
457exists, runs it; else if 457exists, runs it; else if
458.Pa /etc/sshrc 458.Pa /etc/ssh/sshrc
459exists, runs 459exists, runs
460it; otherwise runs xauth. The 460it; otherwise runs xauth. The
461.Dq rc 461.Dq rc
@@ -541,7 +541,7 @@ from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula
541command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi 541command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi
542.Sh SSH_KNOWN_HOSTS FILE FORMAT 542.Sh SSH_KNOWN_HOSTS FILE FORMAT
543The 543The
544.Pa /etc/ssh_known_hosts 544.Pa /etc/ssh/ssh_known_hosts
545and 545and
546.Pa $HOME/.ssh/known_hosts 546.Pa $HOME/.ssh/known_hosts
547files contain host public keys for all known hosts. The global file should 547files contain host public keys for all known hosts. The global file should
@@ -564,7 +564,7 @@ pattern on the line.
564.Pp 564.Pp
565Bits, exponent, and modulus are taken directly from the host key; they 565Bits, exponent, and modulus are taken directly from the host key; they
566can be obtained, e.g., from 566can be obtained, e.g., from
567.Pa /etc/ssh_host_key.pub . 567.Pa /etc/ssh/ssh_host_key.pub .
568The optional comment field continues to the end of the line, and is not used. 568The optional comment field continues to the end of the line, and is not used.
569.Pp 569.Pp
570Lines starting with 570Lines starting with
@@ -583,25 +583,25 @@ Note that the lines in these files are typically hundreds of characters
583long, and you definitely don't want to type in the host keys by hand. 583long, and you definitely don't want to type in the host keys by hand.
584Rather, generate them by a script 584Rather, generate them by a script
585or by taking 585or by taking
586.Pa /etc/ssh_host_key.pub 586.Pa /etc/ssh/ssh_host_key.pub
587and adding the host names at the front. 587and adding the host names at the front.
588.Ss Examples 588.Ss Examples
589closenet,closenet.hut.fi,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi 589closenet,closenet.hut.fi,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi
590.Sh FILES 590.Sh FILES
591.Bl -tag -width Ds 591.Bl -tag -width Ds
592.It Pa /etc/sshd_config 592.It Pa /etc/ssh/sshd_config
593Contains configuration data for 593Contains configuration data for
594.Nm sshd . 594.Nm sshd .
595This file should be writable by root only, but it is recommended 595This file should be writable by root only, but it is recommended
596(though not necessary) that it be world-readable. 596(though not necessary) that it be world-readable.
597.It Pa /etc/ssh_host_key 597.It Pa /etc/ssh/ssh_host_key
598Contains the private part of the host key. 598Contains the private part of the host key.
599This file should only be owned by root, readable only by root, and not 599This file should only be owned by root, readable only by root, and not
600accessible to others. 600accessible to others.
601Note that 601Note that
602.Nm 602.Nm
603does not start if this file is group/world-accessible. 603does not start if this file is group/world-accessible.
604.It Pa /etc/ssh_host_key.pub 604.It Pa /etc/ssh/ssh_host_key.pub
605Contains the public part of the host key. 605Contains the public part of the host key.
606This file should be world-readable but writable only by 606This file should be world-readable but writable only by
607root. Its contents should match the private part. This file is not 607root. Its contents should match the private part. This file is not
@@ -622,17 +622,17 @@ This file must be readable by root (which may on some machines imply
622it being world-readable if the user's home directory resides on an NFS 622it being world-readable if the user's home directory resides on an NFS
623volume). It is recommended that it not be accessible by others. The 623volume). It is recommended that it not be accessible by others. The
624format of this file is described above. 624format of this file is described above.
625.It Pa /etc/ssh_known_hosts 625.It Pa /etc/ssh/ssh_known_hosts
626This file is consulted when using rhosts with RSA host 626This file is consulted when using rhosts with RSA host
627authentication to check the public key of the host. The key must be 627authentication to check the public key of the host. The key must be
628listed in this file to be accepted. 628listed in this file to be accepted.
629.It Pa $HOME/.ssh/known_hosts 629.It Pa $HOME/.ssh/known_hosts
630The client uses this file 630The client uses this file
631and 631and
632.Pa /etc/ssh_known_hosts 632.Pa /etc/ssh/ssh_known_hosts
633to verify that the remote host is the one we intended to 633to verify that the remote host is the one we intended to
634connect. These files should be writable only by root/the owner. 634connect. These files should be writable only by root/the owner.
635.Pa /etc/ssh_known_hosts 635.Pa /etc/ssh/ssh_known_hosts
636should be world-readable, and 636should be world-readable, and
637.Pa $HOME/.ssh/known_hosts 637.Pa $HOME/.ssh/known_hosts
638can but need not be world-readable. 638can but need not be world-readable.
@@ -694,7 +694,7 @@ user root access. The only valid use for user names that I can think
694of is in negative entries. 694of is in negative entries.
695.Pp 695.Pp
696Note that this warning also applies to rsh/rlogin. 696Note that this warning also applies to rsh/rlogin.
697.It Pa /etc/shosts.equiv 697.It Pa /etc/ssh/shosts.equiv
698This is processed exactly as 698This is processed exactly as
699.Pa /etc/hosts.equiv . 699.Pa /etc/hosts.equiv .
700However, this file may be useful in environments that want to run both 700However, this file may be useful in environments that want to run both
@@ -724,13 +724,13 @@ something similar to: "if read proto cookie; then echo add $DISPLAY
724$proto $cookie | xauth -q -; fi". 724$proto $cookie | xauth -q -; fi".
725.Pp 725.Pp
726If this file does not exist, 726If this file does not exist,
727.Pa /etc/sshrc 727.Pa /etc/ssh/sshrc
728is run, and if that 728is run, and if that
729does not exist either, xauth is used to store the cookie. 729does not exist either, xauth is used to store the cookie.
730.Pp 730.Pp
731This file should be writable only by the user, and need not be 731This file should be writable only by the user, and need not be
732readable by anyone else. 732readable by anyone else.
733.It Pa /etc/sshrc 733.It Pa /etc/ssh/sshrc
734Like 734Like
735.Pa $HOME/.ssh/rc . 735.Pa $HOME/.ssh/rc .
736This can be used to specify 736This can be used to specify