diff options
Diffstat (limited to 'ssh-keygen.0')
-rw-r--r-- | ssh-keygen.0 | 102 |
1 files changed, 62 insertions, 40 deletions
diff --git a/ssh-keygen.0 b/ssh-keygen.0 index 38e50b121..998b6f1e0 100644 --- a/ssh-keygen.0 +++ b/ssh-keygen.0 | |||
@@ -14,6 +14,9 @@ SYNOPSIS | |||
14 | ssh-keygen -l [-f input_keyfile] | 14 | ssh-keygen -l [-f input_keyfile] |
15 | ssh-keygen -B [-f input_keyfile] | 15 | ssh-keygen -B [-f input_keyfile] |
16 | ssh-keygen -D reader | 16 | ssh-keygen -D reader |
17 | ssh-keygen -F hostname [-f known_hosts_file] | ||
18 | ssh-keygen -H [-f known_hosts_file] | ||
19 | ssh-keygen -R hostname [-f known_hosts_file] | ||
17 | ssh-keygen -U reader [-f input_keyfile] | 20 | ssh-keygen -U reader [-f input_keyfile] |
18 | ssh-keygen -r hostname [-f input_keyfile] [-g] | 21 | ssh-keygen -r hostname [-f input_keyfile] [-g] |
19 | ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point] | 22 | ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point] |
@@ -67,27 +70,54 @@ DESCRIPTION | |||
67 | Specifies the number of primality tests to perform when screening | 70 | Specifies the number of primality tests to perform when screening |
68 | DH-GEX candidates using the -T command. | 71 | DH-GEX candidates using the -T command. |
69 | 72 | ||
73 | -B Show the bubblebabble digest of specified private or public key | ||
74 | file. | ||
75 | |||
70 | -b bits | 76 | -b bits |
71 | Specifies the number of bits in the key to create. Minimum is | 77 | Specifies the number of bits in the key to create. Minimum is |
72 | 512 bits. Generally, 1024 bits is considered sufficient. The | 78 | 512 bits. Generally, 1024 bits is considered sufficient. The |
73 | default is 1024 bits. | 79 | default is 1024 bits. |
74 | 80 | ||
81 | -C comment | ||
82 | Provides a new comment. | ||
83 | |||
75 | -c Requests changing the comment in the private and public key | 84 | -c Requests changing the comment in the private and public key |
76 | files. This operation is only supported for RSA1 keys. The pro- | 85 | files. This operation is only supported for RSA1 keys. The pro- |
77 | gram will prompt for the file containing the private keys, for | 86 | gram will prompt for the file containing the private keys, for |
78 | the passphrase if the key has one, and for the new comment. | 87 | the passphrase if the key has one, and for the new comment. |
79 | 88 | ||
89 | -D reader | ||
90 | Download the RSA public key stored in the smartcard in reader. | ||
91 | |||
80 | -e This option will read a private or public OpenSSH key file and | 92 | -e This option will read a private or public OpenSSH key file and |
81 | print the key in a `SECSH Public Key File Format' to stdout. | 93 | print the key in a `SECSH Public Key File Format' to stdout. |
82 | This option allows exporting keys for use by several commercial | 94 | This option allows exporting keys for use by several commercial |
83 | SSH implementations. | 95 | SSH implementations. |
84 | 96 | ||
85 | -g Use generic DNS format when printing fingerprint resource records | 97 | -F hostname |
86 | using the -r command. | 98 | Search for the specified hostname in a known_hosts file, listing |
99 | any occurrences found. This option is useful to find hashed host | ||
100 | names or addresses and may also be used in conjunction with the | ||
101 | -H option to print found keys in a hashed format. | ||
87 | 102 | ||
88 | -f filename | 103 | -f filename |
89 | Specifies the filename of the key file. | 104 | Specifies the filename of the key file. |
90 | 105 | ||
106 | -G output_file | ||
107 | Generate candidate primes for DH-GEX. These primes must be | ||
108 | screened for safety (using the -T option) before use. | ||
109 | |||
110 | -g Use generic DNS format when printing fingerprint resource records | ||
111 | using the -r command. | ||
112 | |||
113 | -H Hash a known_hosts file, printing the result to standard output. | ||
114 | This replaces all hostnames and addresses with hashed representa- | ||
115 | tions. These hashes may be used normally by ssh and sshd, but | ||
116 | they do not reveal identifying information should the file's con- | ||
117 | tents be disclosed. This option will not modify existing hashed | ||
118 | hostnames and is therefore safe to use on files that mix hashed | ||
119 | and non-hashed names. | ||
120 | |||
91 | -i This option will read an unencrypted private (or public) key file | 121 | -i This option will read an unencrypted private (or public) key file |
92 | in SSH2-compatible format and print an OpenSSH compatible private | 122 | in SSH2-compatible format and print an OpenSSH compatible private |
93 | (or public) key to stdout. ssh-keygen also reads the `SECSH | 123 | (or public) key to stdout. ssh-keygen also reads the `SECSH |
@@ -98,34 +128,6 @@ DESCRIPTION | |||
98 | are also supported. For RSA and DSA keys ssh-keygen tries to | 128 | are also supported. For RSA and DSA keys ssh-keygen tries to |
99 | find the matching public key file and prints its fingerprint. | 129 | find the matching public key file and prints its fingerprint. |
100 | 130 | ||
101 | -p Requests changing the passphrase of a private key file instead of | ||
102 | creating a new private key. The program will prompt for the file | ||
103 | containing the private key, for the old passphrase, and twice for | ||
104 | the new passphrase. | ||
105 | |||
106 | -q Silence ssh-keygen. Used by /etc/rc when creating a new key. | ||
107 | |||
108 | -y This option will read a private OpenSSH format file and print an | ||
109 | OpenSSH public key to stdout. | ||
110 | |||
111 | -t type | ||
112 | Specifies the type of the key to create. The possible values are | ||
113 | ``rsa1'' for protocol version 1 and ``rsa'' or ``dsa'' for proto- | ||
114 | col version 2. | ||
115 | |||
116 | -B Show the bubblebabble digest of specified private or public key | ||
117 | file. | ||
118 | |||
119 | -C comment | ||
120 | Provides the new comment. | ||
121 | |||
122 | -D reader | ||
123 | Download the RSA public key stored in the smartcard in reader. | ||
124 | |||
125 | -G output_file | ||
126 | Generate candidate primes for DH-GEX. These primes must be | ||
127 | screened for safety (using the -T option) before use. | ||
128 | |||
129 | -M memory | 131 | -M memory |
130 | Specify the amount of memory to use (in megabytes) when generat- | 132 | Specify the amount of memory to use (in megabytes) when generat- |
131 | ing candidate moduli for DH-GEX. | 133 | ing candidate moduli for DH-GEX. |
@@ -136,6 +138,22 @@ DESCRIPTION | |||
136 | -P passphrase | 138 | -P passphrase |
137 | Provides the (old) passphrase. | 139 | Provides the (old) passphrase. |
138 | 140 | ||
141 | -p Requests changing the passphrase of a private key file instead of | ||
142 | creating a new private key. The program will prompt for the file | ||
143 | containing the private key, for the old passphrase, and twice for | ||
144 | the new passphrase. | ||
145 | |||
146 | -q Silence ssh-keygen. Used by /etc/rc when creating a new key. | ||
147 | |||
148 | -R hostname | ||
149 | Removes all keys belonging to hostname from a known_hosts file. | ||
150 | This option is useful to delete hashed hosts (see the -H option | ||
151 | above). | ||
152 | |||
153 | -r hostname | ||
154 | Print the SSHFP fingerprint resource record named hostname for | ||
155 | the specified public key file. | ||
156 | |||
139 | -S start | 157 | -S start |
140 | Specify start point (in hex) when generating candidate moduli for | 158 | Specify start point (in hex) when generating candidate moduli for |
141 | DH-GEX. | 159 | DH-GEX. |
@@ -144,9 +162,10 @@ DESCRIPTION | |||
144 | Test DH group exchange candidate primes (generated using the -G | 162 | Test DH group exchange candidate primes (generated using the -G |
145 | option) for safety. | 163 | option) for safety. |
146 | 164 | ||
147 | -W generator | 165 | -t type |
148 | Specify desired generator when testing candidate moduli for DH- | 166 | Specifies the type of key to create. The possible values are |
149 | GEX. | 167 | ``rsa1'' for protocol version 1 and ``rsa'' or ``dsa'' for proto- |
168 | col version 2. | ||
150 | 169 | ||
151 | -U reader | 170 | -U reader |
152 | Upload an existing RSA private key into the smartcard in reader. | 171 | Upload an existing RSA private key into the smartcard in reader. |
@@ -156,9 +175,12 @@ DESCRIPTION | |||
156 | tion. Multiple -v options increase the verbosity. The maximum | 175 | tion. Multiple -v options increase the verbosity. The maximum |
157 | is 3. | 176 | is 3. |
158 | 177 | ||
159 | -r hostname | 178 | -W generator |
160 | Print the SSHFP fingerprint resource record named hostname for | 179 | Specify desired generator when testing candidate moduli for DH- |
161 | the specified public key file. | 180 | GEX. |
181 | |||
182 | -y This option will read a private OpenSSH format file and print an | ||
183 | OpenSSH public key to stdout. | ||
162 | 184 | ||
163 | MODULI GENERATION | 185 | MODULI GENERATION |
164 | ssh-keygen may be used to generate groups for the Diffie-Hellman Group | 186 | ssh-keygen may be used to generate groups for the Diffie-Hellman Group |
@@ -170,7 +192,7 @@ MODULI GENERATION | |||
170 | Generation of primes is performed using the -G option. The desired | 192 | Generation of primes is performed using the -G option. The desired |
171 | length of the primes may be specified by the -b option. For example: | 193 | length of the primes may be specified by the -b option. For example: |
172 | 194 | ||
173 | ssh-keygen -G moduli-2048.candidates -b 2048 | 195 | # ssh-keygen -G moduli-2048.candidates -b 2048 |
174 | 196 | ||
175 | By default, the search for primes begins at a random point in the desired | 197 | By default, the search for primes begins at a random point in the desired |
176 | length range. This may be overridden using the -S option, which speci- | 198 | length range. This may be overridden using the -S option, which speci- |
@@ -181,13 +203,13 @@ MODULI GENERATION | |||
181 | ssh-keygen will read candidates from standard input (or a file specified | 203 | ssh-keygen will read candidates from standard input (or a file specified |
182 | using the -f option). For example: | 204 | using the -f option). For example: |
183 | 205 | ||
184 | ssh-keygen -T moduli-2048 -f moduli-2048.candidates | 206 | # ssh-keygen -T moduli-2048 -f moduli-2048.candidates |
185 | 207 | ||
186 | By default, each candidate will be subjected to 100 primality tests. | 208 | By default, each candidate will be subjected to 100 primality tests. |
187 | This may be overridden using the -a option. The DH generator value will | 209 | This may be overridden using the -a option. The DH generator value will |
188 | be chosen automatically for the prime under consideration. If a specific | 210 | be chosen automatically for the prime under consideration. If a specific |
189 | generator is desired, it may be requested using the -W option. Valid | 211 | generator is desired, it may be requested using the -W option. Valid |
190 | generator values are 2, 3 and 5. | 212 | generator values are 2, 3, and 5. |
191 | 213 | ||
192 | Screened DH groups may be installed in /etc/moduli. It is important that | 214 | Screened DH groups may be installed in /etc/moduli. It is important that |
193 | this file contains moduli of a range of bit lengths and that both ends of | 215 | this file contains moduli of a range of bit lengths and that both ends of |
@@ -259,4 +281,4 @@ AUTHORS | |||
259 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | 281 | created OpenSSH. Markus Friedl contributed the support for SSH protocol |
260 | versions 1.5 and 2.0. | 282 | versions 1.5 and 2.0. |
261 | 283 | ||
262 | OpenBSD 3.6 September 25, 1999 4 | 284 | OpenBSD 3.6 September 25, 1999 5 |