summaryrefslogtreecommitdiff
path: root/ssh-keygen.1
diff options
context:
space:
mode:
Diffstat (limited to 'ssh-keygen.1')
-rw-r--r--ssh-keygen.127
1 files changed, 19 insertions, 8 deletions
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index d0c00ebb0..7c8b1f202 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
1.\" $OpenBSD: ssh-keygen.1,v 1.101 2010/10/28 18:33:28 jmc Exp $ 1.\" $OpenBSD: ssh-keygen.1,v 1.106 2011/04/13 04:09:37 djm Exp $
2.\" 2.\"
3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
35.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37.\" 37.\"
38.Dd $Mdocdate: October 28 2010 $ 38.Dd $Mdocdate: April 13 2011 $
39.Dt SSH-KEYGEN 1 39.Dt SSH-KEYGEN 1
40.Os 40.Os
41.Sh NAME 41.Sh NAME
@@ -117,6 +117,8 @@
117.Nm ssh-keygen 117.Nm ssh-keygen
118.Fl L 118.Fl L
119.Op Fl f Ar input_keyfile 119.Op Fl f Ar input_keyfile
120.Nm ssh-keygen
121.Fl A
120.Ek 122.Ek
121.Sh DESCRIPTION 123.Sh DESCRIPTION
122.Nm 124.Nm
@@ -171,9 +173,8 @@ The passphrase can be changed later by using the
171option. 173option.
172.Pp 174.Pp
173There is no way to recover a lost passphrase. 175There is no way to recover a lost passphrase.
174If the passphrase is 176If the passphrase is lost or forgotten, a new key must be generated
175lost or forgotten, a new key must be generated and copied to the 177and the corresponding public key copied to other machines.
176corresponding public key to other machines.
177.Pp 178.Pp
178For RSA1 keys, 179For RSA1 keys,
179there is also a comment field in the key file that is only for 180there is also a comment field in the key file that is only for
@@ -190,6 +191,11 @@ should be placed to be activated.
190.Pp 191.Pp
191The options are as follows: 192The options are as follows:
192.Bl -tag -width Ds 193.Bl -tag -width Ds
194.It Fl A
195For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys
196do not exist, generate the host keys with the default key file path,
197an empty passphrase, default bits for the key type, and default comment.
198This is used by system administration scripts to generate new host keys.
193.It Fl a Ar trials 199.It Fl a Ar trials
194Specifies the number of primality tests to perform when screening DH-GEX 200Specifies the number of primality tests to perform when screening DH-GEX
195candidates using the 201candidates using the
@@ -202,6 +208,12 @@ Specifies the number of bits in the key to create.
202For RSA keys, the minimum size is 768 bits and the default is 2048 bits. 208For RSA keys, the minimum size is 768 bits and the default is 2048 bits.
203Generally, 2048 bits is considered sufficient. 209Generally, 2048 bits is considered sufficient.
204DSA keys must be exactly 1024 bits as specified by FIPS 186-2. 210DSA keys must be exactly 1024 bits as specified by FIPS 186-2.
211For ECDSA keys, the
212.Fl b
213flag determines they key length by selecting from one of three elliptic
214curve sizes: 256, 384 or 521 bits.
215Attempting to use bit lengths other than these three values for ECDSA keys
216will fail.
205.It Fl C Ar comment 217.It Fl C Ar comment
206Provides a new comment. 218Provides a new comment.
207.It Fl c 219.It Fl c
@@ -391,7 +403,6 @@ new passphrase.
391.It Fl q 403.It Fl q
392Silence 404Silence
393.Nm ssh-keygen . 405.Nm ssh-keygen .
394Used by system administration scripts when creating a new key.
395.It Fl R Ar hostname 406.It Fl R Ar hostname
396Removes all keys belonging to 407Removes all keys belonging to
397.Ar hostname 408.Ar hostname
@@ -520,7 +531,7 @@ option.
520Valid generator values are 2, 3, and 5. 531Valid generator values are 2, 3, and 5.
521.Pp 532.Pp
522Screened DH groups may be installed in 533Screened DH groups may be installed in
523.Pa /etc/moduli . 534.Pa /etc/ssh/moduli .
524It is important that this file contains moduli of a range of bit lengths and 535It is important that this file contains moduli of a range of bit lengths and
525that both ends of a connection share common moduli. 536that both ends of a connection share common moduli.
526.Sh CERTIFICATES 537.Sh CERTIFICATES
@@ -646,7 +657,7 @@ on all machines
646where the user wishes to log in using public key authentication. 657where the user wishes to log in using public key authentication.
647There is no need to keep the contents of this file secret. 658There is no need to keep the contents of this file secret.
648.Pp 659.Pp
649.It Pa /etc/moduli 660.It Pa /etc/ssh/moduli
650Contains Diffie-Hellman groups used for DH-GEX. 661Contains Diffie-Hellman groups used for DH-GEX.
651The file format is described in 662The file format is described in
652.Xr moduli 5 . 663.Xr moduli 5 .