1 files changed, 84 insertions, 82 deletions

diff --git a/ssh.0 b/ssh.0
index 2397456b2..274fab8b5 100644
--- a/ssh.0
+++ b/ssh.0
@@ -30,16 +30,16 @@ DESCRIPTION
      bined with RSA-based host authentication.  If the machine the user logs
      in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
      machine, and the user names are the same on both sides, or if the files
-     $HOME/.rhosts or $HOME/.shosts exist in the user's home directory on the
-     remote machine and contain a line containing the name of the client ma-
-     chine and the name of the user on that machine, the user is considered
-     for log in.  Additionally, if the server can verify the client's host key
-     (see /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts in the FILES
-     section), only then is login permitted.  This authentication method clos-
-     es security holes due to IP spoofing, DNS spoofing and routing spoofing.
-     [Note to the administrator: /etc/hosts.equiv, $HOME/.rhosts, and the
-     rlogin/rsh protocol in general, are inherently insecure and should be
-     disabled if security is desired.]
+     ~/.rhosts or ~/.shosts exist in the user's home directory on the remote
+     machine and contain a line containing the name of the client machine and
+     the name of the user on that machine, the user is considered for log in.
+     Additionally, if the server can verify the client's host key (see
+     /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts in the FILES section),
+     only then is login permitted.  This authentication method closes security
+     holes due to IP spoofing, DNS spoofing and routing spoofing.  [Note to
+     the administrator: /etc/hosts.equiv, ~/.rhosts, and the rlogin/rsh proto-
+     col in general, are inherently insecure and should be disabled if securi-
+     ty is desired.]
 
      As a second authentication method, ssh supports RSA based authentication.
      The scheme is based on public-key cryptography: there are cryptosystems
@@ -49,25 +49,25 @@ DESCRIPTION
      key pair for authentication purposes.  The server knows the public key,
      and only the user knows the private key.
 
-     The file $HOME/.ssh/authorized_keys lists the public keys that are per-
-     mitted for logging in.  When the user logs in, the ssh program tells the
-     server which key pair it would like to use for authentication.  The serv-
-     er checks if this key is permitted, and if so, sends the user (actually
-     the ssh program running on behalf of the user) a challenge, a random num-
-     ber, encrypted by the user's public key.  The challenge can only be de-
-     crypted using the proper private key.  The user's client then decrypts
-     the challenge using the private key, proving that he/she knows the pri-
-     vate key but without disclosing it to the server.
+     The file ~/.ssh/authorized_keys lists the public keys that are permitted
+     for logging in.  When the user logs in, the ssh program tells the server
+     which key pair it would like to use for authentication.  The server
+     checks if this key is permitted, and if so, sends the user (actually the
+     ssh program running on behalf of the user) a challenge, a random number,
+     encrypted by the user's public key.  The challenge can only be decrypted
+     using the proper private key.  The user's client then decrypts the chal-
+     lenge using the private key, proving that he/she knows the private key
+     but without disclosing it to the server.
 
      ssh implements the RSA authentication protocol automatically.  The user
      creates his/her RSA key pair by running ssh-keygen(1).  This stores the
-     private key in $HOME/.ssh/identity and stores the public key in
-     $HOME/.ssh/identity.pub in the user's home directory.  The user should
-     then copy the identity.pub to $HOME/.ssh/authorized_keys in his/her home
-     directory on the remote machine (the authorized_keys file corresponds to
-     the conventional $HOME/.rhosts file, and has one key per line, though the
-     lines can be very long).  After this, the user can log in without giving
-     the password.
+     private key in ~/.ssh/identity and stores the public key in
+     ~/.ssh/identity.pub in the user's home directory.  The user should then
+     copy the identity.pub to ~/.ssh/authorized_keys in his/her home directory
+     on the remote machine (the authorized_keys file corresponds to the con-
+     ventional ~/.rhosts file, and has one key per line, though the lines can
+     be very long).  After this, the user can log in without giving the pass-
+     word.
 
      The most convenient way to use RSA authentication may be with an authen-
      tication agent.  See ssh-agent(1) for more information.
@@ -87,13 +87,12 @@ DESCRIPTION
 
      The public key method is similar to RSA authentication described in the
      previous section and allows the RSA or DSA algorithm to be used: The
-     client uses his private key, $HOME/.ssh/id_dsa or $HOME/.ssh/id_rsa, to
-     sign the session identifier and sends the result to the server.  The
-     server checks whether the matching public key is listed in
-     $HOME/.ssh/authorized_keys and grants access if both the key is found and
-     the signature is correct.  The session identifier is derived from a
-     shared Diffie-Hellman value and is only known to the client and the serv-
-     er.
+     client uses his private key, ~/.ssh/id_dsa or ~/.ssh/id_rsa, to sign the
+     session identifier and sends the result to the server.  The server checks
+     whether the matching public key is listed in ~/.ssh/authorized_keys and
+     grants access if both the key is found and the signature is correct.  The
+     session identifier is derived from a shared Diffie-Hellman value and is
+     only known to the client and the server.
 
      If public key authentication fails or is not available, a password can be
      sent encrypted to the remote host to prove the user's identity.
@@ -194,13 +193,13 @@ DESCRIPTION
    Server authentication
      ssh automatically maintains and checks a database containing identifica-
      tions for all hosts it has ever been used with.  Host keys are stored in
-     $HOME/.ssh/known_hosts in the user's home directory.  Additionally, the
-     file /etc/ssh/ssh_known_hosts is automatically checked for known hosts.
-     Any new hosts are automatically added to the user's file.  If a host's
-     identification ever changes, ssh warns about this and disables password
-     authentication to prevent a trojan horse from getting the user's pass-
-     word.  Another purpose of this mechanism is to prevent man-in-the-middle
-     attacks which could otherwise be used to circumvent the encryption.  The
+     ~/.ssh/known_hosts in the user's home directory.  Additionally, the file
+     /etc/ssh/ssh_known_hosts is automatically checked for known hosts.  Any
+     new hosts are automatically added to the user's file.  If a host's iden-
+     tification ever changes, ssh warns about this and disables password au-
+     thentication to prevent a trojan horse from getting the user's password.
+     Another purpose of this mechanism is to prevent man-in-the-middle attacks
+     which could otherwise be used to circumvent the encryption.  The
      StrictHostKeyChecking option can be used to prevent logins to machines
      whose host key is not known or has changed.
 
@@ -234,8 +233,9 @@ DESCRIPTION
      -a      Disables forwarding of the authentication agent connection.
 
      -b bind_address
-             Specify the interface to transmit from on machines with multiple
-             interfaces or aliased addresses.
+             Use bind_address on the local machine as the source address of
+             the connection.  Only useful on systems with more than one ad-
+             dress.
 
      -C      Requests compression of all data (including stdin, stdout,
              stderr, and data for forwarded X11 and TCP/IP connections).  The
@@ -262,11 +262,13 @@ DESCRIPTION
              For protocol version 2 cipher_spec is a comma-separated list of
              ciphers listed in order of preference.  The supported ciphers are
              ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
-             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour'',
-             ``blowfish-cbc'', and ``cast128-cbc''.  The default is
+             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
+             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
+             ``cast128-cbc''.  The default is
 
-               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-                 aes192-cbc,aes256-cbc''
+               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                 aes192-ctr,aes256-ctr''
 
      -D port
              Specifies a local ``dynamic'' application-level port forwarding.
@@ -292,7 +294,7 @@ DESCRIPTION
              Specifies an alternative per-user configuration file.  If a con-
              figuration file is given on the command line, the system-wide
              configuration file (/etc/ssh/ssh_config) will be ignored.  The
-             default for the per-user configuration file is $HOME/.ssh/config.
+             default for the per-user configuration file is ~/.ssh/config.
 
      -f      Requests ssh to go to background just before command execution.
              This is useful if ssh is going to ask for passwords or passphras-
@@ -309,12 +311,12 @@ DESCRIPTION
 
      -i identity_file
              Selects a file from which the identity (private key) for RSA or
-             DSA authentication is read.  The default is $HOME/.ssh/identity
-             for protocol version 1, and $HOME/.ssh/id_rsa and
-             $HOME/.ssh/id_dsa for protocol version 2.  Identity files may al-
-             so be specified on a per-host basis in the configuration file.
-             It is possible to have multiple -i options (and multiple identi-
-             ties specified in configuration files).
+             DSA authentication is read.  The default is ~/.ssh/identity for
+             protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for pro-
+             tocol version 2.  Identity files may also be specified on a per-
+             host basis in the configuration file.  It is possible to have
+             multiple -i options (and multiple identities specified in config-
+             uration files).
 
      -k      Disables forwarding (delegation) of GSSAPI credentials to the
              server.
@@ -567,17 +569,17 @@ ENVIRONMENT
 
      USER     Set to the name of the user logging in.
 
-     Additionally, ssh reads $HOME/.ssh/environment, and adds lines of the
-     format ``VARNAME=value'' to the environment if the file exists and if
-     users are allowed to change their environment.  For more information, see
-     the PermitUserEnvironment option in sshd_config(5).
+     Additionally, ssh reads ~/.ssh/environment, and adds lines of the format
+     ``VARNAME=value'' to the environment if the file exists and if users are
+     allowed to change their environment.  For more information, see the
+     PermitUserEnvironment option in sshd_config(5).
 
 FILES
-     $HOME/.ssh/known_hosts
+     ~/.ssh/known_hosts
              Records host keys for all hosts the user has logged into that are
              not in /etc/ssh/ssh_known_hosts.  See sshd(8).
 
-     $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
+     ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
              Contains the authentication identity of the user.  They are for
              protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
              These files contain sensitive data and should be readable by the
@@ -587,27 +589,27 @@ FILES
              key; the passphrase will be used to encrypt the sensitive part of
              this file using 3DES.
 
-     $HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub
+     ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
              Contains the public key for authentication (public part of the
              identity file in human-readable form).  The contents of the
-             $HOME/.ssh/identity.pub file should be added to the file
-             $HOME/.ssh/authorized_keys on all machines where the user wishes
-             to log in using protocol version 1 RSA authentication.  The con-
-             tents of the $HOME/.ssh/id_dsa.pub and $HOME/.ssh/id_rsa.pub file
-             should be added to $HOME/.ssh/authorized_keys on all machines
-             where the user wishes to log in using protocol version 2 DSA/RSA
-             authentication.  These files are not sensitive and can (but need
-             not) be readable by anyone.  These files are never used automati-
-             cally and are not necessary; they are only provided for the con-
-             venience of the user.
-
-     $HOME/.ssh/config
+             ~/.ssh/identity.pub file should be added to the file
+             ~/.ssh/authorized_keys on all machines where the user wishes to
+             log in using protocol version 1 RSA authentication.  The contents
+             of the ~/.ssh/id_dsa.pub and ~/.ssh/id_rsa.pub file should be
+             added to ~/.ssh/authorized_keys on all machines where the user
+             wishes to log in using protocol version 2 DSA/RSA authentication.
+             These files are not sensitive and can (but need not) be readable
+             by anyone.  These files are never used automatically and are not
+             necessary; they are only provided for the convenience of the us-
+             er.
+
+     ~/.ssh/config
              This is the per-user configuration file.  The file format and
              configuration options are described in ssh_config(5).  Because of
              the potential for abuse, this file must have strict permissions:
              read/write for the user, and not accessible by others.
 
-     $HOME/.ssh/authorized_keys
+     ~/.ssh/authorized_keys
              Lists the public keys (RSA/DSA) that can be used for logging in
              as this user.  The format of this file is described in the
              sshd(8) manual page.  In the simplest form the format is the same
@@ -648,7 +650,7 @@ FILES
              requirement that ssh be setuid root when that authentication
              method is used.  By default ssh is not setuid root.
 
-     $HOME/.rhosts
+     ~/.rhosts
              This file is used in RhostsRSAAuthentication and
              HostbasedAuthentication authentication to list the host/user
              pairs that are permitted to log in.  (Note that this file is also
@@ -665,12 +667,12 @@ FILES
              Note that sshd(8) allows authentication only in combination with
              client host key authentication before permitting log in.  If the
              server machine does not have the client's host key in
-             /etc/ssh/ssh_known_hosts, it can be stored in
-             $HOME/.ssh/known_hosts.  The easiest way to do this is to connect
-             back to the client from the server machine using ssh; this will
-             automatically add the host key to $HOME/.ssh/known_hosts.
+             /etc/ssh/ssh_known_hosts, it can be stored in ~/.ssh/known_hosts.
+             The easiest way to do this is to connect back to the client from
+             the server machine using ssh; this will automatically add the
+             host key to ~/.ssh/known_hosts.
 
-     $HOME/.shosts
+     ~/.shosts
              This file is used exactly the same way as .rhosts.  The purpose
              for having this file is to be able to use RhostsRSAAuthentication
              and HostbasedAuthentication authentication without permitting lo-
@@ -696,12 +698,12 @@ FILES
              just before the user's shell (or command) is started.  See the
              sshd(8) manual page for more information.
 
-     $HOME/.ssh/rc
+     ~/.ssh/rc
              Commands in this file are executed by ssh when the user logs in
              just before the user's shell (or command) is started.  See the
              sshd(8) manual page for more information.
 
-     $HOME/.ssh/environment
+     ~/.ssh/environment
              Contains additional definitions for environment variables, see
              section ENVIRONMENT above.
 
@@ -725,4 +727,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 3.7                   September 25, 1999                            11
+OpenBSD 3.8                   September 25, 1999                            12