diff options
Diffstat (limited to 'ssh.1')
-rw-r--r-- | ssh.1 | 57 |
1 files changed, 37 insertions, 20 deletions
@@ -34,7 +34,7 @@ | |||
34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
36 | .\" | 36 | .\" |
37 | .\" $OpenBSD: ssh.1,v 1.160 2002/06/22 11:51:39 naddy Exp $ | 37 | .\" $OpenBSD: ssh.1,v 1.167 2002/09/27 15:46:21 stevesk Exp $ |
38 | .Dd September 25, 1999 | 38 | .Dd September 25, 1999 |
39 | .Dt SSH 1 | 39 | .Dt SSH 1 |
40 | .Os | 40 | .Os |
@@ -48,7 +48,7 @@ | |||
48 | .Op Ar command | 48 | .Op Ar command |
49 | .Pp | 49 | .Pp |
50 | .Nm ssh | 50 | .Nm ssh |
51 | .Op Fl afgknqstvxACNPTX1246 | 51 | .Op Fl afgknqstvxACNTX1246 |
52 | .Op Fl b Ar bind_address | 52 | .Op Fl b Ar bind_address |
53 | .Op Fl c Ar cipher_spec | 53 | .Op Fl c Ar cipher_spec |
54 | .Op Fl e Ar escape_char | 54 | .Op Fl e Ar escape_char |
@@ -353,9 +353,17 @@ the connection is opened. | |||
353 | The real authentication cookie is never | 353 | The real authentication cookie is never |
354 | sent to the server machine (and no cookies are sent in the plain). | 354 | sent to the server machine (and no cookies are sent in the plain). |
355 | .Pp | 355 | .Pp |
356 | If the user is using an authentication agent, the connection to the agent | 356 | If the |
357 | is automatically forwarded to the remote side unless disabled on | 357 | .Cm ForwardAgent |
358 | the command line or in a configuration file. | 358 | variable is set to |
359 | .Dq yes | ||
360 | (or, see the description of the | ||
361 | .Fl A | ||
362 | and | ||
363 | .Fl a | ||
364 | options described later) and | ||
365 | the user is using an authentication agent, the connection to the agent | ||
366 | is automatically forwarded to the remote side. | ||
359 | .Pp | 367 | .Pp |
360 | Forwarding of arbitrary TCP/IP connections over the secure channel can | 368 | Forwarding of arbitrary TCP/IP connections over the secure channel can |
361 | be specified either on the command line or in a configuration file. | 369 | be specified either on the command line or in a configuration file. |
@@ -394,6 +402,13 @@ Disables forwarding of the authentication agent connection. | |||
394 | .It Fl A | 402 | .It Fl A |
395 | Enables forwarding of the authentication agent connection. | 403 | Enables forwarding of the authentication agent connection. |
396 | This can also be specified on a per-host basis in a configuration file. | 404 | This can also be specified on a per-host basis in a configuration file. |
405 | .Pp | ||
406 | Agent forwarding should be enabled with caution. Users with the | ||
407 | ability to bypass file permissions on the remote host (for the agent's | ||
408 | Unix-domain socket) can access the local agent through the forwarded | ||
409 | connection. An attacker cannot obtain key material from the agent, | ||
410 | however they can perform operations on the keys that enable them to | ||
411 | authenticate using the identities loaded into the agent. | ||
397 | .It Fl b Ar bind_address | 412 | .It Fl b Ar bind_address |
398 | Specify the interface to transmit from on machines with multiple | 413 | Specify the interface to transmit from on machines with multiple |
399 | interfaces or aliased addresses. | 414 | interfaces or aliased addresses. |
@@ -515,15 +530,6 @@ command-line flag. | |||
515 | Port to connect to on the remote host. | 530 | Port to connect to on the remote host. |
516 | This can be specified on a | 531 | This can be specified on a |
517 | per-host basis in the configuration file. | 532 | per-host basis in the configuration file. |
518 | .It Fl P | ||
519 | Use a non-privileged port for outgoing connections. | ||
520 | This can be used if a firewall does | ||
521 | not permit connections from privileged ports. | ||
522 | Note that this option turns off | ||
523 | .Cm RhostsAuthentication | ||
524 | and | ||
525 | .Cm RhostsRSAAuthentication | ||
526 | for older servers. | ||
527 | .It Fl q | 533 | .It Fl q |
528 | Quiet mode. | 534 | Quiet mode. |
529 | Causes all warning and diagnostic messages to be suppressed. | 535 | Causes all warning and diagnostic messages to be suppressed. |
@@ -559,6 +565,12 @@ Disables X11 forwarding. | |||
559 | .It Fl X | 565 | .It Fl X |
560 | Enables X11 forwarding. | 566 | Enables X11 forwarding. |
561 | This can also be specified on a per-host basis in a configuration file. | 567 | This can also be specified on a per-host basis in a configuration file. |
568 | .Pp | ||
569 | X11 forwarding should be enabled with caution. Users with the ability | ||
570 | to bypass file permissions on the remote host (for the user's X | ||
571 | authorization database) can access the local X11 display through the | ||
572 | forwarded connection. An attacker may then be able to perform | ||
573 | activities such as keystroke monitoring. | ||
562 | .It Fl C | 574 | .It Fl C |
563 | Requests compression of all data (including stdin, stdout, stderr, and | 575 | Requests compression of all data (including stdin, stdout, stderr, and |
564 | data for forwarded X11 and TCP/IP connections). | 576 | data for forwarded X11 and TCP/IP connections). |
@@ -568,7 +580,7 @@ and the | |||
568 | .Dq level | 580 | .Dq level |
569 | can be controlled by the | 581 | can be controlled by the |
570 | .Cm CompressionLevel | 582 | .Cm CompressionLevel |
571 | option. | 583 | option for protocol version 1. |
572 | Compression is desirable on modem lines and other | 584 | Compression is desirable on modem lines and other |
573 | slow connections, but will only slow down things on fast networks. | 585 | slow connections, but will only slow down things on fast networks. |
574 | The default value can be set on a host-by-host basis in the | 586 | The default value can be set on a host-by-host basis in the |
@@ -714,11 +726,11 @@ to make this work.) | |||
714 | .It Ev SSH_AUTH_SOCK | 726 | .It Ev SSH_AUTH_SOCK |
715 | Identifies the path of a unix-domain socket used to communicate with the | 727 | Identifies the path of a unix-domain socket used to communicate with the |
716 | agent. | 728 | agent. |
717 | .It Ev SSH_CLIENT | 729 | .It Ev SSH_CONNECTION |
718 | Identifies the client end of the connection. | 730 | Identifies the client and server ends of the connection. |
719 | The variable contains | 731 | The variable contains |
720 | three space-separated values: client ip-address, client port number, | 732 | four space-separated values: client ip-address, client port number, |
721 | and server port number. | 733 | server ip-address and server port number. |
722 | .It Ev SSH_ORIGINAL_COMMAND | 734 | .It Ev SSH_ORIGINAL_COMMAND |
723 | The variable contains the original command line if a forced command | 735 | The variable contains the original command line if a forced command |
724 | is executed. | 736 | is executed. |
@@ -742,7 +754,12 @@ reads | |||
742 | .Pa $HOME/.ssh/environment , | 754 | .Pa $HOME/.ssh/environment , |
743 | and adds lines of the format | 755 | and adds lines of the format |
744 | .Dq VARNAME=value | 756 | .Dq VARNAME=value |
745 | to the environment. | 757 | to the environment if the file exists and if users are allowed to |
758 | change their environment. | ||
759 | See the | ||
760 | .Cm PermitUserEnvironment | ||
761 | option in | ||
762 | .Xr sshd_config 5 . | ||
746 | .Sh FILES | 763 | .Sh FILES |
747 | .Bl -tag -width Ds | 764 | .Bl -tag -width Ds |
748 | .It Pa $HOME/.ssh/known_hosts | 765 | .It Pa $HOME/.ssh/known_hosts |