summaryrefslogtreecommitdiff
path: root/sshd.0
diff options
context:
space:
mode:
Diffstat (limited to 'sshd.0')
-rw-r--r--sshd.0414
1 files changed, 207 insertions, 207 deletions
diff --git a/sshd.0 b/sshd.0
index 7c88c953f..658af69a6 100644
--- a/sshd.0
+++ b/sshd.0
@@ -1,33 +1,33 @@
1SSHD(8) System Manager's Manual SSHD(8) 1SSHD(8) BSD System ManagerM-bM-^@M-^Ys Manual SSHD(8)
2 2
3NAME 3^[[1mNAME^[[0m
4 sshd - OpenSSH SSH daemon 4 ^[[1msshd ^[[22mM-bMM-^R OpenSSH SSH daemon
5 5
6SYNOPSIS 6^[[1mSYNOPSIS^[[0m
7 sshd [-deiqtD46] [-b bits] [-f config_file] [-g login_grace_time] 7 ^[[1msshd ^[[22m[^[[1mM-bMM-^RdeiqtD46^[[22m] [^[[1mM-bMM-^Rb ^[[4m^[[22mbits^[[24m] [^[[1mM-bMM-^Rf ^[[4m^[[22mconfig_file^[[24m] [^[[1mM-bMM-^Rg ^[[4m^[[22mlogin_grace_time^[[24m]
8 [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len] 8 [^[[1mM-bMM-^Rh ^[[4m^[[22mhost_key_file^[[24m] [^[[1mM-bMM-^Rk ^[[4m^[[22mkey_gen_time^[[24m] [^[[1mM-bMM-^Ro ^[[4m^[[22moption^[[24m] [^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[24m] [^[[1mM-bMM-^Ru ^[[4m^[[22mlen^[[24m]
9 9
10DESCRIPTION 10^[[1mDESCRIPTION^[[0m
11 sshd (SSH Daemon) is the daemon program for ssh(1). Together these proM-- 11 ^[[1msshd ^[[22m(SSH Daemon) is the daemon program for ssh(1). Together these proM-bM-^@M-^P
12 grams replace rlogin and rsh, and provide secure encrypted communications 12 grams replace rlogin and rsh, and provide secure encrypted communications
13 between two untrusted hosts over an insecure network. The programs are 13 between two untrusted hosts over an insecure network. The programs are
14 intended to be as easy to install and use as possible. 14 intended to be as easy to install and use as possible.
15 15
16 sshd is the daemon that listens for connections from clients. It is norM-- 16 ^[[1msshd ^[[22mis the daemon that listens for connections from clients. It is norM-bM-^@M-^P
17 mally started at boot from /etc/rc. It forks a new daemon for each 17 mally started at boot from ^[[4m/etc/rc^[[24m. It forks a new daemon for each
18 incoming connection. The forked daemons handle key exchange, encryption, 18 incoming connection. The forked daemons handle key exchange, encryption,
19 authentication, command execution, and data exchange. This implementaM-- 19 authentication, command execution, and data exchange. This implementaM-bM-^@M-^P
20 tion of sshd supports both SSH protocol version 1 and 2 simultaneously. 20 tion of ^[[1msshd ^[[22msupports both SSH protocol version 1 and 2 simultaneously.
21 sshd works as follows. 21 ^[[1msshd ^[[22mworks as follows:
22 22
23 SSH protocol version 1 23 ^[[1mSSH protocol version 1^[[0m
24 24
25 Each host has a host-specific RSA key (normally 1024 bits) used to idenM-- 25 Each host has a hostM-bM-^@M-^Pspecific RSA key (normally 1024 bits) used to idenM-bM-^@M-^P
26 tify the host. Additionally, when the daemon starts, it generates a 26 tify the host. Additionally, when the daemon starts, it generates a
27 server RSA key (normally 768 bits). This key is normally regenerated 27 server RSA key (normally 768 bits). This key is normally regenerated
28 every hour if it has been used, and is never stored on disk. 28 every hour if it has been used, and is never stored on disk.
29 29
30 Whenever a client connects the daemon responds with its public host and 30 Whenever a client connects, the daemon responds with its public host and
31 server keys. The client compares the RSA host key against its own 31 server keys. The client compares the RSA host key against its own
32 database to verify that it has not changed. The client then generates a 32 database to verify that it has not changed. The client then generates a
33 256 bit random number. It encrypts this random number using both the 33 256 bit random number. It encrypts this random number using both the
@@ -35,24 +35,24 @@ DESCRIPTION
35 server. Both sides then use this random number as a session key which is 35 server. Both sides then use this random number as a session key which is
36 used to encrypt all further communications in the session. The rest of 36 used to encrypt all further communications in the session. The rest of
37 the session is encrypted using a conventional cipher, currently Blowfish 37 the session is encrypted using a conventional cipher, currently Blowfish
38 or 3DES, with 3DES being used by default. The client selects the encrypM-- 38 or 3DES, with 3DES being used by default. The client selects the encrypM-bM-^@M-^P
39 tion algorithm to use from those offered by the server. 39 tion algorithm to use from those offered by the server.
40 40
41 Next, the server and the client enter an authentication dialog. The 41 Next, the server and the client enter an authentication dialog. The
42 client tries to authenticate itself using .rhosts authentication, .rhosts 42 client tries to authenticate itself using ^[[4m.rhosts^[[24m authentication, ^[[4m.rhosts^[[0m
43 authentication combined with RSA host authentication, RSA challenge- 43 authentication combined with RSA host authentication, RSA challengeM-bM-^@M-^P
44 response authentication, or password based authentication. 44 response authentication, or password based authentication.
45 45
46 Rhosts authentication is normally disabled because it is fundamentally 46 Rhosts authentication is normally disabled because it is fundamentally
47 insecure, but can be enabled in the server configuration file if desired. 47 insecure, but can be enabled in the server configuration file if desired.
48 System security is not improved unless rshd, rlogind, and rexecd are disM-- 48 System security is not improved unless ^[[1mrshd^[[22m, ^[[1mrlogind^[[22m, and ^[[1mrexecd ^[[22mare disM-bM-^@M-^P
49 abled (thus completely disabling rlogin and rsh into the machine). 49 abled (thus completely disabling rlogin and rsh into the machine).
50 50
51 SSH protocol version 2 51 ^[[1mSSH protocol version 2^[[0m
52 52
53 Version 2 works similarly: Each host has a host-specific key (RSA or DSA) 53 Version 2 works similarly: Each host has a hostM-bM-^@M-^Pspecific key (RSA or DSA)
54 used to identify the host. However, when the daemon starts, it does not 54 used to identify the host. However, when the daemon starts, it does not
55 generate a server key. Forward security is provided through a Diffie- 55 generate a server key. Forward security is provided through a DiffieM-bM-^@M-^P
56 Hellman key agreement. This key agreement results in a shared session 56 Hellman key agreement. This key agreement results in a shared session
57 key. 57 key.
58 58
@@ -60,19 +60,19 @@ DESCRIPTION
60 128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit 60 128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit
61 AES. The client selects the encryption algorithm to use from those 61 AES. The client selects the encryption algorithm to use from those
62 offered by the server. Additionally, session integrity is provided 62 offered by the server. Additionally, session integrity is provided
63 through a cryptographic message authentication code (hmac-sha1 or hmac- 63 through a cryptographic message authentication code (hmacM-bM-^@M-^Psha1 or hmacM-bM-^@M-^P
64 md5). 64 md5).
65 65
66 Protocol version 2 provides a public key based user (PubkeyAuthenticaM-- 66 Protocol version 2 provides a public key based user (PubkeyAuthenticaM-bM-^@M-^P
67 tion) or client host (HostbasedAuthentication) authentication method, 67 tion) or client host (HostbasedAuthentication) authentication method,
68 conventional password authentication and challenge response based methM-- 68 conventional password authentication and challenge response based methM-bM-^@M-^P
69 ods. 69 ods.
70 70
71 Command execution and data forwarding 71 ^[[1mCommand execution and data forwarding^[[0m
72 72
73 If the client successfully authenticates itself, a dialog for preparing 73 If the client successfully authenticates itself, a dialog for preparing
74 the session is entered. At this time the client may request things like 74 the session is entered. At this time the client may request things like
75 allocating a pseudo-tty, forwarding X11 connections, forwarding TCP/IP 75 allocating a pseudoM-bM-^@M-^Ptty, forwarding X11 connections, forwarding TCP/IP
76 connections, or forwarding the authentication agent connection over the 76 connections, or forwarding the authentication agent connection over the
77 secure channel. 77 secure channel.
78 78
@@ -81,390 +81,390 @@ DESCRIPTION
81 data at any time, and such data is forwarded to/from the shell or command 81 data at any time, and such data is forwarded to/from the shell or command
82 on the server side, and the user terminal in the client side. 82 on the server side, and the user terminal in the client side.
83 83
84 When the user program terminates and all forwarded X11 and other connecM-- 84 When the user program terminates and all forwarded X11 and other connecM-bM-^@M-^P
85 tions have been closed, the server sends command exit status to the 85 tions have been closed, the server sends command exit status to the
86 client, and both sides exit. 86 client, and both sides exit.
87 87
88 sshd can be configured using command-line options or a configuration 88 ^[[1msshd ^[[22mcan be configured using commandM-bM-^@M-^Pline options or a configuration
89 file. Command-line options override values specified in the configuraM-- 89 file. CommandM-bM-^@M-^Pline options override values specified in the configuraM-bM-^@M-^P
90 tion file. 90 tion file.
91 91
92 sshd rereads its configuration file when it receives a hangup signal, 92 ^[[1msshd ^[[22mrereads its configuration file when it receives a hangup signal,
93 SIGHUP, by executing itself with the name it was started as, i.e., 93 SIGHUP, by executing itself with the name it was started as, i.e.,
94 /usr/sbin/sshd. 94 ^[[4m/usr/sbin/sshd^[[24m.
95 95
96 The options are as follows: 96 The options are as follows:
97 97
98 -b bits 98 ^[[1mM-bMM-^Rb ^[[4m^[[22mbits^[[0m
99 Specifies the number of bits in the ephemeral protocol version 1 99 Specifies the number of bits in the ephemeral protocol version 1
100 server key (default 768). 100 server key (default 768).
101 101
102 -d Debug mode. The server sends verbose debug output to the system 102 ^[[1mM-bMM-^Rd ^[[22mDebug mode. The server sends verbose debug output to the system
103 log, and does not put itself in the background. The server also 103 log, and does not put itself in the background. The server also
104 will not fork and will only process one connection. This option 104 will not fork and will only process one connection. This option
105 is only intended for debugging for the server. Multiple -d 105 is only intended for debugging for the server. Multiple ^[[1mM-bMM-^Rd^[[0m
106 options increase the debugging level. Maximum is 3. 106 options increase the debugging level. Maximum is 3.
107 107
108 -e When this option is specified, sshd will send the output to the 108 ^[[1mM-bMM-^Re ^[[22mWhen this option is specified, ^[[1msshd ^[[22mwill send the output to the
109 standard error instead of the system log. 109 standard error instead of the system log.
110 110
111 -f configuration_file 111 ^[[1mM-bMM-^Rf ^[[4m^[[22mconfiguration_file^[[0m
112 Specifies the name of the configuration file. The default is 112 Specifies the name of the configuration file. The default is
113 /etc/ssh/sshd_config. sshd refuses to start if there is no conM-- 113 ^[[4m/etc/ssh/sshd_config^[[24m. ^[[1msshd ^[[22mrefuses to start if there is no conM-bM-^@M-^P
114 figuration file. 114 figuration file.
115 115
116 -g login_grace_time 116 ^[[1mM-bMM-^Rg ^[[4m^[[22mlogin_grace_time^[[0m
117 Gives the grace time for clients to authenticate themselves 117 Gives the grace time for clients to authenticate themselves
118 (default 120 seconds). If the client fails to authenticate the 118 (default 120 seconds). If the client fails to authenticate the
119 user within this many seconds, the server disconnects and exits. 119 user within this many seconds, the server disconnects and exits.
120 A value of zero indicates no limit. 120 A value of zero indicates no limit.
121 121
122 -h host_key_file 122 ^[[1mM-bMM-^Rh ^[[4m^[[22mhost_key_file^[[0m
123 Specifies a file from which a host key is read. This option must 123 Specifies a file from which a host key is read. This option must
124 be given if sshd is not run as root (as the normal host key files 124 be given if ^[[1msshd ^[[22mis not run as root (as the normal host key files
125 are normally not readable by anyone but root). The default is 125 are normally not readable by anyone but root). The default is
126 /etc/ssh/ssh_host_key for protocol version 1, and 126 ^[[4m/etc/ssh/ssh_host_key^[[24m for protocol version 1, and
127 /etc/ssh/ssh_host_rsa_key and /etc/ssh/ssh_host_dsa_key for proM-- 127 ^[[4m/etc/ssh/ssh_host_rsa_key^[[24m and ^[[4m/etc/ssh/ssh_host_dsa_key^[[24m for proM-bM-^@M-^P
128 tocol version 2. It is possible to have multiple host key files 128 tocol version 2. It is possible to have multiple host key files
129 for the different protocol versions and host key algorithms. 129 for the different protocol versions and host key algorithms.
130 130
131 -i Specifies that sshd is being run from inetd. sshd is normally 131 ^[[1mM-bMM-^Ri ^[[22mSpecifies that ^[[1msshd ^[[22mis being run from inetd(8). ^[[1msshd ^[[22mis normally
132 not run from inetd because it needs to generate the server key 132 not run from inetd because it needs to generate the server key
133 before it can respond to the client, and this may take tens of 133 before it can respond to the client, and this may take tens of
134 seconds. Clients would have to wait too long if the key was 134 seconds. Clients would have to wait too long if the key was
135 regenerated every time. However, with small key sizes (e.g., 135 regenerated every time. However, with small key sizes (e.g.,
136 512) using sshd from inetd may be feasible. 136 512) using ^[[1msshd ^[[22mfrom inetd may be feasible.
137 137
138 -k key_gen_time 138 ^[[1mM-bMM-^Rk ^[[4m^[[22mkey_gen_time^[[0m
139 Specifies how often the ephemeral protocol version 1 server key 139 Specifies how often the ephemeral protocol version 1 server key
140 is regenerated (default 3600 seconds, or one hour). The motivaM-- 140 is regenerated (default 3600 seconds, or one hour). The motivaM-bM-^@M-^P
141 tion for regenerating the key fairly often is that the key is not 141 tion for regenerating the key fairly often is that the key is not
142 stored anywhere, and after about an hour, it becomes impossible 142 stored anywhere, and after about an hour, it becomes impossible
143 to recover the key for decrypting intercepted communications even 143 to recover the key for decrypting intercepted communications even
144 if the machine is cracked into or physically seized. A value of 144 if the machine is cracked into or physically seized. A value of
145 zero indicates that the key will never be regenerated. 145 zero indicates that the key will never be regenerated.
146 146
147 -o option 147 ^[[1mM-bMM-^Ro ^[[4m^[[22moption^[[0m
148 Can be used to give options in the format used in the configuraM-- 148 Can be used to give options in the format used in the configuraM-bM-^@M-^P
149 tion file. This is useful for specifying options for which there 149 tion file. This is useful for specifying options for which there
150 is no separate command-line flag. 150 is no separate commandM-bM-^@M-^Pline flag.
151 151
152 -p port 152 ^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[0m
153 Specifies the port on which the server listens for connections 153 Specifies the port on which the server listens for connections
154 (default 22). Multiple port options are permitted. Ports speciM-- 154 (default 22). Multiple port options are permitted. Ports speciM-bM-^@M-^P
155 fied in the configuration file are ignored when a command-line 155 fied in the configuration file are ignored when a commandM-bM-^@M-^Pline
156 port is specified. 156 port is specified.
157 157
158 -q Quiet mode. Nothing is sent to the system log. Normally the 158 ^[[1mM-bMM-^Rq ^[[22mQuiet mode. Nothing is sent to the system log. Normally the
159 beginning, authentication, and termination of each connection is 159 beginning, authentication, and termination of each connection is
160 logged. 160 logged.
161 161
162 -t Test mode. Only check the validity of the configuration file and 162 ^[[1mM-bMM-^Rt ^[[22mTest mode. Only check the validity of the configuration file and
163 sanity of the keys. This is useful for updating sshd reliably as 163 sanity of the keys. This is useful for updating ^[[1msshd ^[[22mreliably as
164 configuration options may change. 164 configuration options may change.
165 165
166 -u len This option is used to specify the size of the field in the utmp 166 ^[[1mM-bMM-^Ru ^[[4m^[[22mlen^[[24m This option is used to specify the size of the field in the utmp
167 structure that holds the remote host name. If the resolved host 167 structure that holds the remote host name. If the resolved host
168 name is longer than len, the dotted decimal value will be used 168 name is longer than ^[[4mlen^[[24m, the dotted decimal value will be used
169 instead. This allows hosts with very long host names that overM-- 169 instead. This allows hosts with very long host names that overM-bM-^@M-^P
170 flow this field to still be uniquely identified. Specifying -u0 170 flow this field to still be uniquely identified. Specifying ^[[1mM-bMM-^Ru0^[[0m
171 indicates that only dotted decimal addresses should be put into 171 indicates that only dotted decimal addresses should be put into
172 the utmp file. -u0 is also be used to prevent sshd from making 172 the ^[[4mutmp^[[24m file. ^[[1mM-bMM-^Ru0 ^[[22mmay also be used to prevent ^[[1msshd ^[[22mfrom making
173 DNS requests unless the authentication mechanism or configuration 173 DNS requests unless the authentication mechanism or configuration
174 requires it. Authentication mechanisms that may require DNS 174 requires it. Authentication mechanisms that may require DNS
175 include RhostsAuthentication, RhostsRSAAuthentication, 175 include ^[[1mRhostsAuthentication^[[22m, ^[[1mRhostsRSAAuthentication^[[22m,
176 HostbasedAuthentication and using a from="pattern-list" option in 176 ^[[1mHostbasedAuthentication ^[[22mand using a ^[[1mfrom="patternM-bM-^@M-^Plist" ^[[22moption in
177 a key file. Configuration options that require DNS include using 177 a key file. Configuration options that require DNS include using
178 a USER@HOST pattern in AllowUsers or DenyUsers. 178 a USER@HOST pattern in ^[[1mAllowUsers ^[[22mor ^[[1mDenyUsers^[[22m.
179 179
180 -D When this option is specified sshd will not detach and does not 180 ^[[1mM-bMM-^RD ^[[22mWhen this option is specified ^[[1msshd ^[[22mwill not detach and does not
181 become a daemon. This allows easy monitoring of sshd. 181 become a daemon. This allows easy monitoring of ^[[1msshd^[[22m.
182 182
183 -4 Forces sshd to use IPv4 addresses only. 183 ^[[1mM-bMM-^R4 ^[[22mForces ^[[1msshd ^[[22mto use IPv4 addresses only.
184 184
185 -6 Forces sshd to use IPv6 addresses only. 185 ^[[1mM-bMM-^R6 ^[[22mForces ^[[1msshd ^[[22mto use IPv6 addresses only.
186 186
187CONFIGURATION FILE 187^[[1mCONFIGURATION FILE^[[0m
188 sshd reads configuration data from /etc/ssh/sshd_config (or the file 188 ^[[1msshd ^[[22mreads configuration data from ^[[4m/etc/ssh/sshd_config^[[24m (or the file
189 specified with -f on the command line). The file format and configuraM-- 189 specified with ^[[1mM-bMM-^Rf ^[[22mon the command line). The file format and configuraM-bM-^@M-^P
190 tion options are described in sshd_config(5). 190 tion options are described in sshd_config(5).
191 191
192LOGIN PROCESS 192^[[1mLOGIN PROCESS^[[0m
193 When a user successfully logs in, sshd does the following: 193 When a user successfully logs in, ^[[1msshd ^[[22mdoes the following:
194 194
195 1. If the login is on a tty, and no command has been specified, 195 1. If the login is on a tty, and no command has been specified,
196 prints last login time and /etc/motd (unless prevented in the 196 prints last login time and ^[[4m/etc/motd^[[24m (unless prevented in the
197 configuration file or by $HOME/.hushlogin; see the FILES secM-- 197 configuration file or by ^[[4m$HOME/.hushlogin^[[24m; see the ^[[4mFILES^[[24m secM-bM-^@M-^P
198 tion). 198 tion).
199 199
200 2. If the login is on a tty, records login time. 200 2. If the login is on a tty, records login time.
201 201
202 3. Checks /etc/nologin; if it exists, prints contents and quits 202 3. Checks ^[[4m/etc/nologin^[[24m; if it exists, prints contents and quits
203 (unless root). 203 (unless root).
204 204
205 4. Changes to run with normal user privileges. 205 4. Changes to run with normal user privileges.
206 206
207 5. Sets up basic environment. 207 5. Sets up basic environment.
208 208
209 6. Reads $HOME/.ssh/environment if it exists and users are 209 6. Reads ^[[4m$HOME/.ssh/environment^[[24m if it exists and users are
210 allowed to change their environment. See the 210 allowed to change their environment. See the
211 PermitUserEnvironment option in sshd_config(5). 211 ^[[1mPermitUserEnvironment ^[[22moption in sshd_config(5).
212 212
213 7. Changes to user's home directory. 213 7. Changes to userM-bM-^@M-^Ys home directory.
214 214
215 8. If $HOME/.ssh/rc exists, runs it; else if /etc/ssh/sshrc 215 8. If ^[[4m$HOME/.ssh/rc^[[24m exists, runs it; else if ^[[4m/etc/ssh/sshrc^[[0m
216 exists, runs it; otherwise runs xauth. The ``rc'' files are 216 exists, runs it; otherwise runs xauth. The M-bM-^@M-^\rcM-bM-^@M-^] files are
217 given the X11 authentication protocol and cookie in standard 217 given the X11 authentication protocol and cookie in standard
218 input. 218 input.
219 219
220 9. Runs user's shell or command. 220 9. Runs userM-bM-^@M-^Ys shell or command.
221 221
222AUTHORIZED_KEYS FILE FORMAT 222^[[1mAUTHORIZED_KEYS FILE FORMAT^[[0m
223 $HOME/.ssh/authorized_keys is the default file that lists the public keys 223 ^[[4m$HOME/.ssh/authorized_keys^[[24m is the default file that lists the public keys
224 that are permitted for RSA authentication in protocol version 1 and for 224 that are permitted for RSA authentication in protocol version 1 and for
225 public key authentication (PubkeyAuthentication) in protocol version 2. 225 public key authentication (PubkeyAuthentication) in protocol version 2.
226 AuthorizedKeysFile may be used to specify an alternative file. 226 ^[[1mAuthorizedKeysFile ^[[22mmay be used to specify an alternative file.
227 227
228 Each line of the file contains one key (empty lines and lines starting 228 Each line of the file contains one key (empty lines and lines starting
229 with a `#' are ignored as comments). Each RSA public key consists of the 229 with a M-bM-^@M-^X#M-bM-^@M-^Y are ignored as comments). Each RSA public key consists of the
230 following fields, separated by spaces: options, bits, exponent, modulus, 230 following fields, separated by spaces: options, bits, exponent, modulus,
231 comment. Each protocol version 2 public key consists of: options, keyM-- 231 comment. Each protocol version 2 public key consists of: options, keyM-bM-^@M-^P
232 type, base64 encoded key, comment. The options field is optional; its 232 type, base64 encoded key, comment. The options field is optional; its
233 presence is determined by whether the line starts with a number or not 233 presence is determined by whether the line starts with a number or not
234 (the options field never starts with a number). The bits, exponent, modM-- 234 (the options field never starts with a number). The bits, exponent, modM-bM-^@M-^P
235 ulus and comment fields give the RSA key for protocol version 1; the comM-- 235 ulus and comment fields give the RSA key for protocol version 1; the comM-bM-^@M-^P
236 ment field is not used for anything (but may be convenient for the user 236 ment field is not used for anything (but may be convenient for the user
237 to identify the key). For protocol version 2 the keytype is ``ssh-dss'' 237 to identify the key). For protocol version 2 the keytype is M-bM-^@M-^\sshM-bM-^@M-^PdssM-bM-^@M-^] or
238 or ``ssh-rsa''. 238 M-bM-^@M-^\sshM-bM-^@M-^PrsaM-bM-^@M-^].
239 239
240 Note that lines in this file are usually several hundred bytes long 240 Note that lines in this file are usually several hundred bytes long
241 (because of the size of the public key encoding). You don't want to type 241 (because of the size of the public key encoding). You donM-bM-^@M-^Yt want to type
242 them in; instead, copy the identity.pub, id_dsa.pub or the id_rsa.pub 242 them in; instead, copy the ^[[4midentity.pub^[[24m, ^[[4mid_dsa.pub^[[24m or the ^[[4mid_rsa.pub^[[0m
243 file and edit it. 243 file and edit it.
244 244
245 sshd enforces a minimum RSA key modulus size for protocol 1 and protocol 245 ^[[1msshd ^[[22menforces a minimum RSA key modulus size for protocol 1 and protocol
246 2 keys of 768 bits. 246 2 keys of 768 bits.
247 247
248 The options (if present) consist of comma-separated option specificaM-- 248 The options (if present) consist of commaM-bM-^@M-^Pseparated option specificaM-bM-^@M-^P
249 tions. No spaces are permitted, except within double quotes. The folM-- 249 tions. No spaces are permitted, except within double quotes. The folM-bM-^@M-^P
250 lowing option specifications are supported (note that option keywords are 250 lowing option specifications are supported (note that option keywords are
251 case-insensitive): 251 caseM-bM-^@M-^Pinsensitive):
252 252
253 from="pattern-list" 253 ^[[1mfrom="patternM-bM-^@M-^Plist"^[[0m
254 Specifies that in addition to public key authentication, the 254 Specifies that in addition to public key authentication, the
255 canonical name of the remote host must be present in the comma- 255 canonical name of the remote host must be present in the commaM-bM-^@M-^P
256 separated list of patterns (`*' and `'? serve as wildcards). 256 separated list of patterns (M-bM-^@M-^X*M-bM-^@M-^Y and M-bM-^@M-^XM-bM-^@M-^Y? serve as wildcards).
257 The list may also contain patterns negated by prefixing them with 257 The list may also contain patterns negated by prefixing them with
258 `'!; if the canonical host name matches a negated pattern, the 258 M-bM-^@M-^XM-bM-^@M-^Y!; if the canonical host name matches a negated pattern, the
259 key is not accepted. The purpose of this option is to optionally 259 key is not accepted. The purpose of this option is to optionally
260 increase security: public key authentication by itself does not 260 increase security: public key authentication by itself does not
261 trust the network or name servers or anything (but the key); howM-- 261 trust the network or name servers or anything (but the key); howM-bM-^@M-^P
262 ever, if somebody somehow steals the key, the key permits an 262 ever, if somebody somehow steals the key, the key permits an
263 intruder to log in from anywhere in the world. This additional 263 intruder to log in from anywhere in the world. This additional
264 option makes using a stolen key more difficult (name servers 264 option makes using a stolen key more difficult (name servers
265 and/or routers would have to be compromised in addition to just 265 and/or routers would have to be compromised in addition to just
266 the key). 266 the key).
267 267
268 command="command" 268 ^[[1mcommand="command"^[[0m
269 Specifies that the command is executed whenever this key is used 269 Specifies that the command is executed whenever this key is used
270 for authentication. The command supplied by the user (if any) is 270 for authentication. The command supplied by the user (if any) is
271 ignored. The command is run on a pty if the client requests a 271 ignored. The command is run on a pty if the client requests a
272 pty; otherwise it is run without a tty. If a 8-bit clean channel 272 pty; otherwise it is run without a tty. If an 8M-bM-^@M-^Pbit clean chanM-bM-^@M-^P
273 is required, one must not request a pty or should specify no-pty. 273 nel is required, one must not request a pty or should specify
274 A quote may be included in the command by quoting it with a backM-- 274 ^[[1mnoM-bM-^@M-^Ppty^[[22m. A quote may be included in the command by quoting it
275 slash. This option might be useful to restrict certain public 275 with a backslash. This option might be useful to restrict cerM-bM-^@M-^P
276 keys to perform just a specific operation. An example might be a 276 tain public keys to perform just a specific operation. An examM-bM-^@M-^P
277 key that permits remote backups but nothing else. Note that the 277 ple might be a key that permits remote backups but nothing else.
278 client may specify TCP/IP and/or X11 forwarding unless they are 278 Note that the client may specify TCP/IP and/or X11 forwarding
279 explicitly prohibited. Note that this option applies to shell, 279 unless they are explicitly prohibited. Note that this option
280 command or subsystem execution. 280 applies to shell, command or subsystem execution.
281 281
282 environment="NAME=value" 282 ^[[1menvironment="NAME=value"^[[0m
283 Specifies that the string is to be added to the environment when 283 Specifies that the string is to be added to the environment when
284 logging in using this key. Environment variables set this way 284 logging in using this key. Environment variables set this way
285 override other default environment values. Multiple options of 285 override other default environment values. Multiple options of
286 this type are permitted. Environment processing is disabled by 286 this type are permitted. Environment processing is disabled by
287 default and is controlled via the PermitUserEnvironment option. 287 default and is controlled via the ^[[1mPermitUserEnvironment ^[[22moption.
288 This option is automatically disabled if UseLogin is enabled. 288 This option is automatically disabled if ^[[1mUseLogin ^[[22mis enabled.
289 289
290 no-port-forwarding 290 ^[[1mnoM-bM-^@M-^PportM-bM-^@M-^Pforwarding^[[0m
291 Forbids TCP/IP forwarding when this key is used for authenticaM-- 291 Forbids TCP/IP forwarding when this key is used for authenticaM-bM-^@M-^P
292 tion. Any port forward requests by the client will return an 292 tion. Any port forward requests by the client will return an
293 error. This might be used, e.g., in connection with the command 293 error. This might be used, e.g., in connection with the ^[[1mcommand^[[0m
294 option. 294 option.
295 295
296 no-X11-forwarding 296 ^[[1mnoM-bM-^@M-^PX11M-bM-^@M-^Pforwarding^[[0m
297 Forbids X11 forwarding when this key is used for authentication. 297 Forbids X11 forwarding when this key is used for authentication.
298 Any X11 forward requests by the client will return an error. 298 Any X11 forward requests by the client will return an error.
299 299
300 no-agent-forwarding 300 ^[[1mnoM-bM-^@M-^PagentM-bM-^@M-^Pforwarding^[[0m
301 Forbids authentication agent forwarding when this key is used for 301 Forbids authentication agent forwarding when this key is used for
302 authentication. 302 authentication.
303 303
304 no-pty Prevents tty allocation (a request to allocate a pty will fail). 304 ^[[1mnoM-bM-^@M-^Ppty ^[[22mPrevents tty allocation (a request to allocate a pty will fail).
305 305
306 permitopen="host:port" 306 ^[[1mpermitopen="host:port"^[[0m
307 Limit local ``ssh -L'' port forwarding such that it may only conM-- 307 Limit local M-bM-^@M-^XM-bM-^@M-^Xssh M-bM-^@M-^PLM-bM-^@M-^YM-bM-^@M-^Y port forwarding such that it may only conM-bM-^@M-^P
308 nect to the specified host and port. IPv6 addresses can be specM-- 308 nect to the specified host and port. IPv6 addresses can be specM-bM-^@M-^P
309 ified with an alternative syntax: host/port. Multiple permitopen 309 ified with an alternative syntax: ^[[4mhost/port^[[24m. Multiple ^[[1mpermitopen^[[0m
310 options may be applied separated by commas. No pattern matching 310 options may be applied separated by commas. No pattern matching
311 is performed on the specified hostnames, they must be literal 311 is performed on the specified hostnames, they must be literal
312 domains or addresses. 312 domains or addresses.
313 313
314 Examples 314 ^[[1mExamples^[[0m
315 1024 33 12121...312314325 ylo@foo.bar 315 1024 33 12121...312314325 ylo@foo.bar
316 316
317 from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula 317 from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
318 318
319 command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 319 command="dump /home",noM-bM-^@M-^Ppty,noM-bM-^@M-^PportM-bM-^@M-^Pforwarding 1024 33 23...2323
320 backup.hut.fi 320 backup.hut.fi
321 321
322 permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323 322 permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
323 323
324SSH_KNOWN_HOSTS FILE FORMAT 324^[[1mSSH_KNOWN_HOSTS FILE FORMAT^[[0m
325 The /etc/ssh/ssh_known_hosts, and $HOME/.ssh/known_hosts files contain 325 The ^[[4m/etc/ssh/ssh_known_hosts^[[24m and ^[[4m$HOME/.ssh/known_hosts^[[24m files contain
326 host public keys for all known hosts. The global file should be prepared 326 host public keys for all known hosts. The global file should be prepared
327 by the administrator (optional), and the per-user file is maintained 327 by the administrator (optional), and the perM-bM-^@M-^Puser file is maintained
328 automatically: whenever the user connects from an unknown host its key is 328 automatically: whenever the user connects from an unknown host its key is
329 added to the per-user file. 329 added to the perM-bM-^@M-^Puser file.
330 330
331 Each line in these files contains the following fields: hostnames, bits, 331 Each line in these files contains the following fields: hostnames, bits,
332 exponent, modulus, comment. The fields are separated by spaces. 332 exponent, modulus, comment. The fields are separated by spaces.
333 333
334 Hostnames is a comma-separated list of patterns ('*' and '?' act as wildM-- 334 Hostnames is a commaM-bM-^@M-^Pseparated list of patterns (M-bM-^@M-^Y*M-bM-^@M-^Y and M-bM-^@M-^Y?M-bM-^@M-^Y act as wildM-bM-^@M-^P
335 cards); each pattern in turn is matched against the canonical host name 335 cards); each pattern in turn is matched against the canonical host name
336 (when authenticating a client) or against the user-supplied name (when 336 (when authenticating a client) or against the userM-bM-^@M-^Psupplied name (when
337 authenticating a server). A pattern may also be preceded by `'! to 337 authenticating a server). A pattern may also be preceded by M-bM-^@M-^XM-bM-^@M-^Y! to
338 indicate negation: if the host name matches a negated pattern, it is not 338 indicate negation: if the host name matches a negated pattern, it is not
339 accepted (by that line) even if it matched another pattern on the line. 339 accepted (by that line) even if it matched another pattern on the line.
340 340
341 Bits, exponent, and modulus are taken directly from the RSA host key; 341 Bits, exponent, and modulus are taken directly from the RSA host key;
342 they can be obtained, e.g., from /etc/ssh/ssh_host_key.pub. The optional 342 they can be obtained, e.g., from ^[[4m/etc/ssh/ssh_host_key.pub^[[24m. The optional
343 comment field continues to the end of the line, and is not used. 343 comment field continues to the end of the line, and is not used.
344 344
345 Lines starting with `#' and empty lines are ignored as comments. 345 Lines starting with M-bM-^@M-^X#M-bM-^@M-^Y and empty lines are ignored as comments.
346 346
347 When performing host authentication, authentication is accepted if any 347 When performing host authentication, authentication is accepted if any
348 matching line has the proper key. It is thus permissible (but not recomM-- 348 matching line has the proper key. It is thus permissible (but not recomM-bM-^@M-^P
349 mended) to have several lines or different host keys for the same names. 349 mended) to have several lines or different host keys for the same names.
350 This will inevitably happen when short forms of host names from different 350 This will inevitably happen when short forms of host names from different
351 domains are put in the file. It is possible that the files contain conM-- 351 domains are put in the file. It is possible that the files contain conM-bM-^@M-^P
352 flicting information; authentication is accepted if valid information can 352 flicting information; authentication is accepted if valid information can
353 be found from either file. 353 be found from either file.
354 354
355 Note that the lines in these files are typically hundreds of characters 355 Note that the lines in these files are typically hundreds of characters
356 long, and you definitely don't want to type in the host keys by hand. 356 long, and you definitely donM-bM-^@M-^Yt want to type in the host keys by hand.
357 Rather, generate them by a script or by taking /etc/ssh/ssh_host_key.pub 357 Rather, generate them by a script or by taking ^[[4m/etc/ssh/ssh_host_key.pub^[[0m
358 and adding the host names at the front. 358 and adding the host names at the front.
359 359
360 Examples 360 ^[[1mExamples^[[0m
361 361
362 closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi 362 closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
363 cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....= 363 cvs.openbsd.org,199.185.137.3 sshM-bM-^@M-^Prsa AAAA1234.....=
364 364
365FILES 365^[[1mFILES^[[0m
366 /etc/ssh/sshd_config 366 /etc/ssh/sshd_config
367 Contains configuration data for sshd. The file format and conM-- 367 Contains configuration data for ^[[1msshd^[[22m. The file format and conM-bM-^@M-^P
368 figuration options are described in sshd_config(5). 368 figuration options are described in sshd_config(5).
369 369
370 /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, 370 /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key,
371 /etc/ssh/ssh_host_rsa_key 371 /etc/ssh/ssh_host_rsa_key
372 These three files contain the private parts of the host keys. 372 These three files contain the private parts of the host keys.
373 These files should only be owned by root, readable only by root, 373 These files should only be owned by root, readable only by root,
374 and not accessible to others. Note that sshd does not start if 374 and not accessible to others. Note that ^[[1msshd ^[[22mdoes not start if
375 this file is group/world-accessible. 375 this file is group/worldM-bM-^@M-^Paccessible.
376 376
377 /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub, 377 /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub,
378 /etc/ssh/ssh_host_rsa_key.pub 378 /etc/ssh/ssh_host_rsa_key.pub
379 These three files contain the public parts of the host keys. 379 These three files contain the public parts of the host keys.
380 These files should be world-readable but writable only by root. 380 These files should be worldM-bM-^@M-^Preadable but writable only by root.
381 Their contents should match the respective private parts. These 381 Their contents should match the respective private parts. These
382 files are not really used for anything; they are provided for the 382 files are not really used for anything; they are provided for the
383 convenience of the user so their contents can be copied to known 383 convenience of the user so their contents can be copied to known
384 hosts files. These files are created using ssh-keygen(1). 384 hosts files. These files are created using sshM-bM-^@M-^Pkeygen(1).
385 385
386 /etc/moduli 386 /etc/moduli
387 Contains Diffie-Hellman groups used for the "Diffie-Hellman Group 387 Contains DiffieM-bM-^@M-^PHellman groups used for the "DiffieM-bM-^@M-^PHellman Group
388 Exchange". The file format is described in moduli(5). 388 Exchange". The file format is described in moduli(5).
389 389
390 /var/empty 390 /var/empty
391 chroot(2) directory used by sshd during privilege separation in 391 chroot(2) directory used by ^[[1msshd ^[[22mduring privilege separation in
392 the pre-authentication phase. The directory should not contain 392 the preM-bM-^@M-^Pauthentication phase. The directory should not contain
393 any files and must be owned by root and not group or world- 393 any files and must be owned by root and not group or worldM-bM-^@M-^P
394 writable. 394 writable.
395 395
396 /var/run/sshd.pid 396 /var/run/sshd.pid
397 Contains the process ID of the sshd listening for connections (if 397 Contains the process ID of the ^[[1msshd ^[[22mlistening for connections (if
398 there are several daemons running concurrently for different 398 there are several daemons running concurrently for different
399 ports, this contains the process ID of the one started last). 399 ports, this contains the process ID of the one started last).
400 The content of this file is not sensitive; it can be world-readM-- 400 The content of this file is not sensitive; it can be worldM-bM-^@M-^PreadM-bM-^@M-^P
401 able. 401 able.
402 402
403 $HOME/.ssh/authorized_keys 403 $HOME/.ssh/authorized_keys
404 Lists the public keys (RSA or DSA) that can be used to log into 404 Lists the public keys (RSA or DSA) that can be used to log into
405 the user's account. This file must be readable by root (which 405 the userM-bM-^@M-^Ys account. This file must be readable by root (which
406 may on some machines imply it being world-readable if the user's 406 may on some machines imply it being worldM-bM-^@M-^Preadable if the userM-bM-^@M-^Ys
407 home directory resides on an NFS volume). It is recommended that 407 home directory resides on an NFS volume). It is recommended that
408 it not be accessible by others. The format of this file is 408 it not be accessible by others. The format of this file is
409 described above. Users will place the contents of their 409 described above. Users will place the contents of their
410 identity.pub, id_dsa.pub and/or id_rsa.pub files into this file, 410 ^[[4midentity.pub^[[24m, ^[[4mid_dsa.pub^[[24m and/or ^[[4mid_rsa.pub^[[24m files into this file,
411 as described in ssh-keygen(1). 411 as described in sshM-bM-^@M-^Pkeygen(1).
412 412
413 /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts 413 /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts
414 These files are consulted when using rhosts with RSA host authenM-- 414 These files are consulted when using rhosts with RSA host authenM-bM-^@M-^P
415 tication or protocol version 2 hostbased authentication to check 415 tication or protocol version 2 hostbased authentication to check
416 the public key of the host. The key must be listed in one of 416 the public key of the host. The key must be listed in one of
417 these files to be accepted. The client uses the same files to 417 these files to be accepted. The client uses the same files to
418 verify that it is connecting to the correct remote host. These 418 verify that it is connecting to the correct remote host. These
419 files should be writable only by root/the owner. 419 files should be writable only by root/the owner.
420 /etc/ssh/ssh_known_hosts should be world-readable, and 420 ^[[4m/etc/ssh/ssh_known_hosts^[[24m should be worldM-bM-^@M-^Preadable, and
421 $HOME/.ssh/known_hosts can but need not be world-readable. 421 ^[[4m$HOME/.ssh/known_hosts^[[24m can, but need not be, worldM-bM-^@M-^Preadable.
422 422
423 /etc/nologin 423 /etc/nologin
424 If this file exists, sshd refuses to let anyone except root log 424 If this file exists, ^[[1msshd ^[[22mrefuses to let anyone except root log
425 in. The contents of the file are displayed to anyone trying to 425 in. The contents of the file are displayed to anyone trying to
426 log in, and non-root connections are refused. The file should be 426 log in, and nonM-bM-^@M-^Proot connections are refused. The file should be
427 world-readable. 427 worldM-bM-^@M-^Preadable.
428 428
429 /etc/hosts.allow, /etc/hosts.deny 429 /etc/hosts.allow, /etc/hosts.deny
430 Access controls that should be enforced by tcp-wrappers are 430 Access controls that should be enforced by tcpM-bM-^@M-^Pwrappers are
431 defined here. Further details are described in hosts_access(5). 431 defined here. Further details are described in hosts_access(5).
432 432
433 $HOME/.rhosts 433 $HOME/.rhosts
434 This file contains host-username pairs, separated by a space, one 434 This file contains hostM-bM-^@M-^Pusername pairs, separated by a space, one
435 per line. The given user on the corresponding host is permitted 435 per line. The given user on the corresponding host is permitted
436 to log in without password. The same file is used by rlogind and 436 to log in without a password. The same file is used by rlogind
437 rshd. The file must be writable only by the user; it is recomM-- 437 and rshd. The file must be writable only by the user; it is recM-bM-^@M-^P
438 mended that it not be accessible by others. 438 ommended that it not be accessible by others.
439 439
440 If is also possible to use netgroups in the file. Either host or 440 If is also possible to use netgroups in the file. Either host or
441 user name may be of the form +@groupname to specify all hosts or 441 user name may be of the form +@groupname to specify all hosts or
442 all users in the group. 442 all users in the group.
443 443
444 $HOME/.shosts 444 $HOME/.shosts
445 For ssh, this file is exactly the same as for .rhosts. However, 445 For ssh, this file is exactly the same as for ^[[4m.rhosts^[[24m. However,
446 this file is not used by rlogin and rshd, so using this permits 446 this file is not used by rlogin and rshd, so using this permits
447 access using SSH only. 447 access using SSH only.
448 448
449 /etc/hosts.equiv 449 /etc/hosts.equiv
450 This file is used during .rhosts authentication. In the simplest 450 This file is used during ^[[4m.rhosts^[[24m authentication. In the simplest
451 form, this file contains host names, one per line. Users on 451 form, this file contains host names, one per line. Users on
452 those hosts are permitted to log in without a password, provided 452 those hosts are permitted to log in without a password, provided
453 they have the same user name on both machines. The host name may 453 they have the same user name on both machines. The host name may
454 also be followed by a user name; such users are permitted to log 454 also be followed by a user name; such users are permitted to log
455 in as any user on this machine (except root). Additionally, the 455 in as ^[[4many^[[24m user on this machine (except root). Additionally, the
456 syntax ``+@group'' can be used to specify netgroups. Negated 456 syntax M-bM-^@M-^\+@groupM-bM-^@M-^] can be used to specify netgroups. Negated
457 entries start with `-'. 457 entries start with M-bM-^@M-^XM-bM-^@M-^PM-bM-^@M-^Y.
458 458
459 If the client host/user is successfully matched in this file, 459 If the client host/user is successfully matched in this file,
460 login is automatically permitted provided the client and server 460 login is automatically permitted provided the client and server
461 user names are the same. Additionally, successful RSA host 461 user names are the same. Additionally, successful RSA host
462 authentication is normally required. This file must be writable 462 authentication is normally required. This file must be writable
463 only by root; it is recommended that it be world-readable. 463 only by root; it is recommended that it be worldM-bM-^@M-^Preadable.
464 464
465 Warning: It is almost never a good idea to use user names in 465 ^[[1mWarning: It is almost never a good idea to use user names in^[[0m
466 hosts.equiv. Beware that it really means that the named user(s) 466 ^[[4mhosts.equiv^[[24m. Beware that it really means that the named user(s)
467 can log in as anybody, which includes bin, daemon, adm, and other 467 can log in as ^[[4manybody^[[24m, which includes bin, daemon, adm, and other
468 accounts that own critical binaries and directories. Using a 468 accounts that own critical binaries and directories. Using a
469 user name practically grants the user root access. The only 469 user name practically grants the user root access. The only
470 valid use for user names that I can think of is in negative 470 valid use for user names that I can think of is in negative
@@ -473,75 +473,75 @@ FILES
473 Note that this warning also applies to rsh/rlogin. 473 Note that this warning also applies to rsh/rlogin.
474 474
475 /etc/shosts.equiv 475 /etc/shosts.equiv
476 This is processed exactly as /etc/hosts.equiv. However, this 476 This is processed exactly as ^[[4m/etc/hosts.equiv^[[24m. However, this
477 file may be useful in environments that want to run both 477 file may be useful in environments that want to run both
478 rsh/rlogin and ssh. 478 rsh/rlogin and ssh.
479 479
480 $HOME/.ssh/environment 480 $HOME/.ssh/environment
481 This file is read into the environment at login (if it exists). 481 This file is read into the environment at login (if it exists).
482 It can only contain empty lines, comment lines (that start with 482 It can only contain empty lines, comment lines (that start with
483 `#'), and assignment lines of the form name=value. The file 483 M-bM-^@M-^X#M-bM-^@M-^Y), and assignment lines of the form name=value. The file
484 should be writable only by the user; it need not be readable by 484 should be writable only by the user; it need not be readable by
485 anyone else. Environment processing is disabled by default and 485 anyone else. Environment processing is disabled by default and
486 is controlled via the PermitUserEnvironment option. 486 is controlled via the ^[[1mPermitUserEnvironment ^[[22moption.
487 487
488 $HOME/.ssh/rc 488 $HOME/.ssh/rc
489 If this file exists, it is run with /bin/sh after reading the 489 If this file exists, it is run with ^[[4m/bin/sh^[[24m after reading the
490 environment files but before starting the user's shell or comM-- 490 environment files but before starting the userM-bM-^@M-^Ys shell or comM-bM-^@M-^P
491 mand. It must not produce any output on stdout; stderr must be 491 mand. It must not produce any output on stdout; stderr must be
492 used instead. If X11 forwarding is in use, it will receive the 492 used instead. If X11 forwarding is in use, it will receive the
493 "proto cookie" pair in its standard input (and DISPLAY in its 493 "proto cookie" pair in its standard input (and DISPLAY in its
494 environment). The script must call xauth(1) because sshd will 494 environment). The script must call xauth(1) because ^[[1msshd ^[[22mwill
495 not run xauth automatically to add X11 cookies. 495 not run xauth automatically to add X11 cookies.
496 496
497 The primary purpose of this file is to run any initialization 497 The primary purpose of this file is to run any initialization
498 routines which may be needed before the user's home directory 498 routines which may be needed before the userM-bM-^@M-^Ys home directory
499 becomes accessible; AFS is a particular example of such an enviM-- 499 becomes accessible; AFS is a particular example of such an enviM-bM-^@M-^P
500 ronment. 500 ronment.
501 501
502 This file will probably contain some initialization code followed 502 This file will probably contain some initialization code followed
503 by something similar to: 503 by something similar to:
504 504
505 if read proto cookie && [ -n "$DISPLAY" ]; then 505 if read proto cookie && [ M-bM-^@M-^Pn "$DISPLAY" ]; then
506 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 506 if [ M-bM-^@M-^Xecho $DISPLAY | cut M-bM-^@M-^Pc1M-bM-^@M-^P10M-bM-^@M-^X = M-bM-^@M-^Ylocalhost:M-bM-^@M-^Y ]; then
507 # X11UseLocalhost=yes 507 # X11UseLocalhost=yes
508 echo add unix:`echo $DISPLAY | 508 echo add unix:M-bM-^@M-^Xecho $DISPLAY |
509 cut -c11-` $proto $cookie 509 cut M-bM-^@M-^Pc11M-bM-^@M-^PM-bM-^@M-^X $proto $cookie
510 else 510 else
511 # X11UseLocalhost=no 511 # X11UseLocalhost=no
512 echo add $DISPLAY $proto $cookie 512 echo add $DISPLAY $proto $cookie
513 fi | xauth -q - 513 fi | xauth M-bM-^@M-^Pq M-bM-^@M-^P
514 fi 514 fi
515 515
516 If this file does not exist, /etc/ssh/sshrc is run, and if that 516 If this file does not exist, ^[[4m/etc/ssh/sshrc^[[24m is run, and if that
517 does not exist either, xauth is used to add the cookie. 517 does not exist either, xauth is used to add the cookie.
518 518
519 This file should be writable only by the user, and need not be 519 This file should be writable only by the user, and need not be
520 readable by anyone else. 520 readable by anyone else.
521 521
522 /etc/ssh/sshrc 522 /etc/ssh/sshrc
523 Like $HOME/.ssh/rc. This can be used to specify machine-specific 523 Like ^[[4m$HOME/.ssh/rc^[[24m. This can be used to specify machineM-bM-^@M-^Pspecific
524 login-time initializations globally. This file should be 524 loginM-bM-^@M-^Ptime initializations globally. This file should be
525 writable only by root, and should be world-readable. 525 writable only by root, and should be worldM-bM-^@M-^Preadable.
526 526
527AUTHORS 527^[[1mAUTHORS^[[0m
528 OpenSSH is a derivative of the original and free ssh 1.2.12 release by 528 OpenSSH is a derivative of the original and free ssh 1.2.12 release by
529 Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo 529 Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
530 de Raadt and Dug Song removed many bugs, re-added newer features and creM-- 530 de Raadt and Dug Song removed many bugs, reM-bM-^@M-^Padded newer features and creM-bM-^@M-^P
531 ated OpenSSH. Markus Friedl contributed the support for SSH protocol 531 ated OpenSSH. Markus Friedl contributed the support for SSH protocol
532 versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support 532 versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support
533 for privilege separation. 533 for privilege separation.
534 534
535SEE ALSO 535^[[1mSEE ALSO^[[0m
536 scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), 536 scp(1), sftp(1), ssh(1), sshM-bM-^@M-^Padd(1), sshM-bM-^@M-^Pagent(1), sshM-bM-^@M-^Pkeygen(1),
537 login.conf(5), moduli(5), sshd_config(5), sftp-server(8) 537 login.conf(5), moduli(5), sshd_config(5), sftpM-bM-^@M-^Pserver(8)
538 538
539 T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, SSH 539 T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, ^[[4mSSH^[[0m
540 Protocol Architecture, draft-ietf-secsh-architecture-12.txt, January 540 ^[[4mProtocol^[[24m ^[[4mArchitecture^[[24m, draftM-bM-^@M-^PietfM-bM-^@M-^PsecshM-bM-^@M-^ParchitectureM-bM-^@M-^P12.txt, January
541 2002, work in progress material. 541 2002, work in progress material.
542 542
543 M. Friedl, N. Provos, and W. A. Simpson, Diffie-Hellman Group Exchange 543 M. Friedl, N. Provos, and W. A. Simpson, ^[[4mDiffieM-bM-^@M-^PHellman^[[24m ^[[4mGroup^[[24m ^[[4mExchange^[[0m
544 for the SSH Transport Layer Protocol, draft-ietf-secsh-dh-group- 544 ^[[4mfor^[[24m ^[[4mthe^[[24m ^[[4mSSH^[[24m ^[[4mTransport^[[24m ^[[4mLayer^[[24m ^[[4mProtocol^[[24m, draftM-bM-^@M-^PietfM-bM-^@M-^PsecshM-bM-^@M-^PdhM-bM-^@M-^PgroupM-bM-^@M-^P
545 exchange-02.txt, January 2002, work in progress material. 545 exchangeM-bM-^@M-^P02.txt, January 2002, work in progress material.
546 546
547BSD September 25, 1999 BSD 547BSD September 25, 1999 BSD
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-29 15:45:14 +0000