1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.317 2021/09/10 11:38:38 dtucker Exp $ 37.\" $FreeBSD$ 38.Dd $Mdocdate: September 10 2021 $ 39.Dt SSHD 8 40.Os 41.Sh NAME 42.Nm sshd 43.Nd OpenSSH daemon 44.Sh SYNOPSIS 45.Nm sshd 46.Bk -words 47.Op Fl 46DdeiqTt 48.Op Fl C Ar connection_spec 49.Op Fl c Ar host_certificate_file 50.Op Fl E Ar log_file 51.Op Fl f Ar config_file 52.Op Fl g Ar login_grace_time 53.Op Fl h Ar host_key_file 54.Op Fl o Ar option 55.Op Fl p Ar port 56.Op Fl u Ar len 57.Ek 58.Sh DESCRIPTION 59.Nm 60(OpenSSH Daemon) is the daemon program for 61.Xr ssh 1 . 62It provides secure encrypted communications between two untrusted hosts 63over an insecure network. 64.Pp 65.Nm 66listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc.d/sshd . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74.Pp 75.Nm 76can be configured using command-line options or a configuration file 77(by default 78.Xr sshd_config 5 ) ; 79command-line options override values specified in the 80configuration file. 81.Nm 82rereads its configuration file when it receives a hangup signal, 83.Dv SIGHUP , 84by executing itself with the name and options it was started with, e.g.\& 85.Pa /usr/sbin/sshd . 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 4 90Forces 91.Nm 92to use IPv4 addresses only. 93.It Fl 6 94Forces 95.Nm 96to use IPv6 addresses only. 97.It Fl C Ar connection_spec 98Specify the connection parameters to use for the 99.Fl T 100extended test mode. 101If provided, any 102.Cm Match 103directives in the configuration file that would apply are applied before the 104configuration is written to standard output. 105The connection parameters are supplied as keyword=value pairs and may be 106supplied in any order, either with multiple 107.Fl C 108options or as a comma-separated list. 109The keywords are 110.Dq addr , 111.Dq user , 112.Dq host , 113.Dq laddr , 114.Dq lport , 115and 116.Dq rdomain 117and correspond to source address, user, resolved source host name, 118local address, local port number and routing domain respectively. 119.It Fl c Ar host_certificate_file 120Specifies a path to a certificate file to identify 121.Nm 122during key exchange. 123The certificate file must match a host key file specified using the 124.Fl h 125option or the 126.Cm HostKey 127configuration directive. 128.It Fl D 129When this option is specified, 130.Nm 131will not detach and does not become a daemon. 132This allows easy monitoring of 133.Nm sshd . 134.It Fl d 135Debug mode. 136The server sends verbose debug output to standard error, 137and does not put itself in the background. 138The server also will not 139.Xr fork 2 140and will only process one connection. 141This option is only intended for debugging for the server. 142Multiple 143.Fl d 144options increase the debugging level. 145Maximum is 3. 146.It Fl E Ar log_file 147Append debug logs to 148.Ar log_file 149instead of the system log. 150.It Fl e 151Write debug logs to standard error instead of the system log. 152.It Fl f Ar config_file 153Specifies the name of the configuration file. 154The default is 155.Pa /etc/ssh/sshd_config . 156.Nm 157refuses to start if there is no configuration file. 158.It Fl g Ar login_grace_time 159Gives the grace time for clients to authenticate themselves (default 160120 seconds). 161If the client fails to authenticate the user within 162this many seconds, the server disconnects and exits. 163A value of zero indicates no limit. 164.It Fl h Ar host_key_file 165Specifies a file from which a host key is read. 166This option must be given if 167.Nm 168is not run as root (as the normal 169host key files are normally not readable by anyone but root). 170The default is 171.Pa /etc/ssh/ssh_host_ecdsa_key , 172.Pa /etc/ssh/ssh_host_ed25519_key 173and 174.Pa /etc/ssh/ssh_host_rsa_key . 175It is possible to have multiple host key files for 176the different host key algorithms. 177.It Fl i 178Specifies that 179.Nm 180is being run from 181.Xr inetd 8 . 182.It Fl o Ar option 183Can be used to give options in the format used in the configuration file. 184This is useful for specifying options for which there is no separate 185command-line flag. 186For full details of the options, and their values, see 187.Xr sshd_config 5 . 188.It Fl p Ar port 189Specifies the port on which the server listens for connections 190(default 22). 191Multiple port options are permitted. 192Ports specified in the configuration file with the 193.Cm Port 194option are ignored when a command-line port is specified. 195Ports specified using the 196.Cm ListenAddress 197option override command-line ports. 198.It Fl q 199Quiet mode. 200Nothing is sent to the system log. 201Normally the beginning, 202authentication, and termination of each connection is logged. 203.It Fl T 204Extended test mode. 205Check the validity of the configuration file, output the effective configuration 206to stdout and then exit. 207Optionally, 208.Cm Match 209rules may be applied by specifying the connection parameters using one or more 210.Fl C 211options. 212.It Fl t 213Test mode. 214Only check the validity of the configuration file and sanity of the keys. 215This is useful for updating 216.Nm 217reliably as configuration options may change. 218.It Fl u Ar len 219This option is used to specify the size of the field 220in the 221.Li utmp 222structure that holds the remote host name. 223If the resolved host name is longer than 224.Ar len , 225the dotted decimal value will be used instead. 226This allows hosts with very long host names that 227overflow this field to still be uniquely identified. 228Specifying 229.Fl u0 230indicates that only dotted decimal addresses 231should be put into the 232.Pa utmp 233file. 234.Fl u0 235may also be used to prevent 236.Nm 237from making DNS requests unless the authentication 238mechanism or configuration requires it. 239Authentication mechanisms that may require DNS include 240.Cm HostbasedAuthentication 241and using a 242.Cm from="pattern-list" 243option in a key file. 244Configuration options that require DNS include using a 245USER@HOST pattern in 246.Cm AllowUsers 247or 248.Cm DenyUsers . 249.El 250.Sh AUTHENTICATION 251The OpenSSH SSH daemon supports SSH protocol 2 only. 252Each host has a host-specific key, 253used to identify the host. 254Whenever a client connects, the daemon responds with its public 255host key. 256The client compares the 257host key against its own database to verify that it has not changed. 258Forward secrecy is provided through a Diffie-Hellman key agreement. 259This key agreement results in a shared session key. 260The rest of the session is encrypted using a symmetric cipher. 261The client selects the encryption algorithm 262to use from those offered by the server. 263Additionally, session integrity is provided 264through a cryptographic message authentication code (MAC). 265.Pp 266Finally, the server and the client enter an authentication dialog. 267The client tries to authenticate itself using 268host-based authentication, 269public key authentication, 270challenge-response authentication, 271or password authentication. 272.Pp 273Regardless of the authentication type, the account is checked to 274ensure that it is accessible. An account is not accessible if it is 275locked, listed in 276.Cm DenyUsers 277or its group is listed in 278.Cm DenyGroups 279\&. The definition of a locked account is system dependent. Some platforms 280have their own account database (eg AIX) and some modify the passwd field ( 281.Ql \&*LK\&* 282on Solaris and UnixWare, 283.Ql \&* 284on HP-UX, containing 285.Ql Nologin 286on Tru64, 287a leading 288.Ql \&*LOCKED\&* 289on FreeBSD and a leading 290.Ql \&! 291on most Linuxes). 292If there is a requirement to disable password authentication 293for the account while allowing still public-key, then the passwd field 294should be set to something other than these values (eg 295.Ql NP 296or 297.Ql \&*NP\&* 298). 299.Pp 300If the client successfully authenticates itself, a dialog for 301preparing the session is entered. 302At this time the client may request 303things like allocating a pseudo-tty, forwarding X11 connections, 304forwarding TCP connections, or forwarding the authentication agent 305connection over the secure channel. 306.Pp 307After this, the client either requests an interactive shell or execution 308or a non-interactive command, which 309.Nm 310will execute via the user's shell using its 311.Fl c 312option. 313The sides then enter session mode. 314In this mode, either side may send 315data at any time, and such data is forwarded to/from the shell or 316command on the server side, and the user terminal in the client side. 317.Pp 318When the user program terminates and all forwarded X11 and other 319connections have been closed, the server sends command exit status to 320the client, and both sides exit. 321.Sh LOGIN PROCESS 322When a user successfully logs in, 323.Nm 324does the following: 325.Bl -enum -offset indent 326.It 327If the login is on a tty, and no command has been specified, 328prints last login time and 329.Pa /etc/motd 330(unless prevented in the configuration file or by 331.Pa ~/.hushlogin ; 332see the 333.Sx FILES 334section). 335.It 336If the login is on a tty, records login time. 337.It 338Checks 339.Pa /etc/nologin and 340.Pa /var/run/nologin ; 341if one exists, it prints the contents and quits 342(unless root). 343.It 344Changes to run with normal user privileges. 345.It 346Sets up basic environment. 347.It 348Reads the file 349.Pa ~/.ssh/environment , 350if it exists, and users are allowed to change their environment. 351See the 352.Cm PermitUserEnvironment 353option in 354.Xr sshd_config 5 . 355.It 356Changes to user's home directory. 357.It 358If 359.Pa ~/.ssh/rc 360exists and the 361.Xr sshd_config 5 362.Cm PermitUserRC 363option is set, runs it; else if 364.Pa /etc/ssh/sshrc 365exists, runs 366it; otherwise runs 367.Xr xauth 1 . 368The 369.Dq rc 370files are given the X11 371authentication protocol and cookie in standard input. 372See 373.Sx SSHRC , 374below. 375.It 376Runs user's shell or command. 377All commands are run under the user's login shell as specified in the 378system password database. 379.El 380.Sh SSHRC 381If the file 382.Pa ~/.ssh/rc 383exists, 384.Xr sh 1 385runs it after reading the 386environment files but before starting the user's shell or command. 387It must not produce any output on stdout; stderr must be used 388instead. 389If X11 forwarding is in use, it will receive the "proto cookie" pair in 390its standard input (and 391.Ev DISPLAY 392in its environment). 393The script must call 394.Xr xauth 1 395because 396.Nm 397will not run xauth automatically to add X11 cookies. 398.Pp 399The primary purpose of this file is to run any initialization routines 400which may be needed before the user's home directory becomes 401accessible; AFS is a particular example of such an environment. 402.Pp 403This file will probably contain some initialization code followed by 404something similar to: 405.Bd -literal -offset 3n 406if read proto cookie && [ -n "$DISPLAY" ]; then 407 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 408 # X11UseLocalhost=yes 409 echo add unix:`echo $DISPLAY | 410 cut -c11-` $proto $cookie 411 else 412 # X11UseLocalhost=no 413 echo add $DISPLAY $proto $cookie 414 fi | xauth -q - 415fi 416.Ed 417.Pp 418If this file does not exist, 419.Pa /etc/ssh/sshrc 420is run, and if that 421does not exist either, xauth is used to add the cookie. 422.Sh AUTHORIZED_KEYS FILE FORMAT 423.Cm AuthorizedKeysFile 424specifies the files containing public keys for 425public key authentication; 426if this option is not specified, the default is 427.Pa ~/.ssh/authorized_keys 428and 429.Pa ~/.ssh/authorized_keys2 . 430Each line of the file contains one 431key (empty lines and lines starting with a 432.Ql # 433are ignored as 434comments). 435Public keys consist of the following space-separated fields: 436options, keytype, base64-encoded key, comment. 437The options field is optional. 438The supported key types are: 439.Pp 440.Bl -item -compact -offset indent 441.It 442sk-ecdsa-sha2-nistp256@openssh.com 443.It 444ecdsa-sha2-nistp256 445.It 446ecdsa-sha2-nistp384 447.It 448ecdsa-sha2-nistp521 449.It 450sk-ssh-ed25519@openssh.com 451.It 452ssh-ed25519 453.It 454ssh-dss 455.It 456ssh-rsa 457.El 458.Pp 459The comment field is not used for anything (but may be convenient for the 460user to identify the key). 461.Pp 462Note that lines in this file can be several hundred bytes long 463(because of the size of the public key encoding) up to a limit of 4648 kilobytes, which permits RSA keys up to 16 kilobits. 465You don't want to type them in; instead, copy the 466.Pa id_dsa.pub , 467.Pa id_ecdsa.pub , 468.Pa id_ecdsa_sk.pub , 469.Pa id_ed25519.pub , 470.Pa id_ed25519_sk.pub , 471or the 472.Pa id_rsa.pub 473file and edit it. 474.Pp 475.Nm 476enforces a minimum RSA key modulus size of 1024 bits. 477.Pp 478The options (if present) consist of comma-separated option 479specifications. 480No spaces are permitted, except within double quotes. 481The following option specifications are supported (note 482that option keywords are case-insensitive): 483.Bl -tag -width Ds 484.It Cm agent-forwarding 485Enable authentication agent forwarding previously disabled by the 486.Cm restrict 487option. 488.It Cm cert-authority 489Specifies that the listed key is a certification authority (CA) that is 490trusted to validate signed certificates for user authentication. 491.Pp 492Certificates may encode access restrictions similar to these key options. 493If both certificate restrictions and key options are present, the most 494restrictive union of the two is applied. 495.It Cm command="command" 496Specifies that the command is executed whenever this key is used for 497authentication. 498The command supplied by the user (if any) is ignored. 499The command is run on a pty if the client requests a pty; 500otherwise it is run without a tty. 501If an 8-bit clean channel is required, 502one must not request a pty or should specify 503.Cm no-pty . 504A quote may be included in the command by quoting it with a backslash. 505.Pp 506This option might be useful 507to restrict certain public keys to perform just a specific operation. 508An example might be a key that permits remote backups but nothing else. 509Note that the client may specify TCP and/or X11 510forwarding unless they are explicitly prohibited, e.g. using the 511.Cm restrict 512key option. 513.Pp 514The command originally supplied by the client is available in the 515.Ev SSH_ORIGINAL_COMMAND 516environment variable. 517Note that this option applies to shell, command or subsystem execution. 518Also note that this command may be superseded by a 519.Xr sshd_config 5 520.Cm ForceCommand 521directive. 522.Pp 523If a command is specified and a forced-command is embedded in a certificate 524used for authentication, then the certificate will be accepted only if the 525two commands are identical. 526.It Cm environment="NAME=value" 527Specifies that the string is to be added to the environment when 528logging in using this key. 529Environment variables set this way 530override other default environment values. 531Multiple options of this type are permitted. 532Environment processing is disabled by default and is 533controlled via the 534.Cm PermitUserEnvironment 535option. 536.It Cm expiry-time="timespec" 537Specifies a time after which the key will not be accepted. 538The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time 539in the system time-zone. 540.It Cm from="pattern-list" 541Specifies that in addition to public key authentication, either the canonical 542name of the remote host or its IP address must be present in the 543comma-separated list of patterns. 544See PATTERNS in 545.Xr ssh_config 5 546for more information on patterns. 547.Pp 548In addition to the wildcard matching that may be applied to hostnames or 549addresses, a 550.Cm from 551stanza may match IP addresses using CIDR address/masklen notation. 552.Pp 553The purpose of this option is to optionally increase security: public key 554authentication by itself does not trust the network or name servers or 555anything (but the key); however, if somebody somehow steals the key, the key 556permits an intruder to log in from anywhere in the world. 557This additional option makes using a stolen key more difficult (name 558servers and/or routers would have to be compromised in addition to 559just the key). 560.It Cm no-agent-forwarding 561Forbids authentication agent forwarding when this key is used for 562authentication. 563.It Cm no-port-forwarding 564Forbids TCP forwarding when this key is used for authentication. 565Any port forward requests by the client will return an error. 566This might be used, e.g. in connection with the 567.Cm command 568option. 569.It Cm no-pty 570Prevents tty allocation (a request to allocate a pty will fail). 571.It Cm no-user-rc 572Disables execution of 573.Pa ~/.ssh/rc . 574.It Cm no-X11-forwarding 575Forbids X11 forwarding when this key is used for authentication. 576Any X11 forward requests by the client will return an error. 577.It Cm permitlisten="[host:]port" 578Limit remote port forwarding with the 579.Xr ssh 1 580.Fl R 581option such that it may only listen on the specified host (optional) and port. 582IPv6 addresses can be specified by enclosing the address in square brackets. 583Multiple 584.Cm permitlisten 585options may be applied separated by commas. 586Hostnames may include wildcards as described in the PATTERNS section in 587.Xr ssh_config 5 . 588A port specification of 589.Cm * 590matches any port. 591Note that the setting of 592.Cm GatewayPorts 593may further restrict listen addresses. 594Note that 595.Xr ssh 1 596will send a hostname of 597.Dq localhost 598if a listen host was not specified when the forwarding was requested, and 599that this name is treated differently to the explicit localhost addresses 600.Dq 127.0.0.1 601and 602.Dq ::1 . 603.It Cm permitopen="host:port" 604Limit local port forwarding with the 605.Xr ssh 1 606.Fl L 607option such that it may only connect to the specified host and port. 608IPv6 addresses can be specified by enclosing the address in square brackets. 609Multiple 610.Cm permitopen 611options may be applied separated by commas. 612No pattern matching or name lookup is performed on the 613specified hostnames, they must be literal host names and/or addresses. 614A port specification of 615.Cm * 616matches any port. 617.It Cm port-forwarding 618Enable port forwarding previously disabled by the 619.Cm restrict 620option. 621.It Cm principals="principals" 622On a 623.Cm cert-authority 624line, specifies allowed principals for certificate authentication as a 625comma-separated list. 626At least one name from the list must appear in the certificate's 627list of principals for the certificate to be accepted. 628This option is ignored for keys that are not marked as trusted certificate 629signers using the 630.Cm cert-authority 631option. 632.It Cm pty 633Permits tty allocation previously disabled by the 634.Cm restrict 635option. 636.It Cm no-touch-required 637Do not require demonstration of user presence 638for signatures made using this key. 639This option only makes sense for the FIDO authenticator algorithms 640.Cm ecdsa-sk 641and 642.Cm ed25519-sk . 643.It Cm verify-required 644Require that signatures made using this key attest that they verified 645the user, e.g. via a PIN. 646This option only makes sense for the FIDO authenticator algorithms 647.Cm ecdsa-sk 648and 649.Cm ed25519-sk . 650.It Cm restrict 651Enable all restrictions, i.e. disable port, agent and X11 forwarding, 652as well as disabling PTY allocation 653and execution of 654.Pa ~/.ssh/rc . 655If any future restriction capabilities are added to authorized_keys files 656they will be included in this set. 657.It Cm tunnel="n" 658Force a 659.Xr tun 4 660device on the server. 661Without this option, the next available device will be used if 662the client requests a tunnel. 663.It Cm user-rc 664Enables execution of 665.Pa ~/.ssh/rc 666previously disabled by the 667.Cm restrict 668option. 669.It Cm X11-forwarding 670Permits X11 forwarding previously disabled by the 671.Cm restrict 672option. 673.El 674.Pp 675An example authorized_keys file: 676.Bd -literal -offset 3n 677# Comments are allowed at start of line. Blank lines are allowed. 678# Plain key, no restrictions 679ssh-rsa ... 680# Forced command, disable PTY and all forwarding 681restrict,command="dump /home" ssh-rsa ... 682# Restriction of ssh -L forwarding destinations 683permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa ... 684# Restriction of ssh -R forwarding listeners 685permitlisten="localhost:8080",permitlisten="[::1]:22000" ssh-rsa ... 686# Configuration for tunnel forwarding 687tunnel="0",command="sh /etc/netstart tun0" ssh-rsa ... 688# Override of restriction to allow PTY allocation 689restrict,pty,command="nethack" ssh-rsa ... 690# Allow FIDO key without requiring touch 691no-touch-required sk-ecdsa-sha2-nistp256@openssh.com ... 692# Require user-verification (e.g. PIN or biometric) for FIDO key 693verify-required sk-ecdsa-sha2-nistp256@openssh.com ... 694# Trust CA key, allow touch-less FIDO if requested in certificate 695cert-authority,no-touch-required,principals="user_a" ssh-rsa ... 696.Ed 697.Sh SSH_KNOWN_HOSTS FILE FORMAT 698The 699.Pa /etc/ssh/ssh_known_hosts 700and 701.Pa ~/.ssh/known_hosts 702files contain host public keys for all known hosts. 703The global file should 704be prepared by the administrator (optional), and the per-user file is 705maintained automatically: whenever the user connects to an unknown host, 706its key is added to the per-user file. 707.Pp 708Each line in these files contains the following fields: marker (optional), 709hostnames, keytype, base64-encoded key, comment. 710The fields are separated by spaces. 711.Pp 712The marker is optional, but if it is present then it must be one of 713.Dq @cert-authority , 714to indicate that the line contains a certification authority (CA) key, 715or 716.Dq @revoked , 717to indicate that the key contained on the line is revoked and must not ever 718be accepted. 719Only one marker should be used on a key line. 720.Pp 721Hostnames is a comma-separated list of patterns 722.Pf ( Ql * 723and 724.Ql \&? 725act as 726wildcards); each pattern in turn is matched against the host name. 727When 728.Nm sshd 729is authenticating a client, such as when using 730.Cm HostbasedAuthentication , 731this will be the canonical client host name. 732When 733.Xr ssh 1 734is authenticating a server, this will be the host name 735given by the user, the value of the 736.Xr ssh 1 737.Cm HostkeyAlias 738if it was specified, or the canonical server hostname if the 739.Xr ssh 1 740.Cm CanonicalizeHostname 741option was used. 742.Pp 743A pattern may also be preceded by 744.Ql \&! 745to indicate negation: if the host name matches a negated 746pattern, it is not accepted (by that line) even if it matched another 747pattern on the line. 748A hostname or address may optionally be enclosed within 749.Ql \&[ 750and 751.Ql \&] 752brackets then followed by 753.Ql \&: 754and a non-standard port number. 755.Pp 756Alternately, hostnames may be stored in a hashed form which hides host names 757and addresses should the file's contents be disclosed. 758Hashed hostnames start with a 759.Ql | 760character. 761Only one hashed hostname may appear on a single line and none of the above 762negation or wildcard operators may be applied. 763.Pp 764The keytype and base64-encoded key are taken directly from the host key; they 765can be obtained, for example, from 766.Pa /etc/ssh/ssh_host_rsa_key.pub . 767The optional comment field continues to the end of the line, and is not used. 768.Pp 769Lines starting with 770.Ql # 771and empty lines are ignored as comments. 772.Pp 773When performing host authentication, authentication is accepted if any 774matching line has the proper key; either one that matches exactly or, 775if the server has presented a certificate for authentication, the key 776of the certification authority that signed the certificate. 777For a key to be trusted as a certification authority, it must use the 778.Dq @cert-authority 779marker described above. 780.Pp 781The known hosts file also provides a facility to mark keys as revoked, 782for example when it is known that the associated private key has been 783stolen. 784Revoked keys are specified by including the 785.Dq @revoked 786marker at the beginning of the key line, and are never accepted for 787authentication or as certification authorities, but instead will 788produce a warning from 789.Xr ssh 1 790when they are encountered. 791.Pp 792It is permissible (but not 793recommended) to have several lines or different host keys for the same 794names. 795This will inevitably happen when short forms of host names 796from different domains are put in the file. 797It is possible 798that the files contain conflicting information; authentication is 799accepted if valid information can be found from either file. 800.Pp 801Note that the lines in these files are typically hundreds of characters 802long, and you definitely don't want to type in the host keys by hand. 803Rather, generate them by a script, 804.Xr ssh-keyscan 1 805or by taking, for example, 806.Pa /etc/ssh/ssh_host_rsa_key.pub 807and adding the host names at the front. 808.Xr ssh-keygen 1 809also offers some basic automated editing for 810.Pa ~/.ssh/known_hosts 811including removing hosts matching a host name and converting all host 812names to their hashed representations. 813.Pp 814An example ssh_known_hosts file: 815.Bd -literal -offset 3n 816# Comments allowed at start of line 817closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 818cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 819# A hashed hostname 820|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 821AAAA1234.....= 822# A revoked key 823@revoked * ssh-rsa AAAAB5W... 824# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 825@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 826.Ed 827.Sh FILES 828.Bl -tag -width Ds -compact 829.It Pa ~/.hushlogin 830This file is used to suppress printing the last login time and 831.Pa /etc/motd , 832if 833.Cm PrintLastLog 834and 835.Cm PrintMotd , 836respectively, 837are enabled. 838It does not suppress printing of the banner specified by 839.Cm Banner . 840.Pp 841.It Pa ~/.rhosts 842This file is used for host-based authentication (see 843.Xr ssh 1 844for more information). 845On some machines this file may need to be 846world-readable if the user's home directory is on an NFS partition, 847because 848.Nm 849reads it as root. 850Additionally, this file must be owned by the user, 851and must not have write permissions for anyone else. 852The recommended 853permission for most machines is read/write for the user, and not 854accessible by others. 855.Pp 856.It Pa ~/.shosts 857This file is used in exactly the same way as 858.Pa .rhosts , 859but allows host-based authentication without permitting login with 860rlogin/rsh. 861.Pp 862.It Pa ~/.ssh/ 863This directory is the default location for all user-specific configuration 864and authentication information. 865There is no general requirement to keep the entire contents of this directory 866secret, but the recommended permissions are read/write/execute for the user, 867and not accessible by others. 868.Pp 869.It Pa ~/.ssh/authorized_keys 870Lists the public keys (DSA, ECDSA, Ed25519, RSA) 871that can be used for logging in as this user. 872The format of this file is described above. 873The content of the file is not highly sensitive, but the recommended 874permissions are read/write for the user, and not accessible by others. 875.Pp 876If this file, the 877.Pa ~/.ssh 878directory, or the user's home directory are writable 879by other users, then the file could be modified or replaced by unauthorized 880users. 881In this case, 882.Nm 883will not allow it to be used unless the 884.Cm StrictModes 885option has been set to 886.Dq no . 887.Pp 888.It Pa ~/.ssh/environment 889This file is read into the environment at login (if it exists). 890It can only contain empty lines, comment lines (that start with 891.Ql # ) , 892and assignment lines of the form name=value. 893The file should be writable 894only by the user; it need not be readable by anyone else. 895Environment processing is disabled by default and is 896controlled via the 897.Cm PermitUserEnvironment 898option. 899.Pp 900.It Pa ~/.ssh/known_hosts 901Contains a list of host keys for all hosts the user has logged into 902that are not already in the systemwide list of known host keys. 903The format of this file is described above. 904This file should be writable only by root/the owner and 905can, but need not be, world-readable. 906.Pp 907.It Pa ~/.ssh/rc 908Contains initialization routines to be run before 909the user's home directory becomes accessible. 910This file should be writable only by the user, and need not be 911readable by anyone else. 912.Pp 913.It Pa /etc/hosts.allow 914.It Pa /etc/hosts.deny 915Access controls that should be enforced by tcp-wrappers are defined here. 916Further details are described in 917.Xr hosts_access 5 . 918.Pp 919.It Pa /etc/hosts.equiv 920This file is for host-based authentication (see 921.Xr ssh 1 ) . 922It should only be writable by root. 923.Pp 924.It Pa /etc/moduli 925Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" 926key exchange method. 927The file format is described in 928.Xr moduli 5 . 929If no usable groups are found in this file then fixed internal groups will 930be used. 931.Pp 932.It Pa /etc/motd 933See 934.Xr motd 5 . 935.Pp 936.It Pa /etc/nologin 937If this file exists, 938.Nm 939refuses to let anyone except root log in. 940The contents of the file 941are displayed to anyone trying to log in, and non-root connections are 942refused. 943The file should be world-readable. 944.Pp 945.It Pa /etc/shosts.equiv 946This file is used in exactly the same way as 947.Pa hosts.equiv , 948but allows host-based authentication without permitting login with 949rlogin/rsh. 950.Pp 951.It Pa /etc/ssh/ssh_host_ecdsa_key 952.It Pa /etc/ssh/ssh_host_ed25519_key 953.It Pa /etc/ssh/ssh_host_rsa_key 954These files contain the private parts of the host keys. 955These files should only be owned by root, readable only by root, and not 956accessible to others. 957Note that 958.Nm 959does not start if these files are group/world-accessible. 960.Pp 961.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 962.It Pa /etc/ssh/ssh_host_ed25519_key.pub 963.It Pa /etc/ssh/ssh_host_rsa_key.pub 964These files contain the public parts of the host keys. 965These files should be world-readable but writable only by 966root. 967Their contents should match the respective private parts. 968These files are not 969really used for anything; they are provided for the convenience of 970the user so their contents can be copied to known hosts files. 971These files are created using 972.Xr ssh-keygen 1 . 973.Pp 974.It Pa /etc/ssh/ssh_known_hosts 975Systemwide list of known host keys. 976This file should be prepared by the 977system administrator to contain the public host keys of all machines in the 978organization. 979The format of this file is described above. 980This file should be writable only by root/the owner and 981should be world-readable. 982.Pp 983.It Pa /etc/ssh/sshd_config 984Contains configuration data for 985.Nm sshd . 986The file format and configuration options are described in 987.Xr sshd_config 5 . 988.Pp 989.It Pa /etc/ssh/sshrc 990Similar to 991.Pa ~/.ssh/rc , 992it can be used to specify 993machine-specific login-time initializations globally. 994This file should be writable only by root, and should be world-readable. 995.Pp 996.It Pa /var/empty 997.Xr chroot 2 998directory used by 999.Nm 1000during privilege separation in the pre-authentication phase. 1001The directory should not contain any files and must be owned by root 1002and not group or world-writable. 1003.Pp 1004.It Pa /var/run/sshd.pid 1005Contains the process ID of the 1006.Nm 1007listening for connections (if there are several daemons running 1008concurrently for different ports, this contains the process ID of the one 1009started last). 1010The content of this file is not sensitive; it can be world-readable. 1011.El 1012.Sh SEE ALSO 1013.Xr scp 1 , 1014.Xr sftp 1 , 1015.Xr ssh 1 , 1016.Xr ssh-add 1 , 1017.Xr ssh-agent 1 , 1018.Xr ssh-keygen 1 , 1019.Xr ssh-keyscan 1 , 1020.Xr chroot 2 , 1021.Xr hosts_access 5 , 1022.Xr login.conf 5 , 1023.Xr moduli 5 , 1024.Xr sshd_config 5 , 1025.Xr inetd 8 , 1026.Xr sftp-server 8 1027.Sh AUTHORS 1028OpenSSH is a derivative of the original and free 1029ssh 1.2.12 release by Tatu Ylonen. 1030Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 1031Theo de Raadt and Dug Song 1032removed many bugs, re-added newer features and 1033created OpenSSH. 1034Markus Friedl contributed the support for SSH 1035protocol versions 1.5 and 2.0. 1036Niels Provos and Markus Friedl contributed support 1037for privilege separation. 1038