1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $FreeBSD$ 38.\" 39.Dd September 25, 1999 40.Dt SSHD 8 41.Os 42.Sh NAME 43.Nm sshd 44.Nd secure shell daemon 45.Sh SYNOPSIS 46.Nm sshd 47.Op Fl diqQ46 48.Op Fl b Ar bits 49.Op Fl f Ar config_file 50.Op Fl g Ar login_grace_time 51.Op Fl h Ar host_key_file 52.Op Fl k Ar key_gen_time 53.Op Fl p Ar port 54.Op Fl u Ar len 55.Op Fl V Ar client_protocol_id 56.Sh DESCRIPTION 57.Nm 58(Secure Shell Daemon) is the daemon program for 59.Xr ssh 1 . 60Together these programs replace rlogin and rsh, and 61provide secure encrypted communications between two untrusted hosts 62over an insecure network. 63The programs are intended to be as easy to 64install and use as possible. 65.Pp 66.Nm 67is the daemon that listens for connections from clients. 68It is normally started at boot from 69.Pa /etc/rc.network . 70It forks a new 71daemon for each incoming connection. 72The forked daemons handle 73key exchange, encryption, authentication, command execution, 74and data exchange. 75This implementation of 76.Nm 77supports both SSH protocol version 1 and 2 simultaneously. 78.Nm 79works as follows. 80.Pp 81.Ss SSH protocol version 1 82.Pp 83Each host has a host-specific RSA key 84(normally 1024 bits) used to identify the host. 85Additionally, when 86the daemon starts, it generates a server RSA key (normally 768 bits). 87This key is normally regenerated every hour if it has been used, and 88is never stored on disk. 89.Pp 90Whenever a client connects the daemon responds with its public 91host and server keys. 92The client compares the 93RSA host key against its own database to verify that it has not changed. 94The client then generates a 256 bit random number. 95It encrypts this 96random number using both the host key and the server key, and sends 97the encrypted number to the server. 98Both sides then use this 99random number as a session key which is used to encrypt all further 100communications in the session. 101The rest of the session is encrypted 102using a conventional cipher, currently Blowfish or 3DES, with 3DES 103being used by default. 104The client selects the encryption algorithm 105to use from those offered by the server. 106.Pp 107Next, the server and the client enter an authentication dialog. 108The client tries to authenticate itself using 109.Pa .rhosts 110authentication, 111.Pa .rhosts 112authentication combined with RSA host 113authentication, RSA challenge-response authentication, or password 114based authentication. 115.Pp 116Rhosts authentication is normally disabled 117because it is fundamentally insecure, but can be enabled in the server 118configuration file if desired. 119System security is not improved unless 120.Xr rshd 8 , 121.Xr rlogind 8 , 122.Xr rexecd 8 , 123and 124.Xr rexd 8 125are disabled (thus completely disabling 126.Xr rlogin 1 127and 128.Xr rsh 1 129into the machine). 130.Pp 131.Ss SSH protocol version 2 132.Pp 133Version 2 works similarly: 134Each host has a host-specific DSA key used to identify the host. 135However, when the daemon starts, it does not generate a server key. 136Forward security is provided through a Diffie-Hellman key agreement. 137This key agreement results in a shared session key. 138The rest of the session is encrypted 139using a symmetric cipher, currently 140Blowfish, 3DES or CAST128 in CBC mode or Arcfour. 141The client selects the encryption algorithm 142to use from those offered by the server. 143Additionally, session integrity is provided 144through a cryptographic message authentication code 145(hmac-sha1 or hmac-md5). 146.Pp 147Protocol version 2 provides a public key based 148user authentication method (DSAAuthentication) 149and conventional password authentication. 150.Pp 151.Ss Command execution and data forwarding 152.Pp 153If the client successfully authenticates itself, a dialog for 154preparing the session is entered. 155At this time the client may request 156things like allocating a pseudo-tty, forwarding X11 connections, 157forwarding TCP/IP connections, or forwarding the authentication agent 158connection over the secure channel. 159.Pp 160Finally, the client either requests a shell or execution of a command. 161The sides then enter session mode. 162In this mode, either side may send 163data at any time, and such data is forwarded to/from the shell or 164command on the server side, and the user terminal in the client side. 165.Pp 166When the user program terminates and all forwarded X11 and other 167connections have been closed, the server sends command exit status to 168the client, and both sides exit. 169.Pp 170.Nm 171can be configured using command-line options or a configuration 172file. 173Command-line options override values specified in the 174configuration file. 175.Pp 176.Nm 177rereads its configuration file when it receives a hangup signal, 178.Dv SIGHUP . 179.Pp 180The options are as follows: 181.Bl -tag -width Ds 182.It Fl b Ar bits 183Specifies the number of bits in the server key (default 768). 184.Pp 185.It Fl d 186Debug mode. 187The server sends verbose debug output to the system 188log, and does not put itself in the background. 189The server also will not fork and will only process one connection. 190This option is only intended for debugging for the server. 191Multiple -d options increases the debugging level. 192Maximum is 3. 193.It Fl f Ar configuration_file 194Specifies the name of the configuration file. 195The default is 196.Pa /etc/ssh/sshd_config . 197.Nm 198refuses to start if there is no configuration file. 199.It Fl g Ar login_grace_time 200Gives the grace time for clients to authenticate themselves (default 201300 seconds). 202If the client fails to authenticate the user within 203this many seconds, the server disconnects and exits. 204A value of zero indicates no limit. 205.It Fl h Ar host_key_file 206Specifies the file from which the RSA host key is read (default 207.Pa /etc/ssh/ssh_host_key ) . 208This option must be given if 209.Nm 210is not run as root (as the normal 211host file is normally not readable by anyone but root). 212.It Fl i 213Specifies that 214.Nm 215is being run from inetd. 216.Nm 217is normally not run 218from inetd because it needs to generate the server key before it can 219respond to the client, and this may take tens of seconds. 220Clients would have to wait too long if the key was regenerated every time. 221However, with small key sizes (e.g., 512) using 222.Nm 223from inetd may 224be feasible. 225.It Fl k Ar key_gen_time 226Specifies how often the server key is regenerated (default 3600 227seconds, or one hour). 228The motivation for regenerating the key fairly 229often is that the key is not stored anywhere, and after about an hour, 230it becomes impossible to recover the key for decrypting intercepted 231communications even if the machine is cracked into or physically 232seized. 233A value of zero indicates that the key will never be regenerated. 234.It Fl p Ar port 235Specifies the port on which the server listens for connections 236(default 22). 237.It Fl q 238Quiet mode. 239Nothing is sent to the system log. 240Normally the beginning, 241authentication, and termination of each connection is logged. 242.It Fl u Ar len 243This option is used to specify the size of the field 244in the 245.Li utmp 246structure that holds the remote host name. 247If the resolved host name is longer than 248.Ar len , 249the dotted decimal value will be used instead. 250This allows hosts with very long host names that 251overflow this field to still be uniquely identified. 252Specifying 253.Fl u0 254indicates that only dotted decimal addresses 255should be put into the 256.Pa utmp 257file. 258.It Fl Q 259Do not print an error message if RSA support is missing. 260.It Fl V Ar client_protocol_id 261SSH-2 compatibility mode. 262When this option is specified 263.Nm 264assumes the client has sent the supplied version string 265and skips the 266Protocol Version Identification Exchange. 267This option is not intended to be called directly. 268.It Fl 4 269Forces 270.Nm 271to use IPv4 addresses only. 272.It Fl 6 273Forces 274.Nm 275to use IPv6 addresses only. 276.El 277.Sh CONFIGURATION FILE 278.Nm 279reads configuration data from 280.Pa /etc/ssh/sshd_config 281(or the file specified with 282.Fl f 283on the command line). 284The file contains keyword-value pairs, one per line. 285Lines starting with 286.Ql # 287and empty lines are interpreted as comments. 288.Pp 289The following keywords are possible. 290.Bl -tag -width Ds 291.It Cm AFSTokenPassing 292Specifies whether an AFS token may be forwarded to the server. 293Default is 294.Dq yes . 295.It Cm AllowGroups 296This keyword can be followed by a number of group names, separated 297by spaces. 298If specified, login is allowed only for users whose primary 299group matches one of the patterns. 300.Ql \&* 301and 302.Ql ? 303can be used as 304wildcards in the patterns. 305Only group names are valid; a numerical group ID isn't recognized. 306By default login is allowed regardless of the primary group. 307.Pp 308.It Cm AllowTcpForwarding 309Specifies whether TCP forwarding is permitted. 310The default is 311.Dq yes . 312Note that disabling TCP forwarding does not improve security unless 313users are also denied shell access, as they can always install their 314own forwarders. 315.Pp 316.It Cm AllowUsers 317This keyword can be followed by a number of user names, separated 318by spaces. 319If specified, login is allowed only for users names that 320match one of the patterns. 321.Ql \&* 322and 323.Ql ? 324can be used as 325wildcards in the patterns. 326Only user names are valid; a numerical user ID isn't recognized. 327By default login is allowed regardless of the user name. 328.Pp 329.It Cm Ciphers 330Specifies the ciphers allowed for protocol version 2. 331Multiple ciphers must be comma-separated. 332The default is 333.Dq 3des-cbc,blowfish-cbc,arcfour,cast128-cbc . 334.It Cm CheckMail 335Specifies whether 336.Nm 337should check for new mail for interactive logins. 338The default is 339.Dq yes . 340.It Cm DenyGroups 341This keyword can be followed by a number of group names, separated 342by spaces. 343Users whose primary group matches one of the patterns 344aren't allowed to log in. 345.Ql \&* 346and 347.Ql ? 348can be used as 349wildcards in the patterns. 350Only group names are valid; a numerical group ID isn't recognized. 351By default login is allowed regardless of the primary group. 352.Pp 353.It Cm DenyUsers 354This keyword can be followed by a number of user names, separated 355by spaces. 356Login is disallowed for user names that match one of the patterns. 357.Ql \&* 358and 359.Ql ? 360can be used as wildcards in the patterns. 361Only user names are valid; a numerical user ID isn't recognized. 362By default login is allowed regardless of the user name. 363.It Cm DSAAuthentication 364Specifies whether DSA authentication is allowed. 365The default is 366.Dq yes . 367Note that this option applies to protocol version 2 only. 368.It Cm GatewayPorts 369Specifies whether remote hosts are allowed to connect to ports 370forwarded for the client. 371The argument must be 372.Dq yes 373or 374.Dq no . 375The default is 376.Dq no . 377.It Cm HostDSAKey 378Specifies the file containing the private DSA host key (default 379.Pa /etc/ssh/ssh_host_dsa_key ) 380used by SSH protocol 2.0. 381Note that 382.Nm 383disables protocol 2.0 if this file is group/world-accessible. 384.It Cm HostKey 385Specifies the file containing the private RSA host key (default 386.Pa /etc/ssh/ssh_host_key ) 387used by SSH protocols 1.3 and 1.5. 388Note that 389.Nm 390disables protocols 1.3 and 1.5 if this file is group/world-accessible. 391.It Cm IgnoreRhosts 392Specifies that 393.Pa .rhosts 394and 395.Pa .shosts 396files will not be used in authentication. 397.Pa /etc/hosts.equiv 398and 399.Pa /etc/ssh/shosts.equiv 400are still used. 401The default is 402.Dq yes . 403.It Cm IgnoreUserKnownHosts 404Specifies whether 405.Nm 406should ignore the user's 407.Pa $HOME/.ssh/known_hosts 408during 409.Cm RhostsRSAAuthentication . 410The default is 411.Dq no . 412.It Cm KeepAlive 413Specifies whether the system should send keepalive messages to the 414other side. 415If they are sent, death of the connection or crash of one 416of the machines will be properly noticed. 417However, this means that 418connections will die if the route is down temporarily, and some people 419find it annoying. 420On the other hand, if keepalives are not sent, 421sessions may hang indefinitely on the server, leaving 422.Dq ghost 423users and consuming server resources. 424.Pp 425The default is 426.Dq yes 427(to send keepalives), and the server will notice 428if the network goes down or the client host reboots. 429This avoids infinitely hanging sessions. 430.Pp 431To disable keepalives, the value should be set to 432.Dq no 433in both the server and the client configuration files. 434.It Cm KerberosAuthentication 435Specifies whether Kerberos authentication is allowed. 436This can be in the form of a Kerberos ticket, or if 437.Cm PasswordAuthentication 438is yes, the password provided by the user will be validated through 439the Kerberos KDC. 440To use this option, the server needs a 441Kerberos servtab which allows the verification of the KDC's identity. 442Default is 443.Dq yes . 444.It Cm KerberosOrLocalPasswd 445If set then if password authentication through Kerberos fails then 446the password will be validated via any additional local mechanism 447such as 448.Pa /etc/passwd . 449Default is 450.Dq yes . 451.It Cm KerberosTgtPassing 452Specifies whether a Kerberos TGT may be forwarded to the server. 453Default is 454.Dq no , 455as this only works when the Kerberos KDC is actually an AFS kaserver. 456.It Cm KerberosTicketCleanup 457Specifies whether to automatically destroy the user's ticket cache 458file on logout. 459Default is 460.Dq yes . 461.It Cm KeyRegenerationInterval 462The server key is automatically regenerated after this many seconds 463(if it has been used). 464The purpose of regeneration is to prevent 465decrypting captured sessions by later breaking into the machine and 466stealing the keys. 467The key is never stored anywhere. 468If the value is 0, the key is never regenerated. 469The default is 3600 (seconds). 470.It Cm ListenAddress 471Specifies what local address 472.Nm 473should listen on. 474The default is to listen to all local addresses. 475Multiple options of this type are permitted. 476Additionally, the 477.Cm Ports 478options must precede this option. 479.It Cm LoginGraceTime 480The server disconnects after this time if the user has not 481successfully logged in. 482If the value is 0, there is no time limit. 483The default is 120 (seconds). 484.It Cm LogLevel 485Gives the verbosity level that is used when logging messages from 486.Nm sshd . 487The possible values are: 488QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. 489The default is INFO. 490Logging with level DEBUG violates the privacy of users 491and is not recommended. 492.It Cm MaxStartups 493Specifies the maximum number of concurrent unauthenticated connections to the 494.Nm 495daemon. 496Additional connections will be dropped until authentication succeeds or the 497.Cm LoginGraceTime 498expires for a connection. 499The default is 10. 500.Pp 501Alternatively, random early drop can be enabled by specifying 502the three colon separated values 503.Dq start:rate:full 504(e.g., "10:30:60"). 505.Nm 506will refuse connection attempts with a probabillity of 507.Dq rate/100 508(30%) 509if there are currently 510.Dq start 511(10) 512unauthenticated connections. 513The probabillity increases linearly and all connection attempts 514are refused if the number of unauthenticated connections reaches 515.Dq full 516(60). 517.It Cm PasswordAuthentication 518Specifies whether password authentication is allowed. 519The default is 520.Dq yes . 521Note that this option applies to both protocol versions 1 and 2. 522.It Cm PermitEmptyPasswords 523When password authentication is allowed, it specifies whether the 524server allows login to accounts with empty password strings. 525The default is 526.Dq no . 527.It Cm PermitRootLogin 528Specifies whether the root can log in using 529.Xr ssh 1 . 530The argument must be 531.Dq yes , 532.Dq without-password 533or 534.Dq no . 535The default is 536.Dq no . 537If this options is set to 538.Dq without-password 539only password authentication is disabled for root. 540.Pp 541Root login with RSA authentication when the 542.Ar command 543option has been 544specified will be allowed regardless of the value of this setting 545(which may be useful for taking remote backups even if root login is 546normally not allowed). 547.It Cm PidFile 548Specifies the file that contains the process identifier of the 549.Nm 550daemon. 551The default is 552.Pa /var/run/sshd.pid . 553.It Cm Port 554Specifies the port number that 555.Nm 556listens on. 557The default is 22. 558Multiple options of this type are permitted. 559.It Cm PrintMotd 560Specifies whether 561.Nm 562should print 563.Pa /etc/motd 564when a user logs in interactively. 565(On some systems it is also printed by the shell, 566.Pa /etc/profile , 567or equivalent.) 568The default is 569.Dq yes . 570.It Cm Protocol 571Specifies the protocol versions 572.Nm 573should support. 574The possible values are 575.Dq 1 576and 577.Dq 2 . 578Multiple versions must be comma-separated. 579The default is 580.Dq 1 . 581.It Cm RandomSeed 582Obsolete - accepted and ignored with a warning. 583Random number generation uses other techniques. 584.It Cm RhostsAuthentication 585Specifies whether authentication using rhosts or 586.Pa /etc/hosts.equiv 587files is sufficient. 588Normally, this method should not be permitted because it is insecure. 589.Cm RhostsRSAAuthentication 590should be used 591instead, because it performs RSA-based host authentication in addition 592to normal rhosts or 593.Pa /etc/hosts.equiv 594authentication. 595The default is 596.Dq no . 597.It Cm RhostsRSAAuthentication 598Specifies whether rhosts or 599.Pa /etc/hosts.equiv 600authentication together 601with successful RSA host authentication is allowed. 602The default is 603.Dq no . 604.It Cm RSAAuthentication 605Specifies whether pure RSA authentication is allowed. 606The default is 607.Dq yes . 608Note that this option applies to protocol version 1 only. 609.It Cm ServerKeyBits 610Defines the number of bits in the server key. 611The minimum value is 512, and the default is 768. 612.It Cm SkeyAuthentication 613Specifies whether 614.Xr skey 1 615authentication is allowed. 616The default is 617.Dq yes . 618Note that OPIE authentication is enabled only if 619.Cm PasswordAuthentication 620is allowed, too. 621.It Cm StrictModes 622Specifies whether 623.Nm 624should check file modes and ownership of the 625user's files and home directory before accepting login. 626This is normally desirable because novices sometimes accidentally leave their 627directory or files world-writable. 628The default is 629.Dq yes . 630.It Cm Subsystem 631Configures an external subsystem (e.g., file transfer daemon). 632Arguments should be a subsystem name and a command to execute upon subsystem 633request. 634The command 635.Xr sftp-server 8 636implements the 637.Dq sftp 638file transfer subsystem. 639By default no subsystems are defined. 640Note that this option applies to protocol version 2 only. 641.It Cm SyslogFacility 642Gives the facility code that is used when logging messages from 643.Nm sshd . 644The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 645LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 646The default is AUTH. 647.It Cm UseLogin 648Specifies whether 649.Xr login 1 650is used for interactive login sessions. 651Note that 652.Xr login 1 653is never used for remote command execution. 654The default is 655.Dq no . 656.It Cm X11DisplayOffset 657Specifies the first display number available for 658.Nm sshd Ns 's 659X11 forwarding. 660This prevents 661.Nm 662from interfering with real X11 servers. 663The default is 10. 664.It Cm X11Forwarding 665Specifies whether X11 forwarding is permitted. 666The default is 667.Dq no . 668Note that disabling X11 forwarding does not improve security in any 669way, as users can always install their own forwarders. 670.It Cm XAuthLocation 671Specifies the location of the 672.Xr xauth 1 673program. 674The default is 675.Pa /usr/X11R6/bin/xauth . 676.El 677.Sh LOGIN PROCESS 678When a user successfully logs in, 679.Nm 680does the following: 681.Bl -enum -offset indent 682.It 683If the login is on a tty, and no command has been specified, 684prints last login time and 685.Pa /etc/motd 686(unless prevented in the configuration file or by 687.Pa $HOME/.hushlogin ; 688see the 689.Sx FILES 690section). 691.It 692If the login is on a tty, records login time. 693.It 694Checks 695.Pa /etc/nologin and 696.Pa /var/run/nologin ; 697if one exists, it prints the contents and quits 698(unless root). 699.It 700Changes to run with normal user privileges. 701.It 702Sets up basic environment. 703.It 704Reads 705.Pa $HOME/.ssh/environment 706if it exists. 707.It 708Changes to user's home directory. 709.It 710If 711.Pa $HOME/.ssh/rc 712exists, runs it; else if 713.Pa /etc/ssh/sshrc 714exists, runs 715it; otherwise runs 716.Xr xauth 1 . 717The 718.Dq rc 719files are given the X11 720authentication protocol and cookie (if applicable) in standard input. 721.It 722Runs user's shell or command. 723.El 724.Sh AUTHORIZED_KEYS FILE FORMAT 725The 726.Pa $HOME/.ssh/authorized_keys 727file lists the RSA keys that are 728permitted for RSA authentication in SSH protocols 1.3 and 1.5 729Similarly, the 730.Pa $HOME/.ssh/authorized_keys2 731file lists the DSA keys that are 732permitted for DSA authentication in SSH protocol 2.0. 733Each line of the file contains one 734key (empty lines and lines starting with a 735.Ql # 736are ignored as 737comments). 738Each line consists of the following fields, separated by 739spaces: options, bits, exponent, modulus, comment. 740The options field 741is optional; its presence is determined by whether the line starts 742with a number or not (the option field never starts with a number). 743The bits, exponent, modulus and comment fields give the RSA key; the 744comment field is not used for anything (but may be convenient for the 745user to identify the key). 746.Pp 747Note that lines in this file are usually several hundred bytes long 748(because of the size of the RSA key modulus). 749You don't want to type them in; instead, copy the 750.Pa identity.pub 751file and edit it. 752.Pp 753The options (if present) consist of comma-separated option 754specifications. 755No spaces are permitted, except within double quotes. 756The following option specifications are supported: 757.Bl -tag -width Ds 758.It Cm from="pattern-list" 759Specifies that in addition to RSA authentication, the canonical name 760of the remote host must be present in the comma-separated list of 761patterns 762.Pf ( Ql * 763and 764.Ql ? 765serve as wildcards). 766The list may also contain 767patterns negated by prefixing them with 768.Ql ! ; 769if the canonical host name matches a negated pattern, the key is not accepted. 770The purpose 771of this option is to optionally increase security: RSA authentication 772by itself does not trust the network or name servers or anything (but 773the key); however, if somebody somehow steals the key, the key 774permits an intruder to log in from anywhere in the world. 775This additional option makes using a stolen key more difficult (name 776servers and/or routers would have to be compromised in addition to 777just the key). 778.It Cm command="command" 779Specifies that the command is executed whenever this key is used for 780authentication. 781The command supplied by the user (if any) is ignored. 782The command is run on a pty if the connection requests a pty; 783otherwise it is run without a tty. 784A quote may be included in the command by quoting it with a backslash. 785This option might be useful 786to restrict certain RSA keys to perform just a specific operation. 787An example might be a key that permits remote backups but nothing else. 788Note that the client may specify TCP/IP and/or X11 789forwarding unless they are explicitly prohibited. 790.It Cm environment="NAME=value" 791Specifies that the string is to be added to the environment when 792logging in using this key. 793Environment variables set this way 794override other default environment values. 795Multiple options of this type are permitted. 796.It Cm no-port-forwarding 797Forbids TCP/IP forwarding when this key is used for authentication. 798Any port forward requests by the client will return an error. 799This might be used, e.g., in connection with the 800.Cm command 801option. 802.It Cm no-X11-forwarding 803Forbids X11 forwarding when this key is used for authentication. 804Any X11 forward requests by the client will return an error. 805.It Cm no-agent-forwarding 806Forbids authentication agent forwarding when this key is used for 807authentication. 808.It Cm no-pty 809Prevents tty allocation (a request to allocate a pty will fail). 810.El 811.Ss Examples 812.Bd -literal 8131024 33 12121...312314325 ylo@foo.bar 814from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula 815command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 backup.hut.fi 816.Ed 817.Sh SSH_KNOWN_HOSTS FILE FORMAT 818The 819.Pa /etc/ssh/ssh_known_hosts , 820.Pa /etc/ssh/ssh_known_hosts2 , 821.Pa $HOME/.ssh/known_hosts , 822and 823.Pa $HOME/.ssh/known_hosts2 824files contain host public keys for all known hosts. 825The global file should 826be prepared by the administrator (optional), and the per-user file is 827maintained automatically: whenever the user connects from an unknown host 828its key is added to the per-user file. 829.Pp 830Each line in these files contains the following fields: hostnames, 831bits, exponent, modulus, comment. 832The fields are separated by spaces. 833.Pp 834Hostnames is a comma-separated list of patterns ('*' and '?' act as 835wildcards); each pattern in turn is matched against the canonical host 836name (when authenticating a client) or against the user-supplied 837name (when authenticating a server). 838A pattern may also be preceded by 839.Ql ! 840to indicate negation: if the host name matches a negated 841pattern, it is not accepted (by that line) even if it matched another 842pattern on the line. 843.Pp 844Bits, exponent, and modulus are taken directly from the RSA host key; they 845can be obtained, e.g., from 846.Pa /etc/ssh/ssh_host_key.pub . 847The optional comment field continues to the end of the line, and is not used. 848.Pp 849Lines starting with 850.Ql # 851and empty lines are ignored as comments. 852.Pp 853When performing host authentication, authentication is accepted if any 854matching line has the proper key. 855It is thus permissible (but not 856recommended) to have several lines or different host keys for the same 857names. 858This will inevitably happen when short forms of host names 859from different domains are put in the file. 860It is possible 861that the files contain conflicting information; authentication is 862accepted if valid information can be found from either file. 863.Pp 864Note that the lines in these files are typically hundreds of characters 865long, and you definitely don't want to type in the host keys by hand. 866Rather, generate them by a script 867or by taking 868.Pa /etc/ssh/ssh_host_key.pub 869and adding the host names at the front. 870.Ss Examples 871.Bd -literal 872closenet,closenet.hut.fi,...,130.233.208.41 1024 37 159...93 closenet.hut.fi 873.Ed 874.Sh FILES 875.Bl -tag -width Ds 876.It Pa /etc/ssh/sshd_config 877Contains configuration data for 878.Nm sshd . 879This file should be writable by root only, but it is recommended 880(though not necessary) that it be world-readable. 881.It Pa /etc/ssh/ssh_host_key 882Contains the private part of the host key. 883This file should only be owned by root, readable only by root, and not 884accessible to others. 885Note that 886.Nm 887does not start if this file is group/world-accessible. 888.It Pa /etc/ssh/ssh_host_key.pub 889Contains the public part of the host key. 890This file should be world-readable but writable only by 891root. 892Its contents should match the private part. 893This file is not 894really used for anything; it is only provided for the convenience of 895the user so its contents can be copied to known hosts files. 896These two files are created using 897.Xr ssh-keygen 1 . 898.It Pa /var/run/sshd.pid 899Contains the process ID of the 900.Nm 901listening for connections (if there are several daemons running 902concurrently for different ports, this contains the pid of the one 903started last). 904The content of this file is not sensitive; it can be world-readable. 905.It Pa $HOME/.ssh/authorized_keys 906Lists the RSA keys that can be used to log into the user's account. 907This file must be readable by root (which may on some machines imply 908it being world-readable if the user's home directory resides on an NFS 909volume). 910It is recommended that it not be accessible by others. 911The format of this file is described above. 912Users will place the contents of their 913.Pa identity.pub 914files into this file, as described in 915.Xr ssh-keygen 1 . 916.It Pa $HOME/.ssh/authorized_keys2 917Lists the DSA keys that can be used to log into the user's account. 918This file must be readable by root (which may on some machines imply 919it being world-readable if the user's home directory resides on an NFS 920volume). 921It is recommended that it not be accessible by others. 922The format of this file is described above. 923Users will place the contents of their 924.Pa id_dsa.pub 925files into this file, as described in 926.Xr ssh-keygen 1 . 927.It Pa "/etc/ssh/ssh_known_hosts" and "$HOME/.ssh/known_hosts" 928These files are consulted when using rhosts with RSA host 929authentication to check the public key of the host. 930The key must be listed in one of these files to be accepted. 931The client uses the same files 932to verify that the remote host is the one it intended to connect. 933These files should be writable only by root/the owner. 934.Pa /etc/ssh/ssh_known_hosts 935should be world-readable, and 936.Pa $HOME/.ssh/known_hosts 937can but need not be world-readable. 938.It Pa /etc/nologin 939If this file exists, 940.Nm 941refuses to let anyone except root log in. 942The contents of the file 943are displayed to anyone trying to log in, and non-root connections are 944refused. 945The file should be world-readable. 946.It Pa /etc/hosts.allow 947If compiled with 948.Sy LIBWRAP 949support, tcp-wrappers access controls may be defined here as described in 950.Xr hosts_access 5 . 951.It Pa $HOME/.rhosts 952This file contains host-username pairs, separated by a space, one per 953line. 954The given user on the corresponding host is permitted to log in 955without password. 956The same file is used by rlogind and rshd. 957The file must 958be writable only by the user; it is recommended that it not be 959accessible by others. 960.Pp 961If is also possible to use netgroups in the file. 962Either host or user 963name may be of the form +@groupname to specify all hosts or all users 964in the group. 965.It Pa $HOME/.shosts 966For ssh, 967this file is exactly the same as for 968.Pa .rhosts . 969However, this file is 970not used by rlogin and rshd, so using this permits access using SSH only. 971.It Pa /etc/hosts.equiv 972This file is used during 973.Pa .rhosts 974authentication. 975In the simplest form, this file contains host names, one per line. 976Users on 977those hosts are permitted to log in without a password, provided they 978have the same user name on both machines. 979The host name may also be 980followed by a user name; such users are permitted to log in as 981.Em any 982user on this machine (except root). 983Additionally, the syntax 984.Dq +@group 985can be used to specify netgroups. 986Negated entries start with 987.Ql \&- . 988.Pp 989If the client host/user is successfully matched in this file, login is 990automatically permitted provided the client and server user names are the 991same. 992Additionally, successful RSA host authentication is normally required. 993This file must be writable only by root; it is recommended 994that it be world-readable. 995.Pp 996.Sy "Warning: It is almost never a good idea to use user names in" 997.Pa hosts.equiv . 998Beware that it really means that the named user(s) can log in as 999.Em anybody , 1000which includes bin, daemon, adm, and other accounts that own critical 1001binaries and directories. 1002Using a user name practically grants the user root access. 1003The only valid use for user names that I can think 1004of is in negative entries. 1005.Pp 1006Note that this warning also applies to rsh/rlogin. 1007.It Pa /etc/ssh/shosts.equiv 1008This is processed exactly as 1009.Pa /etc/hosts.equiv . 1010However, this file may be useful in environments that want to run both 1011rsh/rlogin and ssh. 1012.It Pa $HOME/.ssh/environment 1013This file is read into the environment at login (if it exists). 1014It can only contain empty lines, comment lines (that start with 1015.Ql # ) , 1016and assignment lines of the form name=value. 1017The file should be writable 1018only by the user; it need not be readable by anyone else. 1019.It Pa $HOME/.ssh/rc 1020If this file exists, it is run with 1021.Pa /bin/sh 1022after reading the 1023environment files but before starting the user's shell or command. 1024If X11 spoofing is in use, this will receive the "proto cookie" pair in 1025standard input (and 1026.Ev DISPLAY 1027in environment). 1028This must call 1029.Xr xauth 1 1030in that case. 1031.Pp 1032The primary purpose of this file is to run any initialization routines 1033which may be needed before the user's home directory becomes 1034accessible; AFS is a particular example of such an environment. 1035.Pp 1036This file will probably contain some initialization code followed by 1037something similar to: 1038.Bd -literal -offset indent 1039if [ -n "$DISPLAY" ] && read proto cookie; then 1040 echo add $DISPLAY $proto $cookie | xauth -q - 1041fi 1042.Ed 1043.Pp 1044If this file does not exist, 1045.Pa /etc/ssh/sshrc 1046is run, and if that 1047does not exist either, 1048.Xr xauth 1 1049is used to store the cookie. 1050.Pp 1051This file should be writable only by the user, and need not be 1052readable by anyone else. 1053.It Pa /etc/ssh/sshrc 1054Like 1055.Pa $HOME/.ssh/rc . 1056This can be used to specify 1057machine-specific login-time initializations globally. 1058This file should be writable only by root, and should be world-readable. 1059.El 1060.Sh AUTHOR 1061OpenSSH 1062is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen, 1063but with bugs removed and newer features re-added. 1064Rapidly after the 10651.2.12 release, newer versions of the original ssh bore successively 1066more restrictive licenses, and thus demand for a free version was born. 1067.Pp 1068This version of OpenSSH 1069.Bl -bullet 1070.It 1071has all components of a restrictive nature (i.e., patents, see 1072.Xr ssl 8 ) 1073directly removed from the source code; any licensed or patented components 1074are chosen from 1075external libraries. 1076.It 1077has been updated to support SSH protocol 1.5 and 2, making it compatible with 1078all other SSH clients and servers. 1079.It 1080contains added support for 1081.Xr kerberos 8 1082authentication and ticket passing. 1083.It 1084supports one-time password authentication with 1085.Xr skey 1 . 1086.El 1087.Pp 1088OpenSSH has been created by Aaron Campbell, Bob Beck, Markus Friedl, 1089Niels Provos, Theo de Raadt, and Dug Song. 1090.Pp 1091The support for SSH protocol 2 was written by Markus Friedl. 1092.Sh SEE ALSO 1093.Xr scp 1 , 1094.Xr sftp-server 8 , 1095.Xr ssh 1 , 1096.Xr ssh-add 1 , 1097.Xr ssh-agent 1 , 1098.Xr ssh-keygen 1 , 1099.Xr ssl 8 , 1100.Xr rlogin 1 , 1101.Xr rsh 1 1102