1*ba1276acSMatthew Dillon.\" $OpenBSD: ssh-keysign.8,v 1.18 2024/06/17 08:30:29 djm Exp $ 218de8d7fSPeter Avalos.\" 318de8d7fSPeter Avalos.\" Copyright (c) 2002 Markus Friedl. All rights reserved. 418de8d7fSPeter Avalos.\" 518de8d7fSPeter Avalos.\" Redistribution and use in source and binary forms, with or without 618de8d7fSPeter Avalos.\" modification, are permitted provided that the following conditions 718de8d7fSPeter Avalos.\" are met: 818de8d7fSPeter Avalos.\" 1. Redistributions of source code must retain the above copyright 918de8d7fSPeter Avalos.\" notice, this list of conditions and the following disclaimer. 1018de8d7fSPeter Avalos.\" 2. Redistributions in binary form must reproduce the above copyright 1118de8d7fSPeter Avalos.\" notice, this list of conditions and the following disclaimer in the 1218de8d7fSPeter Avalos.\" documentation and/or other materials provided with the distribution. 1318de8d7fSPeter Avalos.\" 1418de8d7fSPeter Avalos.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1518de8d7fSPeter Avalos.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1618de8d7fSPeter Avalos.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 1718de8d7fSPeter Avalos.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 1818de8d7fSPeter Avalos.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 1918de8d7fSPeter Avalos.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2018de8d7fSPeter Avalos.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2118de8d7fSPeter Avalos.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2218de8d7fSPeter Avalos.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 2318de8d7fSPeter Avalos.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 2418de8d7fSPeter Avalos.\" 25*ba1276acSMatthew Dillon.Dd $Mdocdate: June 17 2024 $ 2618de8d7fSPeter Avalos.Dt SSH-KEYSIGN 8 2718de8d7fSPeter Avalos.Os 2818de8d7fSPeter Avalos.Sh NAME 2918de8d7fSPeter Avalos.Nm ssh-keysign 300cbfa66cSDaniel Fojt.Nd OpenSSH helper for host-based authentication 3118de8d7fSPeter Avalos.Sh SYNOPSIS 3218de8d7fSPeter Avalos.Nm 3318de8d7fSPeter Avalos.Sh DESCRIPTION 3418de8d7fSPeter Avalos.Nm 3518de8d7fSPeter Avalosis used by 3618de8d7fSPeter Avalos.Xr ssh 1 3718de8d7fSPeter Avalosto access the local host keys and generate the digital signature 38e9778795SPeter Avalosrequired during host-based authentication. 3918de8d7fSPeter Avalos.Pp 4018de8d7fSPeter Avalos.Nm 4118de8d7fSPeter Avalosis disabled by default and can only be enabled in the 4218de8d7fSPeter Avalosglobal client configuration file 4318de8d7fSPeter Avalos.Pa /etc/ssh/ssh_config 4418de8d7fSPeter Avalosby setting 4518de8d7fSPeter Avalos.Cm EnableSSHKeysign 4618de8d7fSPeter Avalosto 4718de8d7fSPeter Avalos.Dq yes . 4818de8d7fSPeter Avalos.Pp 4918de8d7fSPeter Avalos.Nm 5018de8d7fSPeter Avalosis not intended to be invoked by the user, but from 5118de8d7fSPeter Avalos.Xr ssh 1 . 5218de8d7fSPeter AvalosSee 5318de8d7fSPeter Avalos.Xr ssh 1 5418de8d7fSPeter Avalosand 5518de8d7fSPeter Avalos.Xr sshd 8 5618de8d7fSPeter Avalosfor more information about host-based authentication. 5718de8d7fSPeter Avalos.Sh FILES 589f304aafSPeter Avalos.Bl -tag -width Ds -compact 5918de8d7fSPeter Avalos.It Pa /etc/ssh/ssh_config 6018de8d7fSPeter AvalosControls whether 6118de8d7fSPeter Avalos.Nm 6218de8d7fSPeter Avalosis enabled. 639f304aafSPeter Avalos.Pp 649f304aafSPeter Avalos.It Pa /etc/ssh/ssh_host_ecdsa_key 6536e94dc5SPeter Avalos.It Pa /etc/ssh/ssh_host_ed25519_key 669f304aafSPeter Avalos.It Pa /etc/ssh/ssh_host_rsa_key 6718de8d7fSPeter AvalosThese files contain the private parts of the host keys used to 6818de8d7fSPeter Avalosgenerate the digital signature. 6918de8d7fSPeter AvalosThey should be owned by root, readable only by root, and not 7018de8d7fSPeter Avalosaccessible to others. 7118de8d7fSPeter AvalosSince they are readable only by root, 7218de8d7fSPeter Avalos.Nm 7318de8d7fSPeter Avalosmust be set-uid root if host-based authentication is used. 749f304aafSPeter Avalos.Pp 759f304aafSPeter Avalos.It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub 7636e94dc5SPeter Avalos.It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub 779f304aafSPeter Avalos.It Pa /etc/ssh/ssh_host_rsa_key-cert.pub 78ee116499SAntonio Huete JimenezIf these files exist, they are assumed to contain public certificate 79856ea928SPeter Avalosinformation corresponding with the private keys above. 8018de8d7fSPeter Avalos.El 8118de8d7fSPeter Avalos.Sh SEE ALSO 8218de8d7fSPeter Avalos.Xr ssh 1 , 8318de8d7fSPeter Avalos.Xr ssh-keygen 1 , 8418de8d7fSPeter Avalos.Xr ssh_config 5 , 8518de8d7fSPeter Avalos.Xr sshd 8 8618de8d7fSPeter Avalos.Sh HISTORY 8718de8d7fSPeter Avalos.Nm 8818de8d7fSPeter Avalosfirst appeared in 8918de8d7fSPeter Avalos.Ox 3.2 . 9018de8d7fSPeter Avalos.Sh AUTHORS 9136e94dc5SPeter Avalos.An Markus Friedl Aq Mt markus@openbsd.org 92