1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.266 2012/06/18 12:07:07 dtucker Exp $ 37.Dd $Mdocdate: June 18 2012 $ 38.Dt SSHD 8 39.Os 40.Sh NAME 41.Nm sshd 42.Nd OpenSSH SSH daemon 43.Sh SYNOPSIS 44.Nm sshd 45.Bk -words 46.Op Fl 46DdeiqTt 47.Op Fl b Ar bits 48.Op Fl C Ar connection_spec 49.Op Fl c Ar host_certificate_file 50.Op Fl f Ar config_file 51.Op Fl g Ar login_grace_time 52.Op Fl h Ar host_key_file 53.Op Fl k Ar key_gen_time 54.Op Fl o Ar option 55.Op Fl p Ar port 56.Op Fl u Ar len 57.Ek 58.Sh DESCRIPTION 59.Nm 60(OpenSSH Daemon) is the daemon program for 61.Xr ssh 1 . 62Together these programs replace 63.Xr rlogin 1 64and 65.Xr rsh 1 , 66and provide secure encrypted communications between two untrusted hosts 67over an insecure network. 68.Pp 69.Nm 70listens for connections from clients. 71It is normally started at boot from 72.Pa /etc/rc . 73It forks a new 74daemon for each incoming connection. 75The forked daemons handle 76key exchange, encryption, authentication, command execution, 77and data exchange. 78.Pp 79.Nm 80can be configured using command-line options or a configuration file 81(by default 82.Xr sshd_config 5 ) ; 83command-line options override values specified in the 84configuration file. 85.Nm 86rereads its configuration file when it receives a hangup signal, 87.Dv SIGHUP , 88by executing itself with the name and options it was started with, e.g.\& 89.Pa /usr/sbin/sshd . 90.Pp 91The options are as follows: 92.Bl -tag -width Ds 93.It Fl 4 94Forces 95.Nm 96to use IPv4 addresses only. 97.It Fl 6 98Forces 99.Nm 100to use IPv6 addresses only. 101.It Fl b Ar bits 102Specifies the number of bits in the ephemeral protocol version 1 103server key (default 1024). 104.It Fl C Ar connection_spec 105Specify the connection parameters to use for the 106.Fl T 107extended test mode. 108If provided, any 109.Cm Match 110directives in the configuration file 111that would apply to the specified user, host, and address will be set before 112the configuration is written to standard output. 113The connection parameters are supplied as keyword=value pairs. 114The keywords are 115.Dq user , 116.Dq host , 117.Dq laddr , 118.Dq lport , 119and 120.Dq addr . 121All are required and may be supplied in any order, either with multiple 122.Fl C 123options or as a comma-separated list. 124.It Fl c Ar host_certificate_file 125Specifies a path to a certificate file to identify 126.Nm 127during key exchange. 128The certificate file must match a host key file specified using the 129.Fl h 130option or the 131.Cm HostKey 132configuration directive. 133.It Fl D 134When this option is specified, 135.Nm 136will not detach and does not become a daemon. 137This allows easy monitoring of 138.Nm sshd . 139.It Fl d 140Debug mode. 141The server sends verbose debug output to standard error, 142and does not put itself in the background. 143The server also will not fork and will only process one connection. 144This option is only intended for debugging for the server. 145Multiple 146.Fl d 147options increase the debugging level. 148Maximum is 3. 149.It Fl e 150When this option is specified, 151.Nm 152will send the output to the standard error instead of the system log. 153.It Fl f Ar config_file 154Specifies the name of the configuration file. 155The default is 156.Pa /etc/ssh/sshd_config . 157.Nm 158refuses to start if there is no configuration file. 159.It Fl g Ar login_grace_time 160Gives the grace time for clients to authenticate themselves (default 161120 seconds). 162If the client fails to authenticate the user within 163this many seconds, the server disconnects and exits. 164A value of zero indicates no limit. 165.It Fl h Ar host_key_file 166Specifies a file from which a host key is read. 167This option must be given if 168.Nm 169is not run as root (as the normal 170host key files are normally not readable by anyone but root). 171The default is 172.Pa /etc/ssh/ssh_host_key 173for protocol version 1, and 174.Pa /etc/ssh/ssh_host_dsa_key , 175.Pa /etc/ssh/ssh_host_ecdsa_key 176and 177.Pa /etc/ssh/ssh_host_rsa_key 178for protocol version 2. 179It is possible to have multiple host key files for 180the different protocol versions and host key algorithms. 181.It Fl i 182Specifies that 183.Nm 184is being run from 185.Xr inetd 8 . 186.Nm 187is normally not run 188from inetd because it needs to generate the server key before it can 189respond to the client, and this may take tens of seconds. 190Clients would have to wait too long if the key was regenerated every time. 191However, with small key sizes (e.g. 512) using 192.Nm 193from inetd may 194be feasible. 195.It Fl k Ar key_gen_time 196Specifies how often the ephemeral protocol version 1 server key is 197regenerated (default 3600 seconds, or one hour). 198The motivation for regenerating the key fairly 199often is that the key is not stored anywhere, and after about an hour 200it becomes impossible to recover the key for decrypting intercepted 201communications even if the machine is cracked into or physically 202seized. 203A value of zero indicates that the key will never be regenerated. 204.It Fl o Ar option 205Can be used to give options in the format used in the configuration file. 206This is useful for specifying options for which there is no separate 207command-line flag. 208For full details of the options, and their values, see 209.Xr sshd_config 5 . 210.It Fl p Ar port 211Specifies the port on which the server listens for connections 212(default 22). 213Multiple port options are permitted. 214Ports specified in the configuration file with the 215.Cm Port 216option are ignored when a command-line port is specified. 217Ports specified using the 218.Cm ListenAddress 219option override command-line ports. 220.It Fl q 221Quiet mode. 222Nothing is sent to the system log. 223Normally the beginning, 224authentication, and termination of each connection is logged. 225.It Fl T 226Extended test mode. 227Check the validity of the configuration file, output the effective configuration 228to stdout and then exit. 229Optionally, 230.Cm Match 231rules may be applied by specifying the connection parameters using one or more 232.Fl C 233options. 234.It Fl t 235Test mode. 236Only check the validity of the configuration file and sanity of the keys. 237This is useful for updating 238.Nm 239reliably as configuration options may change. 240.It Fl u Ar len 241This option is used to specify the size of the field 242in the 243.Li utmp 244structure that holds the remote host name. 245If the resolved host name is longer than 246.Ar len , 247the dotted decimal value will be used instead. 248This allows hosts with very long host names that 249overflow this field to still be uniquely identified. 250Specifying 251.Fl u0 252indicates that only dotted decimal addresses 253should be put into the 254.Pa utmp 255file. 256.Fl u0 257may also be used to prevent 258.Nm 259from making DNS requests unless the authentication 260mechanism or configuration requires it. 261Authentication mechanisms that may require DNS include 262.Cm RhostsRSAAuthentication , 263.Cm HostbasedAuthentication , 264and using a 265.Cm from="pattern-list" 266option in a key file. 267Configuration options that require DNS include using a 268USER@HOST pattern in 269.Cm AllowUsers 270or 271.Cm DenyUsers . 272.El 273.Sh AUTHENTICATION 274The OpenSSH SSH daemon supports SSH protocols 1 and 2. 275The default is to use protocol 2 only, 276though this can be changed via the 277.Cm Protocol 278option in 279.Xr sshd_config 5 . 280Protocol 2 supports DSA, ECDSA and RSA keys; 281protocol 1 only supports RSA keys. 282For both protocols, 283each host has a host-specific key, 284normally 2048 bits, 285used to identify the host. 286.Pp 287Forward security for protocol 1 is provided through 288an additional server key, 289normally 768 bits, 290generated when the server starts. 291This key is normally regenerated every hour if it has been used, and 292is never stored on disk. 293Whenever a client connects, the daemon responds with its public 294host and server keys. 295The client compares the 296RSA host key against its own database to verify that it has not changed. 297The client then generates a 256-bit random number. 298It encrypts this 299random number using both the host key and the server key, and sends 300the encrypted number to the server. 301Both sides then use this 302random number as a session key which is used to encrypt all further 303communications in the session. 304The rest of the session is encrypted 305using a conventional cipher, currently Blowfish or 3DES, with 3DES 306being used by default. 307The client selects the encryption algorithm 308to use from those offered by the server. 309.Pp 310For protocol 2, 311forward security is provided through a Diffie-Hellman key agreement. 312This key agreement results in a shared session key. 313The rest of the session is encrypted using a symmetric cipher, currently 314128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES. 315The client selects the encryption algorithm 316to use from those offered by the server. 317Additionally, session integrity is provided 318through a cryptographic message authentication code 319(hmac-md5, hmac-sha1, umac-64, hmac-ripemd160, 320hmac-sha2-256 or hmac-sha2-512). 321.Pp 322Finally, the server and the client enter an authentication dialog. 323The client tries to authenticate itself using 324host-based authentication, 325public key authentication, 326challenge-response authentication, 327or password authentication. 328.Pp 329If the client successfully authenticates itself, a dialog for 330preparing the session is entered. 331At this time the client may request 332things like allocating a pseudo-tty, forwarding X11 connections, 333forwarding TCP connections, or forwarding the authentication agent 334connection over the secure channel. 335.Pp 336After this, the client either requests a shell or execution of a command. 337The sides then enter session mode. 338In this mode, either side may send 339data at any time, and such data is forwarded to/from the shell or 340command on the server side, and the user terminal in the client side. 341.Pp 342When the user program terminates and all forwarded X11 and other 343connections have been closed, the server sends command exit status to 344the client, and both sides exit. 345.Sh LOGIN PROCESS 346When a user successfully logs in, 347.Nm 348does the following: 349.Bl -enum -offset indent 350.It 351If the login is on a tty, and no command has been specified, 352prints last login time and 353.Pa /etc/motd 354(unless prevented in the configuration file or by 355.Pa ~/.hushlogin ; 356see the 357.Sx FILES 358section). 359.It 360If the login is on a tty, records login time. 361.It 362Checks 363.Pa /etc/nologin ; 364if it exists, prints contents and quits 365(unless root). 366.It 367Changes to run with normal user privileges. 368.It 369Sets up basic environment. 370.It 371Reads the file 372.Pa ~/.ssh/environment , 373if it exists, and users are allowed to change their environment. 374See the 375.Cm PermitUserEnvironment 376option in 377.Xr sshd_config 5 . 378.It 379Changes to user's home directory. 380.It 381If 382.Pa ~/.ssh/rc 383exists, runs it; else if 384.Pa /etc/ssh/sshrc 385exists, runs 386it; otherwise runs xauth. 387The 388.Dq rc 389files are given the X11 390authentication protocol and cookie in standard input. 391See 392.Sx SSHRC , 393below. 394.It 395Runs user's shell or command. 396.El 397.Sh SSHRC 398If the file 399.Pa ~/.ssh/rc 400exists, 401.Xr sh 1 402runs it after reading the 403environment files but before starting the user's shell or command. 404It must not produce any output on stdout; stderr must be used 405instead. 406If X11 forwarding is in use, it will receive the "proto cookie" pair in 407its standard input (and 408.Ev DISPLAY 409in its environment). 410The script must call 411.Xr xauth 1 412because 413.Nm 414will not run xauth automatically to add X11 cookies. 415.Pp 416The primary purpose of this file is to run any initialization routines 417which may be needed before the user's home directory becomes 418accessible; AFS is a particular example of such an environment. 419.Pp 420This file will probably contain some initialization code followed by 421something similar to: 422.Bd -literal -offset 3n 423if read proto cookie && [ -n "$DISPLAY" ]; then 424 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 425 # X11UseLocalhost=yes 426 echo add unix:`echo $DISPLAY | 427 cut -c11-` $proto $cookie 428 else 429 # X11UseLocalhost=no 430 echo add $DISPLAY $proto $cookie 431 fi | xauth -q - 432fi 433.Ed 434.Pp 435If this file does not exist, 436.Pa /etc/ssh/sshrc 437is run, and if that 438does not exist either, xauth is used to add the cookie. 439.Sh AUTHORIZED_KEYS FILE FORMAT 440.Cm AuthorizedKeysFile 441specifies the files containing public keys for 442public key authentication; 443if none is specified, the default is 444.Pa ~/.ssh/authorized_keys 445and 446.Pa ~/.ssh/authorized_keys2 . 447Each line of the file contains one 448key (empty lines and lines starting with a 449.Ql # 450are ignored as 451comments). 452Protocol 1 public keys consist of the following space-separated fields: 453options, bits, exponent, modulus, comment. 454Protocol 2 public key consist of: 455options, keytype, base64-encoded key, comment. 456The options field is optional; 457its presence is determined by whether the line starts 458with a number or not (the options field never starts with a number). 459The bits, exponent, modulus, and comment fields give the RSA key for 460protocol version 1; the 461comment field is not used for anything (but may be convenient for the 462user to identify the key). 463For protocol version 2 the keytype is 464.Dq ecdsa-sha2-nistp256 , 465.Dq ecdsa-sha2-nistp384 , 466.Dq ecdsa-sha2-nistp521 , 467.Dq ssh-dss 468or 469.Dq ssh-rsa . 470.Pp 471Note that lines in this file are usually several hundred bytes long 472(because of the size of the public key encoding) up to a limit of 4738 kilobytes, which permits DSA keys up to 8 kilobits and RSA 474keys up to 16 kilobits. 475You don't want to type them in; instead, copy the 476.Pa identity.pub , 477.Pa id_dsa.pub , 478.Pa id_ecdsa.pub , 479or the 480.Pa id_rsa.pub 481file and edit it. 482.Pp 483.Nm 484enforces a minimum RSA key modulus size for protocol 1 485and protocol 2 keys of 768 bits. 486.Pp 487The options (if present) consist of comma-separated option 488specifications. 489No spaces are permitted, except within double quotes. 490The following option specifications are supported (note 491that option keywords are case-insensitive): 492.Bl -tag -width Ds 493.It Cm cert-authority 494Specifies that the listed key is a certification authority (CA) that is 495trusted to validate signed certificates for user authentication. 496.Pp 497Certificates may encode access restrictions similar to these key options. 498If both certificate restrictions and key options are present, the most 499restrictive union of the two is applied. 500.It Cm command="command" 501Specifies that the command is executed whenever this key is used for 502authentication. 503The command supplied by the user (if any) is ignored. 504The command is run on a pty if the client requests a pty; 505otherwise it is run without a tty. 506If an 8-bit clean channel is required, 507one must not request a pty or should specify 508.Cm no-pty . 509A quote may be included in the command by quoting it with a backslash. 510This option might be useful 511to restrict certain public keys to perform just a specific operation. 512An example might be a key that permits remote backups but nothing else. 513Note that the client may specify TCP and/or X11 514forwarding unless they are explicitly prohibited. 515The command originally supplied by the client is available in the 516.Ev SSH_ORIGINAL_COMMAND 517environment variable. 518Note that this option applies to shell, command or subsystem execution. 519Also note that this command may be superseded by either a 520.Xr sshd_config 5 521.Cm ForceCommand 522directive or a command embedded in a certificate. 523.It Cm environment="NAME=value" 524Specifies that the string is to be added to the environment when 525logging in using this key. 526Environment variables set this way 527override other default environment values. 528Multiple options of this type are permitted. 529Environment processing is disabled by default and is 530controlled via the 531.Cm PermitUserEnvironment 532option. 533This option is automatically disabled if 534.Cm UseLogin 535is enabled. 536.It Cm from="pattern-list" 537Specifies that in addition to public key authentication, either the canonical 538name of the remote host or its IP address must be present in the 539comma-separated list of patterns. 540See 541.Sx PATTERNS 542in 543.Xr ssh_config 5 544for more information on patterns. 545.Pp 546In addition to the wildcard matching that may be applied to hostnames or 547addresses, a 548.Cm from 549stanza may match IP addresses using CIDR address/masklen notation. 550.Pp 551The purpose of this option is to optionally increase security: public key 552authentication by itself does not trust the network or name servers or 553anything (but the key); however, if somebody somehow steals the key, the key 554permits an intruder to log in from anywhere in the world. 555This additional option makes using a stolen key more difficult (name 556servers and/or routers would have to be compromised in addition to 557just the key). 558.It Cm no-agent-forwarding 559Forbids authentication agent forwarding when this key is used for 560authentication. 561.It Cm no-port-forwarding 562Forbids TCP forwarding when this key is used for authentication. 563Any port forward requests by the client will return an error. 564This might be used, e.g. in connection with the 565.Cm command 566option. 567.It Cm no-pty 568Prevents tty allocation (a request to allocate a pty will fail). 569.It Cm no-user-rc 570Disables execution of 571.Pa ~/.ssh/rc . 572.It Cm no-X11-forwarding 573Forbids X11 forwarding when this key is used for authentication. 574Any X11 forward requests by the client will return an error. 575.It Cm permitopen="host:port" 576Limit local 577.Li ``ssh -L'' 578port forwarding such that it may only connect to the specified host and 579port. 580IPv6 addresses can be specified by enclosing the address in square brackets. 581Multiple 582.Cm permitopen 583options may be applied separated by commas. 584No pattern matching is performed on the specified hostnames, 585they must be literal domains or addresses. 586A port specification of 587.Cm * 588matches any port. 589.It Cm principals="principals" 590On a 591.Cm cert-authority 592line, specifies allowed principals for certificate authentication as a 593comma-separated list. 594At least one name from the list must appear in the certificate's 595list of principals for the certificate to be accepted. 596This option is ignored for keys that are not marked as trusted certificate 597signers using the 598.Cm cert-authority 599option. 600.It Cm tunnel="n" 601Force a 602.Xr tun 4 603device on the server. 604Without this option, the next available device will be used if 605the client requests a tunnel. 606.El 607.Pp 608An example authorized_keys file: 609.Bd -literal -offset 3n 610# Comments allowed at start of line 611ssh-rsa AAAAB3Nza...LiPk== user@example.net 612from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 613AAAAB2...19Q== john@example.net 614command="dump /home",no-pty,no-port-forwarding ssh-dss 615AAAAC3...51R== example.net 616permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-dss 617AAAAB5...21S== 618tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 619jane@example.net 620.Ed 621.Sh SSH_KNOWN_HOSTS FILE FORMAT 622The 623.Pa /etc/ssh/ssh_known_hosts 624and 625.Pa ~/.ssh/known_hosts 626files contain host public keys for all known hosts. 627The global file should 628be prepared by the administrator (optional), and the per-user file is 629maintained automatically: whenever the user connects from an unknown host, 630its key is added to the per-user file. 631.Pp 632Each line in these files contains the following fields: markers (optional), 633hostnames, bits, exponent, modulus, comment. 634The fields are separated by spaces. 635.Pp 636The marker is optional, but if it is present then it must be one of 637.Dq @cert-authority , 638to indicate that the line contains a certification authority (CA) key, 639or 640.Dq @revoked , 641to indicate that the key contained on the line is revoked and must not ever 642be accepted. 643Only one marker should be used on a key line. 644.Pp 645Hostnames is a comma-separated list of patterns 646.Pf ( Ql * 647and 648.Ql \&? 649act as 650wildcards); each pattern in turn is matched against the canonical host 651name (when authenticating a client) or against the user-supplied 652name (when authenticating a server). 653A pattern may also be preceded by 654.Ql \&! 655to indicate negation: if the host name matches a negated 656pattern, it is not accepted (by that line) even if it matched another 657pattern on the line. 658A hostname or address may optionally be enclosed within 659.Ql \&[ 660and 661.Ql \&] 662brackets then followed by 663.Ql \&: 664and a non-standard port number. 665.Pp 666Alternately, hostnames may be stored in a hashed form which hides host names 667and addresses should the file's contents be disclosed. 668Hashed hostnames start with a 669.Ql | 670character. 671Only one hashed hostname may appear on a single line and none of the above 672negation or wildcard operators may be applied. 673.Pp 674Bits, exponent, and modulus are taken directly from the RSA host key; they 675can be obtained, for example, from 676.Pa /etc/ssh/ssh_host_key.pub . 677The optional comment field continues to the end of the line, and is not used. 678.Pp 679Lines starting with 680.Ql # 681and empty lines are ignored as comments. 682.Pp 683When performing host authentication, authentication is accepted if any 684matching line has the proper key; either one that matches exactly or, 685if the server has presented a certificate for authentication, the key 686of the certification authority that signed the certificate. 687For a key to be trusted as a certification authority, it must use the 688.Dq @cert-authority 689marker described above. 690.Pp 691The known hosts file also provides a facility to mark keys as revoked, 692for example when it is known that the associated private key has been 693stolen. 694Revoked keys are specified by including the 695.Dq @revoked 696marker at the beginning of the key line, and are never accepted for 697authentication or as certification authorities, but instead will 698produce a warning from 699.Xr ssh 1 700when they are encountered. 701.Pp 702It is permissible (but not 703recommended) to have several lines or different host keys for the same 704names. 705This will inevitably happen when short forms of host names 706from different domains are put in the file. 707It is possible 708that the files contain conflicting information; authentication is 709accepted if valid information can be found from either file. 710.Pp 711Note that the lines in these files are typically hundreds of characters 712long, and you definitely don't want to type in the host keys by hand. 713Rather, generate them by a script, 714.Xr ssh-keyscan 1 715or by taking 716.Pa /etc/ssh/ssh_host_key.pub 717and adding the host names at the front. 718.Xr ssh-keygen 1 719also offers some basic automated editing for 720.Pa ~/.ssh/known_hosts 721including removing hosts matching a host name and converting all host 722names to their hashed representations. 723.Pp 724An example ssh_known_hosts file: 725.Bd -literal -offset 3n 726# Comments allowed at start of line 727closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 728cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 729# A hashed hostname 730|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 731AAAA1234.....= 732# A revoked key 733@revoked * ssh-rsa AAAAB5W... 734# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 735@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 736.Ed 737.Sh FILES 738.Bl -tag -width Ds -compact 739.It Pa ~/.hushlogin 740This file is used to suppress printing the last login time and 741.Pa /etc/motd , 742if 743.Cm PrintLastLog 744and 745.Cm PrintMotd , 746respectively, 747are enabled. 748It does not suppress printing of the banner specified by 749.Cm Banner . 750.Pp 751.It Pa ~/.rhosts 752This file is used for host-based authentication (see 753.Xr ssh 1 754for more information). 755On some machines this file may need to be 756world-readable if the user's home directory is on an NFS partition, 757because 758.Nm 759reads it as root. 760Additionally, this file must be owned by the user, 761and must not have write permissions for anyone else. 762The recommended 763permission for most machines is read/write for the user, and not 764accessible by others. 765.Pp 766.It Pa ~/.shosts 767This file is used in exactly the same way as 768.Pa .rhosts , 769but allows host-based authentication without permitting login with 770rlogin/rsh. 771.Pp 772.It Pa ~/.ssh/ 773This directory is the default location for all user-specific configuration 774and authentication information. 775There is no general requirement to keep the entire contents of this directory 776secret, but the recommended permissions are read/write/execute for the user, 777and not accessible by others. 778.Pp 779.It Pa ~/.ssh/authorized_keys 780Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in 781as this user. 782The format of this file is described above. 783The content of the file is not highly sensitive, but the recommended 784permissions are read/write for the user, and not accessible by others. 785.Pp 786If this file, the 787.Pa ~/.ssh 788directory, or the user's home directory are writable 789by other users, then the file could be modified or replaced by unauthorized 790users. 791In this case, 792.Nm 793will not allow it to be used unless the 794.Cm StrictModes 795option has been set to 796.Dq no . 797.Pp 798.It Pa ~/.ssh/environment 799This file is read into the environment at login (if it exists). 800It can only contain empty lines, comment lines (that start with 801.Ql # ) , 802and assignment lines of the form name=value. 803The file should be writable 804only by the user; it need not be readable by anyone else. 805Environment processing is disabled by default and is 806controlled via the 807.Cm PermitUserEnvironment 808option. 809.Pp 810.It Pa ~/.ssh/known_hosts 811Contains a list of host keys for all hosts the user has logged into 812that are not already in the systemwide list of known host keys. 813The format of this file is described above. 814This file should be writable only by root/the owner and 815can, but need not be, world-readable. 816.Pp 817.It Pa ~/.ssh/rc 818Contains initialization routines to be run before 819the user's home directory becomes accessible. 820This file should be writable only by the user, and need not be 821readable by anyone else. 822.Pp 823.It Pa /etc/hosts.allow 824.It Pa /etc/hosts.deny 825Access controls that should be enforced by tcp-wrappers are defined here. 826Further details are described in 827.Xr hosts_access 5 . 828.Pp 829.It Pa /etc/hosts.equiv 830This file is for host-based authentication (see 831.Xr ssh 1 ) . 832It should only be writable by root. 833.Pp 834.It Pa /etc/moduli 835Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". 836The file format is described in 837.Xr moduli 5 . 838.Pp 839.It Pa /etc/motd 840See 841.Xr motd 5 . 842.Pp 843.It Pa /etc/nologin 844If this file exists, 845.Nm 846refuses to let anyone except root log in. 847The contents of the file 848are displayed to anyone trying to log in, and non-root connections are 849refused. 850The file should be world-readable. 851.Pp 852.It Pa /etc/shosts.equiv 853This file is used in exactly the same way as 854.Pa hosts.equiv , 855but allows host-based authentication without permitting login with 856rlogin/rsh. 857.Pp 858.It Pa /etc/ssh/ssh_host_key 859.It Pa /etc/ssh/ssh_host_dsa_key 860.It Pa /etc/ssh/ssh_host_ecdsa_key 861.It Pa /etc/ssh/ssh_host_rsa_key 862These files contain the private parts of the host keys. 863These files should only be owned by root, readable only by root, and not 864accessible to others. 865Note that 866.Nm 867does not start if these files are group/world-accessible. 868.Pp 869.It Pa /etc/ssh/ssh_host_key.pub 870.It Pa /etc/ssh/ssh_host_dsa_key.pub 871.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 872.It Pa /etc/ssh/ssh_host_rsa_key.pub 873These files contain the public parts of the host keys. 874These files should be world-readable but writable only by 875root. 876Their contents should match the respective private parts. 877These files are not 878really used for anything; they are provided for the convenience of 879the user so their contents can be copied to known hosts files. 880These files are created using 881.Xr ssh-keygen 1 . 882.Pp 883.It Pa /etc/ssh/ssh_known_hosts 884Systemwide list of known host keys. 885This file should be prepared by the 886system administrator to contain the public host keys of all machines in the 887organization. 888The format of this file is described above. 889This file should be writable only by root/the owner and 890should be world-readable. 891.Pp 892.It Pa /etc/ssh/sshd_config 893Contains configuration data for 894.Nm sshd . 895The file format and configuration options are described in 896.Xr sshd_config 5 . 897.Pp 898.It Pa /etc/ssh/sshrc 899Similar to 900.Pa ~/.ssh/rc , 901it can be used to specify 902machine-specific login-time initializations globally. 903This file should be writable only by root, and should be world-readable. 904.Pp 905.It Pa /var/empty 906.Xr chroot 2 907directory used by 908.Nm 909during privilege separation in the pre-authentication phase. 910The directory should not contain any files and must be owned by root 911and not group or world-writable. 912.Pp 913.It Pa /var/run/sshd.pid 914Contains the process ID of the 915.Nm 916listening for connections (if there are several daemons running 917concurrently for different ports, this contains the process ID of the one 918started last). 919The content of this file is not sensitive; it can be world-readable. 920.El 921.Sh SEE ALSO 922.Xr scp 1 , 923.Xr sftp 1 , 924.Xr ssh 1 , 925.Xr ssh-add 1 , 926.Xr ssh-agent 1 , 927.Xr ssh-keygen 1 , 928.Xr ssh-keyscan 1 , 929.Xr chroot 2 , 930.Xr hosts_access 5 , 931.Xr login.conf 5 , 932.Xr moduli 5 , 933.Xr sshd_config 5 , 934.Xr inetd 8 , 935.Xr sftp-server 8 936.Sh AUTHORS 937OpenSSH is a derivative of the original and free 938ssh 1.2.12 release by Tatu Ylonen. 939Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 940Theo de Raadt and Dug Song 941removed many bugs, re-added newer features and 942created OpenSSH. 943Markus Friedl contributed the support for SSH 944protocol versions 1.5 and 2.0. 945Niels Provos and Markus Friedl contributed support 946for privilege separation. 947.Sh CAVEATS 948System security is not improved unless 949.Nm rshd , 950.Nm rlogind , 951and 952.Nm rexecd 953are disabled (thus completely disabling 954.Xr rlogin 955and 956.Xr rsh 957into the machine). 958