1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $OpenBSD: sshd.8,v 1.139 2001/08/01 22:16:45 markus Exp $ 38.Dd September 25, 1999 39.Dt SSHD 8 40.Os 41.Sh NAME 42.Nm sshd 43.Nd OpenSSH SSH daemon 44.Sh SYNOPSIS 45.Nm sshd 46.Op Fl deiqD46 47.Op Fl b Ar bits 48.Op Fl f Ar config_file 49.Op Fl g Ar login_grace_time 50.Op Fl h Ar host_key_file 51.Op Fl k Ar key_gen_time 52.Op Fl p Ar port 53.Op Fl u Ar len 54.Op Fl V Ar client_protocol_id 55.Sh DESCRIPTION 56.Nm 57(SSH Daemon) is the daemon program for 58.Xr ssh 1 . 59Together these programs replace rlogin and rsh, and 60provide secure encrypted communications between two untrusted hosts 61over an insecure network. 62The programs are intended to be as easy to 63install and use as possible. 64.Pp 65.Nm 66is the daemon that listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74This implementation of 75.Nm 76supports both SSH protocol version 1 and 2 simultaneously. 77.Nm 78works as follows. 79.Pp 80.Ss SSH protocol version 1 81.Pp 82Each host has a host-specific RSA key 83(normally 1024 bits) used to identify the host. 84Additionally, when 85the daemon starts, it generates a server RSA key (normally 768 bits). 86This key is normally regenerated every hour if it has been used, and 87is never stored on disk. 88.Pp 89Whenever a client connects the daemon responds with its public 90host and server keys. 91The client compares the 92RSA host key against its own database to verify that it has not changed. 93The client then generates a 256 bit random number. 94It encrypts this 95random number using both the host key and the server key, and sends 96the encrypted number to the server. 97Both sides then use this 98random number as a session key which is used to encrypt all further 99communications in the session. 100The rest of the session is encrypted 101using a conventional cipher, currently Blowfish or 3DES, with 3DES 102being used by default. 103The client selects the encryption algorithm 104to use from those offered by the server. 105.Pp 106Next, the server and the client enter an authentication dialog. 107The client tries to authenticate itself using 108.Pa .rhosts 109authentication, 110.Pa .rhosts 111authentication combined with RSA host 112authentication, RSA challenge-response authentication, or password 113based authentication. 114.Pp 115Rhosts authentication is normally disabled 116because it is fundamentally insecure, but can be enabled in the server 117configuration file if desired. 118System security is not improved unless 119.Xr rshd 8 , 120.Xr rlogind 8 , 121.Xr rexecd 8 , 122and 123.Xr rexd 8 124are disabled (thus completely disabling 125.Xr rlogin 1 126and 127.Xr rsh 1 128into the machine). 129.Pp 130.Ss SSH protocol version 2 131.Pp 132Version 2 works similarly: 133Each host has a host-specific key (RSA or DSA) used to identify the host. 134However, when the daemon starts, it does not generate a server key. 135Forward security is provided through a Diffie-Hellman key agreement. 136This key agreement results in a shared session key. 137.Pp 138The rest of the session is encrypted using a symmetric cipher, currently 139128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit AES. 140The client selects the encryption algorithm 141to use from those offered by the server. 142Additionally, session integrity is provided 143through a cryptographic message authentication code 144(hmac-sha1 or hmac-md5). 145.Pp 146Protocol version 2 provides a public key based 147user (PubkeyAuthentication) or 148client host (HostbasedAuthentication) authentication method, 149conventional password authentication and challenge response based methods. 150.Pp 151.Ss Command execution and data forwarding 152.Pp 153If the client successfully authenticates itself, a dialog for 154preparing the session is entered. 155At this time the client may request 156things like allocating a pseudo-tty, forwarding X11 connections, 157forwarding TCP/IP connections, or forwarding the authentication agent 158connection over the secure channel. 159.Pp 160Finally, the client either requests a shell or execution of a command. 161The sides then enter session mode. 162In this mode, either side may send 163data at any time, and such data is forwarded to/from the shell or 164command on the server side, and the user terminal in the client side. 165.Pp 166When the user program terminates and all forwarded X11 and other 167connections have been closed, the server sends command exit status to 168the client, and both sides exit. 169.Pp 170.Nm 171can be configured using command-line options or a configuration 172file. 173Command-line options override values specified in the 174configuration file. 175.Pp 176.Nm 177rereads its configuration file when it receives a hangup signal, 178.Dv SIGHUP , 179by executing itself with the name it was started as, i.e., 180.Pa /usr/sbin/sshd . 181.Pp 182The options are as follows: 183.Bl -tag -width Ds 184.It Fl b Ar bits 185Specifies the number of bits in the ephemeral protocol version 1 186server key (default 768). 187.It Fl d 188Debug mode. 189The server sends verbose debug output to the system 190log, and does not put itself in the background. 191The server also will not fork and will only process one connection. 192This option is only intended for debugging for the server. 193Multiple -d options increase the debugging level. 194Maximum is 3. 195.It Fl e 196When this option is specified, 197.Nm 198will send the output to the standard error instead of the system log. 199.It Fl f Ar configuration_file 200Specifies the name of the configuration file. 201The default is 202.Pa /etc/sshd_config . 203.Nm 204refuses to start if there is no configuration file. 205.It Fl g Ar login_grace_time 206Gives the grace time for clients to authenticate themselves (default 207600 seconds). 208If the client fails to authenticate the user within 209this many seconds, the server disconnects and exits. 210A value of zero indicates no limit. 211.It Fl h Ar host_key_file 212Specifies the file from which the host key is read (default 213.Pa /etc/ssh_host_key ) . 214This option must be given if 215.Nm 216is not run as root (as the normal 217host file is normally not readable by anyone but root). 218It is possible to have multiple host key files for 219the different protocol versions and host key algorithms. 220.It Fl i 221Specifies that 222.Nm 223is being run from inetd. 224.Nm 225is normally not run 226from inetd because it needs to generate the server key before it can 227respond to the client, and this may take tens of seconds. 228Clients would have to wait too long if the key was regenerated every time. 229However, with small key sizes (e.g., 512) using 230.Nm 231from inetd may 232be feasible. 233.It Fl k Ar key_gen_time 234Specifies how often the ephemeral protocol version 1 server key is 235regenerated (default 3600 seconds, or one hour). 236The motivation for regenerating the key fairly 237often is that the key is not stored anywhere, and after about an hour, 238it becomes impossible to recover the key for decrypting intercepted 239communications even if the machine is cracked into or physically 240seized. 241A value of zero indicates that the key will never be regenerated. 242.It Fl p Ar port 243Specifies the port on which the server listens for connections 244(default 22). 245.It Fl q 246Quiet mode. 247Nothing is sent to the system log. 248Normally the beginning, 249authentication, and termination of each connection is logged. 250.It Fl t 251Test mode. 252Only check the validity of the configuration file and sanity of the keys. 253This is useful for updating 254.Nm 255reliably as configuration options may change. 256.It Fl u Ar len 257This option is used to specify the size of the field 258in the 259.Li utmp 260structure that holds the remote host name. 261If the resolved host name is longer than 262.Ar len , 263the dotted decimal value will be used instead. 264This allows hosts with very long host names that 265overflow this field to still be uniquely identified. 266Specifying 267.Fl u0 268indicates that only dotted decimal addresses 269should be put into the 270.Pa utmp 271file. 272.It Fl D 273When this option is specified 274.Nm 275will not detach and does not become a daemon. 276This allows easy monitoring of 277.Nm sshd . 278.It Fl 4 279Forces 280.Nm 281to use IPv4 addresses only. 282.It Fl 6 283Forces 284.Nm 285to use IPv6 addresses only. 286.El 287.Sh CONFIGURATION FILE 288.Nm 289reads configuration data from 290.Pa /etc/sshd_config 291(or the file specified with 292.Fl f 293on the command line). 294The file contains keyword-value pairs, one per line. 295Lines starting with 296.Ql # 297and empty lines are interpreted as comments. 298.Pp 299The following keywords are possible. 300.Bl -tag -width Ds 301.It Cm AFSTokenPassing 302Specifies whether an AFS token may be forwarded to the server. 303Default is 304.Dq yes . 305.It Cm AllowGroups 306This keyword can be followed by a list of group names, separated 307by spaces. 308If specified, login is allowed only for users whose primary 309group or supplementary group list matches one of the patterns. 310.Ql \&* 311and 312.Ql ? 313can be used as 314wildcards in the patterns. 315Only group names are valid; a numerical group ID isn't recognized. 316By default login is allowed regardless of the group list. 317.Pp 318.It Cm AllowTcpForwarding 319Specifies whether TCP forwarding is permitted. 320The default is 321.Dq yes . 322Note that disabling TCP forwarding does not improve security unless 323users are also denied shell access, as they can always install their 324own forwarders. 325.Pp 326.It Cm AllowUsers 327This keyword can be followed by a list of user names, separated 328by spaces. 329If specified, login is allowed only for users names that 330match one of the patterns. 331.Ql \&* 332and 333.Ql ? 334can be used as 335wildcards in the patterns. 336Only user names are valid; a numerical user ID isn't recognized. 337By default login is allowed regardless of the user name. 338If the pattern takes the form USER@HOST then USER and HOST 339are separately checked, allowing you to restrict logins to particular 340users from particular hosts. 341.Pp 342.It Cm AuthorizedKeysFile 343Specifies the file that contains the public keys that can be used 344for user authentication. 345.Cm AuthorizedKeysFile 346may contain tokens of the form %T which are substituted during connection 347set-up. The following tokens are defined; %% is replaces by a literal '%', 348%h is replaced by the home directory of the user being authenticated and 349%u is replaced by the username of that user. 350After expansion, 351.Cm AuthorizedKeysFile 352is taken to be an absolute path or one relative to the user's home 353directory. 354The default is 355.Dq .ssh/authorized_keys 356.It Cm Banner 357In some jurisdictions, sending a warning message before authentication 358may be relevant for getting legal protection. 359The contents of the specified file are sent to the remote user before 360authentication is allowed. 361This option is only available for protocol version 2. 362.Pp 363.It Cm ChallengeResponseAuthentication 364Specifies whether challenge response authentication is allowed. 365All authentication styles from 366.Xr login.conf 5 367are supported. 368The default is 369.Dq yes . 370.It Cm CheckMail 371Specifies whether 372.Nm 373should check for new mail for interactive logins. 374The default is 375.Dq no . 376.It Cm Ciphers 377Specifies the ciphers allowed for protocol version 2. 378Multiple ciphers must be comma-separated. 379The default is 380.Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour. 381.It Cm ClientAliveInterval 382Sets a timeout interval in seconds after which if no data has been received 383from the client, 384.Nm 385will send a message through the encrypted 386channel to request a response from the client. 387The default 388is 0, indicating that these messages will not be sent to the client. 389This option applies to protocol version 2 only. 390.It Cm ClientAliveCountMax 391Sets the number of client alive messages (see above) which may be 392sent without 393.Nm 394receiving any messages back from the client. If this threshold is 395reached while client alive messages are being sent, 396.Nm 397will disconnect the client, terminating the session. It is important 398to note that the use of client alive messages is very different from 399.Cm Keepalive 400(below). The client alive messages are sent through the 401encrypted channel and therefore will not be spoofable. The TCP keepalive 402option enabled by 403.Cm Keepalive 404is spoofable. You want to use the client 405alive mechanism when you are basing something important on 406clients having an active connection to the server. 407.Pp 408The default value is 3. If you set 409.Cm ClientAliveInterval 410(above) to 15, and leave this value at the default, unresponsive ssh clients 411will be disconnected after approximately 45 seconds. 412.It Cm DenyGroups 413This keyword can be followed by a number of group names, separated 414by spaces. 415Users whose primary group or supplementary group list matches 416one of the patterns aren't allowed to log in. 417.Ql \&* 418and 419.Ql ? 420can be used as 421wildcards in the patterns. 422Only group names are valid; a numerical group ID isn't recognized. 423By default login is allowed regardless of the group list. 424.Pp 425.It Cm DenyUsers 426This keyword can be followed by a number of user names, separated 427by spaces. 428Login is disallowed for user names that match one of the patterns. 429.Ql \&* 430and 431.Ql ? 432can be used as wildcards in the patterns. 433Only user names are valid; a numerical user ID isn't recognized. 434By default login is allowed regardless of the user name. 435.It Cm GatewayPorts 436Specifies whether remote hosts are allowed to connect to ports 437forwarded for the client. 438The argument must be 439.Dq yes 440or 441.Dq no . 442The default is 443.Dq no . 444.It Cm HostbasedAuthentication 445Specifies whether rhosts or /etc/hosts.equiv authentication together 446with successful public key client host authentication is allowed 447(hostbased authentication). 448This option is similar to 449.Cm RhostsRSAAuthentication 450and applies to protocol version 2 only. 451The default is 452.Dq no . 453.It Cm HostKey 454Specifies the file containing the private host keys (default 455.Pa /etc/ssh_host_key ) 456used by SSH protocol versions 1 and 2. 457Note that 458.Nm 459will refuse to use a file if it is group/world-accessible. 460It is possible to have multiple host key files. 461.Dq rsa1 462keys are used for version 1 and 463.Dq dsa 464or 465.Dq rsa 466are used for version 2 of the SSH protocol. 467.It Cm IgnoreRhosts 468Specifies that 469.Pa .rhosts 470and 471.Pa .shosts 472files will not be used in 473.Cm RhostsAuthentication , 474.Cm RhostsRSAAuthentication 475or 476.Cm HostbasedAuthentication . 477.Pp 478.Pa /etc/hosts.equiv 479and 480.Pa /etc/shosts.equiv 481are still used. 482The default is 483.Dq yes . 484.It Cm IgnoreUserKnownHosts 485Specifies whether 486.Nm 487should ignore the user's 488.Pa $HOME/.ssh/known_hosts 489during 490.Cm RhostsRSAAuthentication 491or 492.Cm HostbasedAuthentication . 493The default is 494.Dq no . 495.It Cm KeepAlive 496Specifies whether the system should send keepalive messages to the 497other side. 498If they are sent, death of the connection or crash of one 499of the machines will be properly noticed. 500However, this means that 501connections will die if the route is down temporarily, and some people 502find it annoying. 503On the other hand, if keepalives are not sent, 504sessions may hang indefinitely on the server, leaving 505.Dq ghost 506users and consuming server resources. 507.Pp 508The default is 509.Dq yes 510(to send keepalives), and the server will notice 511if the network goes down or the client host reboots. 512This avoids infinitely hanging sessions. 513.Pp 514To disable keepalives, the value should be set to 515.Dq no 516in both the server and the client configuration files. 517.It Cm KerberosAuthentication 518Specifies whether Kerberos authentication is allowed. 519This can be in the form of a Kerberos ticket, or if 520.Cm PasswordAuthentication 521is yes, the password provided by the user will be validated through 522the Kerberos KDC. 523To use this option, the server needs a 524Kerberos servtab which allows the verification of the KDC's identity. 525Default is 526.Dq yes . 527.It Cm KerberosOrLocalPasswd 528If set then if password authentication through Kerberos fails then 529the password will be validated via any additional local mechanism 530such as 531.Pa /etc/passwd . 532Default is 533.Dq yes . 534.It Cm KerberosTgtPassing 535Specifies whether a Kerberos TGT may be forwarded to the server. 536Default is 537.Dq no , 538as this only works when the Kerberos KDC is actually an AFS kaserver. 539.It Cm KerberosTicketCleanup 540Specifies whether to automatically destroy the user's ticket cache 541file on logout. 542Default is 543.Dq yes . 544.It Cm KeyRegenerationInterval 545In protocol version 1, the ephemeral server key is automatically regenerated 546after this many seconds (if it has been used). 547The purpose of regeneration is to prevent 548decrypting captured sessions by later breaking into the machine and 549stealing the keys. 550The key is never stored anywhere. 551If the value is 0, the key is never regenerated. 552The default is 3600 (seconds). 553.It Cm ListenAddress 554Specifies the local addresses 555.Nm 556should listen on. 557The following forms may be used: 558.Pp 559.Bl -item -offset indent -compact 560.It 561.Cm ListenAddress 562.Sm off 563.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 564.Sm on 565.It 566.Cm ListenAddress 567.Sm off 568.Ar host No | Ar IPv4_addr No : Ar port 569.Sm on 570.It 571.Cm ListenAddress 572.Sm off 573.Oo 574.Ar host No | Ar IPv6_addr Oc : Ar port 575.Sm on 576.El 577.Pp 578If 579.Ar port 580is not specified, 581.Nm 582will listen on the address and all prior 583.Cm Port 584options specified. The default is to listen on all local 585addresses. Multiple 586.Cm ListenAddress 587options are permitted. Additionally, any 588.Cm Port 589options must precede this option for non port qualified addresses. 590.It Cm LoginGraceTime 591The server disconnects after this time if the user has not 592successfully logged in. 593If the value is 0, there is no time limit. 594The default is 600 (seconds). 595.It Cm LogLevel 596Gives the verbosity level that is used when logging messages from 597.Nm sshd . 598The possible values are: 599QUIET, FATAL, ERROR, INFO, VERBOSE and DEBUG. 600The default is INFO. 601Logging with level DEBUG violates the privacy of users 602and is not recommended. 603.It Cm MACs 604Specifies the available MAC (message authentication code) algorithms. 605The MAC algorithm is used in protocol version 2 606for data integrity protection. 607Multiple algorithms must be comma-separated. 608The default is 609.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . 610.It Cm MaxStartups 611Specifies the maximum number of concurrent unauthenticated connections to the 612.Nm 613daemon. 614Additional connections will be dropped until authentication succeeds or the 615.Cm LoginGraceTime 616expires for a connection. 617The default is 10. 618.Pp 619Alternatively, random early drop can be enabled by specifying 620the three colon separated values 621.Dq start:rate:full 622(e.g., "10:30:60"). 623.Nm 624will refuse connection attempts with a probability of 625.Dq rate/100 626(30%) 627if there are currently 628.Dq start 629(10) 630unauthenticated connections. 631The probability increases linearly and all connection attempts 632are refused if the number of unauthenticated connections reaches 633.Dq full 634(60). 635.It Cm PasswordAuthentication 636Specifies whether password authentication is allowed. 637The default is 638.Dq yes . 639.It Cm PermitEmptyPasswords 640When password authentication is allowed, it specifies whether the 641server allows login to accounts with empty password strings. 642The default is 643.Dq no . 644.It Cm PermitRootLogin 645Specifies whether root can login using 646.Xr ssh 1 . 647The argument must be 648.Dq yes , 649.Dq without-password , 650.Dq forced-commands-only 651or 652.Dq no . 653The default is 654.Dq yes . 655.Pp 656If this option is set to 657.Dq without-password 658password authentication is disabled for root. 659.Pp 660If this option is set to 661.Dq forced-commands-only 662root login with public key authentication will be allowed, 663but only if the 664.Ar command 665option has been specified 666(which may be useful for taking remote backups even if root login is 667normally not allowed). All other authentication methods are disabled 668for root. 669.Pp 670If this option is set to 671.Dq no 672root is not allowed to login. 673.It Cm PidFile 674Specifies the file that contains the process identifier of the 675.Nm 676daemon. 677The default is 678.Pa /var/run/sshd.pid . 679.It Cm Port 680Specifies the port number that 681.Nm 682listens on. 683The default is 22. 684Multiple options of this type are permitted. 685See also 686.Cm ListenAddress . 687.It Cm PrintLastLog 688Specifies whether 689.Nm 690should print the date and time when the user last logged in. 691The default is 692.Dq yes . 693.It Cm PrintMotd 694Specifies whether 695.Nm 696should print 697.Pa /etc/motd 698when a user logs in interactively. 699(On some systems it is also printed by the shell, 700.Pa /etc/profile , 701or equivalent.) 702The default is 703.Dq yes . 704.It Cm Protocol 705Specifies the protocol versions 706.Nm 707should support. 708The possible values are 709.Dq 1 710and 711.Dq 2 . 712Multiple versions must be comma-separated. 713The default is 714.Dq 2,1 . 715.It Cm PubkeyAuthentication 716Specifies whether public key authentication is allowed. 717The default is 718.Dq yes . 719Note that this option applies to protocol version 2 only. 720.It Cm ReverseMappingCheck 721Specifies whether 722.Nm 723should try to verify the remote host name and check that 724the resolved host name for the remote IP address maps back to the 725very same IP address. 726The default is 727.Dq no . 728.It Cm RhostsAuthentication 729Specifies whether authentication using rhosts or /etc/hosts.equiv 730files is sufficient. 731Normally, this method should not be permitted because it is insecure. 732.Cm RhostsRSAAuthentication 733should be used 734instead, because it performs RSA-based host authentication in addition 735to normal rhosts or /etc/hosts.equiv authentication. 736The default is 737.Dq no . 738This option applies to protocol version 1 only. 739.It Cm RhostsRSAAuthentication 740Specifies whether rhosts or /etc/hosts.equiv authentication together 741with successful RSA host authentication is allowed. 742The default is 743.Dq no . 744This option applies to protocol version 1 only. 745.It Cm RSAAuthentication 746Specifies whether pure RSA authentication is allowed. 747The default is 748.Dq yes . 749This option applies to protocol version 1 only. 750.It Cm ServerKeyBits 751Defines the number of bits in the ephemeral protocol version 1 server key. 752The minimum value is 512, and the default is 768. 753.It Cm StrictModes 754Specifies whether 755.Nm 756should check file modes and ownership of the 757user's files and home directory before accepting login. 758This is normally desirable because novices sometimes accidentally leave their 759directory or files world-writable. 760The default is 761.Dq yes . 762.It Cm Subsystem 763Configures an external subsystem (e.g., file transfer daemon). 764Arguments should be a subsystem name and a command to execute upon subsystem 765request. 766The command 767.Xr sftp-server 8 768implements the 769.Dq sftp 770file transfer subsystem. 771By default no subsystems are defined. 772Note that this option applies to protocol version 2 only. 773.It Cm SyslogFacility 774Gives the facility code that is used when logging messages from 775.Nm sshd . 776The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 777LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 778The default is AUTH. 779.It Cm UseLogin 780Specifies whether 781.Xr login 1 782is used for interactive login sessions. 783The default is 784.Dq no . 785Note that 786.Xr login 1 787is never used for remote command execution. 788Note also, that if this is enabled, 789.Cm X11Forwarding 790will be disabled because 791.Xr login 1 792does not know how to handle 793.Xr xauth 1 794cookies. 795.It Cm X11DisplayOffset 796Specifies the first display number available for 797.Nm sshd Ns 's 798X11 forwarding. 799This prevents 800.Nm 801from interfering with real X11 servers. 802The default is 10. 803.It Cm X11Forwarding 804Specifies whether X11 forwarding is permitted. 805The default is 806.Dq no . 807Note that disabling X11 forwarding does not improve security in any 808way, as users can always install their own forwarders. 809X11 forwarding is automatically disabled if 810.Cm UseLogin 811is enabled. 812.It Cm XAuthLocation 813Specifies the location of the 814.Xr xauth 1 815program. 816The default is 817.Pa /usr/X11R6/bin/xauth . 818.El 819.Ss Time Formats 820.Pp 821.Nm 822command-line arguments and configuration file options that specify time 823may be expressed using a sequence of the form: 824.Sm off 825.Ar time Oo Ar qualifier Oc , 826.Sm on 827where 828.Ar time 829is a positive integer value and 830.Ar qualifier 831is one of the following: 832.Pp 833.Bl -tag -width Ds -compact -offset indent 834.It Cm <none> 835seconds 836.It Cm s | Cm S 837seconds 838.It Cm m | Cm M 839minutes 840.It Cm h | Cm H 841hours 842.It Cm d | Cm D 843days 844.It Cm w | Cm W 845weeks 846.El 847.Pp 848Each member of the sequence is added together to calculate 849the total time value. 850.Pp 851Time format examples: 852.Pp 853.Bl -tag -width Ds -compact -offset indent 854.It 600 855600 seconds (10 minutes) 856.It 10m 85710 minutes 858.It 1h30m 8591 hour 30 minutes (90 minutes) 860.El 861.Sh LOGIN PROCESS 862When a user successfully logs in, 863.Nm 864does the following: 865.Bl -enum -offset indent 866.It 867If the login is on a tty, and no command has been specified, 868prints last login time and 869.Pa /etc/motd 870(unless prevented in the configuration file or by 871.Pa $HOME/.hushlogin ; 872see the 873.Sx FILES 874section). 875.It 876If the login is on a tty, records login time. 877.It 878Checks 879.Pa /etc/nologin ; 880if it exists, prints contents and quits 881(unless root). 882.It 883Changes to run with normal user privileges. 884.It 885Sets up basic environment. 886.It 887Reads 888.Pa $HOME/.ssh/environment 889if it exists. 890.It 891Changes to user's home directory. 892.It 893If 894.Pa $HOME/.ssh/rc 895exists, runs it; else if 896.Pa /etc/sshrc 897exists, runs 898it; otherwise runs xauth. 899The 900.Dq rc 901files are given the X11 902authentication protocol and cookie in standard input. 903.It 904Runs user's shell or command. 905.El 906.Sh AUTHORIZED_KEYS FILE FORMAT 907.Pa $HOME/.ssh/authorized_keys 908is the default file that lists the public keys that are 909permitted for RSA authentication in protocol version 1 910and for public key authentication (PubkeyAuthentication) 911in protocol version 2. 912.Cm AuthorizedKeysFile 913may be used to specify an alternative file. 914.Pp 915Each line of the file contains one 916key (empty lines and lines starting with a 917.Ql # 918are ignored as 919comments). 920Each RSA public key consists of the following fields, separated by 921spaces: options, bits, exponent, modulus, comment. 922Each protocol version 2 public key consists of: 923options, keytype, base64 encoded key, comment. 924The options fields 925are optional; its presence is determined by whether the line starts 926with a number or not (the option field never starts with a number). 927The bits, exponent, modulus and comment fields give the RSA key for 928protocol version 1; the 929comment field is not used for anything (but may be convenient for the 930user to identify the key). 931For protocol version 2 the keytype is 932.Dq ssh-dss 933or 934.Dq ssh-rsa . 935.Pp 936Note that lines in this file are usually several hundred bytes long 937(because of the size of the RSA key modulus). 938You don't want to type them in; instead, copy the 939.Pa identity.pub , 940.Pa id_dsa.pub 941or the 942.Pa id_rsa.pub 943file and edit it. 944.Pp 945The options (if present) consist of comma-separated option 946specifications. 947No spaces are permitted, except within double quotes. 948The following option specifications are supported: 949.Bl -tag -width Ds 950.It Cm from="pattern-list" 951Specifies that in addition to RSA authentication, the canonical name 952of the remote host must be present in the comma-separated list of 953patterns 954.Pf ( Ql * 955and 956.Ql ? 957serve as wildcards). 958The list may also contain 959patterns negated by prefixing them with 960.Ql ! ; 961if the canonical host name matches a negated pattern, the key is not accepted. 962The purpose 963of this option is to optionally increase security: RSA authentication 964by itself does not trust the network or name servers or anything (but 965the key); however, if somebody somehow steals the key, the key 966permits an intruder to log in from anywhere in the world. 967This additional option makes using a stolen key more difficult (name 968servers and/or routers would have to be compromised in addition to 969just the key). 970.It Cm command="command" 971Specifies that the command is executed whenever this key is used for 972authentication. 973The command supplied by the user (if any) is ignored. 974The command is run on a pty if the connection requests a pty; 975otherwise it is run without a tty. 976Note that if you want a 8-bit clean channel, 977you must not request a pty or should specify 978.Cm no-pty . 979A quote may be included in the command by quoting it with a backslash. 980This option might be useful 981to restrict certain RSA keys to perform just a specific operation. 982An example might be a key that permits remote backups but nothing else. 983Note that the client may specify TCP/IP and/or X11 984forwarding unless they are explicitly prohibited. 985.It Cm environment="NAME=value" 986Specifies that the string is to be added to the environment when 987logging in using this key. 988Environment variables set this way 989override other default environment values. 990Multiple options of this type are permitted. 991.It Cm no-port-forwarding 992Forbids TCP/IP forwarding when this key is used for authentication. 993Any port forward requests by the client will return an error. 994This might be used, e.g., in connection with the 995.Cm command 996option. 997.It Cm no-X11-forwarding 998Forbids X11 forwarding when this key is used for authentication. 999Any X11 forward requests by the client will return an error. 1000.It Cm no-agent-forwarding 1001Forbids authentication agent forwarding when this key is used for 1002authentication. 1003.It Cm no-pty 1004Prevents tty allocation (a request to allocate a pty will fail). 1005.It Cm permitopen="host:port" 1006Limit local 1007.Li ``ssh -L'' 1008port forwarding such that it may only connect to the specified host and 1009port. Multiple 1010.Cm permitopen 1011options may be applied separated by commas. No pattern matching is 1012performed on the specified hostnames, they must be literal domains or 1013addresses. 1014.El 1015.Ss Examples 10161024 33 12121.\|.\|.\|312314325 ylo@foo.bar 1017.Pp 1018from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula 1019.Pp 1020command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi 1021.Pp 1022permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323 1023.Sh SSH_KNOWN_HOSTS FILE FORMAT 1024The 1025.Pa /etc/ssh_known_hosts , 1026and 1027.Pa $HOME/.ssh/known_hosts 1028files contain host public keys for all known hosts. 1029The global file should 1030be prepared by the administrator (optional), and the per-user file is 1031maintained automatically: whenever the user connects from an unknown host 1032its key is added to the per-user file. 1033.Pp 1034Each line in these files contains the following fields: hostnames, 1035bits, exponent, modulus, comment. 1036The fields are separated by spaces. 1037.Pp 1038Hostnames is a comma-separated list of patterns ('*' and '?' act as 1039wildcards); each pattern in turn is matched against the canonical host 1040name (when authenticating a client) or against the user-supplied 1041name (when authenticating a server). 1042A pattern may also be preceded by 1043.Ql ! 1044to indicate negation: if the host name matches a negated 1045pattern, it is not accepted (by that line) even if it matched another 1046pattern on the line. 1047.Pp 1048Bits, exponent, and modulus are taken directly from the RSA host key; they 1049can be obtained, e.g., from 1050.Pa /etc/ssh_host_key.pub . 1051The optional comment field continues to the end of the line, and is not used. 1052.Pp 1053Lines starting with 1054.Ql # 1055and empty lines are ignored as comments. 1056.Pp 1057When performing host authentication, authentication is accepted if any 1058matching line has the proper key. 1059It is thus permissible (but not 1060recommended) to have several lines or different host keys for the same 1061names. 1062This will inevitably happen when short forms of host names 1063from different domains are put in the file. 1064It is possible 1065that the files contain conflicting information; authentication is 1066accepted if valid information can be found from either file. 1067.Pp 1068Note that the lines in these files are typically hundreds of characters 1069long, and you definitely don't want to type in the host keys by hand. 1070Rather, generate them by a script 1071or by taking 1072.Pa /etc/ssh_host_key.pub 1073and adding the host names at the front. 1074.Ss Examples 1075.Bd -literal 1076closenet,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi 1077cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....= 1078.Ed 1079.Sh FILES 1080.Bl -tag -width Ds 1081.It Pa /etc/sshd_config 1082Contains configuration data for 1083.Nm sshd . 1084This file should be writable by root only, but it is recommended 1085(though not necessary) that it be world-readable. 1086.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key 1087These three files contain the private parts of the host keys. 1088These files should only be owned by root, readable only by root, and not 1089accessible to others. 1090Note that 1091.Nm 1092does not start if this file is group/world-accessible. 1093.It Pa /etc/ssh_host_key.pub, /etc/ssh_host_dsa_key.pub, /etc/ssh_host_rsa_key.pub 1094These three files contain the public parts of the host keys. 1095These files should be world-readable but writable only by 1096root. 1097Their contents should match the respective private parts. 1098These files are not 1099really used for anything; they are provided for the convenience of 1100the user so their contents can be copied to known hosts files. 1101These files are created using 1102.Xr ssh-keygen 1 . 1103.It Pa /etc/moduli 1104Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". 1105.It Pa /var/run/sshd.pid 1106Contains the process ID of the 1107.Nm 1108listening for connections (if there are several daemons running 1109concurrently for different ports, this contains the pid of the one 1110started last). 1111The content of this file is not sensitive; it can be world-readable. 1112.It Pa $HOME/.ssh/authorized_keys 1113Lists the public keys (RSA or DSA) that can be used to log into the user's account. 1114This file must be readable by root (which may on some machines imply 1115it being world-readable if the user's home directory resides on an NFS 1116volume). 1117It is recommended that it not be accessible by others. 1118The format of this file is described above. 1119Users will place the contents of their 1120.Pa identity.pub , 1121.Pa id_dsa.pub 1122and/or 1123.Pa id_rsa.pub 1124files into this file, as described in 1125.Xr ssh-keygen 1 . 1126.It Pa "/etc/ssh_known_hosts" and "$HOME/.ssh/known_hosts" 1127These files are consulted when using rhosts with RSA host 1128authentication or protocol version 2 hostbased authentication 1129to check the public key of the host. 1130The key must be listed in one of these files to be accepted. 1131The client uses the same files 1132to verify that it is connecting to the correct remote host. 1133These files should be writable only by root/the owner. 1134.Pa /etc/ssh_known_hosts 1135should be world-readable, and 1136.Pa $HOME/.ssh/known_hosts 1137can but need not be world-readable. 1138.It Pa /etc/nologin 1139If this file exists, 1140.Nm 1141refuses to let anyone except root log in. 1142The contents of the file 1143are displayed to anyone trying to log in, and non-root connections are 1144refused. 1145The file should be world-readable. 1146.It Pa /etc/hosts.allow, /etc/hosts.deny 1147If compiled with 1148.Sy LIBWRAP 1149support, tcp-wrappers access controls may be defined here as described in 1150.Xr hosts_access 5 . 1151.It Pa $HOME/.rhosts 1152This file contains host-username pairs, separated by a space, one per 1153line. 1154The given user on the corresponding host is permitted to log in 1155without password. 1156The same file is used by rlogind and rshd. 1157The file must 1158be writable only by the user; it is recommended that it not be 1159accessible by others. 1160.Pp 1161If is also possible to use netgroups in the file. 1162Either host or user 1163name may be of the form +@groupname to specify all hosts or all users 1164in the group. 1165.It Pa $HOME/.shosts 1166For ssh, 1167this file is exactly the same as for 1168.Pa .rhosts . 1169However, this file is 1170not used by rlogin and rshd, so using this permits access using SSH only. 1171.It Pa /etc/hosts.equiv 1172This file is used during 1173.Pa .rhosts 1174authentication. 1175In the simplest form, this file contains host names, one per line. 1176Users on 1177those hosts are permitted to log in without a password, provided they 1178have the same user name on both machines. 1179The host name may also be 1180followed by a user name; such users are permitted to log in as 1181.Em any 1182user on this machine (except root). 1183Additionally, the syntax 1184.Dq +@group 1185can be used to specify netgroups. 1186Negated entries start with 1187.Ql \&- . 1188.Pp 1189If the client host/user is successfully matched in this file, login is 1190automatically permitted provided the client and server user names are the 1191same. 1192Additionally, successful RSA host authentication is normally required. 1193This file must be writable only by root; it is recommended 1194that it be world-readable. 1195.Pp 1196.Sy "Warning: It is almost never a good idea to use user names in" 1197.Pa hosts.equiv . 1198Beware that it really means that the named user(s) can log in as 1199.Em anybody , 1200which includes bin, daemon, adm, and other accounts that own critical 1201binaries and directories. 1202Using a user name practically grants the user root access. 1203The only valid use for user names that I can think 1204of is in negative entries. 1205.Pp 1206Note that this warning also applies to rsh/rlogin. 1207.It Pa /etc/shosts.equiv 1208This is processed exactly as 1209.Pa /etc/hosts.equiv . 1210However, this file may be useful in environments that want to run both 1211rsh/rlogin and ssh. 1212.It Pa $HOME/.ssh/environment 1213This file is read into the environment at login (if it exists). 1214It can only contain empty lines, comment lines (that start with 1215.Ql # ) , 1216and assignment lines of the form name=value. 1217The file should be writable 1218only by the user; it need not be readable by anyone else. 1219.It Pa $HOME/.ssh/rc 1220If this file exists, it is run with /bin/sh after reading the 1221environment files but before starting the user's shell or command. 1222If X11 spoofing is in use, this will receive the "proto cookie" pair in 1223standard input (and 1224.Ev DISPLAY 1225in environment). 1226This must call 1227.Xr xauth 1 1228in that case. 1229.Pp 1230The primary purpose of this file is to run any initialization routines 1231which may be needed before the user's home directory becomes 1232accessible; AFS is a particular example of such an environment. 1233.Pp 1234This file will probably contain some initialization code followed by 1235something similar to: 1236.Bd -literal 1237 if read proto cookie; then 1238 echo add $DISPLAY $proto $cookie | xauth -q - 1239 fi 1240.Ed 1241.Pp 1242If this file does not exist, 1243.Pa /etc/sshrc 1244is run, and if that 1245does not exist either, xauth is used to store the cookie. 1246.Pp 1247This file should be writable only by the user, and need not be 1248readable by anyone else. 1249.It Pa /etc/sshrc 1250Like 1251.Pa $HOME/.ssh/rc . 1252This can be used to specify 1253machine-specific login-time initializations globally. 1254This file should be writable only by root, and should be world-readable. 1255.El 1256.Sh AUTHORS 1257OpenSSH is a derivative of the original and free 1258ssh 1.2.12 release by Tatu Ylonen. 1259Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 1260Theo de Raadt and Dug Song 1261removed many bugs, re-added newer features and 1262created OpenSSH. 1263Markus Friedl contributed the support for SSH 1264protocol versions 1.5 and 2.0. 1265.Sh SEE ALSO 1266.Xr scp 1 , 1267.Xr sftp 1 , 1268.Xr ssh 1 , 1269.Xr ssh-add 1 , 1270.Xr ssh-agent 1 , 1271.Xr ssh-keygen 1 , 1272.Xr login.conf 5 , 1273.Xr moduli 5 , 1274.Xr sftp-server 8 1275.Rs 1276.%A T. Ylonen 1277.%A T. Kivinen 1278.%A M. Saarinen 1279.%A T. Rinne 1280.%A S. Lehtinen 1281.%T "SSH Protocol Architecture" 1282.%N draft-ietf-secsh-architecture-09.txt 1283.%D July 2001 1284.%O work in progress material 1285.Re 1286.Rs 1287.%A M. Friedl 1288.%A N. Provos 1289.%A W. A. Simpson 1290.%T "Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol" 1291.%N draft-ietf-secsh-dh-group-exchange-01.txt 1292.%D April 2001 1293.%O work in progress material 1294.Re 1295