456 lines
7.2 KiB
HTML
456 lines
7.2 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SSH-AGENT</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SSH-AGENT</H1>
|
|
Section: User Commands (1)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
<BR>BSD mandoc<BR>
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
|
|
|
|
<B>ssh-agent</B>
|
|
|
|
- OpenSSH authentication agent
|
|
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>ssh-agent</B>
|
|
|
|
[-<B>c | s</B>
|
|
|
|
]
|
|
|
|
[-<B></B>[-<B>a </B><I>bind_address</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>E </B><I>fingerprint_hash</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>P </B><I>provider_whitelist</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>t </B><I>life</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[<I>command </I>[<I>arg ...</I>
|
|
|
|
]
|
|
|
|
|
|
|
|
]
|
|
|
|
<BR><B>ssh-agent</B>
|
|
|
|
[-<B>c | s</B>
|
|
|
|
]
|
|
|
|
-<B>k</B>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
is a program to hold private keys used for public key authentication.
|
|
Through use of environment variables the agent can be located
|
|
and automatically used for authentication when logging in to other
|
|
machines using
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1).
|
|
|
|
|
|
<P>
|
|
|
|
The options are as follows:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="1"><B>-a </B><I>bind_address</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Bind the agent to the
|
|
UNIX
|
|
socket
|
|
<I>bind_address</I>
|
|
|
|
|
|
The default is
|
|
$TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>
|
|
|
|
|
|
<DT id="2"><B>-c</B>
|
|
|
|
|
|
<DD>
|
|
Generate C-shell commands on
|
|
<B>stdout</B>
|
|
|
|
|
|
This is the default if
|
|
<B>SHELL</B>
|
|
|
|
looks like it's a csh style of shell.
|
|
<DT id="3"><B>-D</B>
|
|
|
|
|
|
<DD>
|
|
Foreground mode.
|
|
When this option is specified
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
will not fork.
|
|
<DT id="4"><B>-d</B>
|
|
|
|
|
|
<DD>
|
|
Debug mode.
|
|
When this option is specified
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
will not fork and will write debug information to standard error.
|
|
<DT id="5"><B>-E </B><I>fingerprint_hash</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specifies the hash algorithm used when displaying key fingerprints.
|
|
Valid options are:
|
|
``md5''
|
|
|
|
and
|
|
``sha256''
|
|
|
|
|
|
The default is
|
|
``sha256''
|
|
|
|
|
|
<DT id="6"><B>-k</B>
|
|
|
|
|
|
<DD>
|
|
Kill the current agent (given by the
|
|
<B>SSH_AGENT_PID</B>
|
|
|
|
environment variable).
|
|
<DT id="7"><B>-P </B><I>provider_whitelist</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specify a pattern-list of acceptable paths for PKCS#11 and FIDO authenticator
|
|
shared libraries that may be used with the
|
|
-<B>S</B>
|
|
|
|
or
|
|
-<B>s</B>
|
|
|
|
options to
|
|
ssh-add1.
|
|
|
|
|
|
Libraries that do not match the whitelist will be refused.
|
|
See PATTERNS in
|
|
ssh_config5
|
|
|
|
|
|
for a description of pattern-list syntax.
|
|
The default whitelist is
|
|
``/usr/lib/*,/usr/local/lib/*''
|
|
|
|
|
|
<DT id="8"><B>-s</B>
|
|
|
|
|
|
<DD>
|
|
Generate Bourne shell commands on
|
|
<B>stdout</B>
|
|
|
|
|
|
This is the default if
|
|
<B>SHELL</B>
|
|
|
|
does not look like it's a csh style of shell.
|
|
<DT id="9"><B>-t </B><I>life</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Set a default value for the maximum lifetime of identities added to the agent.
|
|
The lifetime may be specified in seconds or in a time format specified in
|
|
sshd_config5.
|
|
|
|
|
|
A lifetime specified for an identity with
|
|
ssh-add1
|
|
|
|
|
|
overrides this value.
|
|
Without this option the default maximum lifetime is forever.
|
|
<DT id="10"><B></B><I>command </I>[<I>arg ...</I>
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
If a command (and optional arguments) is given,
|
|
this is executed as a subprocess of the agent.
|
|
The agent exits automatically when the command given on the command
|
|
line terminates.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
There are two main ways to get an agent set up.
|
|
The first is at the start of an X session,
|
|
where all other windows or programs are started as children of the
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
program.
|
|
The agent starts a command under which its environment
|
|
variables are exported, for example
|
|
<B>ssh-agent xterm &</B>
|
|
|
|
|
|
When the command terminates, so does the agent.
|
|
<P>
|
|
|
|
The second method is used for a login session.
|
|
When
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
is started,
|
|
it prints the shell commands required to set its environment variables,
|
|
which in turn can be evaluated in the calling shell, for example
|
|
<B>eval `ssh-agent -s`</B>
|
|
|
|
|
|
<P>
|
|
|
|
In both cases,
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1)
|
|
|
|
|
|
looks at these environment variables and uses them to establish a connection to the agent.
|
|
<P>
|
|
|
|
The agent initially does not have any private keys.
|
|
Keys are added using
|
|
ssh-add1
|
|
|
|
|
|
or by
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1)
|
|
|
|
|
|
when
|
|
<B>AddKeysToAgent</B>
|
|
|
|
is set in
|
|
ssh_config5.
|
|
|
|
|
|
Multiple identities may be stored in
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
concurrently and
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1)
|
|
|
|
|
|
will automatically use them if present.
|
|
ssh-add1
|
|
|
|
|
|
is also used to remove keys from
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
and to query the keys that are held in one.
|
|
<P>
|
|
|
|
Connections to
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
may be forwarded from further remote hosts using the
|
|
-<B>A</B>
|
|
|
|
option to
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1)
|
|
|
|
|
|
(but see the caveats documented therein),
|
|
avoiding the need for authentication data to be stored on other machines.
|
|
Authentication passphrases and private keys never go over the network:
|
|
the connection to the agent is forwarded over SSH remote connections
|
|
and the result is returned to the requester,
|
|
allowing the user access to their identities anywhere in the network
|
|
in a secure fashion.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>ENVIRONMENT</H2>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="11"><B>SSH_AGENT_PID</B>
|
|
|
|
|
|
<DD>
|
|
When
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
starts, it stores the name of the agent's process ID (PID) in this variable.
|
|
<DT id="12"><B>SSH_AUTH_SOCK</B>
|
|
|
|
|
|
<DD>
|
|
When
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
starts, it creates a
|
|
UNIX
|
|
socket and stores its pathname in this variable.
|
|
It is accessible only to the current user,
|
|
but is easily abused by root or another instance of the same user.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
In Debian,
|
|
<B>ssh-agent</B>
|
|
|
|
|
|
is installed with the set-group-id bit set, to prevent
|
|
<A HREF="/cgi-bin/man/man2html?2+ptrace">ptrace</A>(2)
|
|
|
|
|
|
attacks retrieving private key material.
|
|
This has the side-effect of causing the run-time linker to remove certain
|
|
environment variables which might have security implications for set-id
|
|
programs, including
|
|
<B>LD_PRELOAD</B>
|
|
|
|
|
|
<B>LD_LIBRARY_PATH</B>
|
|
|
|
|
|
and
|
|
<B>TMPDIR</B>
|
|
|
|
|
|
If you need to set any of these environment variables, you will need to do
|
|
so in the program executed by ssh-agent.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="13"><B>$TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>
|
|
|
|
</B>
|
|
<DD>
|
|
UNIX
|
|
sockets used to contain the connection to the authentication agent.
|
|
These sockets should only be readable by the owner.
|
|
The sockets should get automatically removed when the agent exits.
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAG"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+ssh">ssh</A>(1),
|
|
|
|
|
|
ssh-add1,
|
|
|
|
|
|
ssh-keygen1,
|
|
|
|
|
|
ssh_config5,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
An -nosplit
|
|
|
|
OpenSSH is a derivative of the original and free ssh 1.2.12 release by
|
|
An Tatu Ylonen .
|
|
|
|
An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , Theo de Raadt
|
|
|
|
and
|
|
An Dug Song
|
|
|
|
removed many bugs, re-added newer features and created OpenSSH.
|
|
An Markus Friedl
|
|
|
|
contributed the support for SSH protocol versions 1.5 and 2.0.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="14"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="15"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="16"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="17"><A HREF="#lbAE">ENVIRONMENT</A><DD>
|
|
<DT id="18"><A HREF="#lbAF">FILES</A><DD>
|
|
<DT id="19"><A HREF="#lbAG">SEE ALSO</A><DD>
|
|
<DT id="20"><A HREF="#lbAH">AUTHORS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:27 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|