3153 lines
52 KiB
HTML
3153 lines
52 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SSH</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SSH</H1>
|
|
Section: User Commands (1)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
<BR>BSD mandoc<BR>
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
|
|
|
|
<B>ssh</B>
|
|
|
|
- OpenSSH remote login client
|
|
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>ssh</B>
|
|
|
|
[-<B>46AaCfGgKkMNnqsTtVvXxYy </B>[-<B>B </B><I>bind_interface</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>b </B><I>bind_address</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>c </B><I>cipher_spec</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>D </B>[<I>bind_address : </I><B></B><I>port</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>E </B><I>log_file</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>e </B><I>escape_char</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>F </B><I>configfile</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>I </B><I>pkcs11</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>i </B><I>identity_file</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>J </B><I>destination</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>L </B><I>address</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>l </B><I>login_name</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>m </B><I>mac_spec</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>O </B><I>ctl_cmd</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>o </B><I>option</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>p </B><I>port</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>Q </B><I>query_option</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>R </B><I>address</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>S </B><I>ctl_path</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>W </B><I>host : </I><B></B><I>port</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
[-<B>w </B><I>local_tun </I><B></B>[: <B></B><I>remote_tun</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
]
|
|
|
|
<I>destination</I>
|
|
|
|
[<I>command</I>
|
|
|
|
]
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
(SSH client) is a program for logging into a remote machine and for
|
|
executing commands on a remote machine.
|
|
It is intended to provide secure encrypted communications between
|
|
two untrusted hosts over an insecure network.
|
|
X11 connections, arbitrary TCP ports and
|
|
UNIX
|
|
sockets can also be forwarded over the secure channel.
|
|
<P>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
connects and logs into the specified
|
|
<I>destination</I>
|
|
|
|
|
|
which may be specified as either
|
|
|
|
[user @ hostname]
|
|
|
|
|
|
or a URI of the form
|
|
|
|
<B>ssh:// </B>[user @ hostname [: port]
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
The user must prove
|
|
his/her identity to the remote machine using one of several methods
|
|
(see below).
|
|
<P>
|
|
|
|
If a
|
|
<I>command</I>
|
|
|
|
is specified,
|
|
it is executed on the remote host instead of a login shell.
|
|
<P>
|
|
|
|
The options are as follows:
|
|
<P>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="1"><B>-4</B>
|
|
|
|
|
|
<DD>
|
|
Forces
|
|
<B>ssh</B>
|
|
|
|
|
|
to use IPv4 addresses only.
|
|
<P>
|
|
|
|
<DT id="2"><B>-6</B>
|
|
|
|
|
|
<DD>
|
|
Forces
|
|
<B>ssh</B>
|
|
|
|
|
|
to use IPv6 addresses only.
|
|
<P>
|
|
|
|
<DT id="3"><B>-A</B>
|
|
|
|
|
|
<DD>
|
|
Enables forwarding of connections from an authentication agent such as
|
|
ssh-agent1.
|
|
|
|
|
|
This can also be specified on a per-host basis in a configuration file.
|
|
<P>
|
|
|
|
Agent forwarding should be enabled with caution.
|
|
Users with the ability to bypass file permissions on the remote host
|
|
(for the agent's
|
|
UNIX
|
|
socket) can access the local agent through the forwarded connection.
|
|
An attacker cannot obtain key material from the agent,
|
|
however they can perform operations on the keys that enable them to
|
|
authenticate using the identities loaded into the agent.
|
|
A safer alternative may be to use a jump host
|
|
(see
|
|
-<B>J )</B>
|
|
|
|
|
|
<P>
|
|
|
|
<DT id="4"><B>-a</B>
|
|
|
|
|
|
<DD>
|
|
Disables forwarding of the authentication agent connection.
|
|
<P>
|
|
|
|
<DT id="5"><B>-B </B><I>bind_interface</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Bind to the address of
|
|
<I>bind_interface</I>
|
|
|
|
before attempting to connect to the destination host.
|
|
This is only useful on systems with more than one address.
|
|
<P>
|
|
|
|
<DT id="6"><B>-b </B><I>bind_address</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Use
|
|
<I>bind_address</I>
|
|
|
|
on the local machine as the source address
|
|
of the connection.
|
|
Only useful on systems with more than one address.
|
|
<P>
|
|
|
|
<DT id="7"><B>-C</B>
|
|
|
|
|
|
<DD>
|
|
Requests compression of all data (including stdin, stdout, stderr, and
|
|
data for forwarded X11, TCP and
|
|
UNIX
|
|
connections).
|
|
The compression algorithm is the same used by
|
|
<A HREF="/cgi-bin/man/man2html?1+gzip">gzip</A>(1).
|
|
|
|
|
|
Compression is desirable on modem lines and other
|
|
slow connections, but will only slow down things on fast networks.
|
|
The default value can be set on a host-by-host basis in the
|
|
configuration files; see the
|
|
<B>Compression</B>
|
|
|
|
option.
|
|
<P>
|
|
|
|
<DT id="8"><B>-c </B><I>cipher_spec</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Selects the cipher specification for encrypting the session.
|
|
<I>cipher_spec</I>
|
|
|
|
is a comma-separated list of ciphers
|
|
listed in order of preference.
|
|
See the
|
|
<B>Ciphers</B>
|
|
|
|
keyword in
|
|
ssh_config5
|
|
|
|
|
|
for more information.
|
|
<P>
|
|
|
|
<DT id="9"><B>-D
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DD>Specifies a local
|
|
``dynamic''
|
|
|
|
application-level port forwarding.
|
|
This works by allocating a socket to listen to
|
|
<I>port</I>
|
|
|
|
on the local side, optionally bound to the specified
|
|
<I>bind_address</I>
|
|
|
|
|
|
Whenever a connection is made to this port, the
|
|
connection is forwarded over the secure channel, and the application
|
|
protocol is then used to determine where to connect to from the
|
|
remote machine.
|
|
Currently the SOCKS4 and SOCKS5 protocols are supported, and
|
|
<B>ssh</B>
|
|
|
|
|
|
will act as a SOCKS server.
|
|
Only root can forward privileged ports.
|
|
Dynamic port forwardings can also be specified in the configuration file.
|
|
<P>
|
|
|
|
IPv6 addresses can be specified by enclosing the address in square brackets.
|
|
Only the superuser can forward privileged ports.
|
|
By default, the local port is bound in accordance with the
|
|
<B>GatewayPorts</B>
|
|
|
|
setting.
|
|
However, an explicit
|
|
<I>bind_address</I>
|
|
|
|
may be used to bind the connection to a specific address.
|
|
The
|
|
<I>bind_address</I>
|
|
|
|
of
|
|
``localhost''
|
|
|
|
indicates that the listening port be bound for local use only, while an
|
|
empty address or
|
|
`*'
|
|
|
|
indicates that the port should be available from all interfaces.
|
|
<P>
|
|
|
|
<DT id="10"><B>-E </B><I>log_file</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Append debug logs to
|
|
<I>log_file</I>
|
|
|
|
instead of standard error.
|
|
<P>
|
|
|
|
<DT id="11"><B>-e </B><I>escape_char</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Sets the escape character for sessions with a pty (default:
|
|
`~'
|
|
|
|
) .
|
|
The escape character is only recognized at the beginning of a line.
|
|
The escape character followed by a dot
|
|
(`.'
|
|
|
|
)
|
|
|
|
closes the connection;
|
|
followed by control-Z suspends the connection;
|
|
and followed by itself sends the escape character once.
|
|
Setting the character to
|
|
``none''
|
|
|
|
disables any escapes and makes the session fully transparent.
|
|
<P>
|
|
|
|
<DT id="12"><B>-F </B><I>configfile</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specifies an alternative per-user configuration file.
|
|
If a configuration file is given on the command line,
|
|
the system-wide configuration file
|
|
(/etc/ssh/ssh_config
|
|
|
|
)
|
|
|
|
will be ignored.
|
|
The default for the per-user configuration file is
|
|
~/.ssh/config
|
|
|
|
|
|
<P>
|
|
|
|
<DT id="13"><B>-f</B>
|
|
|
|
|
|
<DD>
|
|
Requests
|
|
<B>ssh</B>
|
|
|
|
|
|
to go to background just before command execution.
|
|
This is useful if
|
|
<B>ssh</B>
|
|
|
|
|
|
is going to ask for passwords or passphrases, but the user
|
|
wants it in the background.
|
|
This implies
|
|
-<B>n</B>
|
|
|
|
|
|
The recommended way to start X11 programs at a remote site is with
|
|
something like
|
|
<B>ssh -f host xterm</B>
|
|
|
|
|
|
<P>
|
|
|
|
If the
|
|
<B>ExitOnForwardFailure</B>
|
|
|
|
configuration option is set to
|
|
``yes''
|
|
|
|
|
|
then a client started with
|
|
-<B>f</B>
|
|
|
|
will wait for all remote port forwards to be successfully established
|
|
before placing itself in the background.
|
|
<P>
|
|
|
|
<DT id="14"><B>-G</B>
|
|
|
|
|
|
<DD>
|
|
Causes
|
|
<B>ssh</B>
|
|
|
|
|
|
to print its configuration after evaluating
|
|
<B>Host</B>
|
|
|
|
and
|
|
<B>Match</B>
|
|
|
|
blocks and exit.
|
|
<P>
|
|
|
|
<DT id="15"><B>-g</B>
|
|
|
|
|
|
<DD>
|
|
Allows remote hosts to connect to local forwarded ports.
|
|
If used on a multiplexed connection, then this option must be specified
|
|
on the master process.
|
|
<P>
|
|
|
|
<DT id="16"><B>-I </B><I>pkcs11</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specify the PKCS#11 shared library
|
|
<B>ssh</B>
|
|
|
|
|
|
should use to communicate with a PKCS#11 token providing keys for user
|
|
authentication.
|
|
<P>
|
|
|
|
<DT id="17"><B>-i </B><I>identity_file</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Selects a file from which the identity (private key) for
|
|
public key authentication is read.
|
|
The default is
|
|
~/.ssh/id_dsa
|
|
|
|
|
|
~/.ssh/id_ecdsa
|
|
|
|
|
|
~/.ssh/id_ecdsa_sk
|
|
|
|
|
|
~/.ssh/id_ed25519
|
|
|
|
|
|
~/.ssh/id_ed25519_sk
|
|
|
|
and
|
|
~/.ssh/id_rsa
|
|
|
|
|
|
Identity files may also be specified on
|
|
a per-host basis in the configuration file.
|
|
It is possible to have multiple
|
|
-<B>i</B>
|
|
|
|
options (and multiple identities specified in
|
|
configuration files).
|
|
If no certificates have been explicitly specified by the
|
|
<B>CertificateFile</B>
|
|
|
|
directive,
|
|
<B>ssh</B>
|
|
|
|
|
|
will also try to load certificate information from the filename obtained
|
|
by appending
|
|
-cert.pub
|
|
|
|
to identity filenames.
|
|
<P>
|
|
|
|
<DT id="18"><B>-J </B><I>destination</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Connect to the target host by first making a
|
|
<B>ssh</B>
|
|
|
|
|
|
connection to the jump host described by
|
|
<I>destination</I>
|
|
|
|
and then establishing a TCP forwarding to the ultimate destination from
|
|
there.
|
|
Multiple jump hops may be specified separated by comma characters.
|
|
This is a shortcut to specify a
|
|
<B>ProxyJump</B>
|
|
|
|
configuration directive.
|
|
Note that configuration directives supplied on the command-line generally
|
|
apply to the destination host and not any specified jump hosts.
|
|
Use
|
|
~/.ssh/config
|
|
|
|
to specify configuration for jump hosts.
|
|
<P>
|
|
|
|
<DT id="19"><B>-K</B>
|
|
|
|
|
|
<DD>
|
|
Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI
|
|
credentials to the server.
|
|
<P>
|
|
|
|
<DT id="20"><B>-k</B>
|
|
|
|
|
|
<DD>
|
|
Disables forwarding (delegation) of GSSAPI credentials to the server.
|
|
<P>
|
|
|
|
<DT id="21"><B>-L
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port : host : hostport</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="22"><B>-L
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port : remote_socket</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="23"><B>-L
|
|
</B>
|
|
|
|
|
|
|
|
|
|
<I>local_socket : host : hostport</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="24"><B>-L
|
|
</B>
|
|
|
|
|
|
|
|
|
|
<I>local_socket : remote_socket</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DD>Specifies that connections to the given TCP port or Unix socket on the local
|
|
(client) host are to be forwarded to the given host and port, or Unix socket,
|
|
on the remote side.
|
|
This works by allocating a socket to listen to either a TCP
|
|
<I>port</I>
|
|
|
|
on the local side, optionally bound to the specified
|
|
<I>bind_address</I>
|
|
|
|
|
|
or to a Unix socket.
|
|
Whenever a connection is made to the local port or socket, the
|
|
connection is forwarded over the secure channel, and a connection is
|
|
made to either
|
|
<I>host</I>
|
|
|
|
port
|
|
<I>hostport</I>
|
|
|
|
|
|
or the Unix socket
|
|
<I>remote_socket</I>
|
|
|
|
|
|
from the remote machine.
|
|
<P>
|
|
|
|
Port forwardings can also be specified in the configuration file.
|
|
Only the superuser can forward privileged ports.
|
|
IPv6 addresses can be specified by enclosing the address in square brackets.
|
|
<P>
|
|
|
|
By default, the local port is bound in accordance with the
|
|
<B>GatewayPorts</B>
|
|
|
|
setting.
|
|
However, an explicit
|
|
<I>bind_address</I>
|
|
|
|
may be used to bind the connection to a specific address.
|
|
The
|
|
<I>bind_address</I>
|
|
|
|
of
|
|
``localhost''
|
|
|
|
indicates that the listening port be bound for local use only, while an
|
|
empty address or
|
|
`*'
|
|
|
|
indicates that the port should be available from all interfaces.
|
|
<P>
|
|
|
|
<DT id="25"><B>-l </B><I>login_name</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specifies the user to log in as on the remote machine.
|
|
This also may be specified on a per-host basis in the configuration file.
|
|
<P>
|
|
|
|
<DT id="26"><B>-M</B>
|
|
|
|
|
|
<DD>
|
|
Places the
|
|
<B>ssh</B>
|
|
|
|
|
|
client into
|
|
``master''
|
|
|
|
mode for connection sharing.
|
|
Multiple
|
|
-<B>M</B>
|
|
|
|
options places
|
|
<B>ssh</B>
|
|
|
|
|
|
into
|
|
``master''
|
|
|
|
mode but with confirmation required using
|
|
ssh-askpass1
|
|
|
|
|
|
before each operation that changes the multiplexing state
|
|
(e.g. opening a new session).
|
|
Refer to the description of
|
|
<B>ControlMaster</B>
|
|
|
|
in
|
|
ssh_config5
|
|
|
|
|
|
for details.
|
|
<P>
|
|
|
|
<DT id="27"><B>-m </B><I>mac_spec</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
A comma-separated list of MAC (message authentication code) algorithms,
|
|
specified in order of preference.
|
|
See the
|
|
<B>MACs </B>keyword for more information.
|
|
|
|
|
|
|
|
<P>
|
|
|
|
<DT id="28"><B>-N</B>
|
|
|
|
|
|
<DD>
|
|
Do not execute a remote command.
|
|
This is useful for just forwarding ports.
|
|
<P>
|
|
|
|
<DT id="29"><B>-n</B>
|
|
|
|
|
|
<DD>
|
|
Redirects stdin from
|
|
/dev/null
|
|
|
|
(actually, prevents reading from stdin).
|
|
This must be used when
|
|
<B>ssh</B>
|
|
|
|
|
|
is run in the background.
|
|
A common trick is to use this to run X11 programs on a remote machine.
|
|
For example,
|
|
<B>ssh -n shadows.cs.hut.fi emacs</B>
|
|
|
|
|
|
will start an emacs on shadows.cs.hut.fi, and the X11
|
|
connection will be automatically forwarded over an encrypted channel.
|
|
The
|
|
<B>ssh</B>
|
|
|
|
|
|
program will be put in the background.
|
|
(This does not work if
|
|
<B>ssh</B>
|
|
|
|
|
|
needs to ask for a password or passphrase; see also the
|
|
-<B>f</B>
|
|
|
|
option.)
|
|
<P>
|
|
|
|
<DT id="30"><B>-O </B><I>ctl_cmd</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Control an active connection multiplexing master process.
|
|
When the
|
|
-<B>O</B>
|
|
|
|
option is specified, the
|
|
<I>ctl_cmd</I>
|
|
|
|
argument is interpreted and passed to the master process.
|
|
Valid commands are:
|
|
``check''
|
|
|
|
(check that the master process is running),
|
|
``forward''
|
|
|
|
(request forwardings without command execution),
|
|
``cancel''
|
|
|
|
(cancel forwardings),
|
|
``exit''
|
|
|
|
(request the master to exit), and
|
|
``stop''
|
|
|
|
(request the master to stop accepting further multiplexing requests).
|
|
<P>
|
|
|
|
<DT id="31"><B>-o </B><I>option</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Can be used to give options in the format used in the configuration file.
|
|
This is useful for specifying options for which there is no separate
|
|
command-line flag.
|
|
For full details of the options listed below, and their possible values, see
|
|
ssh_config5.
|
|
|
|
|
|
<P>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="32"><B>AddKeysToAgent</B>
|
|
<DD>
|
|
<DT id="33"><B>AddressFamily</B>
|
|
<DD>
|
|
<DT id="34"><B>BatchMode</B>
|
|
<DD>
|
|
<DT id="35"><B>BindAddress</B>
|
|
<DD>
|
|
<DT id="36"><B>CanonicalDomains</B>
|
|
<DD>
|
|
<DT id="37"><B>CanonicalizeFallbackLocal</B>
|
|
<DD>
|
|
<DT id="38"><B>CanonicalizeHostname</B>
|
|
<DD>
|
|
<DT id="39"><B>CanonicalizeMaxDots</B>
|
|
<DD>
|
|
<DT id="40"><B>CanonicalizePermittedCNAMEs </B><DT><B>CASignatureAlgorithms</B>
|
|
<DD>
|
|
|
|
|
|
|
|
<DD>
|
|
<DT id="41"><B>CertificateFile</B>
|
|
<DD>
|
|
<DT id="42"><B>ChallengeResponseAuthentication</B>
|
|
<DD>
|
|
<DT id="43"><B>CheckHostIP</B>
|
|
<DD>
|
|
<DT id="44"><B>Ciphers</B>
|
|
<DD>
|
|
<DT id="45"><B>ClearAllForwardings</B>
|
|
<DD>
|
|
<DT id="46"><B>Compression</B>
|
|
<DD>
|
|
<DT id="47"><B>ConnectionAttempts</B>
|
|
<DD>
|
|
<DT id="48"><B>ConnectTimeout</B>
|
|
<DD>
|
|
<DT id="49"><B>ControlMaster</B>
|
|
<DD>
|
|
<DT id="50"><B>ControlPath</B>
|
|
<DD>
|
|
<DT id="51"><B>ControlPersist</B>
|
|
<DD>
|
|
<DT id="52"><B>DynamicForward</B>
|
|
<DD>
|
|
<DT id="53"><B>EscapeChar</B>
|
|
<DD>
|
|
<DT id="54"><B>ExitOnForwardFailure</B>
|
|
<DD>
|
|
<DT id="55"><B>FingerprintHash</B>
|
|
<DD>
|
|
<DT id="56"><B>ForwardAgent</B>
|
|
<DD>
|
|
<DT id="57"><B>ForwardX11</B>
|
|
<DD>
|
|
<DT id="58"><B>ForwardX11Timeout</B>
|
|
<DD>
|
|
<DT id="59"><B>ForwardX11Trusted</B>
|
|
<DD>
|
|
<DT id="60"><B>GatewayPorts</B>
|
|
<DD>
|
|
<DT id="61"><B>GlobalKnownHostsFile</B>
|
|
<DD>
|
|
<DT id="62"><B>GSSAPIAuthentication</B>
|
|
<DD>
|
|
<DT id="63"><B>GSSAPIKeyExchange</B>
|
|
<DD>
|
|
<DT id="64"><B>GSSAPIClientIdentity</B>
|
|
<DD>
|
|
<DT id="65"><B>GSSAPIDelegateCredentials</B>
|
|
<DD>
|
|
<DT id="66"><B>GSSAPIKexAlgorithms</B>
|
|
<DD>
|
|
<DT id="67"><B>GSSAPIRenewalForcesRekey</B>
|
|
<DD>
|
|
<DT id="68"><B>GSSAPIServerIdentity</B>
|
|
<DD>
|
|
<DT id="69"><B>GSSAPITrustDns</B>
|
|
<DD>
|
|
<DT id="70"><B>HashKnownHosts</B>
|
|
<DD>
|
|
<DT id="71"><B>Host</B>
|
|
<DD>
|
|
<DT id="72"><B>HostbasedAuthentication</B>
|
|
<DD>
|
|
<DT id="73"><B>HostbasedKeyTypes</B>
|
|
<DD>
|
|
<DT id="74"><B>HostKeyAlgorithms</B>
|
|
<DD>
|
|
<DT id="75"><B>HostKeyAlias</B>
|
|
<DD>
|
|
<DT id="76"><B>Hostname</B>
|
|
<DD>
|
|
<DT id="77"><B>IdentitiesOnly</B>
|
|
<DD>
|
|
<DT id="78"><B>IdentityAgent</B>
|
|
<DD>
|
|
<DT id="79"><B>IdentityFile</B>
|
|
<DD>
|
|
<DT id="80"><B>IPQoS</B>
|
|
<DD>
|
|
<DT id="81"><B>KbdInteractiveAuthentication</B>
|
|
<DD>
|
|
<DT id="82"><B>KbdInteractiveDevices</B>
|
|
<DD>
|
|
<DT id="83"><B>KexAlgorithms</B>
|
|
<DD>
|
|
<DT id="84"><B>LocalCommand</B>
|
|
<DD>
|
|
<DT id="85"><B>LocalForward</B>
|
|
<DD>
|
|
<DT id="86"><B>LogLevel</B>
|
|
<DD>
|
|
<DT id="87"><B>MACs </B><DT><B>Match</B>
|
|
<DD>
|
|
|
|
|
|
|
|
<DD>
|
|
<DT id="88"><B>NoHostAuthenticationForLocalhost</B>
|
|
<DD>
|
|
<DT id="89"><B>NumberOfPasswordPrompts</B>
|
|
<DD>
|
|
<DT id="90"><B>PasswordAuthentication</B>
|
|
<DD>
|
|
<DT id="91"><B>PermitLocalCommand</B>
|
|
<DD>
|
|
<DT id="92"><B>PKCS11Provider</B>
|
|
<DD>
|
|
<DT id="93"><B>Port</B>
|
|
<DD>
|
|
<DT id="94"><B>PreferredAuthentications</B>
|
|
<DD>
|
|
<DT id="95"><B>ProxyCommand</B>
|
|
<DD>
|
|
<DT id="96"><B>ProxyJump</B>
|
|
<DD>
|
|
<DT id="97"><B>ProxyUseFdpass</B>
|
|
<DD>
|
|
<DT id="98"><B>PubkeyAcceptedKeyTypes</B>
|
|
<DD>
|
|
<DT id="99"><B>PubkeyAuthentication</B>
|
|
<DD>
|
|
<DT id="100"><B>RekeyLimit</B>
|
|
<DD>
|
|
<DT id="101"><B>RemoteCommand</B>
|
|
<DD>
|
|
<DT id="102"><B>RemoteForward</B>
|
|
<DD>
|
|
<DT id="103"><B>RequestTTY</B>
|
|
<DD>
|
|
<DT id="104"><B>SendEnv</B>
|
|
<DD>
|
|
<DT id="105"><B>ServerAliveInterval</B>
|
|
<DD>
|
|
<DT id="106"><B>ServerAliveCountMax</B>
|
|
<DD>
|
|
<DT id="107"><B>SetEnv</B>
|
|
<DD>
|
|
<DT id="108"><B>StreamLocalBindMask</B>
|
|
<DD>
|
|
<DT id="109"><B>StreamLocalBindUnlink</B>
|
|
<DD>
|
|
<DT id="110"><B>StrictHostKeyChecking</B>
|
|
<DD>
|
|
<DT id="111"><B>TCPKeepAlive</B>
|
|
<DD>
|
|
<DT id="112"><B>Tunnel</B>
|
|
<DD>
|
|
<DT id="113"><B>TunnelDevice</B>
|
|
<DD>
|
|
<DT id="114"><B>UpdateHostKeys</B>
|
|
<DD>
|
|
<DT id="115"><B>User</B>
|
|
<DD>
|
|
<DT id="116"><B>UserKnownHostsFile</B>
|
|
<DD>
|
|
<DT id="117"><B>VerifyHostKeyDNS</B>
|
|
<DD>
|
|
<DT id="118"><B>VisualHostKey</B>
|
|
<DD>
|
|
<DT id="119"><B>XAuthLocation</B>
|
|
<DD>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
<DT id="120"><B>-p </B><I>port</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Port to connect to on the remote host.
|
|
This can be specified on a
|
|
per-host basis in the configuration file.
|
|
<P>
|
|
|
|
<DT id="121"><B>-Q </B><I>query_option</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Queries
|
|
<B>ssh</B>
|
|
|
|
|
|
for the algorithms supported for the specified version 2.
|
|
The available features are:
|
|
<I>cipher</I>
|
|
|
|
(supported symmetric ciphers),
|
|
<I>cipher-auth</I>
|
|
|
|
(supported symmetric ciphers that support authenticated encryption),
|
|
<I>help</I>
|
|
|
|
(supported query terms for use with the
|
|
-<B>Q</B>
|
|
|
|
flag),
|
|
<I>mac</I>
|
|
|
|
(supported message integrity codes),
|
|
<I>kex</I>
|
|
|
|
(key exchange algorithms),
|
|
<I>kex-gss</I>
|
|
|
|
(GSSAPI key exchange algorithms),
|
|
<I>key</I>
|
|
|
|
(key types),
|
|
<I>key-cert</I>
|
|
|
|
(certificate key types),
|
|
<I>key-plain</I>
|
|
|
|
(non-certificate key types),
|
|
<I>key-sig</I>
|
|
|
|
(all key types and signature algorithms),
|
|
<I>protocol-version</I>
|
|
|
|
(supported SSH protocol versions), and
|
|
<I>sig</I>
|
|
|
|
(supported signature algorithms).
|
|
Alternatively, any keyword from
|
|
ssh_config5
|
|
|
|
|
|
or
|
|
sshd_config5
|
|
|
|
|
|
that takes an algorithm list may be used as an alias for the corresponding
|
|
query_option.
|
|
<P>
|
|
|
|
<DT id="122"><B>-q</B>
|
|
|
|
|
|
<DD>
|
|
Quiet mode.
|
|
Causes most warning and diagnostic messages to be suppressed.
|
|
<P>
|
|
|
|
<DT id="123"><B>-R
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port : host : hostport</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="124"><B>-R
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port : local_socket</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="125"><B>-R
|
|
</B>
|
|
|
|
|
|
|
|
|
|
<I>remote_socket : host : hostport</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="126"><B>-R
|
|
</B>
|
|
|
|
|
|
|
|
|
|
<I>remote_socket : local_socket</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DT id="127"><B>-R
|
|
</B>
|
|
|
|
|
|
|
|
|
|
[<I>bind_address : </I>]
|
|
|
|
|
|
|
|
<I>port</I>
|
|
|
|
|
|
<DD>
|
|
|
|
<DD>Specifies that connections to the given TCP port or Unix socket on the remote
|
|
(server) host are to be forwarded to the local side.
|
|
<P>
|
|
|
|
This works by allocating a socket to listen to either a TCP
|
|
<I>port</I>
|
|
|
|
or to a Unix socket on the remote side.
|
|
Whenever a connection is made to this port or Unix socket, the
|
|
connection is forwarded over the secure channel, and a connection
|
|
is made from the local machine to either an explicit destination specified by
|
|
<I>host</I>
|
|
|
|
port
|
|
<I>hostport</I>
|
|
|
|
|
|
or
|
|
<I>local_socket</I>
|
|
|
|
|
|
or, if no explicit destination was specified,
|
|
<B>ssh</B>
|
|
|
|
|
|
will act as a SOCKS 4/5 proxy and forward connections to the destinations
|
|
requested by the remote SOCKS client.
|
|
<P>
|
|
|
|
Port forwardings can also be specified in the configuration file.
|
|
Privileged ports can be forwarded only when
|
|
logging in as root on the remote machine.
|
|
IPv6 addresses can be specified by enclosing the address in square brackets.
|
|
<P>
|
|
|
|
By default, TCP listening sockets on the server will be bound to the loopback
|
|
interface only.
|
|
This may be overridden by specifying a
|
|
<I>bind_address</I>
|
|
|
|
|
|
An empty
|
|
<I>bind_address</I>
|
|
|
|
|
|
or the address
|
|
`*'
|
|
|
|
,
|
|
indicates that the remote socket should listen on all interfaces.
|
|
Specifying a remote
|
|
<I>bind_address</I>
|
|
|
|
will only succeed if the server's
|
|
<B>GatewayPorts</B>
|
|
|
|
option is enabled (see
|
|
sshd_config5).
|
|
|
|
|
|
<P>
|
|
|
|
If the
|
|
<I>port</I>
|
|
|
|
argument is
|
|
`0'
|
|
|
|
,
|
|
the listen port will be dynamically allocated on the server and reported
|
|
to the client at run time.
|
|
When used together with
|
|
<B>-O forward</B>
|
|
|
|
the allocated port will be printed to the standard output.
|
|
<P>
|
|
|
|
<DT id="128"><B>-S </B><I>ctl_path</I>
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Specifies the location of a control socket for connection sharing,
|
|
or the string
|
|
``none''
|
|
|
|
to disable connection sharing.
|
|
Refer to the description of
|
|
<B>ControlPath</B>
|
|
|
|
and
|
|
<B>ControlMaster</B>
|
|
|
|
in
|
|
ssh_config5
|
|
|
|
|
|
for details.
|
|
<P>
|
|
|
|
<DT id="129"><B>-s</B>
|
|
|
|
|
|
<DD>
|
|
May be used to request invocation of a subsystem on the remote system.
|
|
Subsystems facilitate the use of SSH
|
|
as a secure transport for other applications (e.g.
|
|
<A HREF="/cgi-bin/man/man2html?1+sftp">sftp</A>(1)).
|
|
|
|
|
|
The subsystem is specified as the remote command.
|
|
<P>
|
|
|
|
<DT id="130"><B>-T</B>
|
|
|
|
|
|
<DD>
|
|
Disable pseudo-terminal allocation.
|
|
<P>
|
|
|
|
<DT id="131"><B>-t</B>
|
|
|
|
|
|
<DD>
|
|
Force pseudo-terminal allocation.
|
|
This can be used to execute arbitrary
|
|
screen-based programs on a remote machine, which can be very useful,
|
|
e.g. when implementing menu services.
|
|
Multiple
|
|
-<B>t</B>
|
|
|
|
options force tty allocation, even if
|
|
<B>ssh</B>
|
|
|
|
|
|
has no local tty.
|
|
<P>
|
|
|
|
<DT id="132"><B>-V</B>
|
|
|
|
|
|
<DD>
|
|
Display the version number and exit.
|
|
<P>
|
|
|
|
<DT id="133"><B>-v</B>
|
|
|
|
|
|
<DD>
|
|
Verbose mode.
|
|
Causes
|
|
<B>ssh</B>
|
|
|
|
|
|
to print debugging messages about its progress.
|
|
This is helpful in
|
|
debugging connection, authentication, and configuration problems.
|
|
Multiple
|
|
-<B>v</B>
|
|
|
|
options increase the verbosity.
|
|
The maximum is 3.
|
|
<P>
|
|
|
|
<DT id="134"><B>-W </B><I>host : </I><B></B><I>port</I>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
Requests that standard input and output on the client be forwarded to
|
|
<I>host</I>
|
|
|
|
on
|
|
<I>port</I>
|
|
|
|
over the secure channel.
|
|
Implies
|
|
-<B>N</B>
|
|
|
|
|
|
-<B>T</B>
|
|
|
|
|
|
<B>ExitOnForwardFailure</B>
|
|
|
|
and
|
|
<B>ClearAllForwardings</B>
|
|
|
|
|
|
though these can be overridden in the configuration file or using
|
|
-<B>o</B>
|
|
|
|
command line options.
|
|
<P>
|
|
|
|
<DT id="135"><B>-w
|
|
</B>
|
|
|
|
|
|
|
|
<I>local_tun </I><B></B>[: <B></B><I>remote_tun</I>
|
|
|
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
|
|
<DD>Requests
|
|
tunnel
|
|
device forwarding with the specified
|
|
<A HREF="/cgi-bin/man/man2html?4+tun">tun</A>(4)
|
|
|
|
|
|
devices between the client
|
|
(<I>local_tun</I>
|
|
|
|
)
|
|
|
|
and the server
|
|
(<I>remote_tun</I>
|
|
|
|
)
|
|
|
|
|
|
<P>
|
|
|
|
The devices may be specified by numerical ID or the keyword
|
|
``any''
|
|
|
|
|
|
which uses the next available tunnel device.
|
|
If
|
|
<I>remote_tun</I>
|
|
|
|
is not specified, it defaults to
|
|
``any''
|
|
|
|
|
|
See also the
|
|
<B>Tunnel</B>
|
|
|
|
and
|
|
<B>TunnelDevice</B>
|
|
|
|
directives in
|
|
ssh_config5.
|
|
|
|
|
|
<P>
|
|
|
|
If the
|
|
<B>Tunnel</B>
|
|
|
|
directive is unset, it will be set to the default tunnel mode, which is
|
|
``point-to-point''
|
|
|
|
|
|
If a different
|
|
<B>Tunnel</B>
|
|
|
|
forwarding mode it desired, then it should be specified before
|
|
-<B>w</B>
|
|
|
|
|
|
<P>
|
|
|
|
<DT id="136"><B>-X</B>
|
|
|
|
|
|
<DD>
|
|
Enables X11 forwarding.
|
|
This can also be specified on a per-host basis in a configuration file.
|
|
<P>
|
|
|
|
X11 forwarding should be enabled with caution.
|
|
Users with the ability to bypass file permissions on the remote host
|
|
(for the user's X authorization database)
|
|
can access the local X11 display through the forwarded connection.
|
|
An attacker may then be able to perform activities such as keystroke monitoring.
|
|
<P>
|
|
|
|
For this reason, X11 forwarding is subjected to X11 SECURITY extension
|
|
restrictions by default.
|
|
Please refer to the
|
|
<B>ssh</B>
|
|
|
|
|
|
-<B>Y</B>
|
|
|
|
option and the
|
|
<B>ForwardX11Trusted</B>
|
|
|
|
directive in
|
|
ssh_config5
|
|
|
|
|
|
for more information.
|
|
<P>
|
|
|
|
(Debian-specific: X11 forwarding is not subjected to X11 SECURITY extension
|
|
restrictions by default, because too many programs currently crash in this
|
|
mode.
|
|
Set the
|
|
<B>ForwardX11Trusted</B>
|
|
|
|
option to
|
|
``no''
|
|
|
|
to restore the upstream behaviour.
|
|
This may change in future depending on client-side improvements.)
|
|
<P>
|
|
|
|
<DT id="137"><B>-x</B>
|
|
|
|
|
|
<DD>
|
|
Disables X11 forwarding.
|
|
<P>
|
|
|
|
<DT id="138"><B>-Y</B>
|
|
|
|
|
|
<DD>
|
|
Enables trusted X11 forwarding.
|
|
Trusted X11 forwardings are not subjected to the X11 SECURITY extension
|
|
controls.
|
|
<P>
|
|
|
|
(Debian-specific: In the default configuration, this option is equivalent to
|
|
-<B>X</B>
|
|
|
|
|
|
since
|
|
<B>ForwardX11Trusted</B>
|
|
|
|
defaults to
|
|
``yes''
|
|
|
|
as described above.
|
|
Set the
|
|
<B>ForwardX11Trusted</B>
|
|
|
|
option to
|
|
``no''
|
|
|
|
to restore the upstream behaviour.
|
|
This may change in future depending on client-side improvements.)
|
|
<P>
|
|
|
|
<DT id="139"><B>-y</B>
|
|
|
|
|
|
<DD>
|
|
Send log information using the
|
|
<A HREF="/cgi-bin/man/man2html?3+syslog">syslog</A>(3)
|
|
|
|
|
|
system module.
|
|
By default this information is sent to stderr.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
may additionally obtain configuration data from
|
|
a per-user configuration file and a system-wide configuration file.
|
|
The file format and configuration options are described in
|
|
ssh_config5.
|
|
|
|
|
|
<A NAME="lbAE"> </A>
|
|
<H2>AUTHENTICATION</H2>
|
|
|
|
The OpenSSH SSH client supports SSH protocol 2.
|
|
<P>
|
|
|
|
The methods available for authentication are:
|
|
GSSAPI-based authentication,
|
|
host-based authentication,
|
|
public key authentication,
|
|
challenge-response authentication,
|
|
and password authentication.
|
|
Authentication methods are tried in the order specified above,
|
|
though
|
|
<B>PreferredAuthentications</B>
|
|
|
|
can be used to change the default order.
|
|
<P>
|
|
|
|
Host-based authentication works as follows:
|
|
If the machine the user logs in from is listed in
|
|
/etc/hosts.equiv
|
|
|
|
or
|
|
/etc/ssh/shosts.equiv
|
|
|
|
on the remote machine, and the user names are
|
|
the same on both sides, or if the files
|
|
~/.rhosts
|
|
|
|
or
|
|
~/.shosts
|
|
|
|
exist in the user's home directory on the
|
|
remote machine and contain a line containing the name of the client
|
|
machine and the name of the user on that machine, the user is
|
|
considered for login.
|
|
Additionally, the server
|
|
<I>must</I>
|
|
|
|
be able to verify the client's
|
|
host key (see the description of
|
|
/etc/ssh/ssh_known_hosts
|
|
|
|
and
|
|
~/.ssh/known_hosts
|
|
|
|
|
|
below)
|
|
for login to be permitted.
|
|
This authentication method closes security holes due to IP
|
|
spoofing, DNS spoofing, and routing spoofing.
|
|
[Note to the administrator:
|
|
/etc/hosts.equiv
|
|
|
|
|
|
~/.rhosts
|
|
|
|
|
|
and the rlogin/rsh protocol in general, are inherently insecure and should be
|
|
disabled if security is desired.]
|
|
<P>
|
|
|
|
Public key authentication works as follows:
|
|
The scheme is based on public-key cryptography,
|
|
using cryptosystems
|
|
where encryption and decryption are done using separate keys,
|
|
and it is unfeasible to derive the decryption key from the encryption key.
|
|
The idea is that each user creates a public/private
|
|
key pair for authentication purposes.
|
|
The server knows the public key, and only the user knows the private key.
|
|
<B>ssh</B>
|
|
|
|
|
|
implements public key authentication protocol automatically,
|
|
using one of the DSA, ECDSA, Ed25519 or RSA algorithms.
|
|
The HISTORY section of
|
|
<A HREF="/cgi-bin/man/man2html?8+ssl">ssl</A>(8)
|
|
|
|
|
|
(on non-OpenBSD systems, see
|
|
|
|
<A HREF="http://www.openbsd.org/cgi-bin/man.cgi?query=ssl">http://www.openbsd.org/cgi-bin/man.cgi?query=ssl</A>&sektion=8#HISTORY)
|
|
|
|
contains a brief discussion of the DSA and RSA algorithms.
|
|
<P>
|
|
|
|
The file
|
|
~/.ssh/authorized_keys
|
|
|
|
lists the public keys that are permitted for logging in.
|
|
When the user logs in, the
|
|
<B>ssh</B>
|
|
|
|
|
|
program tells the server which key pair it would like to use for
|
|
authentication.
|
|
The client proves that it has access to the private key
|
|
and the server checks that the corresponding public key
|
|
is authorized to accept the account.
|
|
<P>
|
|
|
|
The server may inform the client of errors that prevented public key
|
|
authentication from succeeding after authentication completes using a
|
|
different method.
|
|
These may be viewed by increasing the
|
|
<B>LogLevel</B>
|
|
|
|
to
|
|
<B>DEBUG</B>
|
|
|
|
or higher (e.g. by using the
|
|
-<B>v</B>
|
|
|
|
flag).
|
|
<P>
|
|
|
|
The user creates his/her key pair by running
|
|
ssh-keygen1.
|
|
|
|
|
|
This stores the private key in
|
|
~/.ssh/id_dsa
|
|
|
|
(DSA),
|
|
~/.ssh/id_ecdsa
|
|
|
|
(ECDSA),
|
|
~/.ssh/id_ecdsa_sk
|
|
|
|
(authenticator-hosted ECDSA),
|
|
~/.ssh/id_ed25519
|
|
|
|
(Ed25519),
|
|
~/.ssh/id_ed25519_sk
|
|
|
|
(authenticator-hosted Ed25519),
|
|
or
|
|
~/.ssh/id_rsa
|
|
|
|
(RSA)
|
|
and stores the public key in
|
|
~/.ssh/id_dsa.pub
|
|
|
|
(DSA),
|
|
~/.ssh/id_ecdsa.pub
|
|
|
|
(ECDSA),
|
|
~/.ssh/id_ecdsa_sk.pub
|
|
|
|
(authenticator-hosted ECDSA),
|
|
~/.ssh/id_ed25519.pub
|
|
|
|
(Ed25519),
|
|
~/.ssh/id_ed25519_sk.pub
|
|
|
|
(authenticator-hosted Ed25519),
|
|
or
|
|
~/.ssh/id_rsa.pub
|
|
|
|
(RSA)
|
|
in the user's home directory.
|
|
The user should then copy the public key
|
|
to
|
|
~/.ssh/authorized_keys
|
|
|
|
in his/her home directory on the remote machine.
|
|
The
|
|
authorized_keys
|
|
|
|
file corresponds to the conventional
|
|
~/.rhosts
|
|
|
|
file, and has one key
|
|
per line, though the lines can be very long.
|
|
After this, the user can log in without giving the password.
|
|
<P>
|
|
|
|
A variation on public key authentication
|
|
is available in the form of certificate authentication:
|
|
instead of a set of public/private keys,
|
|
signed certificates are used.
|
|
This has the advantage that a single trusted certification authority
|
|
can be used in place of many public/private keys.
|
|
See the CERTIFICATES section of
|
|
ssh-keygen1
|
|
|
|
|
|
for more information.
|
|
<P>
|
|
|
|
The most convenient way to use public key or certificate authentication
|
|
may be with an authentication agent.
|
|
See
|
|
ssh-agent1
|
|
|
|
|
|
and (optionally) the
|
|
<B>AddKeysToAgent</B>
|
|
|
|
directive in
|
|
ssh_config5
|
|
|
|
|
|
for more information.
|
|
<P>
|
|
|
|
Challenge-response authentication works as follows:
|
|
The server sends an arbitrary
|
|
Qq challenge
|
|
|
|
text, and prompts for a response.
|
|
Examples of challenge-response authentication include
|
|
BSD Authentication (see
|
|
login.conf5)
|
|
|
|
|
|
and PAM (some
|
|
non- Ox systems).
|
|
|
|
|
|
|
|
<P>
|
|
|
|
Finally, if other authentication methods fail,
|
|
<B>ssh</B>
|
|
|
|
|
|
prompts the user for a password.
|
|
The password is sent to the remote
|
|
host for checking; however, since all communications are encrypted,
|
|
the password cannot be seen by someone listening on the network.
|
|
<P>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
automatically maintains and checks a database containing
|
|
identification for all hosts it has ever been used with.
|
|
Host keys are stored in
|
|
~/.ssh/known_hosts
|
|
|
|
in the user's home directory.
|
|
Additionally, the file
|
|
/etc/ssh/ssh_known_hosts
|
|
|
|
is automatically checked for known hosts.
|
|
Any new hosts are automatically added to the user's file.
|
|
If a host's identification ever changes,
|
|
<B>ssh</B>
|
|
|
|
|
|
warns about this and disables password authentication to prevent
|
|
server spoofing or man-in-the-middle attacks,
|
|
which could otherwise be used to circumvent the encryption.
|
|
The
|
|
<B>StrictHostKeyChecking</B>
|
|
|
|
option can be used to control logins to machines whose
|
|
host key is not known or has changed.
|
|
<P>
|
|
|
|
When the user's identity has been accepted by the server, the server
|
|
either executes the given command in a non-interactive session or,
|
|
if no command has been specified, logs into the machine and gives
|
|
the user a normal shell as an interactive session.
|
|
All communication with
|
|
the remote command or shell will be automatically encrypted.
|
|
<P>
|
|
|
|
If an interactive session is requested
|
|
<B>ssh</B>
|
|
|
|
|
|
by default will only request a pseudo-terminal (pty) for interactive
|
|
sessions when the client has one.
|
|
The flags
|
|
-<B>T</B>
|
|
|
|
and
|
|
-<B>t</B>
|
|
|
|
can be used to override this behaviour.
|
|
<P>
|
|
|
|
If a pseudo-terminal has been allocated the
|
|
user may use the escape characters noted below.
|
|
<P>
|
|
|
|
If no pseudo-terminal has been allocated,
|
|
the session is transparent and can be used to reliably transfer binary data.
|
|
On most systems, setting the escape character to
|
|
``none''
|
|
|
|
will also make the session transparent even if a tty is used.
|
|
<P>
|
|
|
|
The session terminates when the command or shell on the remote
|
|
machine exits and all X11 and TCP connections have been closed.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>ESCAPE CHARACTERS</H2>
|
|
|
|
When a pseudo-terminal has been requested,
|
|
<B>ssh</B>
|
|
|
|
|
|
supports a number of functions through the use of an escape character.
|
|
<P>
|
|
|
|
A single tilde character can be sent as
|
|
<B>~~</B>
|
|
|
|
or by following the tilde by a character other than those described below.
|
|
The escape character must always follow a newline to be interpreted as
|
|
special.
|
|
The escape character can be changed in configuration files using the
|
|
<B>EscapeChar</B>
|
|
|
|
configuration directive or on the command line by the
|
|
-<B>e</B>
|
|
|
|
option.
|
|
<P>
|
|
|
|
The supported escapes (assuming the default
|
|
`~'
|
|
|
|
)
|
|
are:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="140"><B>~.</B>
|
|
|
|
|
|
<DD>
|
|
Disconnect.
|
|
<DT id="141"><B>~^Z</B>
|
|
|
|
|
|
<DD>
|
|
Background
|
|
<B>.</B>
|
|
|
|
<DT id="142"><B>~#</B>
|
|
|
|
|
|
<DD>
|
|
List forwarded connections.
|
|
<DT id="143"><B>~&</B>
|
|
|
|
|
|
<DD>
|
|
Background
|
|
<B>ssh</B>
|
|
|
|
|
|
at logout when waiting for forwarded connection / X11 sessions to terminate.
|
|
<DT id="144"><B>~?</B>
|
|
|
|
|
|
<DD>
|
|
Display a list of escape characters.
|
|
<DT id="145"><B>~B</B>
|
|
|
|
|
|
<DD>
|
|
Send a BREAK to the remote system
|
|
(only useful if the peer supports it).
|
|
<DT id="146"><B>~C</B>
|
|
|
|
|
|
<DD>
|
|
Open command line.
|
|
Currently this allows the addition of port forwardings using the
|
|
-<B>L</B>
|
|
|
|
|
|
-<B>R</B>
|
|
|
|
and
|
|
-<B>D</B>
|
|
|
|
options (see above).
|
|
It also allows the cancellation of existing port-forwardings
|
|
with
|
|
|
|
-<B>KL </B>[<I>bind_address : port</I>
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for local,
|
|
|
|
-<B>KR </B>[<I>bind_address : port</I>
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for remote and
|
|
|
|
-<B>KD </B>[<I>bind_address : port</I>
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for dynamic port-forwardings.
|
|
<B>! </B><I>command</I>
|
|
|
|
|
|
|
|
|
|
|
|
allows the user to execute a local command if the
|
|
<B>PermitLocalCommand</B>
|
|
|
|
option is enabled in
|
|
ssh_config5.
|
|
|
|
|
|
Basic help is available, using the
|
|
-<B>h</B>
|
|
|
|
option.
|
|
<DT id="147"><B>~R</B>
|
|
|
|
|
|
<DD>
|
|
Request rekeying of the connection
|
|
(only useful if the peer supports it).
|
|
<DT id="148"><B>~V</B>
|
|
|
|
|
|
<DD>
|
|
Decrease the verbosity
|
|
(<B>LogLevel</B>
|
|
|
|
)
|
|
|
|
when errors are being written to stderr.
|
|
<DT id="149"><B>~v</B>
|
|
|
|
|
|
<DD>
|
|
Increase the verbosity
|
|
(<B>LogLevel</B>
|
|
|
|
)
|
|
|
|
when errors are being written to stderr.
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAG"> </A>
|
|
<H2>TCP FORWARDING</H2>
|
|
|
|
Forwarding of arbitrary TCP connections over a secure channel
|
|
can be specified either on the command line or in a configuration file.
|
|
One possible application of TCP forwarding is a secure connection to a
|
|
mail server; another is going through firewalls.
|
|
<P>
|
|
|
|
In the example below, we look at encrypting communication for an IRC client,
|
|
even though the IRC server it connects to does not directly
|
|
support encrypted communication.
|
|
This works as follows:
|
|
the user connects to the remote host using
|
|
<B>,</B>
|
|
|
|
specifying the ports to be used to forward the connection.
|
|
After that it is possible to start the program locally,
|
|
and
|
|
<B>ssh</B>
|
|
|
|
|
|
will encrypt and forward the connection to the remote server.
|
|
<P>
|
|
|
|
The following example tunnels an IRC session from the client
|
|
to an IRC server at
|
|
``server.example.com''
|
|
|
|
|
|
joining channel
|
|
``#users''
|
|
|
|
|
|
nickname
|
|
``pinky''
|
|
|
|
|
|
using the standard IRC port, 6667:
|
|
|
|
<PRE>
|
|
$ ssh -f -L 6667:localhost:6667 server.example.com sleep 10
|
|
$ irc -c '#users' pinky IRC/127.0.0.1
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
The
|
|
-<B>f</B>
|
|
|
|
option backgrounds
|
|
<B>ssh</B>
|
|
|
|
|
|
and the remote command
|
|
``sleep 10''
|
|
|
|
is specified to allow an amount of time
|
|
(10 seconds, in the example)
|
|
to start the program which is going to use the tunnel.
|
|
If no connections are made within the time specified,
|
|
<B>ssh</B>
|
|
|
|
|
|
will exit.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>X11 FORWARDING</H2>
|
|
|
|
If the
|
|
<B>ForwardX11</B>
|
|
|
|
variable is set to
|
|
``yes''
|
|
|
|
(or see the description of the
|
|
-<B>X</B>
|
|
|
|
|
|
-<B>x</B>
|
|
|
|
|
|
and
|
|
-<B>Y</B>
|
|
|
|
options above)
|
|
and the user is using X11 (the
|
|
<B>DISPLAY</B>
|
|
|
|
environment variable is set), the connection to the X11 display is
|
|
automatically forwarded to the remote side in such a way that any X11
|
|
programs started from the shell (or command) will go through the
|
|
encrypted channel, and the connection to the real X server will be made
|
|
from the local machine.
|
|
The user should not manually set
|
|
<B>DISPLAY</B>
|
|
|
|
|
|
Forwarding of X11 connections can be
|
|
configured on the command line or in configuration files.
|
|
<P>
|
|
|
|
The
|
|
<B>DISPLAY</B>
|
|
|
|
value set by
|
|
<B>ssh</B>
|
|
|
|
|
|
will point to the server machine, but with a display number greater than zero.
|
|
This is normal, and happens because
|
|
<B>ssh</B>
|
|
|
|
|
|
creates a
|
|
``proxy''
|
|
|
|
X server on the server machine for forwarding the
|
|
connections over the encrypted channel.
|
|
<P>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
will also automatically set up Xauthority data on the server machine.
|
|
For this purpose, it will generate a random authorization cookie,
|
|
store it in Xauthority on the server, and verify that any forwarded
|
|
connections carry this cookie and replace it by the real cookie when
|
|
the connection is opened.
|
|
The real authentication cookie is never
|
|
sent to the server machine (and no cookies are sent in the plain).
|
|
<P>
|
|
|
|
If the
|
|
<B>ForwardAgent</B>
|
|
|
|
variable is set to
|
|
``yes''
|
|
|
|
(or see the description of the
|
|
-<B>A</B>
|
|
|
|
and
|
|
-<B>a</B>
|
|
|
|
options above) and
|
|
the user is using an authentication agent, the connection to the agent
|
|
is automatically forwarded to the remote side.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>VERIFYING HOST KEYS</H2>
|
|
|
|
When connecting to a server for the first time,
|
|
a fingerprint of the server's public key is presented to the user
|
|
(unless the option
|
|
<B>StrictHostKeyChecking</B>
|
|
|
|
has been disabled).
|
|
Fingerprints can be determined using
|
|
ssh-keygen1:
|
|
|
|
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE><TT>$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key</TT></BLOCKQUOTE>
|
|
<P>
|
|
|
|
If the fingerprint is already known, it can be matched
|
|
and the key can be accepted or rejected.
|
|
If only legacy (MD5) fingerprints for the server are available, the
|
|
ssh-keygen1
|
|
|
|
|
|
-<B>E</B>
|
|
|
|
option may be used to downgrade the fingerprint algorithm to match.
|
|
<P>
|
|
|
|
Because of the difficulty of comparing host keys
|
|
just by looking at fingerprint strings,
|
|
there is also support to compare host keys visually,
|
|
using
|
|
<I>random art</I>
|
|
|
|
|
|
By setting the
|
|
<B>VisualHostKey</B>
|
|
|
|
option to
|
|
``yes''
|
|
|
|
|
|
a small ASCII graphic gets displayed on every login to a server, no matter
|
|
if the session itself is interactive or not.
|
|
By learning the pattern a known server produces, a user can easily
|
|
find out that the host key has changed when a completely different pattern
|
|
is displayed.
|
|
Because these patterns are not unambiguous however, a pattern that looks
|
|
similar to the pattern remembered only gives a good probability that the
|
|
host key is the same, not guaranteed proof.
|
|
<P>
|
|
|
|
To get a listing of the fingerprints along with their random art for
|
|
all known hosts, the following command line can be used:
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE><TT>$ ssh-keygen -lv -f ~/.ssh/known_hosts</TT></BLOCKQUOTE>
|
|
<P>
|
|
|
|
If the fingerprint is unknown,
|
|
an alternative method of verification is available:
|
|
SSH fingerprints verified by DNS.
|
|
An additional resource record (RR),
|
|
SSHFP,
|
|
is added to a zonefile
|
|
and the connecting client is able to match the fingerprint
|
|
with that of the key presented.
|
|
<P>
|
|
|
|
In this example, we are connecting a client to a server,
|
|
``host.example.com''
|
|
|
|
|
|
The SSHFP resource records should first be added to the zonefile for
|
|
host.example.com:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ ssh-keygen -r host.example.com.
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
The output lines will have to be added to the zonefile.
|
|
To check that the zone is answering fingerprint queries:
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE><TT>$ dig -t SSHFP host.example.com</TT></BLOCKQUOTE>
|
|
<P>
|
|
|
|
Finally the client connects:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
$ ssh -o "VerifyHostKeyDNS ask" host.example.com
|
|
[...]
|
|
Matching host key fingerprint found in DNS.
|
|
Are you sure you want to continue connecting (yes/no)?
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
See the
|
|
<B>VerifyHostKeyDNS</B>
|
|
|
|
option in
|
|
ssh_config5
|
|
|
|
|
|
for more information.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SSH-BASED VIRTUAL PRIVATE NETWORKS</H2>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
contains support for Virtual Private Network (VPN) tunnelling
|
|
using the
|
|
<A HREF="/cgi-bin/man/man2html?4+tun">tun</A>(4)
|
|
|
|
|
|
network pseudo-device,
|
|
allowing two networks to be joined securely.
|
|
The
|
|
sshd_config5
|
|
|
|
|
|
configuration option
|
|
<B>PermitTunnel</B>
|
|
|
|
controls whether the server supports this,
|
|
and at what level (layer 2 or 3 traffic).
|
|
<P>
|
|
|
|
The following example would connect client network 10.0.50.0/24
|
|
with remote network 10.0.99.0/24 using a point-to-point connection
|
|
from 10.1.1.1 to 10.1.1.2,
|
|
provided that the SSH server running on the gateway to the remote network,
|
|
at 192.168.1.15, allows it.
|
|
<P>
|
|
|
|
On the client:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
# ssh -f -w 0:1 192.168.1.15 true
|
|
# ifconfig tun0 10.1.1.1 10.1.1.2 netmask 255.255.255.252
|
|
# route add 10.0.99.0/24 10.1.1.2
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
On the server:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
# ifconfig tun1 10.1.1.2 10.1.1.1 netmask 255.255.255.252
|
|
# route add 10.0.50.0/24 10.1.1.1
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Client access may be more finely tuned via the
|
|
/root/.ssh/authorized_keys
|
|
|
|
file (see below) and the
|
|
<B>PermitRootLogin</B>
|
|
|
|
server option.
|
|
The following entry would permit connections on
|
|
<A HREF="/cgi-bin/man/man2html?4+tun">tun</A>(4)
|
|
|
|
|
|
device 1 from user
|
|
``jane''
|
|
|
|
and on tun device 2 from user
|
|
``john''
|
|
|
|
|
|
if
|
|
<B>PermitRootLogin</B>
|
|
|
|
is set to
|
|
``forced-commands-only''
|
|
|
|
|
|
|
|
<PRE>
|
|
tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
|
|
tunnel="2",command="sh /etc/netstart tun2" ssh-rsa ... john
|
|
</PRE>
|
|
|
|
<P>
|
|
|
|
Since an SSH-based setup entails a fair amount of overhead,
|
|
it may be more suited to temporary setups,
|
|
such as for wireless VPNs.
|
|
More permanent VPNs are better provided by tools such as
|
|
<A HREF="/cgi-bin/man/man2html?8+ipsecctl">ipsecctl</A>(8)
|
|
|
|
|
|
and
|
|
<A HREF="/cgi-bin/man/man2html?8+isakmpd">isakmpd</A>(8).
|
|
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H2>ENVIRONMENT</H2>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
will normally set the following environment variables:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="150"><B>DISPLAY</B>
|
|
|
|
|
|
<DD>
|
|
The
|
|
<B>DISPLAY</B>
|
|
|
|
variable indicates the location of the X11 server.
|
|
It is automatically set by
|
|
<B>ssh</B>
|
|
|
|
|
|
to point to a value of the form
|
|
``hostname:n''
|
|
|
|
|
|
where
|
|
``hostname''
|
|
|
|
indicates the host where the shell runs, and
|
|
`n'
|
|
|
|
is an integer >=; 1.
|
|
<B>ssh</B>
|
|
|
|
|
|
uses this special value to forward X11 connections over the secure
|
|
channel.
|
|
The user should normally not set
|
|
<B>DISPLAY</B>
|
|
|
|
explicitly, as that
|
|
will render the X11 connection insecure (and will require the user to
|
|
manually copy any required authorization cookies).
|
|
<DT id="151"><B>HOME</B>
|
|
|
|
|
|
<DD>
|
|
Set to the path of the user's home directory.
|
|
<DT id="152"><B>LOGNAME</B>
|
|
|
|
|
|
<DD>
|
|
Synonym for
|
|
<B>USER</B>
|
|
|
|
|
|
set for compatibility with systems that use this variable.
|
|
<DT id="153"><B>MAIL</B>
|
|
|
|
|
|
<DD>
|
|
Set to the path of the user's mailbox.
|
|
<DT id="154"><B>PATH</B>
|
|
|
|
|
|
<DD>
|
|
Set to the default
|
|
<B>PATH</B>
|
|
|
|
|
|
as specified when compiling
|
|
<B>.</B>
|
|
|
|
<DT id="155"><B>SSH_ASKPASS</B>
|
|
|
|
|
|
<DD>
|
|
If
|
|
<B>ssh</B>
|
|
|
|
|
|
needs a passphrase, it will read the passphrase from the current
|
|
terminal if it was run from a terminal.
|
|
If
|
|
<B>ssh</B>
|
|
|
|
|
|
does not have a terminal associated with it but
|
|
<B>DISPLAY</B>
|
|
|
|
and
|
|
<B>SSH_ASKPASS</B>
|
|
|
|
are set, it will execute the program specified by
|
|
<B>SSH_ASKPASS</B>
|
|
|
|
and open an X11 window to read the passphrase.
|
|
This is particularly useful when calling
|
|
<B>ssh</B>
|
|
|
|
|
|
from a
|
|
.xsession
|
|
|
|
or related script.
|
|
(Note that on some machines it
|
|
may be necessary to redirect the input from
|
|
/dev/null
|
|
|
|
to make this work.)
|
|
<DT id="156"><B>SSH_AUTH_SOCK</B>
|
|
|
|
|
|
<DD>
|
|
Identifies the path of a
|
|
UNIX
|
|
socket used to communicate with the agent.
|
|
<DT id="157"><B>SSH_CONNECTION</B>
|
|
|
|
|
|
<DD>
|
|
Identifies the client and server ends of the connection.
|
|
The variable contains
|
|
four space-separated values: client IP address, client port number,
|
|
server IP address, and server port number.
|
|
<DT id="158"><B>SSH_ORIGINAL_COMMAND</B>
|
|
|
|
|
|
<DD>
|
|
This variable contains the original command line if a forced command
|
|
is executed.
|
|
It can be used to extract the original arguments.
|
|
<DT id="159"><B>SSH_TTY</B>
|
|
|
|
|
|
<DD>
|
|
This is set to the name of the tty (path to the device) associated
|
|
with the current shell or command.
|
|
If the current session has no tty,
|
|
this variable is not set.
|
|
<DT id="160"><B>SSH_TUNNEL</B>
|
|
|
|
|
|
<DD>
|
|
Optionally set by
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
to contain the interface names assigned if tunnel forwarding was
|
|
requested by the client.
|
|
<DT id="161"><B>SSH_USER_AUTH</B>
|
|
|
|
|
|
<DD>
|
|
Optionally set by
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8),
|
|
|
|
|
|
this variable may contain a pathname to a file that lists the authentication
|
|
methods successfully used when the session was established, including any
|
|
public keys that were used.
|
|
<DT id="162"><B>TZ</B>
|
|
|
|
|
|
<DD>
|
|
This variable is set to indicate the present time zone if it
|
|
was set when the daemon was started (i.e. the daemon passes the value
|
|
on to new connections).
|
|
<DT id="163"><B>USER</B>
|
|
|
|
|
|
<DD>
|
|
Set to the name of the user logging in.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
Additionally,
|
|
<B>ssh</B>
|
|
|
|
|
|
reads
|
|
~/.ssh/environment
|
|
|
|
|
|
and adds lines of the format
|
|
``VARNAME=value''
|
|
|
|
to the environment if the file exists and users are allowed to
|
|
change their environment.
|
|
For more information, see the
|
|
<B>PermitUserEnvironment</B>
|
|
|
|
option in
|
|
sshd_config5.
|
|
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="164"><B>~/.rhosts
|
|
|
|
</B>
|
|
<DD>
|
|
This file is used for host-based authentication (see above).
|
|
On some machines this file may need to be
|
|
world-readable if the user's home directory is on an NFS partition,
|
|
because
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
reads it as root.
|
|
Additionally, this file must be owned by the user,
|
|
and must not have write permissions for anyone else.
|
|
The recommended
|
|
permission for most machines is read/write for the user, and not
|
|
accessible by others.
|
|
<P>
|
|
|
|
<DT id="165"><B>~/.shosts
|
|
|
|
</B>
|
|
<DD>
|
|
This file is used in exactly the same way as
|
|
.rhosts
|
|
|
|
|
|
but allows host-based authentication without permitting login with
|
|
rlogin/rsh.
|
|
<P>
|
|
|
|
<DT id="166"><B>~/.ssh/
|
|
|
|
</B>
|
|
<DD>
|
|
This directory is the default location for all user-specific configuration
|
|
and authentication information.
|
|
There is no general requirement to keep the entire contents of this directory
|
|
secret, but the recommended permissions are read/write/execute for the user,
|
|
and not accessible by others.
|
|
<P>
|
|
|
|
<DT id="167"><B>~/.ssh/authorized_keys
|
|
|
|
</B>
|
|
<DD>
|
|
Lists the public keys (DSA, ECDSA, Ed25519, RSA)
|
|
that can be used for logging in as this user.
|
|
The format of this file is described in the
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
manual page.
|
|
This file is not highly sensitive, but the recommended
|
|
permissions are read/write for the user, and not accessible by others.
|
|
<P>
|
|
|
|
<DT id="168"><B>~/.ssh/config
|
|
|
|
</B>
|
|
<DD>
|
|
This is the per-user configuration file.
|
|
The file format and configuration options are described in
|
|
ssh_config5.
|
|
|
|
|
|
Because of the potential for abuse, this file must have strict permissions:
|
|
read/write for the user, and not writable by others.
|
|
It may be group-writable provided that the group in question contains only
|
|
the user.
|
|
<P>
|
|
|
|
<DT id="169"><B>~/.ssh/environment
|
|
|
|
</B>
|
|
<DD>
|
|
Contains additional definitions for environment variables; see
|
|
Sx ENVIRONMENT ,
|
|
|
|
above.
|
|
<P>
|
|
|
|
<DT id="170"><B>~/.ssh/id_dsa
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="171"><B>~/.ssh/id_ecdsa
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="172"><B>~/.ssh/id_ecdsa_sk
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="173"><B>~/.ssh/id_ed25519
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="174"><B>~/.ssh/id_ed25519_sk
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="175"><B>~/.ssh/id_rsa
|
|
|
|
</B>
|
|
<DD>
|
|
Contains the private key for authentication.
|
|
These files
|
|
contain sensitive data and should be readable by the user but not
|
|
accessible by others (read/write/execute).
|
|
<B>ssh</B>
|
|
|
|
|
|
will simply ignore a private key file if it is accessible by others.
|
|
It is possible to specify a passphrase when
|
|
generating the key which will be used to encrypt the
|
|
sensitive part of this file using AES-128.
|
|
<P>
|
|
|
|
<DT id="176"><B>~/.ssh/id_dsa.pub
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="177"><B>~/.ssh/id_ecdsa.pub
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="178"><B>~/.ssh/id_ecdsa_sk.pub
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="179"><B>~/.ssh/id_ed25519.pub
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="180"><B>~/.ssh/id_ed25519_sk.pub
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="181"><B>~/.ssh/id_rsa.pub
|
|
|
|
</B>
|
|
<DD>
|
|
Contains the public key for authentication.
|
|
These files are not
|
|
sensitive and can (but need not) be readable by anyone.
|
|
<P>
|
|
|
|
<DT id="182"><B>~/.ssh/known_hosts
|
|
|
|
</B>
|
|
<DD>
|
|
Contains a list of host keys for all hosts the user has logged into
|
|
that are not already in the systemwide list of known host keys.
|
|
See
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
for further details of the format of this file.
|
|
<P>
|
|
|
|
<DT id="183"><B>~/.ssh/rc
|
|
|
|
</B>
|
|
<DD>
|
|
Commands in this file are executed by
|
|
<B>ssh</B>
|
|
|
|
|
|
when the user logs in, just before the user's shell (or command) is
|
|
started.
|
|
See the
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
manual page for more information.
|
|
<P>
|
|
|
|
<DT id="184"><B>/etc/hosts.equiv
|
|
|
|
</B>
|
|
<DD>
|
|
This file is for host-based authentication (see above).
|
|
It should only be writable by root.
|
|
<P>
|
|
|
|
<DT id="185"><B>/etc/ssh/shosts.equiv
|
|
|
|
</B>
|
|
<DD>
|
|
This file is used in exactly the same way as
|
|
hosts.equiv
|
|
|
|
|
|
but allows host-based authentication without permitting login with
|
|
rlogin/rsh.
|
|
<P>
|
|
|
|
<DT id="186"><B>/etc/ssh/ssh_config
|
|
|
|
</B>
|
|
<DD>
|
|
Systemwide configuration file.
|
|
The file format and configuration options are described in
|
|
ssh_config5.
|
|
|
|
|
|
<P>
|
|
|
|
<DT id="187"><B>/etc/ssh/ssh_host_key
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="188"><B>/etc/ssh/ssh_host_dsa_key
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="189"><B>/etc/ssh/ssh_host_ecdsa_key
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="190"><B>/etc/ssh/ssh_host_ed25519_key
|
|
|
|
</B>
|
|
<DD>
|
|
<DT id="191"><B>/etc/ssh/ssh_host_rsa_key
|
|
|
|
</B>
|
|
<DD>
|
|
These files contain the private parts of the host keys
|
|
and are used for host-based authentication.
|
|
<P>
|
|
|
|
<DT id="192"><B>/etc/ssh/ssh_known_hosts
|
|
|
|
</B>
|
|
<DD>
|
|
Systemwide list of known host keys.
|
|
This file should be prepared by the
|
|
system administrator to contain the public host keys of all machines in the
|
|
organization.
|
|
It should be world-readable.
|
|
See
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
for further details of the format of this file.
|
|
<P>
|
|
|
|
<DT id="193"><B>/etc/ssh/sshrc
|
|
|
|
</B>
|
|
<DD>
|
|
Commands in this file are executed by
|
|
<B>ssh</B>
|
|
|
|
|
|
when the user logs in, just before the user's shell (or command) is started.
|
|
See the
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
manual page for more information.
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H2>EXIT STATUS</H2>
|
|
|
|
<B>ssh</B>
|
|
|
|
|
|
exits with the exit status of the remote command or with 255
|
|
if an error occurred.
|
|
<A NAME="lbAN"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+scp">scp</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+sftp">sftp</A>(1),
|
|
|
|
|
|
ssh-add1,
|
|
|
|
|
|
ssh-agent1,
|
|
|
|
|
|
ssh-argv01,
|
|
|
|
|
|
ssh-keygen1,
|
|
|
|
|
|
ssh-keyscan1,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?4+tun">tun</A>(4),
|
|
|
|
|
|
ssh_config5,
|
|
|
|
|
|
ssh-keysign8,
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?8+sshd">sshd</A>(8)
|
|
|
|
|
|
<A NAME="lbAO"> </A>
|
|
<H2>STANDARDS</H2>
|
|
|
|
<DL COMPACT><DT id="194"><DD>
|
|
S. Lehtinen
|
|
C. Lonvick
|
|
January 2006
|
|
<I>RFC 4250</I>
|
|
<I>The Secure Shell (SSH) Protocol Assigned Numbers</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="195"><DD>
|
|
T. Ylonen
|
|
C. Lonvick
|
|
January 2006
|
|
<I>RFC 4251</I>
|
|
<I>The Secure Shell (SSH) Protocol Architecture</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="196"><DD>
|
|
T. Ylonen
|
|
C. Lonvick
|
|
January 2006
|
|
<I>RFC 4252</I>
|
|
<I>The Secure Shell (SSH) Authentication Protocol</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="197"><DD>
|
|
T. Ylonen
|
|
C. Lonvick
|
|
January 2006
|
|
<I>RFC 4253</I>
|
|
<I>The Secure Shell (SSH) Transport Layer Protocol</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="198"><DD>
|
|
T. Ylonen
|
|
C. Lonvick
|
|
January 2006
|
|
<I>RFC 4254</I>
|
|
<I>The Secure Shell (SSH) Connection Protocol</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="199"><DD>
|
|
J. Schlyter
|
|
W. Griffin
|
|
January 2006
|
|
<I>RFC 4255</I>
|
|
<I>Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="200"><DD>
|
|
F. Cusack
|
|
M. Forssen
|
|
January 2006
|
|
<I>RFC 4256</I>
|
|
<I>Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="201"><DD>
|
|
J. Galbraith
|
|
P. Remaker
|
|
January 2006
|
|
<I>RFC 4335</I>
|
|
<I>The Secure Shell (SSH) Session Channel Break Extension</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="202"><DD>
|
|
M. Bellare
|
|
T. Kohno
|
|
C. Namprempre
|
|
January 2006
|
|
<I>RFC 4344</I>
|
|
<I>The Secure Shell (SSH) Transport Layer Encryption Modes</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="203"><DD>
|
|
B. Harris
|
|
January 2006
|
|
<I>RFC 4345</I>
|
|
<I>Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="204"><DD>
|
|
M. Friedl
|
|
N. Provos
|
|
W. Simpson
|
|
March 2006
|
|
<I>RFC 4419</I>
|
|
<I>Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="205"><DD>
|
|
J. Galbraith
|
|
R. Thayer
|
|
November 2006
|
|
<I>RFC 4716</I>
|
|
<I>The Secure Shell (SSH) Public Key File Format</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="206"><DD>
|
|
D. Stebila
|
|
J. Green
|
|
December 2009
|
|
<I>RFC 5656</I>
|
|
<I>Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer</I>
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<DL COMPACT><DT id="207"><DD>
|
|
A. Perrig
|
|
D. Song
|
|
1999
|
|
International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99)
|
|
<I>Hash Visualization: a New Technique to improve Real-World Security</I>
|
|
</DL>
|
|
|
|
<A NAME="lbAP"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
OpenSSH is a derivative of the original and free
|
|
ssh 1.2.12 release by Tatu Ylonen.
|
|
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
|
|
Theo de Raadt and Dug Song
|
|
removed many bugs, re-added newer features and
|
|
created OpenSSH.
|
|
Markus Friedl contributed the support for SSH
|
|
protocol versions 1.5 and 2.0.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="208"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="209"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="210"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="211"><A HREF="#lbAE">AUTHENTICATION</A><DD>
|
|
<DT id="212"><A HREF="#lbAF">ESCAPE CHARACTERS</A><DD>
|
|
<DT id="213"><A HREF="#lbAG">TCP FORWARDING</A><DD>
|
|
<DT id="214"><A HREF="#lbAH">X11 FORWARDING</A><DD>
|
|
<DT id="215"><A HREF="#lbAI">VERIFYING HOST KEYS</A><DD>
|
|
<DT id="216"><A HREF="#lbAJ">SSH-BASED VIRTUAL PRIVATE NETWORKS</A><DD>
|
|
<DT id="217"><A HREF="#lbAK">ENVIRONMENT</A><DD>
|
|
<DT id="218"><A HREF="#lbAL">FILES</A><DD>
|
|
<DT id="219"><A HREF="#lbAM">EXIT STATUS</A><DD>
|
|
<DT id="220"><A HREF="#lbAN">SEE ALSO</A><DD>
|
|
<DT id="221"><A HREF="#lbAO">STANDARDS</A><DD>
|
|
<DT id="222"><A HREF="#lbAP">AUTHORS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:27 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|