1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.313 2020/08/27 01:07:10 djm Exp $ 37.Dd $Mdocdate: August 27 2020 $ 38.Dt SSHD 8 39.Os 40.Sh NAME 41.Nm sshd 42.Nd OpenSSH daemon 43.Sh SYNOPSIS 44.Nm sshd 45.Bk -words 46.Op Fl 46DdeiqTt 47.Op Fl C Ar connection_spec 48.Op Fl c Ar host_certificate_file 49.Op Fl E Ar log_file 50.Op Fl f Ar config_file 51.Op Fl g Ar login_grace_time 52.Op Fl h Ar host_key_file 53.Op Fl o Ar option 54.Op Fl p Ar port 55.Op Fl u Ar len 56.Ek 57.Sh DESCRIPTION 58.Nm 59(OpenSSH Daemon) is the daemon program for 60.Xr ssh 1 . 61Together these programs replace rlogin and rsh, 62and provide secure encrypted communications between two untrusted hosts 63over an insecure network. 64.Pp 65.Nm 66listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74.Pp 75.Nm 76can be configured using command-line options or a configuration file 77(by default 78.Xr sshd_config 5 ) ; 79command-line options override values specified in the 80configuration file. 81.Nm 82rereads its configuration file when it receives a hangup signal, 83.Dv SIGHUP , 84by executing itself with the name and options it was started with, e.g.\& 85.Pa /usr/sbin/sshd . 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 4 90Forces 91.Nm 92to use IPv4 addresses only. 93.It Fl 6 94Forces 95.Nm 96to use IPv6 addresses only. 97.It Fl C Ar connection_spec 98Specify the connection parameters to use for the 99.Fl T 100extended test mode. 101If provided, any 102.Cm Match 103directives in the configuration file that would apply are applied before the 104configuration is written to standard output. 105The connection parameters are supplied as keyword=value pairs and may be 106supplied in any order, either with multiple 107.Fl C 108options or as a comma-separated list. 109The keywords are 110.Dq addr, 111.Dq user , 112.Dq host , 113.Dq laddr , 114.Dq lport , 115and 116.Dq rdomain 117and correspond to source address, user, resolved source host name, 118local address, local port number and routing domain respectively. 119.It Fl c Ar host_certificate_file 120Specifies a path to a certificate file to identify 121.Nm 122during key exchange. 123The certificate file must match a host key file specified using the 124.Fl h 125option or the 126.Cm HostKey 127configuration directive. 128.It Fl D 129When this option is specified, 130.Nm 131will not detach and does not become a daemon. 132This allows easy monitoring of 133.Nm sshd . 134.It Fl d 135Debug mode. 136The server sends verbose debug output to standard error, 137and does not put itself in the background. 138The server also will not fork and will only process one connection. 139This option is only intended for debugging for the server. 140Multiple 141.Fl d 142options increase the debugging level. 143Maximum is 3. 144.It Fl E Ar log_file 145Append debug logs to 146.Ar log_file 147instead of the system log. 148.It Fl e 149Write debug logs to standard error instead of the system log. 150.It Fl f Ar config_file 151Specifies the name of the configuration file. 152The default is 153.Pa /etc/ssh/sshd_config . 154.Nm 155refuses to start if there is no configuration file. 156.It Fl g Ar login_grace_time 157Gives the grace time for clients to authenticate themselves (default 158120 seconds). 159If the client fails to authenticate the user within 160this many seconds, the server disconnects and exits. 161A value of zero indicates no limit. 162.It Fl h Ar host_key_file 163Specifies a file from which a host key is read. 164This option must be given if 165.Nm 166is not run as root (as the normal 167host key files are normally not readable by anyone but root). 168The default is 169.Pa /etc/ssh/ssh_host_ecdsa_key , 170.Pa /etc/ssh/ssh_host_ed25519_key 171and 172.Pa /etc/ssh/ssh_host_rsa_key . 173It is possible to have multiple host key files for 174the different host key algorithms. 175.It Fl i 176Specifies that 177.Nm 178is being run from 179.Xr inetd 8 . 180.It Fl o Ar option 181Can be used to give options in the format used in the configuration file. 182This is useful for specifying options for which there is no separate 183command-line flag. 184For full details of the options, and their values, see 185.Xr sshd_config 5 . 186.It Fl p Ar port 187Specifies the port on which the server listens for connections 188(default 22). 189Multiple port options are permitted. 190Ports specified in the configuration file with the 191.Cm Port 192option are ignored when a command-line port is specified. 193Ports specified using the 194.Cm ListenAddress 195option override command-line ports. 196.It Fl q 197Quiet mode. 198Nothing is sent to the system log. 199Normally the beginning, 200authentication, and termination of each connection is logged. 201.It Fl T 202Extended test mode. 203Check the validity of the configuration file, output the effective configuration 204to stdout and then exit. 205Optionally, 206.Cm Match 207rules may be applied by specifying the connection parameters using one or more 208.Fl C 209options. 210.It Fl t 211Test mode. 212Only check the validity of the configuration file and sanity of the keys. 213This is useful for updating 214.Nm 215reliably as configuration options may change. 216.It Fl u Ar len 217This option is used to specify the size of the field 218in the 219.Li utmp 220structure that holds the remote host name. 221If the resolved host name is longer than 222.Ar len , 223the dotted decimal value will be used instead. 224This allows hosts with very long host names that 225overflow this field to still be uniquely identified. 226Specifying 227.Fl u0 228indicates that only dotted decimal addresses 229should be put into the 230.Pa utmp 231file. 232.Fl u0 233may also be used to prevent 234.Nm 235from making DNS requests unless the authentication 236mechanism or configuration requires it. 237Authentication mechanisms that may require DNS include 238.Cm HostbasedAuthentication 239and using a 240.Cm from="pattern-list" 241option in a key file. 242Configuration options that require DNS include using a 243USER@HOST pattern in 244.Cm AllowUsers 245or 246.Cm DenyUsers . 247.El 248.Sh AUTHENTICATION 249The OpenSSH SSH daemon supports SSH protocol 2 only. 250Each host has a host-specific key, 251used to identify the host. 252Whenever a client connects, the daemon responds with its public 253host key. 254The client compares the 255host key against its own database to verify that it has not changed. 256Forward secrecy is provided through a Diffie-Hellman key agreement. 257This key agreement results in a shared session key. 258The rest of the session is encrypted using a symmetric cipher. 259The client selects the encryption algorithm 260to use from those offered by the server. 261Additionally, session integrity is provided 262through a cryptographic message authentication code (MAC). 263.Pp 264Finally, the server and the client enter an authentication dialog. 265The client tries to authenticate itself using 266host-based authentication, 267public key authentication, 268challenge-response authentication, 269or password authentication. 270.Pp 271If the client successfully authenticates itself, a dialog for 272preparing the session is entered. 273At this time the client may request 274things like allocating a pseudo-tty, forwarding X11 connections, 275forwarding TCP connections, or forwarding the authentication agent 276connection over the secure channel. 277.Pp 278After this, the client either requests a shell or execution of a command. 279The sides then enter session mode. 280In this mode, either side may send 281data at any time, and such data is forwarded to/from the shell or 282command on the server side, and the user terminal in the client side. 283.Pp 284When the user program terminates and all forwarded X11 and other 285connections have been closed, the server sends command exit status to 286the client, and both sides exit. 287.Sh LOGIN PROCESS 288When a user successfully logs in, 289.Nm 290does the following: 291.Bl -enum -offset indent 292.It 293If the login is on a tty, and no command has been specified, 294prints last login time and 295.Pa /etc/motd 296(unless prevented in the configuration file or by 297.Pa ~/.hushlogin ; 298see the 299.Sx FILES 300section). 301.It 302If the login is on a tty, records login time. 303.It 304Checks 305.Pa /etc/nologin ; 306if it exists, prints contents and quits 307(unless root). 308.It 309Changes to run with normal user privileges. 310.It 311Sets up basic environment. 312.It 313Reads the file 314.Pa ~/.ssh/environment , 315if it exists, and users are allowed to change their environment. 316See the 317.Cm PermitUserEnvironment 318option in 319.Xr sshd_config 5 . 320.It 321Changes to user's home directory. 322.It 323If 324.Pa ~/.ssh/rc 325exists and the 326.Xr sshd_config 5 327.Cm PermitUserRC 328option is set, runs it; else if 329.Pa /etc/ssh/sshrc 330exists, runs 331it; otherwise runs xauth. 332The 333.Dq rc 334files are given the X11 335authentication protocol and cookie in standard input. 336See 337.Sx SSHRC , 338below. 339.It 340Runs user's shell or command. 341All commands are run under the user's login shell as specified in the 342system password database. 343.El 344.Sh SSHRC 345If the file 346.Pa ~/.ssh/rc 347exists, 348.Xr sh 1 349runs it after reading the 350environment files but before starting the user's shell or command. 351It must not produce any output on stdout; stderr must be used 352instead. 353If X11 forwarding is in use, it will receive the "proto cookie" pair in 354its standard input (and 355.Ev DISPLAY 356in its environment). 357The script must call 358.Xr xauth 1 359because 360.Nm 361will not run xauth automatically to add X11 cookies. 362.Pp 363The primary purpose of this file is to run any initialization routines 364which may be needed before the user's home directory becomes 365accessible; AFS is a particular example of such an environment. 366.Pp 367This file will probably contain some initialization code followed by 368something similar to: 369.Bd -literal -offset 3n 370if read proto cookie && [ -n "$DISPLAY" ]; then 371 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 372 # X11UseLocalhost=yes 373 echo add unix:`echo $DISPLAY | 374 cut -c11-` $proto $cookie 375 else 376 # X11UseLocalhost=no 377 echo add $DISPLAY $proto $cookie 378 fi | xauth -q - 379fi 380.Ed 381.Pp 382If this file does not exist, 383.Pa /etc/ssh/sshrc 384is run, and if that 385does not exist either, xauth is used to add the cookie. 386.Sh AUTHORIZED_KEYS FILE FORMAT 387.Cm AuthorizedKeysFile 388specifies the files containing public keys for 389public key authentication; 390if this option is not specified, the default is 391.Pa ~/.ssh/authorized_keys 392and 393.Pa ~/.ssh/authorized_keys2 . 394Each line of the file contains one 395key (empty lines and lines starting with a 396.Ql # 397are ignored as 398comments). 399Public keys consist of the following space-separated fields: 400options, keytype, base64-encoded key, comment. 401The options field is optional. 402The supported key types are: 403.Pp 404.Bl -item -compact -offset indent 405.It 406sk-ecdsa-sha2-nistp256@openssh.com 407.It 408ecdsa-sha2-nistp256 409.It 410ecdsa-sha2-nistp384 411.It 412ecdsa-sha2-nistp521 413.It 414sk-ssh-ed25519@openssh.com 415.It 416ssh-ed25519 417.It 418ssh-dss 419.It 420ssh-rsa 421.El 422.Pp 423The comment field is not used for anything (but may be convenient for the 424user to identify the key). 425.Pp 426Note that lines in this file can be several hundred bytes long 427(because of the size of the public key encoding) up to a limit of 4288 kilobytes, which permits RSA keys up to 16 kilobits. 429You don't want to type them in; instead, copy the 430.Pa id_dsa.pub , 431.Pa id_ecdsa.pub , 432.Pa id_ecdsa_sk.pub , 433.Pa id_ed25519.pub , 434.Pa id_ed25519_sk.pub , 435or the 436.Pa id_rsa.pub 437file and edit it. 438.Pp 439.Nm 440enforces a minimum RSA key modulus size of 1024 bits. 441.Pp 442The options (if present) consist of comma-separated option 443specifications. 444No spaces are permitted, except within double quotes. 445The following option specifications are supported (note 446that option keywords are case-insensitive): 447.Bl -tag -width Ds 448.It Cm agent-forwarding 449Enable authentication agent forwarding previously disabled by the 450.Cm restrict 451option. 452.It Cm cert-authority 453Specifies that the listed key is a certification authority (CA) that is 454trusted to validate signed certificates for user authentication. 455.Pp 456Certificates may encode access restrictions similar to these key options. 457If both certificate restrictions and key options are present, the most 458restrictive union of the two is applied. 459.It Cm command="command" 460Specifies that the command is executed whenever this key is used for 461authentication. 462The command supplied by the user (if any) is ignored. 463The command is run on a pty if the client requests a pty; 464otherwise it is run without a tty. 465If an 8-bit clean channel is required, 466one must not request a pty or should specify 467.Cm no-pty . 468A quote may be included in the command by quoting it with a backslash. 469.Pp 470This option might be useful 471to restrict certain public keys to perform just a specific operation. 472An example might be a key that permits remote backups but nothing else. 473Note that the client may specify TCP and/or X11 474forwarding unless they are explicitly prohibited, e.g. using the 475.Cm restrict 476key option. 477.Pp 478The command originally supplied by the client is available in the 479.Ev SSH_ORIGINAL_COMMAND 480environment variable. 481Note that this option applies to shell, command or subsystem execution. 482Also note that this command may be superseded by a 483.Xr sshd_config 5 484.Cm ForceCommand 485directive. 486.Pp 487If a command is specified and a forced-command is embedded in a certificate 488used for authentication, then the certificate will be accepted only if the 489two commands are identical. 490.It Cm environment="NAME=value" 491Specifies that the string is to be added to the environment when 492logging in using this key. 493Environment variables set this way 494override other default environment values. 495Multiple options of this type are permitted. 496Environment processing is disabled by default and is 497controlled via the 498.Cm PermitUserEnvironment 499option. 500.It Cm expiry-time="timespec" 501Specifies a time after which the key will not be accepted. 502The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time 503in the system time-zone. 504.It Cm from="pattern-list" 505Specifies that in addition to public key authentication, either the canonical 506name of the remote host or its IP address must be present in the 507comma-separated list of patterns. 508See PATTERNS in 509.Xr ssh_config 5 510for more information on patterns. 511.Pp 512In addition to the wildcard matching that may be applied to hostnames or 513addresses, a 514.Cm from 515stanza may match IP addresses using CIDR address/masklen notation. 516.Pp 517The purpose of this option is to optionally increase security: public key 518authentication by itself does not trust the network or name servers or 519anything (but the key); however, if somebody somehow steals the key, the key 520permits an intruder to log in from anywhere in the world. 521This additional option makes using a stolen key more difficult (name 522servers and/or routers would have to be compromised in addition to 523just the key). 524.It Cm no-agent-forwarding 525Forbids authentication agent forwarding when this key is used for 526authentication. 527.It Cm no-port-forwarding 528Forbids TCP forwarding when this key is used for authentication. 529Any port forward requests by the client will return an error. 530This might be used, e.g. in connection with the 531.Cm command 532option. 533.It Cm no-pty 534Prevents tty allocation (a request to allocate a pty will fail). 535.It Cm no-user-rc 536Disables execution of 537.Pa ~/.ssh/rc . 538.It Cm no-X11-forwarding 539Forbids X11 forwarding when this key is used for authentication. 540Any X11 forward requests by the client will return an error. 541.It Cm permitlisten="[host:]port" 542Limit remote port forwarding with the 543.Xr ssh 1 544.Fl R 545option such that it may only listen on the specified host (optional) and port. 546IPv6 addresses can be specified by enclosing the address in square brackets. 547Multiple 548.Cm permitlisten 549options may be applied separated by commas. 550Hostnames may include wildcards as described in the PATTERNS section in 551.Xr ssh_config 5 . 552A port specification of 553.Cm * 554matches any port. 555Note that the setting of 556.Cm GatewayPorts 557may further restrict listen addresses. 558Note that 559.Xr ssh 1 560will send a hostname of 561.Dq localhost 562if a listen host was not specified when the forwarding was requested, and 563that this name is treated differently to the explicit localhost addresses 564.Dq 127.0.0.1 565and 566.Dq ::1 . 567.It Cm permitopen="host:port" 568Limit local port forwarding with the 569.Xr ssh 1 570.Fl L 571option such that it may only connect to the specified host and port. 572IPv6 addresses can be specified by enclosing the address in square brackets. 573Multiple 574.Cm permitopen 575options may be applied separated by commas. 576No pattern matching or name lookup is performed on the 577specified hostnames, they must be literal host names and/or addresses. 578A port specification of 579.Cm * 580matches any port. 581.It Cm port-forwarding 582Enable port forwarding previously disabled by the 583.Cm restrict 584option. 585.It Cm principals="principals" 586On a 587.Cm cert-authority 588line, specifies allowed principals for certificate authentication as a 589comma-separated list. 590At least one name from the list must appear in the certificate's 591list of principals for the certificate to be accepted. 592This option is ignored for keys that are not marked as trusted certificate 593signers using the 594.Cm cert-authority 595option. 596.It Cm pty 597Permits tty allocation previously disabled by the 598.Cm restrict 599option. 600.It Cm no-touch-required 601Do not require demonstration of user presence 602for signatures made using this key. 603This option only makes sense for the FIDO authenticator algorithms 604.Cm ecdsa-sk 605and 606.Cm ed25519-sk . 607.It Cm verify-required 608Require that signatures made using this key attest that they verified 609the user, e.g. via a PIN. 610This option only makes sense for the FIDO authenticator algorithms 611.Cm ecdsa-sk 612and 613.Cm ed25519-sk . 614.It Cm restrict 615Enable all restrictions, i.e. disable port, agent and X11 forwarding, 616as well as disabling PTY allocation 617and execution of 618.Pa ~/.ssh/rc . 619If any future restriction capabilities are added to authorized_keys files 620they will be included in this set. 621.It Cm tunnel="n" 622Force a 623.Xr tun 4 624device on the server. 625Without this option, the next available device will be used if 626the client requests a tunnel. 627.It Cm user-rc 628Enables execution of 629.Pa ~/.ssh/rc 630previously disabled by the 631.Cm restrict 632option. 633.It Cm X11-forwarding 634Permits X11 forwarding previously disabled by the 635.Cm restrict 636option. 637.El 638.Pp 639An example authorized_keys file: 640.Bd -literal -offset 3n 641# Comments allowed at start of line 642ssh-rsa AAAAB3Nza...LiPk== user@example.net 643from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 644AAAAB2...19Q== john@example.net 645command="dump /home",no-pty,no-port-forwarding ssh-rsa 646AAAAC3...51R== example.net 647permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa 648AAAAB5...21S== 649permitlisten="localhost:8080",permitopen="localhost:22000" ssh-rsa 650AAAAB5...21S== 651tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 652jane@example.net 653restrict,command="uptime" ssh-rsa AAAA1C8...32Tv== 654user@example.net 655restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5== 656user@example.net 657no-touch-required sk-ecdsa-sha2-nistp256@openssh.com AAAAInN...Ko== 658user@example.net 659.Ed 660.Sh SSH_KNOWN_HOSTS FILE FORMAT 661The 662.Pa /etc/ssh/ssh_known_hosts 663and 664.Pa ~/.ssh/known_hosts 665files contain host public keys for all known hosts. 666The global file should 667be prepared by the administrator (optional), and the per-user file is 668maintained automatically: whenever the user connects to an unknown host, 669its key is added to the per-user file. 670.Pp 671Each line in these files contains the following fields: markers (optional), 672hostnames, keytype, base64-encoded key, comment. 673The fields are separated by spaces. 674.Pp 675The marker is optional, but if it is present then it must be one of 676.Dq @cert-authority , 677to indicate that the line contains a certification authority (CA) key, 678or 679.Dq @revoked , 680to indicate that the key contained on the line is revoked and must not ever 681be accepted. 682Only one marker should be used on a key line. 683.Pp 684Hostnames is a comma-separated list of patterns 685.Pf ( Ql * 686and 687.Ql \&? 688act as 689wildcards); each pattern in turn is matched against the host name. 690When 691.Nm sshd 692is authenticating a client, such as when using 693.Cm HostbasedAuthentication , 694this will be the canonical client host name. 695When 696.Xr ssh 1 697is authenticating a server, this will be the host name 698given by the user, the value of the 699.Xr ssh 1 700.Cm HostkeyAlias 701if it was specified, or the canonical server hostname if the 702.Xr ssh 1 703.Cm CanonicalizeHostname 704option was used. 705.Pp 706A pattern may also be preceded by 707.Ql \&! 708to indicate negation: if the host name matches a negated 709pattern, it is not accepted (by that line) even if it matched another 710pattern on the line. 711A hostname or address may optionally be enclosed within 712.Ql \&[ 713and 714.Ql \&] 715brackets then followed by 716.Ql \&: 717and a non-standard port number. 718.Pp 719Alternately, hostnames may be stored in a hashed form which hides host names 720and addresses should the file's contents be disclosed. 721Hashed hostnames start with a 722.Ql | 723character. 724Only one hashed hostname may appear on a single line and none of the above 725negation or wildcard operators may be applied. 726.Pp 727The keytype and base64-encoded key are taken directly from the host key; they 728can be obtained, for example, from 729.Pa /etc/ssh/ssh_host_rsa_key.pub . 730The optional comment field continues to the end of the line, and is not used. 731.Pp 732Lines starting with 733.Ql # 734and empty lines are ignored as comments. 735.Pp 736When performing host authentication, authentication is accepted if any 737matching line has the proper key; either one that matches exactly or, 738if the server has presented a certificate for authentication, the key 739of the certification authority that signed the certificate. 740For a key to be trusted as a certification authority, it must use the 741.Dq @cert-authority 742marker described above. 743.Pp 744The known hosts file also provides a facility to mark keys as revoked, 745for example when it is known that the associated private key has been 746stolen. 747Revoked keys are specified by including the 748.Dq @revoked 749marker at the beginning of the key line, and are never accepted for 750authentication or as certification authorities, but instead will 751produce a warning from 752.Xr ssh 1 753when they are encountered. 754.Pp 755It is permissible (but not 756recommended) to have several lines or different host keys for the same 757names. 758This will inevitably happen when short forms of host names 759from different domains are put in the file. 760It is possible 761that the files contain conflicting information; authentication is 762accepted if valid information can be found from either file. 763.Pp 764Note that the lines in these files are typically hundreds of characters 765long, and you definitely don't want to type in the host keys by hand. 766Rather, generate them by a script, 767.Xr ssh-keyscan 1 768or by taking, for example, 769.Pa /etc/ssh/ssh_host_rsa_key.pub 770and adding the host names at the front. 771.Xr ssh-keygen 1 772also offers some basic automated editing for 773.Pa ~/.ssh/known_hosts 774including removing hosts matching a host name and converting all host 775names to their hashed representations. 776.Pp 777An example ssh_known_hosts file: 778.Bd -literal -offset 3n 779# Comments allowed at start of line 780closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 781cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 782# A hashed hostname 783|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 784AAAA1234.....= 785# A revoked key 786@revoked * ssh-rsa AAAAB5W... 787# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 788@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 789.Ed 790.Sh FILES 791.Bl -tag -width Ds -compact 792.It Pa ~/.hushlogin 793This file is used to suppress printing the last login time and 794.Pa /etc/motd , 795if 796.Cm PrintLastLog 797and 798.Cm PrintMotd , 799respectively, 800are enabled. 801It does not suppress printing of the banner specified by 802.Cm Banner . 803.Pp 804.It Pa ~/.rhosts 805This file is used for host-based authentication (see 806.Xr ssh 1 807for more information). 808On some machines this file may need to be 809world-readable if the user's home directory is on an NFS partition, 810because 811.Nm 812reads it as root. 813Additionally, this file must be owned by the user, 814and must not have write permissions for anyone else. 815The recommended 816permission for most machines is read/write for the user, and not 817accessible by others. 818.Pp 819.It Pa ~/.shosts 820This file is used in exactly the same way as 821.Pa .rhosts , 822but allows host-based authentication without permitting login with 823rlogin/rsh. 824.Pp 825.It Pa ~/.ssh/ 826This directory is the default location for all user-specific configuration 827and authentication information. 828There is no general requirement to keep the entire contents of this directory 829secret, but the recommended permissions are read/write/execute for the user, 830and not accessible by others. 831.Pp 832.It Pa ~/.ssh/authorized_keys 833Lists the public keys (DSA, ECDSA, Ed25519, RSA) 834that can be used for logging in as this user. 835The format of this file is described above. 836The content of the file is not highly sensitive, but the recommended 837permissions are read/write for the user, and not accessible by others. 838.Pp 839If this file, the 840.Pa ~/.ssh 841directory, or the user's home directory are writable 842by other users, then the file could be modified or replaced by unauthorized 843users. 844In this case, 845.Nm 846will not allow it to be used unless the 847.Cm StrictModes 848option has been set to 849.Dq no . 850.Pp 851.It Pa ~/.ssh/environment 852This file is read into the environment at login (if it exists). 853It can only contain empty lines, comment lines (that start with 854.Ql # ) , 855and assignment lines of the form name=value. 856The file should be writable 857only by the user; it need not be readable by anyone else. 858Environment processing is disabled by default and is 859controlled via the 860.Cm PermitUserEnvironment 861option. 862.Pp 863.It Pa ~/.ssh/known_hosts 864Contains a list of host keys for all hosts the user has logged into 865that are not already in the systemwide list of known host keys. 866The format of this file is described above. 867This file should be writable only by root/the owner and 868can, but need not be, world-readable. 869.Pp 870.It Pa ~/.ssh/rc 871Contains initialization routines to be run before 872the user's home directory becomes accessible. 873This file should be writable only by the user, and need not be 874readable by anyone else. 875.Pp 876.It Pa /etc/hosts.equiv 877This file is for host-based authentication (see 878.Xr ssh 1 ) . 879It should only be writable by root. 880.Pp 881.It Pa /etc/moduli 882Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" 883key exchange method. 884The file format is described in 885.Xr moduli 5 . 886If no usable groups are found in this file then fixed internal groups will 887be used. 888.Pp 889.It Pa /etc/motd 890See 891.Xr motd 5 . 892.Pp 893.It Pa /etc/nologin 894If this file exists, 895.Nm 896refuses to let anyone except root log in. 897The contents of the file 898are displayed to anyone trying to log in, and non-root connections are 899refused. 900The file should be world-readable. 901.Pp 902.It Pa /etc/shosts.equiv 903This file is used in exactly the same way as 904.Pa hosts.equiv , 905but allows host-based authentication without permitting login with 906rlogin/rsh. 907.Pp 908.It Pa /etc/ssh/ssh_host_ecdsa_key 909.It Pa /etc/ssh/ssh_host_ed25519_key 910.It Pa /etc/ssh/ssh_host_rsa_key 911These files contain the private parts of the host keys. 912These files should only be owned by root, readable only by root, and not 913accessible to others. 914Note that 915.Nm 916does not start if these files are group/world-accessible. 917.Pp 918.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 919.It Pa /etc/ssh/ssh_host_ed25519_key.pub 920.It Pa /etc/ssh/ssh_host_rsa_key.pub 921These files contain the public parts of the host keys. 922These files should be world-readable but writable only by 923root. 924Their contents should match the respective private parts. 925These files are not 926really used for anything; they are provided for the convenience of 927the user so their contents can be copied to known hosts files. 928These files are created using 929.Xr ssh-keygen 1 . 930.Pp 931.It Pa /etc/ssh/ssh_known_hosts 932Systemwide list of known host keys. 933This file should be prepared by the 934system administrator to contain the public host keys of all machines in the 935organization. 936The format of this file is described above. 937This file should be writable only by root/the owner and 938should be world-readable. 939.Pp 940.It Pa /etc/ssh/sshd_config 941Contains configuration data for 942.Nm sshd . 943The file format and configuration options are described in 944.Xr sshd_config 5 . 945.Pp 946.It Pa /etc/ssh/sshrc 947Similar to 948.Pa ~/.ssh/rc , 949it can be used to specify 950machine-specific login-time initializations globally. 951This file should be writable only by root, and should be world-readable. 952.Pp 953.It Pa /var/empty 954.Xr chroot 2 955directory used by 956.Nm 957during privilege separation in the pre-authentication phase. 958The directory should not contain any files and must be owned by root 959and not group or world-writable. 960.Pp 961.It Pa /var/run/sshd.pid 962Contains the process ID of the 963.Nm 964listening for connections (if there are several daemons running 965concurrently for different ports, this contains the process ID of the one 966started last). 967The content of this file is not sensitive; it can be world-readable. 968.El 969.Sh SEE ALSO 970.Xr scp 1 , 971.Xr sftp 1 , 972.Xr ssh 1 , 973.Xr ssh-add 1 , 974.Xr ssh-agent 1 , 975.Xr ssh-keygen 1 , 976.Xr ssh-keyscan 1 , 977.Xr chroot 2 , 978.Xr login.conf 5 , 979.Xr moduli 5 , 980.Xr sshd_config 5 , 981.Xr inetd 8 , 982.Xr sftp-server 8 983.Sh AUTHORS 984OpenSSH is a derivative of the original and free 985ssh 1.2.12 release by Tatu Ylonen. 986Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 987Theo de Raadt and Dug Song 988removed many bugs, re-added newer features and 989created OpenSSH. 990Markus Friedl contributed the support for SSH 991protocol versions 1.5 and 2.0. 992Niels Provos and Markus Friedl contributed support 993for privilege separation. 994