1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.312 2020/01/25 06:03:10 djm Exp $ 37.Dd $Mdocdate: January 25 2020 $ 38.Dt SSHD 8 39.Os 40.Sh NAME 41.Nm sshd 42.Nd OpenSSH daemon 43.Sh SYNOPSIS 44.Nm sshd 45.Bk -words 46.Op Fl 46DdeiqTt 47.Op Fl C Ar connection_spec 48.Op Fl c Ar host_certificate_file 49.Op Fl E Ar log_file 50.Op Fl f Ar config_file 51.Op Fl g Ar login_grace_time 52.Op Fl h Ar host_key_file 53.Op Fl o Ar option 54.Op Fl p Ar port 55.Op Fl u Ar len 56.Ek 57.Sh DESCRIPTION 58.Nm 59(OpenSSH Daemon) is the daemon program for 60.Xr ssh 1 . 61Together these programs replace rlogin and rsh, 62and provide secure encrypted communications between two untrusted hosts 63over an insecure network. 64.Pp 65.Nm 66listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74.Pp 75.Nm 76can be configured using command-line options or a configuration file 77(by default 78.Xr sshd_config 5 ) ; 79command-line options override values specified in the 80configuration file. 81.Nm 82rereads its configuration file when it receives a hangup signal, 83.Dv SIGHUP , 84by executing itself with the name and options it was started with, e.g.\& 85.Pa /usr/sbin/sshd . 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 4 90Forces 91.Nm 92to use IPv4 addresses only. 93.It Fl 6 94Forces 95.Nm 96to use IPv6 addresses only. 97.It Fl C Ar connection_spec 98Specify the connection parameters to use for the 99.Fl T 100extended test mode. 101If provided, any 102.Cm Match 103directives in the configuration file that would apply are applied before the 104configuration is written to standard output. 105The connection parameters are supplied as keyword=value pairs and may be 106supplied in any order, either with multiple 107.Fl C 108options or as a comma-separated list. 109The keywords are 110.Dq addr, 111.Dq user , 112.Dq host , 113.Dq laddr , 114.Dq lport , 115and 116.Dq rdomain 117and correspond to source address, user, resolved source host name, 118local address, local port number and routing domain respectively. 119.It Fl c Ar host_certificate_file 120Specifies a path to a certificate file to identify 121.Nm 122during key exchange. 123The certificate file must match a host key file specified using the 124.Fl h 125option or the 126.Cm HostKey 127configuration directive. 128.It Fl D 129When this option is specified, 130.Nm 131will not detach and does not become a daemon. 132This allows easy monitoring of 133.Nm sshd . 134.It Fl d 135Debug mode. 136The server sends verbose debug output to standard error, 137and does not put itself in the background. 138The server also will not fork and will only process one connection. 139This option is only intended for debugging for the server. 140Multiple 141.Fl d 142options increase the debugging level. 143Maximum is 3. 144.It Fl E Ar log_file 145Append debug logs to 146.Ar log_file 147instead of the system log. 148.It Fl e 149Write debug logs to standard error instead of the system log. 150.It Fl f Ar config_file 151Specifies the name of the configuration file. 152The default is 153.Pa /etc/ssh/sshd_config . 154.Nm 155refuses to start if there is no configuration file. 156.It Fl g Ar login_grace_time 157Gives the grace time for clients to authenticate themselves (default 158120 seconds). 159If the client fails to authenticate the user within 160this many seconds, the server disconnects and exits. 161A value of zero indicates no limit. 162.It Fl h Ar host_key_file 163Specifies a file from which a host key is read. 164This option must be given if 165.Nm 166is not run as root (as the normal 167host key files are normally not readable by anyone but root). 168The default is 169.Pa /etc/ssh/ssh_host_ecdsa_key , 170.Pa /etc/ssh/ssh_host_ed25519_key 171and 172.Pa /etc/ssh/ssh_host_rsa_key . 173It is possible to have multiple host key files for 174the different host key algorithms. 175.It Fl i 176Specifies that 177.Nm 178is being run from 179.Xr inetd 8 . 180.It Fl o Ar option 181Can be used to give options in the format used in the configuration file. 182This is useful for specifying options for which there is no separate 183command-line flag. 184For full details of the options, and their values, see 185.Xr sshd_config 5 . 186.It Fl p Ar port 187Specifies the port on which the server listens for connections 188(default 22). 189Multiple port options are permitted. 190Ports specified in the configuration file with the 191.Cm Port 192option are ignored when a command-line port is specified. 193Ports specified using the 194.Cm ListenAddress 195option override command-line ports. 196.It Fl q 197Quiet mode. 198Nothing is sent to the system log. 199Normally the beginning, 200authentication, and termination of each connection is logged. 201.It Fl T 202Extended test mode. 203Check the validity of the configuration file, output the effective configuration 204to stdout and then exit. 205Optionally, 206.Cm Match 207rules may be applied by specifying the connection parameters using one or more 208.Fl C 209options. 210.It Fl t 211Test mode. 212Only check the validity of the configuration file and sanity of the keys. 213This is useful for updating 214.Nm 215reliably as configuration options may change. 216.It Fl u Ar len 217This option is used to specify the size of the field 218in the 219.Li utmp 220structure that holds the remote host name. 221If the resolved host name is longer than 222.Ar len , 223the dotted decimal value will be used instead. 224This allows hosts with very long host names that 225overflow this field to still be uniquely identified. 226Specifying 227.Fl u0 228indicates that only dotted decimal addresses 229should be put into the 230.Pa utmp 231file. 232.Fl u0 233may also be used to prevent 234.Nm 235from making DNS requests unless the authentication 236mechanism or configuration requires it. 237Authentication mechanisms that may require DNS include 238.Cm HostbasedAuthentication 239and using a 240.Cm from="pattern-list" 241option in a key file. 242Configuration options that require DNS include using a 243USER@HOST pattern in 244.Cm AllowUsers 245or 246.Cm DenyUsers . 247.El 248.Sh AUTHENTICATION 249The OpenSSH SSH daemon supports SSH protocol 2 only. 250Each host has a host-specific key, 251used to identify the host. 252Whenever a client connects, the daemon responds with its public 253host key. 254The client compares the 255host key against its own database to verify that it has not changed. 256Forward secrecy is provided through a Diffie-Hellman key agreement. 257This key agreement results in a shared session key. 258The rest of the session is encrypted using a symmetric cipher. 259The client selects the encryption algorithm 260to use from those offered by the server. 261Additionally, session integrity is provided 262through a cryptographic message authentication code (MAC). 263.Pp 264Finally, the server and the client enter an authentication dialog. 265The client tries to authenticate itself using 266host-based authentication, 267public key authentication, 268challenge-response authentication, 269or password authentication. 270.Pp 271Regardless of the authentication type, the account is checked to 272ensure that it is accessible. An account is not accessible if it is 273locked, listed in 274.Cm DenyUsers 275or its group is listed in 276.Cm DenyGroups 277\&. The definition of a locked account is system dependent. Some platforms 278have their own account database (eg AIX) and some modify the passwd field ( 279.Ql \&*LK\&* 280on Solaris and UnixWare, 281.Ql \&* 282on HP-UX, containing 283.Ql Nologin 284on Tru64, 285a leading 286.Ql \&*LOCKED\&* 287on FreeBSD and a leading 288.Ql \&! 289on most Linuxes). 290If there is a requirement to disable password authentication 291for the account while allowing still public-key, then the passwd field 292should be set to something other than these values (eg 293.Ql NP 294or 295.Ql \&*NP\&* 296). 297.Pp 298If the client successfully authenticates itself, a dialog for 299preparing the session is entered. 300At this time the client may request 301things like allocating a pseudo-tty, forwarding X11 connections, 302forwarding TCP connections, or forwarding the authentication agent 303connection over the secure channel. 304.Pp 305After this, the client either requests a shell or execution of a command. 306The sides then enter session mode. 307In this mode, either side may send 308data at any time, and such data is forwarded to/from the shell or 309command on the server side, and the user terminal in the client side. 310.Pp 311When the user program terminates and all forwarded X11 and other 312connections have been closed, the server sends command exit status to 313the client, and both sides exit. 314.Sh LOGIN PROCESS 315When a user successfully logs in, 316.Nm 317does the following: 318.Bl -enum -offset indent 319.It 320If the login is on a tty, and no command has been specified, 321prints last login time and 322.Pa /etc/motd 323(unless prevented in the configuration file or by 324.Pa ~/.hushlogin ; 325see the 326.Sx FILES 327section). 328.It 329If the login is on a tty, records login time. 330.It 331Checks 332.Pa /etc/nologin ; 333if it exists, prints contents and quits 334(unless root). 335.It 336Changes to run with normal user privileges. 337.It 338Sets up basic environment. 339.It 340Reads the file 341.Pa ~/.ssh/environment , 342if it exists, and users are allowed to change their environment. 343See the 344.Cm PermitUserEnvironment 345option in 346.Xr sshd_config 5 . 347.It 348Changes to user's home directory. 349.It 350If 351.Pa ~/.ssh/rc 352exists and the 353.Xr sshd_config 5 354.Cm PermitUserRC 355option is set, runs it; else if 356.Pa /etc/ssh/sshrc 357exists, runs 358it; otherwise runs xauth. 359The 360.Dq rc 361files are given the X11 362authentication protocol and cookie in standard input. 363See 364.Sx SSHRC , 365below. 366.It 367Runs user's shell or command. 368All commands are run under the user's login shell as specified in the 369system password database. 370.El 371.Sh SSHRC 372If the file 373.Pa ~/.ssh/rc 374exists, 375.Xr sh 1 376runs it after reading the 377environment files but before starting the user's shell or command. 378It must not produce any output on stdout; stderr must be used 379instead. 380If X11 forwarding is in use, it will receive the "proto cookie" pair in 381its standard input (and 382.Ev DISPLAY 383in its environment). 384The script must call 385.Xr xauth 1 386because 387.Nm 388will not run xauth automatically to add X11 cookies. 389.Pp 390The primary purpose of this file is to run any initialization routines 391which may be needed before the user's home directory becomes 392accessible; AFS is a particular example of such an environment. 393.Pp 394This file will probably contain some initialization code followed by 395something similar to: 396.Bd -literal -offset 3n 397if read proto cookie && [ -n "$DISPLAY" ]; then 398 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 399 # X11UseLocalhost=yes 400 echo add unix:`echo $DISPLAY | 401 cut -c11-` $proto $cookie 402 else 403 # X11UseLocalhost=no 404 echo add $DISPLAY $proto $cookie 405 fi | xauth -q - 406fi 407.Ed 408.Pp 409If this file does not exist, 410.Pa /etc/ssh/sshrc 411is run, and if that 412does not exist either, xauth is used to add the cookie. 413.Sh AUTHORIZED_KEYS FILE FORMAT 414.Cm AuthorizedKeysFile 415specifies the files containing public keys for 416public key authentication; 417if this option is not specified, the default is 418.Pa ~/.ssh/authorized_keys 419and 420.Pa ~/.ssh/authorized_keys2 . 421Each line of the file contains one 422key (empty lines and lines starting with a 423.Ql # 424are ignored as 425comments). 426Public keys consist of the following space-separated fields: 427options, keytype, base64-encoded key, comment. 428The options field is optional. 429The supported key types are: 430.Pp 431.Bl -item -compact -offset indent 432.It 433sk-ecdsa-sha2-nistp256@openssh.com 434.It 435ecdsa-sha2-nistp256 436.It 437ecdsa-sha2-nistp384 438.It 439ecdsa-sha2-nistp521 440.It 441sk-ssh-ed25519@openssh.com 442.It 443ssh-ed25519 444.It 445ssh-dss 446.It 447ssh-rsa 448.El 449.Pp 450The comment field is not used for anything (but may be convenient for the 451user to identify the key). 452.Pp 453Note that lines in this file can be several hundred bytes long 454(because of the size of the public key encoding) up to a limit of 4558 kilobytes, which permits RSA keys up to 16 kilobits. 456You don't want to type them in; instead, copy the 457.Pa id_dsa.pub , 458.Pa id_ecdsa.pub , 459.Pa id_ecdsa_sk.pub , 460.Pa id_ed25519.pub , 461.Pa id_ed25519_sk.pub , 462or the 463.Pa id_rsa.pub 464file and edit it. 465.Pp 466.Nm 467enforces a minimum RSA key modulus size of 1024 bits. 468.Pp 469The options (if present) consist of comma-separated option 470specifications. 471No spaces are permitted, except within double quotes. 472The following option specifications are supported (note 473that option keywords are case-insensitive): 474.Bl -tag -width Ds 475.It Cm agent-forwarding 476Enable authentication agent forwarding previously disabled by the 477.Cm restrict 478option. 479.It Cm cert-authority 480Specifies that the listed key is a certification authority (CA) that is 481trusted to validate signed certificates for user authentication. 482.Pp 483Certificates may encode access restrictions similar to these key options. 484If both certificate restrictions and key options are present, the most 485restrictive union of the two is applied. 486.It Cm command="command" 487Specifies that the command is executed whenever this key is used for 488authentication. 489The command supplied by the user (if any) is ignored. 490The command is run on a pty if the client requests a pty; 491otherwise it is run without a tty. 492If an 8-bit clean channel is required, 493one must not request a pty or should specify 494.Cm no-pty . 495A quote may be included in the command by quoting it with a backslash. 496.Pp 497This option might be useful 498to restrict certain public keys to perform just a specific operation. 499An example might be a key that permits remote backups but nothing else. 500Note that the client may specify TCP and/or X11 501forwarding unless they are explicitly prohibited, e.g. using the 502.Cm restrict 503key option. 504.Pp 505The command originally supplied by the client is available in the 506.Ev SSH_ORIGINAL_COMMAND 507environment variable. 508Note that this option applies to shell, command or subsystem execution. 509Also note that this command may be superseded by a 510.Xr sshd_config 5 511.Cm ForceCommand 512directive. 513.Pp 514If a command is specified and a forced-command is embedded in a certificate 515used for authentication, then the certificate will be accepted only if the 516two commands are identical. 517.It Cm environment="NAME=value" 518Specifies that the string is to be added to the environment when 519logging in using this key. 520Environment variables set this way 521override other default environment values. 522Multiple options of this type are permitted. 523Environment processing is disabled by default and is 524controlled via the 525.Cm PermitUserEnvironment 526option. 527.It Cm expiry-time="timespec" 528Specifies a time after which the key will not be accepted. 529The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time 530in the system time-zone. 531.It Cm from="pattern-list" 532Specifies that in addition to public key authentication, either the canonical 533name of the remote host or its IP address must be present in the 534comma-separated list of patterns. 535See PATTERNS in 536.Xr ssh_config 5 537for more information on patterns. 538.Pp 539In addition to the wildcard matching that may be applied to hostnames or 540addresses, a 541.Cm from 542stanza may match IP addresses using CIDR address/masklen notation. 543.Pp 544The purpose of this option is to optionally increase security: public key 545authentication by itself does not trust the network or name servers or 546anything (but the key); however, if somebody somehow steals the key, the key 547permits an intruder to log in from anywhere in the world. 548This additional option makes using a stolen key more difficult (name 549servers and/or routers would have to be compromised in addition to 550just the key). 551.It Cm no-agent-forwarding 552Forbids authentication agent forwarding when this key is used for 553authentication. 554.It Cm no-port-forwarding 555Forbids TCP forwarding when this key is used for authentication. 556Any port forward requests by the client will return an error. 557This might be used, e.g. in connection with the 558.Cm command 559option. 560.It Cm no-pty 561Prevents tty allocation (a request to allocate a pty will fail). 562.It Cm no-user-rc 563Disables execution of 564.Pa ~/.ssh/rc . 565.It Cm no-X11-forwarding 566Forbids X11 forwarding when this key is used for authentication. 567Any X11 forward requests by the client will return an error. 568.It Cm permitlisten="[host:]port" 569Limit remote port forwarding with the 570.Xr ssh 1 571.Fl R 572option such that it may only listen on the specified host (optional) and port. 573IPv6 addresses can be specified by enclosing the address in square brackets. 574Multiple 575.Cm permitlisten 576options may be applied separated by commas. 577Hostnames may include wildcards as described in the PATTERNS section in 578.Xr ssh_config 5 . 579A port specification of 580.Cm * 581matches any port. 582Note that the setting of 583.Cm GatewayPorts 584may further restrict listen addresses. 585Note that 586.Xr ssh 1 587will send a hostname of 588.Dq localhost 589if a listen host was not specified when the forwarding was requested, and 590that this name is treated differently to the explicit localhost addresses 591.Dq 127.0.0.1 592and 593.Dq ::1 . 594.It Cm permitopen="host:port" 595Limit local port forwarding with the 596.Xr ssh 1 597.Fl L 598option such that it may only connect to the specified host and port. 599IPv6 addresses can be specified by enclosing the address in square brackets. 600Multiple 601.Cm permitopen 602options may be applied separated by commas. 603No pattern matching or name lookup is performed on the 604specified hostnames, they must be literal host names and/or addresses. 605A port specification of 606.Cm * 607matches any port. 608.It Cm port-forwarding 609Enable port forwarding previously disabled by the 610.Cm restrict 611option. 612.It Cm principals="principals" 613On a 614.Cm cert-authority 615line, specifies allowed principals for certificate authentication as a 616comma-separated list. 617At least one name from the list must appear in the certificate's 618list of principals for the certificate to be accepted. 619This option is ignored for keys that are not marked as trusted certificate 620signers using the 621.Cm cert-authority 622option. 623.It Cm pty 624Permits tty allocation previously disabled by the 625.Cm restrict 626option. 627.It Cm no-touch-required 628Do not require demonstration of user presence 629for signatures made using this key. 630This option only makes sense for the FIDO authenticator algorithms 631.Cm ecdsa-sk 632and 633.Cm ed25519-sk . 634.It Cm restrict 635Enable all restrictions, i.e. disable port, agent and X11 forwarding, 636as well as disabling PTY allocation 637and execution of 638.Pa ~/.ssh/rc . 639If any future restriction capabilities are added to authorized_keys files 640they will be included in this set. 641.It Cm tunnel="n" 642Force a 643.Xr tun 4 644device on the server. 645Without this option, the next available device will be used if 646the client requests a tunnel. 647.It Cm user-rc 648Enables execution of 649.Pa ~/.ssh/rc 650previously disabled by the 651.Cm restrict 652option. 653.It Cm X11-forwarding 654Permits X11 forwarding previously disabled by the 655.Cm restrict 656option. 657.El 658.Pp 659An example authorized_keys file: 660.Bd -literal -offset 3n 661# Comments allowed at start of line 662ssh-rsa AAAAB3Nza...LiPk== user@example.net 663from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 664AAAAB2...19Q== john@example.net 665command="dump /home",no-pty,no-port-forwarding ssh-rsa 666AAAAC3...51R== example.net 667permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa 668AAAAB5...21S== 669permitlisten="localhost:8080",permitopen="localhost:22000" ssh-rsa 670AAAAB5...21S== 671tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 672jane@example.net 673restrict,command="uptime" ssh-rsa AAAA1C8...32Tv== 674user@example.net 675restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5== 676user@example.net 677no-touch-required sk-ecdsa-sha2-nistp256@openssh.com AAAAInN...Ko== 678user@example.net 679.Ed 680.Sh SSH_KNOWN_HOSTS FILE FORMAT 681The 682.Pa /etc/ssh/ssh_known_hosts 683and 684.Pa ~/.ssh/known_hosts 685files contain host public keys for all known hosts. 686The global file should 687be prepared by the administrator (optional), and the per-user file is 688maintained automatically: whenever the user connects to an unknown host, 689its key is added to the per-user file. 690.Pp 691Each line in these files contains the following fields: markers (optional), 692hostnames, keytype, base64-encoded key, comment. 693The fields are separated by spaces. 694.Pp 695The marker is optional, but if it is present then it must be one of 696.Dq @cert-authority , 697to indicate that the line contains a certification authority (CA) key, 698or 699.Dq @revoked , 700to indicate that the key contained on the line is revoked and must not ever 701be accepted. 702Only one marker should be used on a key line. 703.Pp 704Hostnames is a comma-separated list of patterns 705.Pf ( Ql * 706and 707.Ql \&? 708act as 709wildcards); each pattern in turn is matched against the host name. 710When 711.Nm sshd 712is authenticating a client, such as when using 713.Cm HostbasedAuthentication , 714this will be the canonical client host name. 715When 716.Xr ssh 1 717is authenticating a server, this will be the host name 718given by the user, the value of the 719.Xr ssh 1 720.Cm HostkeyAlias 721if it was specified, or the canonical server hostname if the 722.Xr ssh 1 723.Cm CanonicalizeHostname 724option was used. 725.Pp 726A pattern may also be preceded by 727.Ql \&! 728to indicate negation: if the host name matches a negated 729pattern, it is not accepted (by that line) even if it matched another 730pattern on the line. 731A hostname or address may optionally be enclosed within 732.Ql \&[ 733and 734.Ql \&] 735brackets then followed by 736.Ql \&: 737and a non-standard port number. 738.Pp 739Alternately, hostnames may be stored in a hashed form which hides host names 740and addresses should the file's contents be disclosed. 741Hashed hostnames start with a 742.Ql | 743character. 744Only one hashed hostname may appear on a single line and none of the above 745negation or wildcard operators may be applied. 746.Pp 747The keytype and base64-encoded key are taken directly from the host key; they 748can be obtained, for example, from 749.Pa /etc/ssh/ssh_host_rsa_key.pub . 750The optional comment field continues to the end of the line, and is not used. 751.Pp 752Lines starting with 753.Ql # 754and empty lines are ignored as comments. 755.Pp 756When performing host authentication, authentication is accepted if any 757matching line has the proper key; either one that matches exactly or, 758if the server has presented a certificate for authentication, the key 759of the certification authority that signed the certificate. 760For a key to be trusted as a certification authority, it must use the 761.Dq @cert-authority 762marker described above. 763.Pp 764The known hosts file also provides a facility to mark keys as revoked, 765for example when it is known that the associated private key has been 766stolen. 767Revoked keys are specified by including the 768.Dq @revoked 769marker at the beginning of the key line, and are never accepted for 770authentication or as certification authorities, but instead will 771produce a warning from 772.Xr ssh 1 773when they are encountered. 774.Pp 775It is permissible (but not 776recommended) to have several lines or different host keys for the same 777names. 778This will inevitably happen when short forms of host names 779from different domains are put in the file. 780It is possible 781that the files contain conflicting information; authentication is 782accepted if valid information can be found from either file. 783.Pp 784Note that the lines in these files are typically hundreds of characters 785long, and you definitely don't want to type in the host keys by hand. 786Rather, generate them by a script, 787.Xr ssh-keyscan 1 788or by taking, for example, 789.Pa /etc/ssh/ssh_host_rsa_key.pub 790and adding the host names at the front. 791.Xr ssh-keygen 1 792also offers some basic automated editing for 793.Pa ~/.ssh/known_hosts 794including removing hosts matching a host name and converting all host 795names to their hashed representations. 796.Pp 797An example ssh_known_hosts file: 798.Bd -literal -offset 3n 799# Comments allowed at start of line 800closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 801cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 802# A hashed hostname 803|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 804AAAA1234.....= 805# A revoked key 806@revoked * ssh-rsa AAAAB5W... 807# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 808@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 809.Ed 810.Sh FILES 811.Bl -tag -width Ds -compact 812.It Pa ~/.hushlogin 813This file is used to suppress printing the last login time and 814.Pa /etc/motd , 815if 816.Cm PrintLastLog 817and 818.Cm PrintMotd , 819respectively, 820are enabled. 821It does not suppress printing of the banner specified by 822.Cm Banner . 823.Pp 824.It Pa ~/.rhosts 825This file is used for host-based authentication (see 826.Xr ssh 1 827for more information). 828On some machines this file may need to be 829world-readable if the user's home directory is on an NFS partition, 830because 831.Nm 832reads it as root. 833Additionally, this file must be owned by the user, 834and must not have write permissions for anyone else. 835The recommended 836permission for most machines is read/write for the user, and not 837accessible by others. 838.Pp 839.It Pa ~/.shosts 840This file is used in exactly the same way as 841.Pa .rhosts , 842but allows host-based authentication without permitting login with 843rlogin/rsh. 844.Pp 845.It Pa ~/.ssh/ 846This directory is the default location for all user-specific configuration 847and authentication information. 848There is no general requirement to keep the entire contents of this directory 849secret, but the recommended permissions are read/write/execute for the user, 850and not accessible by others. 851.Pp 852.It Pa ~/.ssh/authorized_keys 853Lists the public keys (DSA, ECDSA, Ed25519, RSA) 854that can be used for logging in as this user. 855The format of this file is described above. 856The content of the file is not highly sensitive, but the recommended 857permissions are read/write for the user, and not accessible by others. 858.Pp 859If this file, the 860.Pa ~/.ssh 861directory, or the user's home directory are writable 862by other users, then the file could be modified or replaced by unauthorized 863users. 864In this case, 865.Nm 866will not allow it to be used unless the 867.Cm StrictModes 868option has been set to 869.Dq no . 870.Pp 871.It Pa ~/.ssh/environment 872This file is read into the environment at login (if it exists). 873It can only contain empty lines, comment lines (that start with 874.Ql # ) , 875and assignment lines of the form name=value. 876The file should be writable 877only by the user; it need not be readable by anyone else. 878Environment processing is disabled by default and is 879controlled via the 880.Cm PermitUserEnvironment 881option. 882.Pp 883.It Pa ~/.ssh/known_hosts 884Contains a list of host keys for all hosts the user has logged into 885that are not already in the systemwide list of known host keys. 886The format of this file is described above. 887This file should be writable only by root/the owner and 888can, but need not be, world-readable. 889.Pp 890.It Pa ~/.ssh/rc 891Contains initialization routines to be run before 892the user's home directory becomes accessible. 893This file should be writable only by the user, and need not be 894readable by anyone else. 895.Pp 896.It Pa /etc/hosts.equiv 897This file is for host-based authentication (see 898.Xr ssh 1 ) . 899It should only be writable by root. 900.Pp 901.It Pa /etc/moduli 902Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" 903key exchange method. 904The file format is described in 905.Xr moduli 5 . 906If no usable groups are found in this file then fixed internal groups will 907be used. 908.Pp 909.It Pa /etc/motd 910See 911.Xr motd 5 . 912.Pp 913.It Pa /etc/nologin 914If this file exists, 915.Nm 916refuses to let anyone except root log in. 917The contents of the file 918are displayed to anyone trying to log in, and non-root connections are 919refused. 920The file should be world-readable. 921.Pp 922.It Pa /etc/shosts.equiv 923This file is used in exactly the same way as 924.Pa hosts.equiv , 925but allows host-based authentication without permitting login with 926rlogin/rsh. 927.Pp 928.It Pa /etc/ssh/ssh_host_ecdsa_key 929.It Pa /etc/ssh/ssh_host_ed25519_key 930.It Pa /etc/ssh/ssh_host_rsa_key 931These files contain the private parts of the host keys. 932These files should only be owned by root, readable only by root, and not 933accessible to others. 934Note that 935.Nm 936does not start if these files are group/world-accessible. 937.Pp 938.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 939.It Pa /etc/ssh/ssh_host_ed25519_key.pub 940.It Pa /etc/ssh/ssh_host_rsa_key.pub 941These files contain the public parts of the host keys. 942These files should be world-readable but writable only by 943root. 944Their contents should match the respective private parts. 945These files are not 946really used for anything; they are provided for the convenience of 947the user so their contents can be copied to known hosts files. 948These files are created using 949.Xr ssh-keygen 1 . 950.Pp 951.It Pa /etc/ssh/ssh_known_hosts 952Systemwide list of known host keys. 953This file should be prepared by the 954system administrator to contain the public host keys of all machines in the 955organization. 956The format of this file is described above. 957This file should be writable only by root/the owner and 958should be world-readable. 959.Pp 960.It Pa /etc/ssh/sshd_config 961Contains configuration data for 962.Nm sshd . 963The file format and configuration options are described in 964.Xr sshd_config 5 . 965.Pp 966.It Pa /etc/ssh/sshrc 967Similar to 968.Pa ~/.ssh/rc , 969it can be used to specify 970machine-specific login-time initializations globally. 971This file should be writable only by root, and should be world-readable. 972.Pp 973.It Pa /var/empty 974.Xr chroot 2 975directory used by 976.Nm 977during privilege separation in the pre-authentication phase. 978The directory should not contain any files and must be owned by root 979and not group or world-writable. 980.Pp 981.It Pa /var/run/sshd.pid 982Contains the process ID of the 983.Nm 984listening for connections (if there are several daemons running 985concurrently for different ports, this contains the process ID of the one 986started last). 987The content of this file is not sensitive; it can be world-readable. 988.El 989.Sh SEE ALSO 990.Xr scp 1 , 991.Xr sftp 1 , 992.Xr ssh 1 , 993.Xr ssh-add 1 , 994.Xr ssh-agent 1 , 995.Xr ssh-keygen 1 , 996.Xr ssh-keyscan 1 , 997.Xr chroot 2 , 998.Xr login.conf 5 , 999.Xr moduli 5 , 1000.Xr sshd_config 5 , 1001.Xr inetd 8 , 1002.Xr sftp-server 8 1003.Sh AUTHORS 1004OpenSSH is a derivative of the original and free 1005ssh 1.2.12 release by Tatu Ylonen. 1006Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 1007Theo de Raadt and Dug Song 1008removed many bugs, re-added newer features and 1009created OpenSSH. 1010Markus Friedl contributed the support for SSH 1011protocol versions 1.5 and 2.0. 1012Niels Provos and Markus Friedl contributed support 1013for privilege separation. 1014