1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.304 2018/07/22 12:16:59 dtucker Exp $ 37.Dd $Mdocdate: July 22 2018 $ 38.Dt SSHD 8 39.Os 40.Sh NAME 41.Nm sshd 42.Nd OpenSSH SSH daemon 43.Sh SYNOPSIS 44.Nm sshd 45.Bk -words 46.Op Fl 46DdeiqTt 47.Op Fl C Ar connection_spec 48.Op Fl c Ar host_certificate_file 49.Op Fl E Ar log_file 50.Op Fl f Ar config_file 51.Op Fl g Ar login_grace_time 52.Op Fl h Ar host_key_file 53.Op Fl o Ar option 54.Op Fl p Ar port 55.Op Fl u Ar len 56.Ek 57.Sh DESCRIPTION 58.Nm 59(OpenSSH Daemon) is the daemon program for 60.Xr ssh 1 . 61Together these programs replace rlogin and rsh, 62and provide secure encrypted communications between two untrusted hosts 63over an insecure network. 64.Pp 65.Nm 66listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74.Pp 75.Nm 76can be configured using command-line options or a configuration file 77(by default 78.Xr sshd_config 5 ) ; 79command-line options override values specified in the 80configuration file. 81.Nm 82rereads its configuration file when it receives a hangup signal, 83.Dv SIGHUP , 84by executing itself with the name and options it was started with, e.g.\& 85.Pa /usr/sbin/sshd . 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 4 90Forces 91.Nm 92to use IPv4 addresses only. 93.It Fl 6 94Forces 95.Nm 96to use IPv6 addresses only. 97.It Fl C Ar connection_spec 98Specify the connection parameters to use for the 99.Fl T 100extended test mode. 101If provided, any 102.Cm Match 103directives in the configuration file that would apply are applied before the 104configuration is written to standard output. 105The connection parameters are supplied as keyword=value pairs and may be 106supplied in any order, either with multiple 107.Fl C 108options or as a comma-separated list. 109The keywords are 110.Dq addr, 111.Dq user , 112.Dq host , 113.Dq laddr , 114.Dq lport , 115and 116.Dq rdomain 117and correspond to source address, user, resolved source host name, 118local address, local port number and routing domain respectively. 119.It Fl c Ar host_certificate_file 120Specifies a path to a certificate file to identify 121.Nm 122during key exchange. 123The certificate file must match a host key file specified using the 124.Fl h 125option or the 126.Cm HostKey 127configuration directive. 128.It Fl D 129When this option is specified, 130.Nm 131will not detach and does not become a daemon. 132This allows easy monitoring of 133.Nm sshd . 134.It Fl d 135Debug mode. 136The server sends verbose debug output to standard error, 137and does not put itself in the background. 138The server also will not fork and will only process one connection. 139This option is only intended for debugging for the server. 140Multiple 141.Fl d 142options increase the debugging level. 143Maximum is 3. 144.It Fl E Ar log_file 145Append debug logs to 146.Ar log_file 147instead of the system log. 148.It Fl e 149Write debug logs to standard error instead of the system log. 150.It Fl f Ar config_file 151Specifies the name of the configuration file. 152The default is 153.Pa /etc/ssh/sshd_config . 154.Nm 155refuses to start if there is no configuration file. 156.It Fl g Ar login_grace_time 157Gives the grace time for clients to authenticate themselves (default 158120 seconds). 159If the client fails to authenticate the user within 160this many seconds, the server disconnects and exits. 161A value of zero indicates no limit. 162.It Fl h Ar host_key_file 163Specifies a file from which a host key is read. 164This option must be given if 165.Nm 166is not run as root (as the normal 167host key files are normally not readable by anyone but root). 168The default is 169.Pa /etc/ssh/ssh_host_ecdsa_key , 170.Pa /etc/ssh/ssh_host_ed25519_key 171and 172.Pa /etc/ssh/ssh_host_rsa_key . 173It is possible to have multiple host key files for 174the different host key algorithms. 175.It Fl i 176Specifies that 177.Nm 178is being run from 179.Xr inetd 8 . 180.It Fl o Ar option 181Can be used to give options in the format used in the configuration file. 182This is useful for specifying options for which there is no separate 183command-line flag. 184For full details of the options, and their values, see 185.Xr sshd_config 5 . 186.It Fl p Ar port 187Specifies the port on which the server listens for connections 188(default 22). 189Multiple port options are permitted. 190Ports specified in the configuration file with the 191.Cm Port 192option are ignored when a command-line port is specified. 193Ports specified using the 194.Cm ListenAddress 195option override command-line ports. 196.It Fl q 197Quiet mode. 198Nothing is sent to the system log. 199Normally the beginning, 200authentication, and termination of each connection is logged. 201.It Fl T 202Extended test mode. 203Check the validity of the configuration file, output the effective configuration 204to stdout and then exit. 205Optionally, 206.Cm Match 207rules may be applied by specifying the connection parameters using one or more 208.Fl C 209options. 210.It Fl t 211Test mode. 212Only check the validity of the configuration file and sanity of the keys. 213This is useful for updating 214.Nm 215reliably as configuration options may change. 216.It Fl u Ar len 217This option is used to specify the size of the field 218in the 219.Li utmp 220structure that holds the remote host name. 221If the resolved host name is longer than 222.Ar len , 223the dotted decimal value will be used instead. 224This allows hosts with very long host names that 225overflow this field to still be uniquely identified. 226Specifying 227.Fl u0 228indicates that only dotted decimal addresses 229should be put into the 230.Pa utmp 231file. 232.Fl u0 233may also be used to prevent 234.Nm 235from making DNS requests unless the authentication 236mechanism or configuration requires it. 237Authentication mechanisms that may require DNS include 238.Cm HostbasedAuthentication 239and using a 240.Cm from="pattern-list" 241option in a key file. 242Configuration options that require DNS include using a 243USER@HOST pattern in 244.Cm AllowUsers 245or 246.Cm DenyUsers . 247.El 248.Sh AUTHENTICATION 249The OpenSSH SSH daemon supports SSH protocol 2 only. 250Each host has a host-specific key, 251used to identify the host. 252Whenever a client connects, the daemon responds with its public 253host key. 254The client compares the 255host key against its own database to verify that it has not changed. 256Forward security is provided through a Diffie-Hellman key agreement. 257This key agreement results in a shared session key. 258The rest of the session is encrypted using a symmetric cipher, currently 259128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES. 260The client selects the encryption algorithm 261to use from those offered by the server. 262Additionally, session integrity is provided 263through a cryptographic message authentication code 264(hmac-md5, hmac-sha1, umac-64, umac-128, 265hmac-sha2-256 or hmac-sha2-512). 266.Pp 267Finally, the server and the client enter an authentication dialog. 268The client tries to authenticate itself using 269host-based authentication, 270public key authentication, 271challenge-response authentication, 272or password authentication. 273.Pp 274Regardless of the authentication type, the account is checked to 275ensure that it is accessible. An account is not accessible if it is 276locked, listed in 277.Cm DenyUsers 278or its group is listed in 279.Cm DenyGroups 280\&. The definition of a locked account is system dependent. Some platforms 281have their own account database (eg AIX) and some modify the passwd field ( 282.Ql \&*LK\&* 283on Solaris and UnixWare, 284.Ql \&* 285on HP-UX, containing 286.Ql Nologin 287on Tru64, 288a leading 289.Ql \&*LOCKED\&* 290on FreeBSD and a leading 291.Ql \&! 292on most Linuxes). 293If there is a requirement to disable password authentication 294for the account while allowing still public-key, then the passwd field 295should be set to something other than these values (eg 296.Ql NP 297or 298.Ql \&*NP\&* 299). 300.Pp 301If the client successfully authenticates itself, a dialog for 302preparing the session is entered. 303At this time the client may request 304things like allocating a pseudo-tty, forwarding X11 connections, 305forwarding TCP connections, or forwarding the authentication agent 306connection over the secure channel. 307.Pp 308After this, the client either requests a shell or execution of a command. 309The sides then enter session mode. 310In this mode, either side may send 311data at any time, and such data is forwarded to/from the shell or 312command on the server side, and the user terminal in the client side. 313.Pp 314When the user program terminates and all forwarded X11 and other 315connections have been closed, the server sends command exit status to 316the client, and both sides exit. 317.Sh LOGIN PROCESS 318When a user successfully logs in, 319.Nm 320does the following: 321.Bl -enum -offset indent 322.It 323If the login is on a tty, and no command has been specified, 324prints last login time and 325.Pa /etc/motd 326(unless prevented in the configuration file or by 327.Pa ~/.hushlogin ; 328see the 329.Sx FILES 330section). 331.It 332If the login is on a tty, records login time. 333.It 334Checks 335.Pa /etc/nologin ; 336if it exists, prints contents and quits 337(unless root). 338.It 339Changes to run with normal user privileges. 340.It 341Sets up basic environment. 342.It 343Reads the file 344.Pa ~/.ssh/environment , 345if it exists, and users are allowed to change their environment. 346See the 347.Cm PermitUserEnvironment 348option in 349.Xr sshd_config 5 . 350.It 351Changes to user's home directory. 352.It 353If 354.Pa ~/.ssh/rc 355exists and the 356.Xr sshd_config 5 357.Cm PermitUserRC 358option is set, runs it; else if 359.Pa /etc/ssh/sshrc 360exists, runs 361it; otherwise runs xauth. 362The 363.Dq rc 364files are given the X11 365authentication protocol and cookie in standard input. 366See 367.Sx SSHRC , 368below. 369.It 370Runs user's shell or command. 371All commands are run under the user's login shell as specified in the 372system password database. 373.El 374.Sh SSHRC 375If the file 376.Pa ~/.ssh/rc 377exists, 378.Xr sh 1 379runs it after reading the 380environment files but before starting the user's shell or command. 381It must not produce any output on stdout; stderr must be used 382instead. 383If X11 forwarding is in use, it will receive the "proto cookie" pair in 384its standard input (and 385.Ev DISPLAY 386in its environment). 387The script must call 388.Xr xauth 1 389because 390.Nm 391will not run xauth automatically to add X11 cookies. 392.Pp 393The primary purpose of this file is to run any initialization routines 394which may be needed before the user's home directory becomes 395accessible; AFS is a particular example of such an environment. 396.Pp 397This file will probably contain some initialization code followed by 398something similar to: 399.Bd -literal -offset 3n 400if read proto cookie && [ -n "$DISPLAY" ]; then 401 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 402 # X11UseLocalhost=yes 403 echo add unix:`echo $DISPLAY | 404 cut -c11-` $proto $cookie 405 else 406 # X11UseLocalhost=no 407 echo add $DISPLAY $proto $cookie 408 fi | xauth -q - 409fi 410.Ed 411.Pp 412If this file does not exist, 413.Pa /etc/ssh/sshrc 414is run, and if that 415does not exist either, xauth is used to add the cookie. 416.Sh AUTHORIZED_KEYS FILE FORMAT 417.Cm AuthorizedKeysFile 418specifies the files containing public keys for 419public key authentication; 420if this option is not specified, the default is 421.Pa ~/.ssh/authorized_keys 422and 423.Pa ~/.ssh/authorized_keys2 . 424Each line of the file contains one 425key (empty lines and lines starting with a 426.Ql # 427are ignored as 428comments). 429Public keys consist of the following space-separated fields: 430options, keytype, base64-encoded key, comment. 431The options field is optional. 432The keytype is 433.Dq ecdsa-sha2-nistp256 , 434.Dq ecdsa-sha2-nistp384 , 435.Dq ecdsa-sha2-nistp521 , 436.Dq ssh-ed25519 , 437.Dq ssh-dss 438or 439.Dq ssh-rsa ; 440the comment field is not used for anything (but may be convenient for the 441user to identify the key). 442.Pp 443Note that lines in this file can be several hundred bytes long 444(because of the size of the public key encoding) up to a limit of 4458 kilobytes, which permits DSA keys up to 8 kilobits and RSA 446keys up to 16 kilobits. 447You don't want to type them in; instead, copy the 448.Pa id_dsa.pub , 449.Pa id_ecdsa.pub , 450.Pa id_ed25519.pub , 451or the 452.Pa id_rsa.pub 453file and edit it. 454.Pp 455.Nm 456enforces a minimum RSA key modulus size of 1024 bits. 457.Pp 458The options (if present) consist of comma-separated option 459specifications. 460No spaces are permitted, except within double quotes. 461The following option specifications are supported (note 462that option keywords are case-insensitive): 463.Bl -tag -width Ds 464.It Cm agent-forwarding 465Enable authentication agent forwarding previously disabled by the 466.Cm restrict 467option. 468.It Cm cert-authority 469Specifies that the listed key is a certification authority (CA) that is 470trusted to validate signed certificates for user authentication. 471.Pp 472Certificates may encode access restrictions similar to these key options. 473If both certificate restrictions and key options are present, the most 474restrictive union of the two is applied. 475.It Cm command="command" 476Specifies that the command is executed whenever this key is used for 477authentication. 478The command supplied by the user (if any) is ignored. 479The command is run on a pty if the client requests a pty; 480otherwise it is run without a tty. 481If an 8-bit clean channel is required, 482one must not request a pty or should specify 483.Cm no-pty . 484A quote may be included in the command by quoting it with a backslash. 485.Pp 486This option might be useful 487to restrict certain public keys to perform just a specific operation. 488An example might be a key that permits remote backups but nothing else. 489Note that the client may specify TCP and/or X11 490forwarding unless they are explicitly prohibited, e.g. using the 491.Cm restrict 492key option. 493.Pp 494The command originally supplied by the client is available in the 495.Ev SSH_ORIGINAL_COMMAND 496environment variable. 497Note that this option applies to shell, command or subsystem execution. 498Also note that this command may be superseded by a 499.Xr sshd_config 5 500.Cm ForceCommand 501directive. 502.Pp 503If a command is specified and a forced-command is embedded in a certificate 504used for authentication, then the certificate will be accepted only if the 505two commands are identical. 506.It Cm environment="NAME=value" 507Specifies that the string is to be added to the environment when 508logging in using this key. 509Environment variables set this way 510override other default environment values. 511Multiple options of this type are permitted. 512Environment processing is disabled by default and is 513controlled via the 514.Cm PermitUserEnvironment 515option. 516.It Cm expiry-time="timespec" 517Specifies a time after which the key will not be accepted. 518The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time 519in the system time-zone. 520.It Cm from="pattern-list" 521Specifies that in addition to public key authentication, either the canonical 522name of the remote host or its IP address must be present in the 523comma-separated list of patterns. 524See PATTERNS in 525.Xr ssh_config 5 526for more information on patterns. 527.Pp 528In addition to the wildcard matching that may be applied to hostnames or 529addresses, a 530.Cm from 531stanza may match IP addresses using CIDR address/masklen notation. 532.Pp 533The purpose of this option is to optionally increase security: public key 534authentication by itself does not trust the network or name servers or 535anything (but the key); however, if somebody somehow steals the key, the key 536permits an intruder to log in from anywhere in the world. 537This additional option makes using a stolen key more difficult (name 538servers and/or routers would have to be compromised in addition to 539just the key). 540.It Cm no-agent-forwarding 541Forbids authentication agent forwarding when this key is used for 542authentication. 543.It Cm no-port-forwarding 544Forbids TCP forwarding when this key is used for authentication. 545Any port forward requests by the client will return an error. 546This might be used, e.g. in connection with the 547.Cm command 548option. 549.It Cm no-pty 550Prevents tty allocation (a request to allocate a pty will fail). 551.It Cm no-user-rc 552Disables execution of 553.Pa ~/.ssh/rc . 554.It Cm no-X11-forwarding 555Forbids X11 forwarding when this key is used for authentication. 556Any X11 forward requests by the client will return an error. 557.It Cm permitlisten="[host:]port" 558Limit remote port forwarding with the 559.Xr ssh 1 560.Fl R 561option such that it may only listen on the specified host (optional) and port. 562IPv6 addresses can be specified by enclosing the address in square brackets. 563Multiple 564.Cm permitlisten 565options may be applied separated by commas. 566Hostnames may include wildcards as described in the PATTERNS section in 567.Xr ssh_config 5 . 568A port specification of 569.Cm * 570matches any port. 571Note that the setting of 572.Cm GatewayPorts 573may further restrict listen addresses. 574Note that 575.Xr ssh 1 576will send a hostname of 577.Dq localhost 578if a listen host was not specified when the forwarding was requested, and 579that this name is treated differently to the explicit localhost addresses 580.Dq 127.0.0.1 581and 582.Dq ::1 . 583.It Cm permitopen="host:port" 584Limit local port forwarding with the 585.Xr ssh 1 586.Fl L 587option such that it may only connect to the specified host and port. 588IPv6 addresses can be specified by enclosing the address in square brackets. 589Multiple 590.Cm permitopen 591options may be applied separated by commas. 592No pattern matching is performed on the specified hostnames, 593they must be literal domains or addresses. 594A port specification of 595.Cm * 596matches any port. 597.It Cm port-forwarding 598Enable port forwarding previously disabled by the 599.Cm restrict 600option. 601.It Cm principals="principals" 602On a 603.Cm cert-authority 604line, specifies allowed principals for certificate authentication as a 605comma-separated list. 606At least one name from the list must appear in the certificate's 607list of principals for the certificate to be accepted. 608This option is ignored for keys that are not marked as trusted certificate 609signers using the 610.Cm cert-authority 611option. 612.It Cm pty 613Permits tty allocation previously disabled by the 614.Cm restrict 615option. 616.It Cm restrict 617Enable all restrictions, i.e. disable port, agent and X11 forwarding, 618as well as disabling PTY allocation 619and execution of 620.Pa ~/.ssh/rc . 621If any future restriction capabilities are added to authorized_keys files 622they will be included in this set. 623.It Cm tunnel="n" 624Force a 625.Xr tun 4 626device on the server. 627Without this option, the next available device will be used if 628the client requests a tunnel. 629.It Cm user-rc 630Enables execution of 631.Pa ~/.ssh/rc 632previously disabled by the 633.Cm restrict 634option. 635.It Cm X11-forwarding 636Permits X11 forwarding previously disabled by the 637.Cm restrict 638option. 639.El 640.Pp 641An example authorized_keys file: 642.Bd -literal -offset 3n 643# Comments allowed at start of line 644ssh-rsa AAAAB3Nza...LiPk== user@example.net 645from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 646AAAAB2...19Q== john@example.net 647command="dump /home",no-pty,no-port-forwarding ssh-rsa 648AAAAC3...51R== example.net 649permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa 650AAAAB5...21S== 651permitlisten="localhost:8080",permitopen="localhost:22000" ssh-rsa 652AAAAB5...21S== 653tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 654jane@example.net 655restrict,command="uptime" ssh-rsa AAAA1C8...32Tv== 656user@example.net 657restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5== 658user@example.net 659.Ed 660.Sh SSH_KNOWN_HOSTS FILE FORMAT 661The 662.Pa /etc/ssh/ssh_known_hosts 663and 664.Pa ~/.ssh/known_hosts 665files contain host public keys for all known hosts. 666The global file should 667be prepared by the administrator (optional), and the per-user file is 668maintained automatically: whenever the user connects to an unknown host, 669its key is added to the per-user file. 670.Pp 671Each line in these files contains the following fields: markers (optional), 672hostnames, keytype, base64-encoded key, comment. 673The fields are separated by spaces. 674.Pp 675The marker is optional, but if it is present then it must be one of 676.Dq @cert-authority , 677to indicate that the line contains a certification authority (CA) key, 678or 679.Dq @revoked , 680to indicate that the key contained on the line is revoked and must not ever 681be accepted. 682Only one marker should be used on a key line. 683.Pp 684Hostnames is a comma-separated list of patterns 685.Pf ( Ql * 686and 687.Ql \&? 688act as 689wildcards); each pattern in turn is matched against the host name. 690When 691.Nm sshd 692is authenticating a client, such as when using 693.Cm HostbasedAuthentication , 694this will be the canonical client host name. 695When 696.Xr ssh 1 697is authenticating a server, this will be the host name 698given by the user, the value of the 699.Xr ssh 1 700.Cm HostkeyAlias 701if it was specified, or the canonical server hostname if the 702.Xr ssh 1 703.Cm CanonicalizeHostname 704option was used. 705.Pp 706A pattern may also be preceded by 707.Ql \&! 708to indicate negation: if the host name matches a negated 709pattern, it is not accepted (by that line) even if it matched another 710pattern on the line. 711A hostname or address may optionally be enclosed within 712.Ql \&[ 713and 714.Ql \&] 715brackets then followed by 716.Ql \&: 717and a non-standard port number. 718.Pp 719Alternately, hostnames may be stored in a hashed form which hides host names 720and addresses should the file's contents be disclosed. 721Hashed hostnames start with a 722.Ql | 723character. 724Only one hashed hostname may appear on a single line and none of the above 725negation or wildcard operators may be applied. 726.Pp 727The keytype and base64-encoded key are taken directly from the host key; they 728can be obtained, for example, from 729.Pa /etc/ssh/ssh_host_rsa_key.pub . 730The optional comment field continues to the end of the line, and is not used. 731.Pp 732Lines starting with 733.Ql # 734and empty lines are ignored as comments. 735.Pp 736When performing host authentication, authentication is accepted if any 737matching line has the proper key; either one that matches exactly or, 738if the server has presented a certificate for authentication, the key 739of the certification authority that signed the certificate. 740For a key to be trusted as a certification authority, it must use the 741.Dq @cert-authority 742marker described above. 743.Pp 744The known hosts file also provides a facility to mark keys as revoked, 745for example when it is known that the associated private key has been 746stolen. 747Revoked keys are specified by including the 748.Dq @revoked 749marker at the beginning of the key line, and are never accepted for 750authentication or as certification authorities, but instead will 751produce a warning from 752.Xr ssh 1 753when they are encountered. 754.Pp 755It is permissible (but not 756recommended) to have several lines or different host keys for the same 757names. 758This will inevitably happen when short forms of host names 759from different domains are put in the file. 760It is possible 761that the files contain conflicting information; authentication is 762accepted if valid information can be found from either file. 763.Pp 764Note that the lines in these files are typically hundreds of characters 765long, and you definitely don't want to type in the host keys by hand. 766Rather, generate them by a script, 767.Xr ssh-keyscan 1 768or by taking, for example, 769.Pa /etc/ssh/ssh_host_rsa_key.pub 770and adding the host names at the front. 771.Xr ssh-keygen 1 772also offers some basic automated editing for 773.Pa ~/.ssh/known_hosts 774including removing hosts matching a host name and converting all host 775names to their hashed representations. 776.Pp 777An example ssh_known_hosts file: 778.Bd -literal -offset 3n 779# Comments allowed at start of line 780closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 781cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 782# A hashed hostname 783|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 784AAAA1234.....= 785# A revoked key 786@revoked * ssh-rsa AAAAB5W... 787# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 788@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 789.Ed 790.Sh FILES 791.Bl -tag -width Ds -compact 792.It Pa ~/.hushlogin 793This file is used to suppress printing the last login time and 794.Pa /etc/motd , 795if 796.Cm PrintLastLog 797and 798.Cm PrintMotd , 799respectively, 800are enabled. 801It does not suppress printing of the banner specified by 802.Cm Banner . 803.Pp 804.It Pa ~/.rhosts 805This file is used for host-based authentication (see 806.Xr ssh 1 807for more information). 808On some machines this file may need to be 809world-readable if the user's home directory is on an NFS partition, 810because 811.Nm 812reads it as root. 813Additionally, this file must be owned by the user, 814and must not have write permissions for anyone else. 815The recommended 816permission for most machines is read/write for the user, and not 817accessible by others. 818.Pp 819.It Pa ~/.shosts 820This file is used in exactly the same way as 821.Pa .rhosts , 822but allows host-based authentication without permitting login with 823rlogin/rsh. 824.Pp 825.It Pa ~/.ssh/ 826This directory is the default location for all user-specific configuration 827and authentication information. 828There is no general requirement to keep the entire contents of this directory 829secret, but the recommended permissions are read/write/execute for the user, 830and not accessible by others. 831.Pp 832.It Pa ~/.ssh/authorized_keys 833Lists the public keys (DSA, ECDSA, Ed25519, RSA) 834that can be used for logging in as this user. 835The format of this file is described above. 836The content of the file is not highly sensitive, but the recommended 837permissions are read/write for the user, and not accessible by others. 838.Pp 839If this file, the 840.Pa ~/.ssh 841directory, or the user's home directory are writable 842by other users, then the file could be modified or replaced by unauthorized 843users. 844In this case, 845.Nm 846will not allow it to be used unless the 847.Cm StrictModes 848option has been set to 849.Dq no . 850.Pp 851.It Pa ~/.ssh/environment 852This file is read into the environment at login (if it exists). 853It can only contain empty lines, comment lines (that start with 854.Ql # ) , 855and assignment lines of the form name=value. 856The file should be writable 857only by the user; it need not be readable by anyone else. 858Environment processing is disabled by default and is 859controlled via the 860.Cm PermitUserEnvironment 861option. 862.Pp 863.It Pa ~/.ssh/known_hosts 864Contains a list of host keys for all hosts the user has logged into 865that are not already in the systemwide list of known host keys. 866The format of this file is described above. 867This file should be writable only by root/the owner and 868can, but need not be, world-readable. 869.Pp 870.It Pa ~/.ssh/rc 871Contains initialization routines to be run before 872the user's home directory becomes accessible. 873This file should be writable only by the user, and need not be 874readable by anyone else. 875.Pp 876.It Pa /etc/hosts.equiv 877This file is for host-based authentication (see 878.Xr ssh 1 ) . 879It should only be writable by root. 880.Pp 881.It Pa /etc/moduli 882Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" 883key exchange method. 884The file format is described in 885.Xr moduli 5 . 886If no usable groups are found in this file then fixed internal groups will 887be used. 888.Pp 889.It Pa /etc/motd 890See 891.Xr motd 5 . 892.Pp 893.It Pa /etc/nologin 894If this file exists, 895.Nm 896refuses to let anyone except root log in. 897The contents of the file 898are displayed to anyone trying to log in, and non-root connections are 899refused. 900The file should be world-readable. 901.Pp 902.It Pa /etc/shosts.equiv 903This file is used in exactly the same way as 904.Pa hosts.equiv , 905but allows host-based authentication without permitting login with 906rlogin/rsh. 907.Pp 908.It Pa /etc/ssh/ssh_host_ecdsa_key 909.It Pa /etc/ssh/ssh_host_ed25519_key 910.It Pa /etc/ssh/ssh_host_rsa_key 911These files contain the private parts of the host keys. 912These files should only be owned by root, readable only by root, and not 913accessible to others. 914Note that 915.Nm 916does not start if these files are group/world-accessible. 917.Pp 918.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 919.It Pa /etc/ssh/ssh_host_ed25519_key.pub 920.It Pa /etc/ssh/ssh_host_rsa_key.pub 921These files contain the public parts of the host keys. 922These files should be world-readable but writable only by 923root. 924Their contents should match the respective private parts. 925These files are not 926really used for anything; they are provided for the convenience of 927the user so their contents can be copied to known hosts files. 928These files are created using 929.Xr ssh-keygen 1 . 930.Pp 931.It Pa /etc/ssh/ssh_known_hosts 932Systemwide list of known host keys. 933This file should be prepared by the 934system administrator to contain the public host keys of all machines in the 935organization. 936The format of this file is described above. 937This file should be writable only by root/the owner and 938should be world-readable. 939.Pp 940.It Pa /etc/ssh/sshd_config 941Contains configuration data for 942.Nm sshd . 943The file format and configuration options are described in 944.Xr sshd_config 5 . 945.Pp 946.It Pa /etc/ssh/sshrc 947Similar to 948.Pa ~/.ssh/rc , 949it can be used to specify 950machine-specific login-time initializations globally. 951This file should be writable only by root, and should be world-readable. 952.Pp 953.It Pa /var/empty 954.Xr chroot 2 955directory used by 956.Nm 957during privilege separation in the pre-authentication phase. 958The directory should not contain any files and must be owned by root 959and not group or world-writable. 960.Pp 961.It Pa /var/run/sshd.pid 962Contains the process ID of the 963.Nm 964listening for connections (if there are several daemons running 965concurrently for different ports, this contains the process ID of the one 966started last). 967The content of this file is not sensitive; it can be world-readable. 968.El 969.Sh SEE ALSO 970.Xr scp 1 , 971.Xr sftp 1 , 972.Xr ssh 1 , 973.Xr ssh-add 1 , 974.Xr ssh-agent 1 , 975.Xr ssh-keygen 1 , 976.Xr ssh-keyscan 1 , 977.Xr chroot 2 , 978.Xr login.conf 5 , 979.Xr moduli 5 , 980.Xr sshd_config 5 , 981.Xr inetd 8 , 982.Xr sftp-server 8 983.Sh AUTHORS 984OpenSSH is a derivative of the original and free 985ssh 1.2.12 release by Tatu Ylonen. 986Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 987Theo de Raadt and Dug Song 988removed many bugs, re-added newer features and 989created OpenSSH. 990Markus Friedl contributed the support for SSH 991protocol versions 1.5 and 2.0. 992Niels Provos and Markus Friedl contributed support 993for privilege separation. 994