1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd.8,v 1.312 2020/01/25 06:03:10 djm Exp $ 37.Dd $Mdocdate: January 25 2020 $ 38.Dt SSHD 8 39.Os 40.Sh NAME 41.Nm sshd 42.Nd OpenSSH daemon 43.Sh SYNOPSIS 44.Nm sshd 45.Bk -words 46.Op Fl 46DdeiqTt 47.Op Fl C Ar connection_spec 48.Op Fl c Ar host_certificate_file 49.Op Fl E Ar log_file 50.Op Fl f Ar config_file 51.Op Fl g Ar login_grace_time 52.Op Fl h Ar host_key_file 53.Op Fl o Ar option 54.Op Fl p Ar port 55.Op Fl u Ar len 56.Ek 57.Sh DESCRIPTION 58.Nm 59(OpenSSH Daemon) is the daemon program for 60.Xr ssh 1 . 61Together these programs replace rlogin and rsh, 62and provide secure encrypted communications between two untrusted hosts 63over an insecure network. 64.Pp 65.Nm 66listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74.Pp 75.Nm 76can be configured using command-line options or a configuration file 77(by default 78.Xr sshd_config 5 ) ; 79command-line options override values specified in the 80configuration file. 81.Nm 82rereads its configuration file when it receives a hangup signal, 83.Dv SIGHUP , 84by executing itself with the name and options it was started with, e.g.\& 85.Pa /usr/sbin/sshd . 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl 4 90Forces 91.Nm 92to use IPv4 addresses only. 93.It Fl 6 94Forces 95.Nm 96to use IPv6 addresses only. 97.It Fl C Ar connection_spec 98Specify the connection parameters to use for the 99.Fl T 100extended test mode. 101If provided, any 102.Cm Match 103directives in the configuration file that would apply are applied before the 104configuration is written to standard output. 105The connection parameters are supplied as keyword=value pairs and may be 106supplied in any order, either with multiple 107.Fl C 108options or as a comma-separated list. 109The keywords are 110.Dq addr, 111.Dq user , 112.Dq host , 113.Dq laddr , 114.Dq lport , 115and 116.Dq rdomain 117and correspond to source address, user, resolved source host name, 118local address, local port number and routing domain respectively. 119.It Fl c Ar host_certificate_file 120Specifies a path to a certificate file to identify 121.Nm 122during key exchange. 123The certificate file must match a host key file specified using the 124.Fl h 125option or the 126.Cm HostKey 127configuration directive. 128.It Fl D 129When this option is specified, 130.Nm 131will not detach and does not become a daemon. 132This allows easy monitoring of 133.Nm sshd . 134.It Fl d 135Debug mode. 136The server sends verbose debug output to standard error, 137and does not put itself in the background. 138The server also will not fork and will only process one connection. 139This option is only intended for debugging for the server. 140Multiple 141.Fl d 142options increase the debugging level. 143Maximum is 3. 144.It Fl E Ar log_file 145Append debug logs to 146.Ar log_file 147instead of the system log. 148.It Fl e 149Write debug logs to standard error instead of the system log. 150.It Fl f Ar config_file 151Specifies the name of the configuration file. 152The default is 153.Pa /etc/ssh/sshd_config . 154.Nm 155refuses to start if there is no configuration file. 156.It Fl g Ar login_grace_time 157Gives the grace time for clients to authenticate themselves (default 158120 seconds). 159If the client fails to authenticate the user within 160this many seconds, the server disconnects and exits. 161A value of zero indicates no limit. 162.It Fl h Ar host_key_file 163Specifies a file from which a host key is read. 164This option must be given if 165.Nm 166is not run as root (as the normal 167host key files are normally not readable by anyone but root). 168The default is 169.Pa /etc/ssh/ssh_host_ecdsa_key , 170.Pa /etc/ssh/ssh_host_ed25519_key 171and 172.Pa /etc/ssh/ssh_host_rsa_key . 173It is possible to have multiple host key files for 174the different host key algorithms. 175.It Fl i 176Specifies that 177.Nm 178is being run from 179.Xr inetd 8 . 180.It Fl o Ar option 181Can be used to give options in the format used in the configuration file. 182This is useful for specifying options for which there is no separate 183command-line flag. 184For full details of the options, and their values, see 185.Xr sshd_config 5 . 186.It Fl p Ar port 187Specifies the port on which the server listens for connections 188(default 22). 189Multiple port options are permitted. 190Ports specified in the configuration file with the 191.Cm Port 192option are ignored when a command-line port is specified. 193Ports specified using the 194.Cm ListenAddress 195option override command-line ports. 196.It Fl q 197Quiet mode. 198Nothing is sent to the system log. 199Normally the beginning, 200authentication, and termination of each connection is logged. 201.It Fl T 202Extended test mode. 203Check the validity of the configuration file, output the effective configuration 204to stdout and then exit. 205Optionally, 206.Cm Match 207rules may be applied by specifying the connection parameters using one or more 208.Fl C 209options. 210.It Fl t 211Test mode. 212Only check the validity of the configuration file and sanity of the keys. 213This is useful for updating 214.Nm 215reliably as configuration options may change. 216.It Fl u Ar len 217This option is used to specify the size of the field 218in the 219.Li utmp 220structure that holds the remote host name. 221If the resolved host name is longer than 222.Ar len , 223the dotted decimal value will be used instead. 224This allows hosts with very long host names that 225overflow this field to still be uniquely identified. 226Specifying 227.Fl u0 228indicates that only dotted decimal addresses 229should be put into the 230.Pa utmp 231file. 232.Fl u0 233may also be used to prevent 234.Nm 235from making DNS requests unless the authentication 236mechanism or configuration requires it. 237Authentication mechanisms that may require DNS include 238.Cm HostbasedAuthentication 239and using a 240.Cm from="pattern-list" 241option in a key file. 242Configuration options that require DNS include using a 243USER@HOST pattern in 244.Cm AllowUsers 245or 246.Cm DenyUsers . 247.El 248.Sh AUTHENTICATION 249The OpenSSH SSH daemon supports SSH protocol 2 only. 250Each host has a host-specific key, 251used to identify the host. 252Whenever a client connects, the daemon responds with its public 253host key. 254The client compares the 255host key against its own database to verify that it has not changed. 256Forward secrecy is provided through a Diffie-Hellman key agreement. 257This key agreement results in a shared session key. 258The rest of the session is encrypted using a symmetric cipher. 259The client selects the encryption algorithm 260to use from those offered by the server. 261Additionally, session integrity is provided 262through a cryptographic message authentication code (MAC). 263.Pp 264Finally, the server and the client enter an authentication dialog. 265The client tries to authenticate itself using 266host-based authentication, 267public key authentication, 268challenge-response authentication, 269or password authentication. 270.Pp 271If the client successfully authenticates itself, a dialog for 272preparing the session is entered. 273At this time the client may request 274things like allocating a pseudo-tty, forwarding X11 connections, 275forwarding TCP connections, or forwarding the authentication agent 276connection over the secure channel. 277.Pp 278After this, the client either requests a shell or execution of a command. 279The sides then enter session mode. 280In this mode, either side may send 281data at any time, and such data is forwarded to/from the shell or 282command on the server side, and the user terminal in the client side. 283.Pp 284When the user program terminates and all forwarded X11 and other 285connections have been closed, the server sends command exit status to 286the client, and both sides exit. 287.Sh LOGIN PROCESS 288When a user successfully logs in, 289.Nm 290does the following: 291.Bl -enum -offset indent 292.It 293If the login is on a tty, and no command has been specified, 294prints last login time and 295.Pa /etc/motd 296(unless prevented in the configuration file or by 297.Pa ~/.hushlogin ; 298see the 299.Sx FILES 300section). 301.It 302If the login is on a tty, records login time. 303.It 304Checks 305.Pa /etc/nologin ; 306if it exists, prints contents and quits 307(unless root). 308.It 309Changes to run with normal user privileges. 310.It 311Sets up basic environment. 312.It 313Reads the file 314.Pa ~/.ssh/environment , 315if it exists, and users are allowed to change their environment. 316See the 317.Cm PermitUserEnvironment 318option in 319.Xr sshd_config 5 . 320.It 321Changes to user's home directory. 322.It 323If 324.Pa ~/.ssh/rc 325exists and the 326.Xr sshd_config 5 327.Cm PermitUserRC 328option is set, runs it; else if 329.Pa /etc/ssh/sshrc 330exists, runs 331it; otherwise runs xauth. 332The 333.Dq rc 334files are given the X11 335authentication protocol and cookie in standard input. 336See 337.Sx SSHRC , 338below. 339.It 340Runs user's shell or command. 341All commands are run under the user's login shell as specified in the 342system password database. 343.El 344.Sh SSHRC 345If the file 346.Pa ~/.ssh/rc 347exists, 348.Xr sh 1 349runs it after reading the 350environment files but before starting the user's shell or command. 351It must not produce any output on stdout; stderr must be used 352instead. 353If X11 forwarding is in use, it will receive the "proto cookie" pair in 354its standard input (and 355.Ev DISPLAY 356in its environment). 357The script must call 358.Xr xauth 1 359because 360.Nm 361will not run xauth automatically to add X11 cookies. 362.Pp 363The primary purpose of this file is to run any initialization routines 364which may be needed before the user's home directory becomes 365accessible; AFS is a particular example of such an environment. 366.Pp 367This file will probably contain some initialization code followed by 368something similar to: 369.Bd -literal -offset 3n 370if read proto cookie && [ -n "$DISPLAY" ]; then 371 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then 372 # X11UseLocalhost=yes 373 echo add unix:`echo $DISPLAY | 374 cut -c11-` $proto $cookie 375 else 376 # X11UseLocalhost=no 377 echo add $DISPLAY $proto $cookie 378 fi | xauth -q - 379fi 380.Ed 381.Pp 382If this file does not exist, 383.Pa /etc/ssh/sshrc 384is run, and if that 385does not exist either, xauth is used to add the cookie. 386.Sh AUTHORIZED_KEYS FILE FORMAT 387.Cm AuthorizedKeysFile 388specifies the files containing public keys for 389public key authentication; 390if this option is not specified, the default is 391.Pa ~/.ssh/authorized_keys 392and 393.Pa ~/.ssh/authorized_keys2 . 394Each line of the file contains one 395key (empty lines and lines starting with a 396.Ql # 397are ignored as 398comments). 399Public keys consist of the following space-separated fields: 400options, keytype, base64-encoded key, comment. 401The options field is optional. 402The supported key types are: 403.Pp 404.Bl -item -compact -offset indent 405.It 406sk-ecdsa-sha2-nistp256@openssh.com 407.It 408ecdsa-sha2-nistp256 409.It 410ecdsa-sha2-nistp384 411.It 412ecdsa-sha2-nistp521 413.It 414sk-ssh-ed25519@openssh.com 415.It 416ssh-ed25519 417.It 418ssh-dss 419.It 420ssh-rsa 421.El 422.Pp 423The comment field is not used for anything (but may be convenient for the 424user to identify the key). 425.Pp 426Note that lines in this file can be several hundred bytes long 427(because of the size of the public key encoding) up to a limit of 4288 kilobytes, which permits RSA keys up to 16 kilobits. 429You don't want to type them in; instead, copy the 430.Pa id_dsa.pub , 431.Pa id_ecdsa.pub , 432.Pa id_ecdsa_sk.pub , 433.Pa id_ed25519.pub , 434.Pa id_ed25519_sk.pub , 435or the 436.Pa id_rsa.pub 437file and edit it. 438.Pp 439.Nm 440enforces a minimum RSA key modulus size of 1024 bits. 441.Pp 442The options (if present) consist of comma-separated option 443specifications. 444No spaces are permitted, except within double quotes. 445The following option specifications are supported (note 446that option keywords are case-insensitive): 447.Bl -tag -width Ds 448.It Cm agent-forwarding 449Enable authentication agent forwarding previously disabled by the 450.Cm restrict 451option. 452.It Cm cert-authority 453Specifies that the listed key is a certification authority (CA) that is 454trusted to validate signed certificates for user authentication. 455.Pp 456Certificates may encode access restrictions similar to these key options. 457If both certificate restrictions and key options are present, the most 458restrictive union of the two is applied. 459.It Cm command="command" 460Specifies that the command is executed whenever this key is used for 461authentication. 462The command supplied by the user (if any) is ignored. 463The command is run on a pty if the client requests a pty; 464otherwise it is run without a tty. 465If an 8-bit clean channel is required, 466one must not request a pty or should specify 467.Cm no-pty . 468A quote may be included in the command by quoting it with a backslash. 469.Pp 470This option might be useful 471to restrict certain public keys to perform just a specific operation. 472An example might be a key that permits remote backups but nothing else. 473Note that the client may specify TCP and/or X11 474forwarding unless they are explicitly prohibited, e.g. using the 475.Cm restrict 476key option. 477.Pp 478The command originally supplied by the client is available in the 479.Ev SSH_ORIGINAL_COMMAND 480environment variable. 481Note that this option applies to shell, command or subsystem execution. 482Also note that this command may be superseded by a 483.Xr sshd_config 5 484.Cm ForceCommand 485directive. 486.Pp 487If a command is specified and a forced-command is embedded in a certificate 488used for authentication, then the certificate will be accepted only if the 489two commands are identical. 490.It Cm environment="NAME=value" 491Specifies that the string is to be added to the environment when 492logging in using this key. 493Environment variables set this way 494override other default environment values. 495Multiple options of this type are permitted. 496Environment processing is disabled by default and is 497controlled via the 498.Cm PermitUserEnvironment 499option. 500.It Cm expiry-time="timespec" 501Specifies a time after which the key will not be accepted. 502The time may be specified as a YYYYMMDD date or a YYYYMMDDHHMM[SS] time 503in the system time-zone. 504.It Cm from="pattern-list" 505Specifies that in addition to public key authentication, either the canonical 506name of the remote host or its IP address must be present in the 507comma-separated list of patterns. 508See PATTERNS in 509.Xr ssh_config 5 510for more information on patterns. 511.Pp 512In addition to the wildcard matching that may be applied to hostnames or 513addresses, a 514.Cm from 515stanza may match IP addresses using CIDR address/masklen notation. 516.Pp 517The purpose of this option is to optionally increase security: public key 518authentication by itself does not trust the network or name servers or 519anything (but the key); however, if somebody somehow steals the key, the key 520permits an intruder to log in from anywhere in the world. 521This additional option makes using a stolen key more difficult (name 522servers and/or routers would have to be compromised in addition to 523just the key). 524.It Cm no-agent-forwarding 525Forbids authentication agent forwarding when this key is used for 526authentication. 527.It Cm no-port-forwarding 528Forbids TCP forwarding when this key is used for authentication. 529Any port forward requests by the client will return an error. 530This might be used, e.g. in connection with the 531.Cm command 532option. 533.It Cm no-pty 534Prevents tty allocation (a request to allocate a pty will fail). 535.It Cm no-user-rc 536Disables execution of 537.Pa ~/.ssh/rc . 538.It Cm no-X11-forwarding 539Forbids X11 forwarding when this key is used for authentication. 540Any X11 forward requests by the client will return an error. 541.It Cm permitlisten="[host:]port" 542Limit remote port forwarding with the 543.Xr ssh 1 544.Fl R 545option such that it may only listen on the specified host (optional) and port. 546IPv6 addresses can be specified by enclosing the address in square brackets. 547Multiple 548.Cm permitlisten 549options may be applied separated by commas. 550Hostnames may include wildcards as described in the PATTERNS section in 551.Xr ssh_config 5 . 552A port specification of 553.Cm * 554matches any port. 555Note that the setting of 556.Cm GatewayPorts 557may further restrict listen addresses. 558Note that 559.Xr ssh 1 560will send a hostname of 561.Dq localhost 562if a listen host was not specified when the forwarding was requested, and 563that this name is treated differently to the explicit localhost addresses 564.Dq 127.0.0.1 565and 566.Dq ::1 . 567.It Cm permitopen="host:port" 568Limit local port forwarding with the 569.Xr ssh 1 570.Fl L 571option such that it may only connect to the specified host and port. 572IPv6 addresses can be specified by enclosing the address in square brackets. 573Multiple 574.Cm permitopen 575options may be applied separated by commas. 576No pattern matching or name lookup is performed on the 577specified hostnames, they must be literal host names and/or addresses. 578A port specification of 579.Cm * 580matches any port. 581.It Cm port-forwarding 582Enable port forwarding previously disabled by the 583.Cm restrict 584option. 585.It Cm principals="principals" 586On a 587.Cm cert-authority 588line, specifies allowed principals for certificate authentication as a 589comma-separated list. 590At least one name from the list must appear in the certificate's 591list of principals for the certificate to be accepted. 592This option is ignored for keys that are not marked as trusted certificate 593signers using the 594.Cm cert-authority 595option. 596.It Cm pty 597Permits tty allocation previously disabled by the 598.Cm restrict 599option. 600.It Cm no-touch-required 601Do not require demonstration of user presence 602for signatures made using this key. 603This option only makes sense for the FIDO authenticator algorithms 604.Cm ecdsa-sk 605and 606.Cm ed25519-sk . 607.It Cm restrict 608Enable all restrictions, i.e. disable port, agent and X11 forwarding, 609as well as disabling PTY allocation 610and execution of 611.Pa ~/.ssh/rc . 612If any future restriction capabilities are added to authorized_keys files 613they will be included in this set. 614.It Cm tunnel="n" 615Force a 616.Xr tun 4 617device on the server. 618Without this option, the next available device will be used if 619the client requests a tunnel. 620.It Cm user-rc 621Enables execution of 622.Pa ~/.ssh/rc 623previously disabled by the 624.Cm restrict 625option. 626.It Cm X11-forwarding 627Permits X11 forwarding previously disabled by the 628.Cm restrict 629option. 630.El 631.Pp 632An example authorized_keys file: 633.Bd -literal -offset 3n 634# Comments allowed at start of line 635ssh-rsa AAAAB3Nza...LiPk== user@example.net 636from="*.sales.example.net,!pc.sales.example.net" ssh-rsa 637AAAAB2...19Q== john@example.net 638command="dump /home",no-pty,no-port-forwarding ssh-rsa 639AAAAC3...51R== example.net 640permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa 641AAAAB5...21S== 642permitlisten="localhost:8080",permitopen="localhost:22000" ssh-rsa 643AAAAB5...21S== 644tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== 645jane@example.net 646restrict,command="uptime" ssh-rsa AAAA1C8...32Tv== 647user@example.net 648restrict,pty,command="nethack" ssh-rsa AAAA1f8...IrrC5== 649user@example.net 650no-touch-required sk-ecdsa-sha2-nistp256@openssh.com AAAAInN...Ko== 651user@example.net 652.Ed 653.Sh SSH_KNOWN_HOSTS FILE FORMAT 654The 655.Pa /etc/ssh/ssh_known_hosts 656and 657.Pa ~/.ssh/known_hosts 658files contain host public keys for all known hosts. 659The global file should 660be prepared by the administrator (optional), and the per-user file is 661maintained automatically: whenever the user connects to an unknown host, 662its key is added to the per-user file. 663.Pp 664Each line in these files contains the following fields: markers (optional), 665hostnames, keytype, base64-encoded key, comment. 666The fields are separated by spaces. 667.Pp 668The marker is optional, but if it is present then it must be one of 669.Dq @cert-authority , 670to indicate that the line contains a certification authority (CA) key, 671or 672.Dq @revoked , 673to indicate that the key contained on the line is revoked and must not ever 674be accepted. 675Only one marker should be used on a key line. 676.Pp 677Hostnames is a comma-separated list of patterns 678.Pf ( Ql * 679and 680.Ql \&? 681act as 682wildcards); each pattern in turn is matched against the host name. 683When 684.Nm sshd 685is authenticating a client, such as when using 686.Cm HostbasedAuthentication , 687this will be the canonical client host name. 688When 689.Xr ssh 1 690is authenticating a server, this will be the host name 691given by the user, the value of the 692.Xr ssh 1 693.Cm HostkeyAlias 694if it was specified, or the canonical server hostname if the 695.Xr ssh 1 696.Cm CanonicalizeHostname 697option was used. 698.Pp 699A pattern may also be preceded by 700.Ql \&! 701to indicate negation: if the host name matches a negated 702pattern, it is not accepted (by that line) even if it matched another 703pattern on the line. 704A hostname or address may optionally be enclosed within 705.Ql \&[ 706and 707.Ql \&] 708brackets then followed by 709.Ql \&: 710and a non-standard port number. 711.Pp 712Alternately, hostnames may be stored in a hashed form which hides host names 713and addresses should the file's contents be disclosed. 714Hashed hostnames start with a 715.Ql | 716character. 717Only one hashed hostname may appear on a single line and none of the above 718negation or wildcard operators may be applied. 719.Pp 720The keytype and base64-encoded key are taken directly from the host key; they 721can be obtained, for example, from 722.Pa /etc/ssh/ssh_host_rsa_key.pub . 723The optional comment field continues to the end of the line, and is not used. 724.Pp 725Lines starting with 726.Ql # 727and empty lines are ignored as comments. 728.Pp 729When performing host authentication, authentication is accepted if any 730matching line has the proper key; either one that matches exactly or, 731if the server has presented a certificate for authentication, the key 732of the certification authority that signed the certificate. 733For a key to be trusted as a certification authority, it must use the 734.Dq @cert-authority 735marker described above. 736.Pp 737The known hosts file also provides a facility to mark keys as revoked, 738for example when it is known that the associated private key has been 739stolen. 740Revoked keys are specified by including the 741.Dq @revoked 742marker at the beginning of the key line, and are never accepted for 743authentication or as certification authorities, but instead will 744produce a warning from 745.Xr ssh 1 746when they are encountered. 747.Pp 748It is permissible (but not 749recommended) to have several lines or different host keys for the same 750names. 751This will inevitably happen when short forms of host names 752from different domains are put in the file. 753It is possible 754that the files contain conflicting information; authentication is 755accepted if valid information can be found from either file. 756.Pp 757Note that the lines in these files are typically hundreds of characters 758long, and you definitely don't want to type in the host keys by hand. 759Rather, generate them by a script, 760.Xr ssh-keyscan 1 761or by taking, for example, 762.Pa /etc/ssh/ssh_host_rsa_key.pub 763and adding the host names at the front. 764.Xr ssh-keygen 1 765also offers some basic automated editing for 766.Pa ~/.ssh/known_hosts 767including removing hosts matching a host name and converting all host 768names to their hashed representations. 769.Pp 770An example ssh_known_hosts file: 771.Bd -literal -offset 3n 772# Comments allowed at start of line 773closenet,...,192.0.2.53 1024 37 159...93 closenet.example.net 774cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= 775# A hashed hostname 776|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa 777AAAA1234.....= 778# A revoked key 779@revoked * ssh-rsa AAAAB5W... 780# A CA key, accepted for any host in *.mydomain.com or *.mydomain.org 781@cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... 782.Ed 783.Sh FILES 784.Bl -tag -width Ds -compact 785.It Pa ~/.hushlogin 786This file is used to suppress printing the last login time and 787.Pa /etc/motd , 788if 789.Cm PrintLastLog 790and 791.Cm PrintMotd , 792respectively, 793are enabled. 794It does not suppress printing of the banner specified by 795.Cm Banner . 796.Pp 797.It Pa ~/.rhosts 798This file is used for host-based authentication (see 799.Xr ssh 1 800for more information). 801On some machines this file may need to be 802world-readable if the user's home directory is on an NFS partition, 803because 804.Nm 805reads it as root. 806Additionally, this file must be owned by the user, 807and must not have write permissions for anyone else. 808The recommended 809permission for most machines is read/write for the user, and not 810accessible by others. 811.Pp 812.It Pa ~/.shosts 813This file is used in exactly the same way as 814.Pa .rhosts , 815but allows host-based authentication without permitting login with 816rlogin/rsh. 817.Pp 818.It Pa ~/.ssh/ 819This directory is the default location for all user-specific configuration 820and authentication information. 821There is no general requirement to keep the entire contents of this directory 822secret, but the recommended permissions are read/write/execute for the user, 823and not accessible by others. 824.Pp 825.It Pa ~/.ssh/authorized_keys 826Lists the public keys (DSA, ECDSA, Ed25519, RSA) 827that can be used for logging in as this user. 828The format of this file is described above. 829The content of the file is not highly sensitive, but the recommended 830permissions are read/write for the user, and not accessible by others. 831.Pp 832If this file, the 833.Pa ~/.ssh 834directory, or the user's home directory are writable 835by other users, then the file could be modified or replaced by unauthorized 836users. 837In this case, 838.Nm 839will not allow it to be used unless the 840.Cm StrictModes 841option has been set to 842.Dq no . 843.Pp 844.It Pa ~/.ssh/environment 845This file is read into the environment at login (if it exists). 846It can only contain empty lines, comment lines (that start with 847.Ql # ) , 848and assignment lines of the form name=value. 849The file should be writable 850only by the user; it need not be readable by anyone else. 851Environment processing is disabled by default and is 852controlled via the 853.Cm PermitUserEnvironment 854option. 855.Pp 856.It Pa ~/.ssh/known_hosts 857Contains a list of host keys for all hosts the user has logged into 858that are not already in the systemwide list of known host keys. 859The format of this file is described above. 860This file should be writable only by root/the owner and 861can, but need not be, world-readable. 862.Pp 863.It Pa ~/.ssh/rc 864Contains initialization routines to be run before 865the user's home directory becomes accessible. 866This file should be writable only by the user, and need not be 867readable by anyone else. 868.Pp 869.It Pa /etc/hosts.equiv 870This file is for host-based authentication (see 871.Xr ssh 1 ) . 872It should only be writable by root. 873.Pp 874.It Pa /etc/moduli 875Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange" 876key exchange method. 877The file format is described in 878.Xr moduli 5 . 879If no usable groups are found in this file then fixed internal groups will 880be used. 881.Pp 882.It Pa /etc/motd 883See 884.Xr motd 5 . 885.Pp 886.It Pa /etc/nologin 887If this file exists, 888.Nm 889refuses to let anyone except root log in. 890The contents of the file 891are displayed to anyone trying to log in, and non-root connections are 892refused. 893The file should be world-readable. 894.Pp 895.It Pa /etc/shosts.equiv 896This file is used in exactly the same way as 897.Pa hosts.equiv , 898but allows host-based authentication without permitting login with 899rlogin/rsh. 900.Pp 901.It Pa /etc/ssh/ssh_host_ecdsa_key 902.It Pa /etc/ssh/ssh_host_ed25519_key 903.It Pa /etc/ssh/ssh_host_rsa_key 904These files contain the private parts of the host keys. 905These files should only be owned by root, readable only by root, and not 906accessible to others. 907Note that 908.Nm 909does not start if these files are group/world-accessible. 910.Pp 911.It Pa /etc/ssh/ssh_host_ecdsa_key.pub 912.It Pa /etc/ssh/ssh_host_ed25519_key.pub 913.It Pa /etc/ssh/ssh_host_rsa_key.pub 914These files contain the public parts of the host keys. 915These files should be world-readable but writable only by 916root. 917Their contents should match the respective private parts. 918These files are not 919really used for anything; they are provided for the convenience of 920the user so their contents can be copied to known hosts files. 921These files are created using 922.Xr ssh-keygen 1 . 923.Pp 924.It Pa /etc/ssh/ssh_known_hosts 925Systemwide list of known host keys. 926This file should be prepared by the 927system administrator to contain the public host keys of all machines in the 928organization. 929The format of this file is described above. 930This file should be writable only by root/the owner and 931should be world-readable. 932.Pp 933.It Pa /etc/ssh/sshd_config 934Contains configuration data for 935.Nm sshd . 936The file format and configuration options are described in 937.Xr sshd_config 5 . 938.Pp 939.It Pa /etc/ssh/sshrc 940Similar to 941.Pa ~/.ssh/rc , 942it can be used to specify 943machine-specific login-time initializations globally. 944This file should be writable only by root, and should be world-readable. 945.Pp 946.It Pa /var/empty 947.Xr chroot 2 948directory used by 949.Nm 950during privilege separation in the pre-authentication phase. 951The directory should not contain any files and must be owned by root 952and not group or world-writable. 953.Pp 954.It Pa /var/run/sshd.pid 955Contains the process ID of the 956.Nm 957listening for connections (if there are several daemons running 958concurrently for different ports, this contains the process ID of the one 959started last). 960The content of this file is not sensitive; it can be world-readable. 961.El 962.Sh SEE ALSO 963.Xr scp 1 , 964.Xr sftp 1 , 965.Xr ssh 1 , 966.Xr ssh-add 1 , 967.Xr ssh-agent 1 , 968.Xr ssh-keygen 1 , 969.Xr ssh-keyscan 1 , 970.Xr chroot 2 , 971.Xr login.conf 5 , 972.Xr moduli 5 , 973.Xr sshd_config 5 , 974.Xr inetd 8 , 975.Xr sftp-server 8 976.Sh AUTHORS 977OpenSSH is a derivative of the original and free 978ssh 1.2.12 release by Tatu Ylonen. 979Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 980Theo de Raadt and Dug Song 981removed many bugs, re-added newer features and 982created OpenSSH. 983Markus Friedl contributed the support for SSH 984protocol versions 1.5 and 2.0. 985Niels Provos and Markus Friedl contributed support 986for privilege separation. 987