1.\" -*- nroff -*- 2.\" 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5.\" All rights reserved 6.\" 7.\" As far as I am concerned, the code I have written for this software 8.\" can be used freely for any purpose. Any derived versions of this 9.\" software must be clearly marked as such, and if the derived work is 10.\" incompatible with the protocol description in the RFC file, it must be 11.\" called by a name other than "ssh" or "Secure Shell". 12.\" 13.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 14.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 15.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 16.\" 17.\" Redistribution and use in source and binary forms, with or without 18.\" modification, are permitted provided that the following conditions 19.\" are met: 20.\" 1. Redistributions of source code must retain the above copyright 21.\" notice, this list of conditions and the following disclaimer. 22.\" 2. Redistributions in binary form must reproduce the above copyright 23.\" notice, this list of conditions and the following disclaimer in the 24.\" documentation and/or other materials provided with the distribution. 25.\" 26.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" 37.\" $OpenBSD: sshd.8,v 1.159 2001/12/28 22:37:48 stevesk Exp $ 38.Dd September 25, 1999 39.Dt SSHD 8 40.Os 41.Sh NAME 42.Nm sshd 43.Nd OpenSSH SSH daemon 44.Sh SYNOPSIS 45.Nm sshd 46.Op Fl deiqtD46 47.Op Fl b Ar bits 48.Op Fl f Ar config_file 49.Op Fl g Ar login_grace_time 50.Op Fl h Ar host_key_file 51.Op Fl k Ar key_gen_time 52.Op Fl o Ar option 53.Op Fl p Ar port 54.Op Fl u Ar len 55.Sh DESCRIPTION 56.Nm 57(SSH Daemon) is the daemon program for 58.Xr ssh 1 . 59Together these programs replace rlogin and rsh, and 60provide secure encrypted communications between two untrusted hosts 61over an insecure network. 62The programs are intended to be as easy to 63install and use as possible. 64.Pp 65.Nm 66is the daemon that listens for connections from clients. 67It is normally started at boot from 68.Pa /etc/rc . 69It forks a new 70daemon for each incoming connection. 71The forked daemons handle 72key exchange, encryption, authentication, command execution, 73and data exchange. 74This implementation of 75.Nm 76supports both SSH protocol version 1 and 2 simultaneously. 77.Nm 78works as follows. 79.Pp 80.Ss SSH protocol version 1 81.Pp 82Each host has a host-specific RSA key 83(normally 1024 bits) used to identify the host. 84Additionally, when 85the daemon starts, it generates a server RSA key (normally 768 bits). 86This key is normally regenerated every hour if it has been used, and 87is never stored on disk. 88.Pp 89Whenever a client connects the daemon responds with its public 90host and server keys. 91The client compares the 92RSA host key against its own database to verify that it has not changed. 93The client then generates a 256 bit random number. 94It encrypts this 95random number using both the host key and the server key, and sends 96the encrypted number to the server. 97Both sides then use this 98random number as a session key which is used to encrypt all further 99communications in the session. 100The rest of the session is encrypted 101using a conventional cipher, currently Blowfish or 3DES, with 3DES 102being used by default. 103The client selects the encryption algorithm 104to use from those offered by the server. 105.Pp 106Next, the server and the client enter an authentication dialog. 107The client tries to authenticate itself using 108.Pa .rhosts 109authentication, 110.Pa .rhosts 111authentication combined with RSA host 112authentication, RSA challenge-response authentication, or password 113based authentication. 114.Pp 115Rhosts authentication is normally disabled 116because it is fundamentally insecure, but can be enabled in the server 117configuration file if desired. 118System security is not improved unless 119.Xr rshd 8 , 120.Xr rlogind 8 , 121and 122.Xr rexecd 8 123are disabled (thus completely disabling 124.Xr rlogin 1 125and 126.Xr rsh 1 127into the machine). 128.Pp 129.Ss SSH protocol version 2 130.Pp 131Version 2 works similarly: 132Each host has a host-specific key (RSA or DSA) used to identify the host. 133However, when the daemon starts, it does not generate a server key. 134Forward security is provided through a Diffie-Hellman key agreement. 135This key agreement results in a shared session key. 136.Pp 137The rest of the session is encrypted using a symmetric cipher, currently 138128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit AES. 139The client selects the encryption algorithm 140to use from those offered by the server. 141Additionally, session integrity is provided 142through a cryptographic message authentication code 143(hmac-sha1 or hmac-md5). 144.Pp 145Protocol version 2 provides a public key based 146user (PubkeyAuthentication) or 147client host (HostbasedAuthentication) authentication method, 148conventional password authentication and challenge response based methods. 149.Pp 150.Ss Command execution and data forwarding 151.Pp 152If the client successfully authenticates itself, a dialog for 153preparing the session is entered. 154At this time the client may request 155things like allocating a pseudo-tty, forwarding X11 connections, 156forwarding TCP/IP connections, or forwarding the authentication agent 157connection over the secure channel. 158.Pp 159Finally, the client either requests a shell or execution of a command. 160The sides then enter session mode. 161In this mode, either side may send 162data at any time, and such data is forwarded to/from the shell or 163command on the server side, and the user terminal in the client side. 164.Pp 165When the user program terminates and all forwarded X11 and other 166connections have been closed, the server sends command exit status to 167the client, and both sides exit. 168.Pp 169.Nm 170can be configured using command-line options or a configuration 171file. 172Command-line options override values specified in the 173configuration file. 174.Pp 175.Nm 176rereads its configuration file when it receives a hangup signal, 177.Dv SIGHUP , 178by executing itself with the name it was started as, i.e., 179.Pa /usr/sbin/sshd . 180.Pp 181The options are as follows: 182.Bl -tag -width Ds 183.It Fl b Ar bits 184Specifies the number of bits in the ephemeral protocol version 1 185server key (default 768). 186.It Fl d 187Debug mode. 188The server sends verbose debug output to the system 189log, and does not put itself in the background. 190The server also will not fork and will only process one connection. 191This option is only intended for debugging for the server. 192Multiple -d options increase the debugging level. 193Maximum is 3. 194.It Fl e 195When this option is specified, 196.Nm 197will send the output to the standard error instead of the system log. 198.It Fl f Ar configuration_file 199Specifies the name of the configuration file. 200The default is 201.Pa /etc/sshd_config . 202.Nm 203refuses to start if there is no configuration file. 204.It Fl g Ar login_grace_time 205Gives the grace time for clients to authenticate themselves (default 206600 seconds). 207If the client fails to authenticate the user within 208this many seconds, the server disconnects and exits. 209A value of zero indicates no limit. 210.It Fl h Ar host_key_file 211Specifies the file from which the host key is read (default 212.Pa /etc/ssh_host_key ) . 213This option must be given if 214.Nm 215is not run as root (as the normal 216host file is normally not readable by anyone but root). 217It is possible to have multiple host key files for 218the different protocol versions and host key algorithms. 219.It Fl i 220Specifies that 221.Nm 222is being run from inetd. 223.Nm 224is normally not run 225from inetd because it needs to generate the server key before it can 226respond to the client, and this may take tens of seconds. 227Clients would have to wait too long if the key was regenerated every time. 228However, with small key sizes (e.g., 512) using 229.Nm 230from inetd may 231be feasible. 232.It Fl k Ar key_gen_time 233Specifies how often the ephemeral protocol version 1 server key is 234regenerated (default 3600 seconds, or one hour). 235The motivation for regenerating the key fairly 236often is that the key is not stored anywhere, and after about an hour, 237it becomes impossible to recover the key for decrypting intercepted 238communications even if the machine is cracked into or physically 239seized. 240A value of zero indicates that the key will never be regenerated. 241.It Fl o Ar option 242Can be used to give options in the format used in the configuration file. 243This is useful for specifying options for which there is no separate 244command-line flag. 245.It Fl p Ar port 246Specifies the port on which the server listens for connections 247(default 22). 248Multiple port options are permitted. 249Ports specified in the configuration file are ignored when a 250command-line port is specified. 251.It Fl q 252Quiet mode. 253Nothing is sent to the system log. 254Normally the beginning, 255authentication, and termination of each connection is logged. 256.It Fl t 257Test mode. 258Only check the validity of the configuration file and sanity of the keys. 259This is useful for updating 260.Nm 261reliably as configuration options may change. 262.It Fl u Ar len 263This option is used to specify the size of the field 264in the 265.Li utmp 266structure that holds the remote host name. 267If the resolved host name is longer than 268.Ar len , 269the dotted decimal value will be used instead. 270This allows hosts with very long host names that 271overflow this field to still be uniquely identified. 272Specifying 273.Fl u0 274indicates that only dotted decimal addresses 275should be put into the 276.Pa utmp 277file. 278.Fl u0 279is also be used to prevent 280.Nm 281from making DNS requests unless the authentication 282mechanism or configuration requires it. 283Authentication mechanisms that may require DNS include 284.Cm RhostsAuthentication , 285.Cm RhostsRSAAuthentication , 286.Cm HostbasedAuthentication 287and using a 288.Cm from="pattern-list" 289option in a key file. 290.It Fl D 291When this option is specified 292.Nm 293will not detach and does not become a daemon. 294This allows easy monitoring of 295.Nm sshd . 296.It Fl 4 297Forces 298.Nm 299to use IPv4 addresses only. 300.It Fl 6 301Forces 302.Nm 303to use IPv6 addresses only. 304.El 305.Sh CONFIGURATION FILE 306.Nm 307reads configuration data from 308.Pa /etc/sshd_config 309(or the file specified with 310.Fl f 311on the command line). 312The file contains keyword-argument pairs, one per line. 313Lines starting with 314.Ql # 315and empty lines are interpreted as comments. 316.Pp 317The possible 318keywords and their meanings are as follows (note that 319keywords are case-insensitive and arguments are case-sensitive): 320.Bl -tag -width Ds 321.It Cm AFSTokenPassing 322Specifies whether an AFS token may be forwarded to the server. 323Default is 324.Dq yes . 325.It Cm AllowGroups 326This keyword can be followed by a list of group names, separated 327by spaces. 328If specified, login is allowed only for users whose primary 329group or supplementary group list matches one of the patterns. 330.Ql \&* 331and 332.Ql ? 333can be used as 334wildcards in the patterns. 335Only group names are valid; a numerical group ID is not recognized. 336By default login is allowed regardless of the group list. 337.Pp 338.It Cm AllowTcpForwarding 339Specifies whether TCP forwarding is permitted. 340The default is 341.Dq yes . 342Note that disabling TCP forwarding does not improve security unless 343users are also denied shell access, as they can always install their 344own forwarders. 345.Pp 346.It Cm AllowUsers 347This keyword can be followed by a list of user names, separated 348by spaces. 349If specified, login is allowed only for users names that 350match one of the patterns. 351.Ql \&* 352and 353.Ql ? 354can be used as 355wildcards in the patterns. 356Only user names are valid; a numerical user ID is not recognized. 357By default login is allowed regardless of the user name. 358If the pattern takes the form USER@HOST then USER and HOST 359are separately checked, restricting logins to particular 360users from particular hosts. 361.Pp 362.It Cm AuthorizedKeysFile 363Specifies the file that contains the public keys that can be used 364for user authentication. 365.Cm AuthorizedKeysFile 366may contain tokens of the form %T which are substituted during connection 367set-up. The following tokens are defined: %% is replaced by a literal '%', 368%h is replaced by the home directory of the user being authenticated and 369%u is replaced by the username of that user. 370After expansion, 371.Cm AuthorizedKeysFile 372is taken to be an absolute path or one relative to the user's home 373directory. 374The default is 375.Dq .ssh/authorized_keys 376.It Cm Banner 377In some jurisdictions, sending a warning message before authentication 378may be relevant for getting legal protection. 379The contents of the specified file are sent to the remote user before 380authentication is allowed. 381This option is only available for protocol version 2. 382.Pp 383.It Cm ChallengeResponseAuthentication 384Specifies whether challenge response authentication is allowed. 385All authentication styles from 386.Xr login.conf 5 387are supported. 388The default is 389.Dq yes . 390.It Cm Ciphers 391Specifies the ciphers allowed for protocol version 2. 392Multiple ciphers must be comma-separated. 393The default is 394.Dq aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour. 395.It Cm ClientAliveInterval 396Sets a timeout interval in seconds after which if no data has been received 397from the client, 398.Nm 399will send a message through the encrypted 400channel to request a response from the client. 401The default 402is 0, indicating that these messages will not be sent to the client. 403This option applies to protocol version 2 only. 404.It Cm ClientAliveCountMax 405Sets the number of client alive messages (see above) which may be 406sent without 407.Nm 408receiving any messages back from the client. If this threshold is 409reached while client alive messages are being sent, 410.Nm 411will disconnect the client, terminating the session. It is important 412to note that the use of client alive messages is very different from 413.Cm KeepAlive 414(below). The client alive messages are sent through the 415encrypted channel and therefore will not be spoofable. The TCP keepalive 416option enabled by 417.Cm KeepAlive 418is spoofable. The client alive mechanism is valuable when the client or 419server depend on knowing when a connection has become inactive. 420.Pp 421The default value is 3. If 422.Cm ClientAliveInterval 423(above) is set to 15, and 424.Cm ClientAliveCountMax 425is left at the default, unresponsive ssh clients 426will be disconnected after approximately 45 seconds. 427.It Cm DenyGroups 428This keyword can be followed by a number of group names, separated 429by spaces. 430Users whose primary group or supplementary group list matches 431one of the patterns aren't allowed to log in. 432.Ql \&* 433and 434.Ql ? 435can be used as 436wildcards in the patterns. 437Only group names are valid; a numerical group ID is not recognized. 438By default login is allowed regardless of the group list. 439.Pp 440.It Cm DenyUsers 441This keyword can be followed by a number of user names, separated 442by spaces. 443Login is disallowed for user names that match one of the patterns. 444.Ql \&* 445and 446.Ql ? 447can be used as wildcards in the patterns. 448Only user names are valid; a numerical user ID is not recognized. 449By default login is allowed regardless of the user name. 450.It Cm GatewayPorts 451Specifies whether remote hosts are allowed to connect to ports 452forwarded for the client. 453By default, 454.Nm 455binds remote port forwardings to the loopback addresss. This 456prevents other remote hosts from connecting to forwarded ports. 457.Cm GatewayPorts 458can be used to specify that 459.Nm 460should bind remote port forwardings to the wildcard address, 461thus allowing remote hosts to connect to forwarded ports. 462The argument must be 463.Dq yes 464or 465.Dq no . 466The default is 467.Dq no . 468.It Cm HostbasedAuthentication 469Specifies whether rhosts or /etc/hosts.equiv authentication together 470with successful public key client host authentication is allowed 471(hostbased authentication). 472This option is similar to 473.Cm RhostsRSAAuthentication 474and applies to protocol version 2 only. 475The default is 476.Dq no . 477.It Cm HostKey 478Specifies the file containing the private host keys (default 479.Pa /etc/ssh_host_key ) 480used by SSH protocol versions 1 and 2. 481Note that 482.Nm 483will refuse to use a file if it is group/world-accessible. 484It is possible to have multiple host key files. 485.Dq rsa1 486keys are used for version 1 and 487.Dq dsa 488or 489.Dq rsa 490are used for version 2 of the SSH protocol. 491.It Cm IgnoreRhosts 492Specifies that 493.Pa .rhosts 494and 495.Pa .shosts 496files will not be used in 497.Cm RhostsAuthentication , 498.Cm RhostsRSAAuthentication 499or 500.Cm HostbasedAuthentication . 501.Pp 502.Pa /etc/hosts.equiv 503and 504.Pa /etc/shosts.equiv 505are still used. 506The default is 507.Dq yes . 508.It Cm IgnoreUserKnownHosts 509Specifies whether 510.Nm 511should ignore the user's 512.Pa $HOME/.ssh/known_hosts 513during 514.Cm RhostsRSAAuthentication 515or 516.Cm HostbasedAuthentication . 517The default is 518.Dq no . 519.It Cm KeepAlive 520Specifies whether the system should send keepalive messages to the 521other side. 522If they are sent, death of the connection or crash of one 523of the machines will be properly noticed. 524However, this means that 525connections will die if the route is down temporarily, and some people 526find it annoying. 527On the other hand, if keepalives are not sent, 528sessions may hang indefinitely on the server, leaving 529.Dq ghost 530users and consuming server resources. 531.Pp 532The default is 533.Dq yes 534(to send keepalives), and the server will notice 535if the network goes down or the client host reboots. 536This avoids infinitely hanging sessions. 537.Pp 538To disable keepalives, the value should be set to 539.Dq no 540in both the server and the client configuration files. 541.It Cm KerberosAuthentication 542Specifies whether Kerberos authentication is allowed. 543This can be in the form of a Kerberos ticket, or if 544.Cm PasswordAuthentication 545is yes, the password provided by the user will be validated through 546the Kerberos KDC. 547To use this option, the server needs a 548Kerberos servtab which allows the verification of the KDC's identity. 549Default is 550.Dq yes . 551.It Cm KerberosOrLocalPasswd 552If set then if password authentication through Kerberos fails then 553the password will be validated via any additional local mechanism 554such as 555.Pa /etc/passwd . 556Default is 557.Dq yes . 558.It Cm KerberosTgtPassing 559Specifies whether a Kerberos TGT may be forwarded to the server. 560Default is 561.Dq no , 562as this only works when the Kerberos KDC is actually an AFS kaserver. 563.It Cm KerberosTicketCleanup 564Specifies whether to automatically destroy the user's ticket cache 565file on logout. 566Default is 567.Dq yes . 568.It Cm KeyRegenerationInterval 569In protocol version 1, the ephemeral server key is automatically regenerated 570after this many seconds (if it has been used). 571The purpose of regeneration is to prevent 572decrypting captured sessions by later breaking into the machine and 573stealing the keys. 574The key is never stored anywhere. 575If the value is 0, the key is never regenerated. 576The default is 3600 (seconds). 577.It Cm ListenAddress 578Specifies the local addresses 579.Nm 580should listen on. 581The following forms may be used: 582.Pp 583.Bl -item -offset indent -compact 584.It 585.Cm ListenAddress 586.Sm off 587.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 588.Sm on 589.It 590.Cm ListenAddress 591.Sm off 592.Ar host No | Ar IPv4_addr No : Ar port 593.Sm on 594.It 595.Cm ListenAddress 596.Sm off 597.Oo 598.Ar host No | Ar IPv6_addr Oc : Ar port 599.Sm on 600.El 601.Pp 602If 603.Ar port 604is not specified, 605.Nm 606will listen on the address and all prior 607.Cm Port 608options specified. The default is to listen on all local 609addresses. Multiple 610.Cm ListenAddress 611options are permitted. Additionally, any 612.Cm Port 613options must precede this option for non port qualified addresses. 614.It Cm LoginGraceTime 615The server disconnects after this time if the user has not 616successfully logged in. 617If the value is 0, there is no time limit. 618The default is 600 (seconds). 619.It Cm LogLevel 620Gives the verbosity level that is used when logging messages from 621.Nm sshd . 622The possible values are: 623QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. 624The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 625and DEBUG3 each specify higher levels of debugging output. 626Logging with a DEBUG level violates the privacy of users 627and is not recommended. 628.It Cm MACs 629Specifies the available MAC (message authentication code) algorithms. 630The MAC algorithm is used in protocol version 2 631for data integrity protection. 632Multiple algorithms must be comma-separated. 633The default is 634.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 . 635.It Cm MaxStartups 636Specifies the maximum number of concurrent unauthenticated connections to the 637.Nm 638daemon. 639Additional connections will be dropped until authentication succeeds or the 640.Cm LoginGraceTime 641expires for a connection. 642The default is 10. 643.Pp 644Alternatively, random early drop can be enabled by specifying 645the three colon separated values 646.Dq start:rate:full 647(e.g., "10:30:60"). 648.Nm 649will refuse connection attempts with a probability of 650.Dq rate/100 651(30%) 652if there are currently 653.Dq start 654(10) 655unauthenticated connections. 656The probability increases linearly and all connection attempts 657are refused if the number of unauthenticated connections reaches 658.Dq full 659(60). 660.It Cm PasswordAuthentication 661Specifies whether password authentication is allowed. 662The default is 663.Dq yes . 664.It Cm PermitEmptyPasswords 665When password authentication is allowed, it specifies whether the 666server allows login to accounts with empty password strings. 667The default is 668.Dq no . 669.It Cm PermitRootLogin 670Specifies whether root can login using 671.Xr ssh 1 . 672The argument must be 673.Dq yes , 674.Dq without-password , 675.Dq forced-commands-only 676or 677.Dq no . 678The default is 679.Dq yes . 680.Pp 681If this option is set to 682.Dq without-password 683password authentication is disabled for root. 684.Pp 685If this option is set to 686.Dq forced-commands-only 687root login with public key authentication will be allowed, 688but only if the 689.Ar command 690option has been specified 691(which may be useful for taking remote backups even if root login is 692normally not allowed). All other authentication methods are disabled 693for root. 694.Pp 695If this option is set to 696.Dq no 697root is not allowed to login. 698.It Cm PidFile 699Specifies the file that contains the process identifier of the 700.Nm 701daemon. 702The default is 703.Pa /var/run/sshd.pid . 704.It Cm Port 705Specifies the port number that 706.Nm 707listens on. 708The default is 22. 709Multiple options of this type are permitted. 710See also 711.Cm ListenAddress . 712.It Cm PrintLastLog 713Specifies whether 714.Nm 715should print the date and time when the user last logged in. 716The default is 717.Dq yes . 718.It Cm PrintMotd 719Specifies whether 720.Nm 721should print 722.Pa /etc/motd 723when a user logs in interactively. 724(On some systems it is also printed by the shell, 725.Pa /etc/profile , 726or equivalent.) 727The default is 728.Dq yes . 729.It Cm Protocol 730Specifies the protocol versions 731.Nm 732should support. 733The possible values are 734.Dq 1 735and 736.Dq 2 . 737Multiple versions must be comma-separated. 738The default is 739.Dq 2,1 . 740.It Cm PubkeyAuthentication 741Specifies whether public key authentication is allowed. 742The default is 743.Dq yes . 744Note that this option applies to protocol version 2 only. 745.It Cm ReverseMappingCheck 746Specifies whether 747.Nm 748should try to verify the remote host name and check that 749the resolved host name for the remote IP address maps back to the 750very same IP address. 751The default is 752.Dq no . 753.It Cm RhostsAuthentication 754Specifies whether authentication using rhosts or /etc/hosts.equiv 755files is sufficient. 756Normally, this method should not be permitted because it is insecure. 757.Cm RhostsRSAAuthentication 758should be used 759instead, because it performs RSA-based host authentication in addition 760to normal rhosts or /etc/hosts.equiv authentication. 761The default is 762.Dq no . 763This option applies to protocol version 1 only. 764.It Cm RhostsRSAAuthentication 765Specifies whether rhosts or /etc/hosts.equiv authentication together 766with successful RSA host authentication is allowed. 767The default is 768.Dq no . 769This option applies to protocol version 1 only. 770.It Cm RSAAuthentication 771Specifies whether pure RSA authentication is allowed. 772The default is 773.Dq yes . 774This option applies to protocol version 1 only. 775.It Cm ServerKeyBits 776Defines the number of bits in the ephemeral protocol version 1 server key. 777The minimum value is 512, and the default is 768. 778.It Cm StrictModes 779Specifies whether 780.Nm 781should check file modes and ownership of the 782user's files and home directory before accepting login. 783This is normally desirable because novices sometimes accidentally leave their 784directory or files world-writable. 785The default is 786.Dq yes . 787.It Cm Subsystem 788Configures an external subsystem (e.g., file transfer daemon). 789Arguments should be a subsystem name and a command to execute upon subsystem 790request. 791The command 792.Xr sftp-server 8 793implements the 794.Dq sftp 795file transfer subsystem. 796By default no subsystems are defined. 797Note that this option applies to protocol version 2 only. 798.It Cm SyslogFacility 799Gives the facility code that is used when logging messages from 800.Nm sshd . 801The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 802LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 803The default is AUTH. 804.It Cm UseLogin 805Specifies whether 806.Xr login 1 807is used for interactive login sessions. 808The default is 809.Dq no . 810Note that 811.Xr login 1 812is never used for remote command execution. 813Note also, that if this is enabled, 814.Cm X11Forwarding 815will be disabled because 816.Xr login 1 817does not know how to handle 818.Xr xauth 1 819cookies. 820.It Cm X11DisplayOffset 821Specifies the first display number available for 822.Nm sshd Ns 's 823X11 forwarding. 824This prevents 825.Nm 826from interfering with real X11 servers. 827The default is 10. 828.It Cm X11Forwarding 829Specifies whether X11 forwarding is permitted. 830The default is 831.Dq no . 832Note that disabling X11 forwarding does not improve security in any 833way, as users can always install their own forwarders. 834X11 forwarding is automatically disabled if 835.Cm UseLogin 836is enabled. 837.It Cm XAuthLocation 838Specifies the location of the 839.Xr xauth 1 840program. 841The default is 842.Pa /usr/X11R6/bin/xauth . 843.El 844.Ss Time Formats 845.Pp 846.Nm 847command-line arguments and configuration file options that specify time 848may be expressed using a sequence of the form: 849.Sm off 850.Ar time Oo Ar qualifier Oc , 851.Sm on 852where 853.Ar time 854is a positive integer value and 855.Ar qualifier 856is one of the following: 857.Pp 858.Bl -tag -width Ds -compact -offset indent 859.It Cm <none> 860seconds 861.It Cm s | Cm S 862seconds 863.It Cm m | Cm M 864minutes 865.It Cm h | Cm H 866hours 867.It Cm d | Cm D 868days 869.It Cm w | Cm W 870weeks 871.El 872.Pp 873Each member of the sequence is added together to calculate 874the total time value. 875.Pp 876Time format examples: 877.Pp 878.Bl -tag -width Ds -compact -offset indent 879.It 600 880600 seconds (10 minutes) 881.It 10m 88210 minutes 883.It 1h30m 8841 hour 30 minutes (90 minutes) 885.El 886.Sh LOGIN PROCESS 887When a user successfully logs in, 888.Nm 889does the following: 890.Bl -enum -offset indent 891.It 892If the login is on a tty, and no command has been specified, 893prints last login time and 894.Pa /etc/motd 895(unless prevented in the configuration file or by 896.Pa $HOME/.hushlogin ; 897see the 898.Sx FILES 899section). 900.It 901If the login is on a tty, records login time. 902.It 903Checks 904.Pa /etc/nologin ; 905if it exists, prints contents and quits 906(unless root). 907.It 908Changes to run with normal user privileges. 909.It 910Sets up basic environment. 911.It 912Reads 913.Pa $HOME/.ssh/environment 914if it exists. 915.It 916Changes to user's home directory. 917.It 918If 919.Pa $HOME/.ssh/rc 920exists, runs it; else if 921.Pa /etc/sshrc 922exists, runs 923it; otherwise runs xauth. 924The 925.Dq rc 926files are given the X11 927authentication protocol and cookie in standard input. 928.It 929Runs user's shell or command. 930.El 931.Sh AUTHORIZED_KEYS FILE FORMAT 932.Pa $HOME/.ssh/authorized_keys 933is the default file that lists the public keys that are 934permitted for RSA authentication in protocol version 1 935and for public key authentication (PubkeyAuthentication) 936in protocol version 2. 937.Cm AuthorizedKeysFile 938may be used to specify an alternative file. 939.Pp 940Each line of the file contains one 941key (empty lines and lines starting with a 942.Ql # 943are ignored as 944comments). 945Each RSA public key consists of the following fields, separated by 946spaces: options, bits, exponent, modulus, comment. 947Each protocol version 2 public key consists of: 948options, keytype, base64 encoded key, comment. 949The options fields 950are optional; its presence is determined by whether the line starts 951with a number or not (the option field never starts with a number). 952The bits, exponent, modulus and comment fields give the RSA key for 953protocol version 1; the 954comment field is not used for anything (but may be convenient for the 955user to identify the key). 956For protocol version 2 the keytype is 957.Dq ssh-dss 958or 959.Dq ssh-rsa . 960.Pp 961Note that lines in this file are usually several hundred bytes long 962(because of the size of the RSA key modulus). 963You don't want to type them in; instead, copy the 964.Pa identity.pub , 965.Pa id_dsa.pub 966or the 967.Pa id_rsa.pub 968file and edit it. 969.Pp 970The options (if present) consist of comma-separated option 971specifications. 972No spaces are permitted, except within double quotes. 973The following option specifications are supported (note 974that option keywords are case-insensitive): 975.Bl -tag -width Ds 976.It Cm from="pattern-list" 977Specifies that in addition to RSA authentication, the canonical name 978of the remote host must be present in the comma-separated list of 979patterns 980.Pf ( Ql * 981and 982.Ql ? 983serve as wildcards). 984The list may also contain 985patterns negated by prefixing them with 986.Ql ! ; 987if the canonical host name matches a negated pattern, the key is not accepted. 988The purpose 989of this option is to optionally increase security: RSA authentication 990by itself does not trust the network or name servers or anything (but 991the key); however, if somebody somehow steals the key, the key 992permits an intruder to log in from anywhere in the world. 993This additional option makes using a stolen key more difficult (name 994servers and/or routers would have to be compromised in addition to 995just the key). 996.It Cm command="command" 997Specifies that the command is executed whenever this key is used for 998authentication. 999The command supplied by the user (if any) is ignored. 1000The command is run on a pty if the client requests a pty; 1001otherwise it is run without a tty. 1002If a 8-bit clean channel is required, 1003one must not request a pty or should specify 1004.Cm no-pty . 1005A quote may be included in the command by quoting it with a backslash. 1006This option might be useful 1007to restrict certain RSA keys to perform just a specific operation. 1008An example might be a key that permits remote backups but nothing else. 1009Note that the client may specify TCP/IP and/or X11 1010forwarding unless they are explicitly prohibited. 1011Note that this option applies to shell, command or subsystem execution. 1012.It Cm environment="NAME=value" 1013Specifies that the string is to be added to the environment when 1014logging in using this key. 1015Environment variables set this way 1016override other default environment values. 1017Multiple options of this type are permitted. 1018This option is automatically disabled if 1019.Cm UseLogin 1020is enabled. 1021.It Cm no-port-forwarding 1022Forbids TCP/IP forwarding when this key is used for authentication. 1023Any port forward requests by the client will return an error. 1024This might be used, e.g., in connection with the 1025.Cm command 1026option. 1027.It Cm no-X11-forwarding 1028Forbids X11 forwarding when this key is used for authentication. 1029Any X11 forward requests by the client will return an error. 1030.It Cm no-agent-forwarding 1031Forbids authentication agent forwarding when this key is used for 1032authentication. 1033.It Cm no-pty 1034Prevents tty allocation (a request to allocate a pty will fail). 1035.It Cm permitopen="host:port" 1036Limit local 1037.Li ``ssh -L'' 1038port forwarding such that it may only connect to the specified host and 1039port. 1040IPv6 addresses can be specified with an alternative syntax: 1041.Ar host/port . 1042Multiple 1043.Cm permitopen 1044options may be applied separated by commas. No pattern matching is 1045performed on the specified hostnames, they must be literal domains or 1046addresses. 1047.El 1048.Ss Examples 10491024 33 12121.\|.\|.\|312314325 ylo@foo.bar 1050.Pp 1051from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula 1052.Pp 1053command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi 1054.Pp 1055permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323 1056.Sh SSH_KNOWN_HOSTS FILE FORMAT 1057The 1058.Pa /etc/ssh_known_hosts , 1059and 1060.Pa $HOME/.ssh/known_hosts 1061files contain host public keys for all known hosts. 1062The global file should 1063be prepared by the administrator (optional), and the per-user file is 1064maintained automatically: whenever the user connects from an unknown host 1065its key is added to the per-user file. 1066.Pp 1067Each line in these files contains the following fields: hostnames, 1068bits, exponent, modulus, comment. 1069The fields are separated by spaces. 1070.Pp 1071Hostnames is a comma-separated list of patterns ('*' and '?' act as 1072wildcards); each pattern in turn is matched against the canonical host 1073name (when authenticating a client) or against the user-supplied 1074name (when authenticating a server). 1075A pattern may also be preceded by 1076.Ql ! 1077to indicate negation: if the host name matches a negated 1078pattern, it is not accepted (by that line) even if it matched another 1079pattern on the line. 1080.Pp 1081Bits, exponent, and modulus are taken directly from the RSA host key; they 1082can be obtained, e.g., from 1083.Pa /etc/ssh_host_key.pub . 1084The optional comment field continues to the end of the line, and is not used. 1085.Pp 1086Lines starting with 1087.Ql # 1088and empty lines are ignored as comments. 1089.Pp 1090When performing host authentication, authentication is accepted if any 1091matching line has the proper key. 1092It is thus permissible (but not 1093recommended) to have several lines or different host keys for the same 1094names. 1095This will inevitably happen when short forms of host names 1096from different domains are put in the file. 1097It is possible 1098that the files contain conflicting information; authentication is 1099accepted if valid information can be found from either file. 1100.Pp 1101Note that the lines in these files are typically hundreds of characters 1102long, and you definitely don't want to type in the host keys by hand. 1103Rather, generate them by a script 1104or by taking 1105.Pa /etc/ssh_host_key.pub 1106and adding the host names at the front. 1107.Ss Examples 1108.Bd -literal 1109closenet,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi 1110cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....= 1111.Ed 1112.Sh FILES 1113.Bl -tag -width Ds 1114.It Pa /etc/sshd_config 1115Contains configuration data for 1116.Nm sshd . 1117This file should be writable by root only, but it is recommended 1118(though not necessary) that it be world-readable. 1119.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key 1120These three files contain the private parts of the host keys. 1121These files should only be owned by root, readable only by root, and not 1122accessible to others. 1123Note that 1124.Nm 1125does not start if this file is group/world-accessible. 1126.It Pa /etc/ssh_host_key.pub, /etc/ssh_host_dsa_key.pub, /etc/ssh_host_rsa_key.pub 1127These three files contain the public parts of the host keys. 1128These files should be world-readable but writable only by 1129root. 1130Their contents should match the respective private parts. 1131These files are not 1132really used for anything; they are provided for the convenience of 1133the user so their contents can be copied to known hosts files. 1134These files are created using 1135.Xr ssh-keygen 1 . 1136.It Pa /etc/moduli 1137Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange". 1138.It Pa /var/run/sshd.pid 1139Contains the process ID of the 1140.Nm 1141listening for connections (if there are several daemons running 1142concurrently for different ports, this contains the pid of the one 1143started last). 1144The content of this file is not sensitive; it can be world-readable. 1145.It Pa $HOME/.ssh/authorized_keys 1146Lists the public keys (RSA or DSA) that can be used to log into the user's account. 1147This file must be readable by root (which may on some machines imply 1148it being world-readable if the user's home directory resides on an NFS 1149volume). 1150It is recommended that it not be accessible by others. 1151The format of this file is described above. 1152Users will place the contents of their 1153.Pa identity.pub , 1154.Pa id_dsa.pub 1155and/or 1156.Pa id_rsa.pub 1157files into this file, as described in 1158.Xr ssh-keygen 1 . 1159.It Pa "/etc/ssh_known_hosts" and "$HOME/.ssh/known_hosts" 1160These files are consulted when using rhosts with RSA host 1161authentication or protocol version 2 hostbased authentication 1162to check the public key of the host. 1163The key must be listed in one of these files to be accepted. 1164The client uses the same files 1165to verify that it is connecting to the correct remote host. 1166These files should be writable only by root/the owner. 1167.Pa /etc/ssh_known_hosts 1168should be world-readable, and 1169.Pa $HOME/.ssh/known_hosts 1170can but need not be world-readable. 1171.It Pa /etc/nologin 1172If this file exists, 1173.Nm 1174refuses to let anyone except root log in. 1175The contents of the file 1176are displayed to anyone trying to log in, and non-root connections are 1177refused. 1178The file should be world-readable. 1179.It Pa /etc/hosts.allow, /etc/hosts.deny 1180Access controls that should be enforced by tcp-wrappers are defined here. 1181Further details are described in 1182.Xr hosts_access 5 . 1183.It Pa $HOME/.rhosts 1184This file contains host-username pairs, separated by a space, one per 1185line. 1186The given user on the corresponding host is permitted to log in 1187without password. 1188The same file is used by rlogind and rshd. 1189The file must 1190be writable only by the user; it is recommended that it not be 1191accessible by others. 1192.Pp 1193If is also possible to use netgroups in the file. 1194Either host or user 1195name may be of the form +@groupname to specify all hosts or all users 1196in the group. 1197.It Pa $HOME/.shosts 1198For ssh, 1199this file is exactly the same as for 1200.Pa .rhosts . 1201However, this file is 1202not used by rlogin and rshd, so using this permits access using SSH only. 1203.It Pa /etc/hosts.equiv 1204This file is used during 1205.Pa .rhosts 1206authentication. 1207In the simplest form, this file contains host names, one per line. 1208Users on 1209those hosts are permitted to log in without a password, provided they 1210have the same user name on both machines. 1211The host name may also be 1212followed by a user name; such users are permitted to log in as 1213.Em any 1214user on this machine (except root). 1215Additionally, the syntax 1216.Dq +@group 1217can be used to specify netgroups. 1218Negated entries start with 1219.Ql \&- . 1220.Pp 1221If the client host/user is successfully matched in this file, login is 1222automatically permitted provided the client and server user names are the 1223same. 1224Additionally, successful RSA host authentication is normally required. 1225This file must be writable only by root; it is recommended 1226that it be world-readable. 1227.Pp 1228.Sy "Warning: It is almost never a good idea to use user names in" 1229.Pa hosts.equiv . 1230Beware that it really means that the named user(s) can log in as 1231.Em anybody , 1232which includes bin, daemon, adm, and other accounts that own critical 1233binaries and directories. 1234Using a user name practically grants the user root access. 1235The only valid use for user names that I can think 1236of is in negative entries. 1237.Pp 1238Note that this warning also applies to rsh/rlogin. 1239.It Pa /etc/shosts.equiv 1240This is processed exactly as 1241.Pa /etc/hosts.equiv . 1242However, this file may be useful in environments that want to run both 1243rsh/rlogin and ssh. 1244.It Pa $HOME/.ssh/environment 1245This file is read into the environment at login (if it exists). 1246It can only contain empty lines, comment lines (that start with 1247.Ql # ) , 1248and assignment lines of the form name=value. 1249The file should be writable 1250only by the user; it need not be readable by anyone else. 1251.It Pa $HOME/.ssh/rc 1252If this file exists, it is run with /bin/sh after reading the 1253environment files but before starting the user's shell or command. 1254If X11 spoofing is in use, this will receive the "proto cookie" pair in 1255standard input (and 1256.Ev DISPLAY 1257in environment). 1258This must call 1259.Xr xauth 1 1260in that case. 1261.Pp 1262The primary purpose of this file is to run any initialization routines 1263which may be needed before the user's home directory becomes 1264accessible; AFS is a particular example of such an environment. 1265.Pp 1266This file will probably contain some initialization code followed by 1267something similar to: 1268.Bd -literal 1269 if read proto cookie; then 1270 echo add $DISPLAY $proto $cookie | xauth -q - 1271 fi 1272.Ed 1273.Pp 1274If this file does not exist, 1275.Pa /etc/sshrc 1276is run, and if that 1277does not exist either, xauth is used to store the cookie. 1278.Pp 1279This file should be writable only by the user, and need not be 1280readable by anyone else. 1281.It Pa /etc/sshrc 1282Like 1283.Pa $HOME/.ssh/rc . 1284This can be used to specify 1285machine-specific login-time initializations globally. 1286This file should be writable only by root, and should be world-readable. 1287.El 1288.Sh AUTHORS 1289OpenSSH is a derivative of the original and free 1290ssh 1.2.12 release by Tatu Ylonen. 1291Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 1292Theo de Raadt and Dug Song 1293removed many bugs, re-added newer features and 1294created OpenSSH. 1295Markus Friedl contributed the support for SSH 1296protocol versions 1.5 and 2.0. 1297.Sh SEE ALSO 1298.Xr scp 1 , 1299.Xr sftp 1 , 1300.Xr ssh 1 , 1301.Xr ssh-add 1 , 1302.Xr ssh-agent 1 , 1303.Xr ssh-keygen 1 , 1304.Xr login.conf 5 , 1305.Xr moduli 5 , 1306.Xr sftp-server 8 1307.Rs 1308.%A T. Ylonen 1309.%A T. Kivinen 1310.%A M. Saarinen 1311.%A T. Rinne 1312.%A S. Lehtinen 1313.%T "SSH Protocol Architecture" 1314.%N draft-ietf-secsh-architecture-09.txt 1315.%D July 2001 1316.%O work in progress material 1317.Re 1318.Rs 1319.%A M. Friedl 1320.%A N. Provos 1321.%A W. A. Simpson 1322.%T "Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol" 1323.%N draft-ietf-secsh-dh-group-exchange-01.txt 1324.%D April 2001 1325.%O work in progress material 1326.Re 1327