Forwarding of arbitrary TCP/IP connections over the secure channel can

Forwarding of arbitrary TCP/IP connections over the secure channel can

be specified either on command line or in a configuration file.  One

be specified either on command line or in a configuration file.  One

possible application of TCP/IP forwarding is a secure connection to an

possible application of TCP/IP forwarding is a secure connection to an

.Pp

.Pp

.Nm

.Nm

automatically maintains and checks a database containing RSA-based

automatically maintains and checks a database containing RSA-based

.Sh OPTIONS

.Sh OPTIONS

.Bl -tag -width Ds

.Bl -tag -width Ds

.It Fl a

.It Fl a

also be specified on a per-host basis in the configuration file.

also be specified on a per-host basis in the configuration file.

.It Fl c Ar blowfish|3des

.It Fl c Ar blowfish|3des

Selects the cipher to use for encrypting the session. 

Selects the cipher to use for encrypting the session. 

options (and multiple identities specified in

options (and multiple identities specified in

configuration files).

configuration files).

.It Fl k

.It Fl k

also be specified on a per-host basis in the configuration file.

also be specified on a per-host basis in the configuration file.

.It Fl l Ar login_name

.It Fl l Ar login_name

Specifies the user to log in as on the remote machine.  This may also

Specifies the user to log in as on the remote machine.  This may also

argument given on the command line (i.e., the name is not converted to

argument given on the command line (i.e., the name is not converted to

a canonicalized host name before matching).

a canonicalized host name before matching).

.It Cm AFSTokenPassing

.It Cm AFSTokenPassing

this keyword must be

this keyword must be

.Dq yes

.Dq yes

or

or

.Dq yes ,

.Dq yes ,

ssh will additionally check the host ip address in the

ssh will additionally check the host ip address in the

.Pa known_hosts

.Pa known_hosts

If the option is set to

If the option is set to

.Dq no ,

.Dq no ,

the check will not be executed.

the check will not be executed.

.Dq no

.Dq no

in both the server and the client configuration files.

in both the server and the client configuration files.

.It Cm KerberosAuthentication

.It Cm KerberosAuthentication

this keyword must be

this keyword must be

.Dq yes

.Dq yes

or

or

.Dq no .

.Dq no .

.It Cm KerberosTgtPassing

.It Cm KerberosTgtPassing

argument to this keyword must be

argument to this keyword must be

.Dq yes

.Dq yes

or

or

QUIET, FATAL, ERROR, INFO, CHAT and DEBUG.

QUIET, FATAL, ERROR, INFO, CHAT and DEBUG.

The default is INFO.

The default is INFO.

.It Cm NumberOfPasswordPrompts

.It Cm NumberOfPasswordPrompts

.It Cm PasswordAuthentication

.It Cm PasswordAuthentication

Specifies whether to use password authentication.  The argument to

Specifies whether to use password authentication.  The argument to

this keyword must be

this keyword must be

22.

22.

.It Cm ProxyCommand

.It Cm ProxyCommand

Specifies the command to use to connect to the server.  The command

Specifies the command to use to connect to the server.  The command

and should read from its stdin and write to its stdout.  It should

and should read from its stdin and write to its stdout.  It should

eventually connect an

eventually connect an

.Xr sshd 8

.Xr sshd 8

to point to a value of the form

to point to a value of the form

.Dq hostname:n

.Dq hostname:n

where hostname indicates

where hostname indicates

this special value to forward X11 connections over the secure

this special value to forward X11 connections over the secure

channel.  The user should normally not set DISPLAY explicitly, as that

channel.  The user should normally not set DISPLAY explicitly, as that

will render the X11 connection insecure (and will require the user to

will render the X11 connection insecure (and will require the user to

.Xr rsh 1 .

.Xr rsh 1 .

.It Pa /etc/hosts.equiv

.It Pa /etc/hosts.equiv

This file is used during

This file is used during

canonical hosts names, one per line (the full format is described on

canonical hosts names, one per line (the full format is described on

the

the

.Xr sshd 8

.Xr sshd 8

.Sh CONFIGURATION FILE

.Sh CONFIGURATION FILE

.Nm

.Nm

reads configuration data from 

reads configuration data from 

(or the file specified with

(or the file specified with

.Fl f

.Fl f

on the command line).  The file

on the command line).  The file

The following keywords are possible.

The following keywords are possible.

.Bl -tag -width Ds

.Bl -tag -width Ds

.It Cm AFSTokenPassing

.It Cm AFSTokenPassing

.Dq yes .

.Dq yes .

.It Cm AllowGroups

.It Cm AllowGroups

This keyword can be followed by a number of group names, separated

This keyword can be followed by a number of group names, separated

.Dq no

.Dq no

in both the server and the client configuration files.

in both the server and the client configuration files.

.It Cm KerberosAuthentication

.It Cm KerberosAuthentication

be in the form of a Kerberos ticket, or if

be in the form of a Kerberos ticket, or if

.Cm PasswordAuthentication

.Cm PasswordAuthentication

is yes, the password provided by the user will be validated through

is yes, the password provided by the user will be validated through

.Dq yes .

.Dq yes .

.It Cm KerberosOrLocalPasswd

.It Cm KerberosOrLocalPasswd

If set then if password authentication through Kerberos fails then

If set then if password authentication through Kerberos fails then

the password will be validated via any additional local mechanism

the password will be validated via any additional local mechanism

such as

such as

.Pa /etc/passwd

.Pa /etc/passwd

.Dq yes .

.Dq yes .

.It Cm KerberosTgtPassing

.It Cm KerberosTgtPassing

Specifies whether a Kerberos TGT may be forwarded to the server.

Specifies whether a Kerberos TGT may be forwarded to the server.

as this only works when the Kerberos KDC is actually an AFS kaserver.

as this only works when the Kerberos KDC is actually an AFS kaserver.

.It Cm KerberosTicketCleanup

.It Cm KerberosTicketCleanup

Specifies whether to automatically destroy the user's ticket cache

Specifies whether to automatically destroy the user's ticket cache

.Dq yes .

.Dq yes .

.It Cm KeyRegenerationInterval

.It Cm KeyRegenerationInterval

The server key is automatically regenerated after this many seconds

The server key is automatically regenerated after this many seconds

or equivalent.)  The default is

or equivalent.)  The default is

.Dq yes .

.Dq yes .

.It Cm RandomSeed

.It Cm RandomSeed

.It Cm RhostsAuthentication

.It Cm RhostsAuthentication

files is sufficient.  Normally, this method should not be permitted

files is sufficient.  Normally, this method should not be permitted

because it is insecure. 

because it is insecure. 

.Cm RhostsRSAAuthentication

.Cm RhostsRSAAuthentication

should be used

should be used

instead, because it performs RSA-based host authentication in addition

instead, because it performs RSA-based host authentication in addition

The default is

The default is

.Dq no .

.Dq no .

.It Cm RhostsRSAAuthentication

.It Cm RhostsRSAAuthentication

with successful RSA host authentication is allowed.  The default is

with successful RSA host authentication is allowed.  The default is

.Dq no .

.Dq no .

.It Cm RSAAuthentication

.It Cm RSAAuthentication

.Xr skey 1 

.Xr skey 1 

authentication is allowed.  The default is

authentication is allowed.  The default is

.Dq yes .

.Dq yes .

.Cm PasswordAuthentication

.Cm PasswordAuthentication

is allowed, too.

is allowed, too.

.It Cm StrictModes

.It Cm StrictModes

.It Cm UseLogin

.It Cm UseLogin

Specifies whether

Specifies whether

.Xr login 1

.Xr login 1

.Dq no .

.Dq no .

.It Cm X11DisplayOffset

.It Cm X11DisplayOffset

Specifies the first display number available for

Specifies the first display number available for

exists, runs it; else if

exists, runs it; else if

.Pa /etc/ssh/sshrc

.Pa /etc/ssh/sshrc

exists, runs

exists, runs

.Dq rc

.Dq rc

files are given the X11

files are given the X11

.It

.It

Runs user's shell or command.

Runs user's shell or command.

.El

.El

Prevents tty allocation (a request to allocate a pty will fail).

Prevents tty allocation (a request to allocate a pty will fail).

.El

.El

.Ss Examples

.Ss Examples

.Sh SSH_KNOWN_HOSTS FILE FORMAT

.Sh SSH_KNOWN_HOSTS FILE FORMAT

The 

The 

.Pa /etc/ssh/ssh_known_hosts

.Pa /etc/ssh/ssh_known_hosts

.Pa /etc/ssh/ssh_host_key.pub

.Pa /etc/ssh/ssh_host_key.pub

and adding the host names at the front.

and adding the host names at the front.

.Ss Examples

.Ss Examples

.Sh FILES

.Sh FILES

.Bl -tag -width Ds

.Bl -tag -width Ds

.It Pa /etc/ssh/sshd_config

.It Pa /etc/ssh/sshd_config

listed in one of these files to be accepted.

listed in one of these files to be accepted.

The client uses the same files

The client uses the same files

to verify that the remote host is the one we intended to

to verify that the remote host is the one we intended to

.Pa /etc/ssh/ssh_known_hosts

.Pa /etc/ssh/ssh_known_hosts

should be world-readable, and

should be world-readable, and

.Pa $HOME/.ssh/known_hosts

.Pa $HOME/.ssh/known_hosts

refuses to let anyone except root log in.  The contents of the file

refuses to let anyone except root log in.  The contents of the file

are displayed to anyone trying to log in, and non-root connections are

are displayed to anyone trying to log in, and non-root connections are

refused.  The file should be world-readable.

refused.  The file should be world-readable.

If compiled with

If compiled with

.Sy LIBWRAP

.Sy LIBWRAP

support, tcp-wrappers access controls may be defined here as described in

support, tcp-wrappers access controls may be defined here as described in

.Pa .rhosts .

.Pa .rhosts .

However, this file is

However, this file is

not used by rlogin and rshd, so using this permits access using SSH only.

not used by rlogin and rshd, so using this permits access using SSH only.

This file is used during

This file is used during

.Pa .rhosts

.Pa .rhosts

authentication.  In the

authentication.  In the

and assignment lines of the form name=value.  The file should be writable

and assignment lines of the form name=value.  The file should be writable

only by the user; it need not be readable by anyone else.

only by the user; it need not be readable by anyone else.

.It Pa $HOME/.ssh/rc

.It Pa $HOME/.ssh/rc

environment files but before starting the user's shell or command.  If

environment files but before starting the user's shell or command.  If

X11 spoofing is in use, this will receive the "proto cookie" pair in

X11 spoofing is in use, this will receive the "proto cookie" pair in

standard input (and

standard input (and

accessible; AFS is a particular example of such an environment.

accessible; AFS is a particular example of such an environment.

.Pp

.Pp

This file will probably contain some initialization code followed by

This file will probably contain some initialization code followed by

.Pp

.Pp

If this file does not exist,

If this file does not exist,

.Pa /etc/ssh/sshrc

.Pa /etc/ssh/sshrc

is run, and if that

is run, and if that

.Pp

.Pp

This file should be writable only by the user, and need not be

This file should be writable only by the user, and need not be

readable by anyone else.

readable by anyone else.