RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2025-01-03 00:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

- (djm) OpenBSD CVS Sync

Browse Source 
- deraadt@cvs.openbsd.org 2002/02/09 17:37:34
     [pathnames.h session.c ssh.1 sshd.8 sshd_config ssh-keyscan.1]
     move ssh config files to /etc/ssh
 - (djm) Adjust portable Makefile.in tnd ssh-rand-helper.c o match
This commit is contained in:
Damien Miller 2002-02-10 18:32:28 +11:00
parent 4860650842
commit 05eda437a6
9 changed files with 79 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,10 @@
20020210
- (djm) OpenBSD CVS Sync
- deraadt@cvs.openbsd.org 2002/02/09 17:37:34
[pathnames.h session.c ssh.1 sshd.8 sshd_config ssh-keyscan.1]
move ssh config files to /etc/ssh
- (djm) Adjust portable Makefile.in tnd ssh-rand-helper.c o match
20020208 20020208
- (djm) OpenBSD CVS Sync - (djm) OpenBSD CVS Sync
- markus@cvs.openbsd.org 2002/02/04 12:15:25 - markus@cvs.openbsd.org 2002/02/04 12:15:25
@ -7534,4 +7541,4 @@
- Wrote replacements for strlcpy and mkdtemp - Wrote replacements for strlcpy and mkdtemp
- Released 1.0pre1 - Released 1.0pre1
$Id: ChangeLog,v 1.1836 2002/02/08 11:07:33 djm Exp $ $Id: ChangeLog,v 1.1837 2002/02/10 07:32:28 djm Exp $

20
Makefile.in
View File

@ -1,4 +1,4 @@
# $Id: Makefile.in,v 1.194 2002/01/23 23:26:44 stevesk Exp $ # $Id: Makefile.in,v 1.195 2002/02/10 07:32:29 djm Exp $
prefix=@prefix@ prefix=@prefix@
exec_prefix=@exec_prefix@ exec_prefix=@exec_prefix@
@ -19,7 +19,7 @@ SSH_PROGRAM=@bindir@/ssh
ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
SFTP_SERVER=$(libexecdir)/sftp-server SFTP_SERVER=$(libexecdir)/sftp-server
PATHS= -DETCDIR=\"$(sysconfdir)\" \ PATHS= -DSSHDIR=\"$(sysconfdir)\" \
-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \ -D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
-D_PATH_SSH_ASKPASS_DEFAULT=\"$(ASKPASS_PROGRAM)\" \ -D_PATH_SSH_ASKPASS_DEFAULT=\"$(ASKPASS_PROGRAM)\" \
-D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \ -D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \
@ -62,17 +62,17 @@ CONFIGFILES=sshd_config.out ssh_config.out moduli.out
CONFIGFILES_IN=sshd_config ssh_config moduli CONFIGFILES_IN=sshd_config ssh_config moduli
PATHSUBS = \ PATHSUBS = \
-D/etc/ssh_config=$(sysconfdir)/ssh_config \ -D/etc/ssh/ssh_config=$(sysconfdir)/ssh_config \
-D/etc/ssh_known_hosts=$(sysconfdir)/ssh_known_hosts \ -D/etc/ssh/ssh_known_hosts=$(sysconfdir)/ssh_known_hosts \
-D/etc/sshd_config=$(sysconfdir)/sshd_config \ -D/etc/ssh/sshd_config=$(sysconfdir)/sshd_config \
-D/usr/libexec=$(libexecdir) \ -D/usr/libexec=$(libexecdir) \
-D/etc/shosts.equiv=$(sysconfdir)/shosts.equiv \ -D/etc/shosts.equiv=$(sysconfdir)/shosts.equiv \
-D/etc/ssh_host_key=$(sysconfdir)/ssh_host_key \ -D/etc/ssh/ssh_host_key=$(sysconfdir)/ssh_host_key \
-D/etc/ssh_host_dsa_key=$(sysconfdir)/ssh_host_dsa_key \ -D/etc/ssh/ssh_host_dsa_key=$(sysconfdir)/ssh_host_dsa_key \
-D/etc/ssh_host_rsa_key=$(sysconfdir)/ssh_host_rsa_key \ -D/etc/ssh/ssh_host_rsa_key=$(sysconfdir)/ssh_host_rsa_key \
-D/var/run/sshd.pid=$(piddir)/sshd.pid \ -D/var/run/sshd.pid=$(piddir)/sshd.pid \
-D/etc/moduli=$(sysconfdir)/moduli \ -D/etc/ssh/moduli=$(sysconfdir)/moduli \
-D/etc/sshrc=$(sysconfdir)/sshrc \ -D/etc/ssh/sshrc=$(sysconfdir)/sshrc \
-D/usr/X11R6/bin/xauth=$(XAUTH_PATH) \ -D/usr/X11R6/bin/xauth=$(XAUTH_PATH) \
-D/usr/bin:/bin:/usr/sbin:/sbin=@user_path@ -D/usr/bin:/bin:/usr/sbin:/sbin=@user_path@

28
pathnames.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: pathnames.h,v 1.10 2001/12/08 17:49:28 stevesk Exp $ */ /* $OpenBSD: pathnames.h,v 1.11 2002/02/09 17:37:34 deraadt Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -12,8 +12,10 @@
* called by a name other than "ssh" or "Secure Shell". * called by a name other than "ssh" or "Secure Shell".
*/ */
#ifndef ETCDIR
#define ETCDIR "/etc" #define ETCDIR "/etc"
#ifndef SSHDIR
#define SSHDIR ETCDIR "/ssh"
#endif #endif
#ifndef _PATH_SSH_PIDDIR #ifndef _PATH_SSH_PIDDIR
@ -24,22 +26,22 @@
* System-wide file containing host keys of known hosts. This file should be * System-wide file containing host keys of known hosts. This file should be
* world-readable. * world-readable.
*/ */
#define _PATH_SSH_SYSTEM_HOSTFILE ETCDIR "/ssh_known_hosts" #define _PATH_SSH_SYSTEM_HOSTFILE SSHDIR "/ssh_known_hosts"
/* backward compat for protocol 2 */ /* backward compat for protocol 2 */
#define _PATH_SSH_SYSTEM_HOSTFILE2 ETCDIR "/ssh_known_hosts2" #define _PATH_SSH_SYSTEM_HOSTFILE2 SSHDIR "/ssh_known_hosts2"
/* /*
* Of these, ssh_host_key must be readable only by root, whereas ssh_config * Of these, ssh_host_key must be readable only by root, whereas ssh_config
* should be world-readable. * should be world-readable.
*/ */
#define _PATH_SERVER_CONFIG_FILE ETCDIR "/sshd_config" #define _PATH_SERVER_CONFIG_FILE SSHDIR "/sshd_config"
#define _PATH_HOST_CONFIG_FILE ETCDIR "/ssh_config" #define _PATH_HOST_CONFIG_FILE SSHDIR "/ssh_config"
#define _PATH_HOST_KEY_FILE ETCDIR "/ssh_host_key" #define _PATH_HOST_KEY_FILE SSHDIR "/ssh_host_key"
#define _PATH_HOST_DSA_KEY_FILE ETCDIR "/ssh_host_dsa_key" #define _PATH_HOST_DSA_KEY_FILE SSHDIR "/ssh_host_dsa_key"
#define _PATH_HOST_RSA_KEY_FILE ETCDIR "/ssh_host_rsa_key" #define _PATH_HOST_RSA_KEY_FILE SSHDIR "/ssh_host_rsa_key"
#define _PATH_DH_MODULI ETCDIR "/moduli" #define _PATH_DH_MODULI SSHDIR "/moduli"
/* Backwards compatibility */ /* Backwards compatibility */
#define _PATH_DH_PRIMES ETCDIR "/primes" #define _PATH_DH_PRIMES SSHDIR "/primes"
#ifndef _PATH_SSH_PROGRAM #ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh" #define _PATH_SSH_PROGRAM "/usr/bin/ssh"
@ -102,13 +104,13 @@
* use. xauth will be run if neither of these exists. * use. xauth will be run if neither of these exists.
*/ */
#define _PATH_SSH_USER_RC ".ssh/rc" #define _PATH_SSH_USER_RC ".ssh/rc"
#define _PATH_SSH_SYSTEM_RC ETCDIR "/sshrc" #define _PATH_SSH_SYSTEM_RC SSHDIR "/sshrc"
/* /*
* Ssh-only version of /etc/hosts.equiv. Additionally, the daemon may use * Ssh-only version of /etc/hosts.equiv. Additionally, the daemon may use
* ~/.rhosts and /etc/hosts.equiv if rhosts authentication is enabled. * ~/.rhosts and /etc/hosts.equiv if rhosts authentication is enabled.
*/ */
#define _PATH_SSH_HOSTS_EQUIV ETCDIR "/shosts.equiv" #define _PATH_SSH_HOSTS_EQUIV SSHDIR "/shosts.equiv"
#define _PATH_RHOSTS_EQUIV "/etc/hosts.equiv" #define _PATH_RHOSTS_EQUIV "/etc/hosts.equiv"
/* /*

10
session.c
View File

@ -33,7 +33,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: session.c,v 1.124 2002/02/06 14:37:22 markus Exp $"); RCSID("$OpenBSD: session.c,v 1.125 2002/02/09 17:37:34 deraadt Exp $");
#include "ssh.h" #include "ssh.h"
#include "ssh1.h" #include "ssh1.h"
@ -1324,8 +1324,8 @@ do_child(Session *s, const char *command)
close(i); close(i);
/* /*
* Must take new environment into use so that .ssh/rc, /etc/sshrc and * Must take new environment into use so that .ssh/rc,
* xauth are run in the proper environment. * /etc/ssh/sshrc and xauth are run in the proper environment.
*/ */
environ = env; environ = env;
@ -1352,8 +1352,8 @@ do_child(Session *s, const char *command)
} }
/* /*
* Run $HOME/.ssh/rc, /etc/sshrc, or xauth (whichever is found first * Run $HOME/.ssh/rc, /etc/ssh/sshrc, or xauth (whichever is found
* in this order). * first in this order).
*/ */
if (!options.use_login) { if (!options.use_login) {
/* ignore _PATH_SSH_USER_RC for subsystems */ /* ignore _PATH_SSH_USER_RC for subsystems */

4
ssh-keyscan.1
View File

@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-keyscan.1,v 1.12 2001/09/05 06:23:07 deraadt Exp $ .\" $OpenBSD: ssh-keyscan.1,v 1.13 2002/02/09 17:37:34 deraadt Exp $
.\" .\"
.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
.\" .\"
@ -138,7 +138,7 @@ is either
or or
.Dq ssh-dsa . .Dq ssh-dsa .
.Pp .Pp
.Pa /etc/ssh_known_hosts .Pa /etc/ssh/ssh_known_hosts
.Sh BUGS .Sh BUGS
It generates "Connection closed by remote host" messages on the consoles It generates "Connection closed by remote host" messages on the consoles
of all the machines it scans if the server is older than version 2.9. of all the machines it scans if the server is older than version 2.9.

4
ssh-rand-helper.c
View File

@ -39,7 +39,7 @@
#include "pathnames.h" #include "pathnames.h"
#include "log.h" #include "log.h"
RCSID("$Id: ssh-rand-helper.c,v 1.4 2002/01/22 10:58:28 djm Exp $"); RCSID("$Id: ssh-rand-helper.c,v 1.5 2002/02/10 07:32:30 djm Exp $");
/* Number of bytes we write out */ /* Number of bytes we write out */
#define OUTPUT_SEED_SIZE 48 #define OUTPUT_SEED_SIZE 48
@ -60,7 +60,7 @@ RCSID("$Id: ssh-rand-helper.c,v 1.4 2002/01/22 10:58:28 djm Exp $");
/* Path to PRNG commands list */ /* Path to PRNG commands list */
#ifndef SSH_PRNG_COMMAND_FILE #ifndef SSH_PRNG_COMMAND_FILE
# define SSH_PRNG_COMMAND_FILE ETCDIR "/ssh_prng_cmds" # define SSH_PRNG_COMMAND_FILE SSHDIR "/ssh_prng_cmds"
#endif #endif

26
ssh.1
View File

@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: ssh.1,v 1.146 2002/02/03 22:35:57 stevesk Exp $ .\" $OpenBSD: ssh.1,v 1.147 2002/02/09 17:37:34 deraadt Exp $
.Dd September 25, 1999 .Dd September 25, 1999
.Dt SSH 1 .Dt SSH 1
.Os .Os
@ -126,7 +126,7 @@ or
.Pa /etc/shosts.equiv , .Pa /etc/shosts.equiv ,
and if additionally the server can verify the client's and if additionally the server can verify the client's
host key (see host key (see
.Pa /etc/ssh_known_hosts .Pa /etc/ssh/ssh_known_hosts
and and
.Pa $HOME/.ssh/known_hosts .Pa $HOME/.ssh/known_hosts
in the in the
@ -365,7 +365,7 @@ Host keys are stored in
.Pa $HOME/.ssh/known_hosts .Pa $HOME/.ssh/known_hosts
in the user's home directory. in the user's home directory.
Additionally, the file Additionally, the file
.Pa /etc/ssh_known_hosts .Pa /etc/ssh/ssh_known_hosts
is automatically checked for known hosts. is automatically checked for known hosts.
Any new hosts are automatically added to the user's file. Any new hosts are automatically added to the user's file.
If a host's identification If a host's identification
@ -574,7 +574,7 @@ option below.
Specifies an alternative per-user configuration file. Specifies an alternative per-user configuration file.
If a configuration file is given on the command line, If a configuration file is given on the command line,
the system-wide configuration file the system-wide configuration file
.Pq Pa /etc/ssh_config .Pq Pa /etc/ssh/ssh_config
will be ignored. will be ignored.
The default for the per-user configuration file is The default for the per-user configuration file is
.Pa $HOME/.ssh/config . .Pa $HOME/.ssh/config .
@ -649,7 +649,7 @@ the following order:
command line options, user's configuration file command line options, user's configuration file
.Pq Pa $HOME/.ssh/config , .Pq Pa $HOME/.ssh/config ,
and system-wide configuration file and system-wide configuration file
.Pq Pa /etc/ssh_config . .Pq Pa /etc/ssh/ssh_config .
For each parameter, the first obtained value For each parameter, the first obtained value
will be used. will be used.
The configuration files contain sections bracketed by The configuration files contain sections bracketed by
@ -887,7 +887,7 @@ The default is
.It Cm GlobalKnownHostsFile .It Cm GlobalKnownHostsFile
Specifies a file to use for the global Specifies a file to use for the global
host key database instead of host key database instead of
.Pa /etc/ssh_known_hosts . .Pa /etc/ssh/ssh_known_hosts .
.It Cm HostbasedAuthentication .It Cm HostbasedAuthentication
Specifies whether to try rhosts based authentication with public key Specifies whether to try rhosts based authentication with public key
authentication. authentication.
@ -1145,7 +1145,7 @@ will never automatically add host keys to the
file, and refuses to connect to hosts whose host key has changed. file, and refuses to connect to hosts whose host key has changed.
This provides maximum protection against trojan horse attacks, This provides maximum protection against trojan horse attacks,
however, can be annoying when the however, can be annoying when the
.Pa /etc/ssh_known_hosts .Pa /etc/ssh/ssh_known_hosts
file is poorly maintained, or connections to new hosts are file is poorly maintained, or connections to new hosts are
frequently made. frequently made.
This option forces the user to manually This option forces the user to manually
@ -1313,7 +1313,7 @@ to the environment.
.It Pa $HOME/.ssh/known_hosts .It Pa $HOME/.ssh/known_hosts
Records host keys for all hosts the user has logged into that are not Records host keys for all hosts the user has logged into that are not
in in
.Pa /etc/ssh_known_hosts . .Pa /etc/ssh/ssh_known_hosts .
See See
.Xr sshd 8 . .Xr sshd 8 .
.It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa .It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
@ -1368,7 +1368,7 @@ In the simplest form the format is the same as the .pub
identity files. identity files.
This file is not highly sensitive, but the recommended This file is not highly sensitive, but the recommended
permissions are read/write for the user, and not accessible by others. permissions are read/write for the user, and not accessible by others.
.It Pa /etc/ssh_known_hosts .It Pa /etc/ssh/ssh_known_hosts
Systemwide list of known host keys. Systemwide list of known host keys.
This file should be prepared by the This file should be prepared by the
system administrator to contain the public host keys of all machines in the system administrator to contain the public host keys of all machines in the
@ -1391,13 +1391,13 @@ to verify the client host when logging in; other names are needed because
does not convert the user-supplied name to a canonical name before does not convert the user-supplied name to a canonical name before
checking the key, because someone with access to the name servers checking the key, because someone with access to the name servers
would then be able to fool host authentication. would then be able to fool host authentication.
.It Pa /etc/ssh_config .It Pa /etc/ssh/ssh_config
Systemwide configuration file. Systemwide configuration file.
This file provides defaults for those This file provides defaults for those
values that are not specified in the user's configuration file, and values that are not specified in the user's configuration file, and
for those users who do not have a configuration file. for those users who do not have a configuration file.
This file must be world-readable. This file must be world-readable.
.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key .It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
These three files contain the private parts of the host keys These three files contain the private parts of the host keys
and are used for and are used for
.Cm RhostsRSAAuthentication .Cm RhostsRSAAuthentication
@ -1432,7 +1432,7 @@ Note that by default
will be installed so that it requires successful RSA host will be installed so that it requires successful RSA host
authentication before permitting \s+2.\s0rhosts authentication. authentication before permitting \s+2.\s0rhosts authentication.
If the server machine does not have the client's host key in If the server machine does not have the client's host key in
.Pa /etc/ssh_known_hosts , .Pa /etc/ssh/ssh_known_hosts ,
it can be stored in it can be stored in
.Pa $HOME/.ssh/known_hosts . .Pa $HOME/.ssh/known_hosts .
The easiest way to do this is to The easiest way to do this is to
@ -1469,7 +1469,7 @@ This file is processed exactly as
This file may be useful to permit logins using This file may be useful to permit logins using
.Nm .Nm
but not using rsh/rlogin. but not using rsh/rlogin.
.It Pa /etc/sshrc .It Pa /etc/ssh/sshrc
Commands in this file are executed by Commands in this file are executed by
.Nm .Nm
when the user logs in just before the user's shell (or command) is started. when the user logs in just before the user's shell (or command) is started.

38
sshd.8
View File

@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: sshd.8,v 1.166 2002/02/03 22:35:57 stevesk Exp $ .\" $OpenBSD: sshd.8,v 1.167 2002/02/09 17:37:34 deraadt Exp $
.Dd September 25, 1999 .Dd September 25, 1999
.Dt SSHD 8 .Dt SSHD 8
.Os .Os
@ -198,7 +198,7 @@ will send the output to the standard error instead of the system log.
.It Fl f Ar configuration_file .It Fl f Ar configuration_file
Specifies the name of the configuration file. Specifies the name of the configuration file.
The default is The default is
.Pa /etc/sshd_config . .Pa /etc/ssh/sshd_config .
.Nm .Nm
refuses to start if there is no configuration file. refuses to start if there is no configuration file.
.It Fl g Ar login_grace_time .It Fl g Ar login_grace_time
@ -214,11 +214,11 @@ This option must be given if
is not run as root (as the normal is not run as root (as the normal
host key files are normally not readable by anyone but root). host key files are normally not readable by anyone but root).
The default is The default is
.Pa /etc/ssh_host_key .Pa /etc/ssh/ssh_host_key
for protocol version 1, and for protocol version 1, and
.Pa /etc/ssh_host_rsa_key .Pa /etc/ssh/ssh_host_rsa_key
and and
.Pa /etc/ssh_host_dsa_key .Pa /etc/ssh/ssh_host_dsa_key
for protocol version 2. for protocol version 2.
It is possible to have multiple host key files for It is possible to have multiple host key files for
the different protocol versions and host key algorithms. the different protocol versions and host key algorithms.
@ -311,7 +311,7 @@ to use IPv6 addresses only.
.Sh CONFIGURATION FILE .Sh CONFIGURATION FILE
.Nm .Nm
reads configuration data from reads configuration data from
.Pa /etc/sshd_config .Pa /etc/ssh/sshd_config
(or the file specified with (or the file specified with
.Fl f .Fl f
on the command line). on the command line).
@ -488,11 +488,11 @@ The default is
Specifies a file containing a private host key Specifies a file containing a private host key
used by SSH. used by SSH.
The default is The default is
.Pa /etc/ssh_host_key .Pa /etc/ssh/ssh_host_key
for protocol version 1, and for protocol version 1, and
.Pa /etc/ssh_host_rsa_key .Pa /etc/ssh/ssh_host_rsa_key
and and
.Pa /etc/ssh_host_dsa_key .Pa /etc/ssh/ssh_host_dsa_key
for protocol version 2. for protocol version 2.
Note that Note that
.Nm .Nm
@ -1103,7 +1103,7 @@ command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hu
permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323 permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323
.Sh SSH_KNOWN_HOSTS FILE FORMAT .Sh SSH_KNOWN_HOSTS FILE FORMAT
The The
.Pa /etc/ssh_known_hosts , .Pa /etc/ssh/ssh_known_hosts ,
and and
.Pa $HOME/.ssh/known_hosts .Pa $HOME/.ssh/known_hosts
files contain host public keys for all known hosts. files contain host public keys for all known hosts.
@ -1128,7 +1128,7 @@ pattern on the line.
.Pp .Pp
Bits, exponent, and modulus are taken directly from the RSA host key; they Bits, exponent, and modulus are taken directly from the RSA host key; they
can be obtained, e.g., from can be obtained, e.g., from
.Pa /etc/ssh_host_key.pub . .Pa /etc/ssh/ssh_host_key.pub .
The optional comment field continues to the end of the line, and is not used. The optional comment field continues to the end of the line, and is not used.
.Pp .Pp
Lines starting with Lines starting with
@ -1150,7 +1150,7 @@ Note that the lines in these files are typically hundreds of characters
long, and you definitely don't want to type in the host keys by hand. long, and you definitely don't want to type in the host keys by hand.
Rather, generate them by a script Rather, generate them by a script
or by taking or by taking
.Pa /etc/ssh_host_key.pub .Pa /etc/ssh/ssh_host_key.pub
and adding the host names at the front. and adding the host names at the front.
.Ss Examples .Ss Examples
.Bd -literal .Bd -literal
@ -1159,19 +1159,19 @@ cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....=
.Ed .Ed
.Sh FILES .Sh FILES
.Bl -tag -width Ds .Bl -tag -width Ds
.It Pa /etc/sshd_config .It Pa /etc/ssh/sshd_config
Contains configuration data for Contains configuration data for
.Nm sshd . .Nm sshd .
This file should be writable by root only, but it is recommended This file should be writable by root only, but it is recommended
(though not necessary) that it be world-readable. (though not necessary) that it be world-readable.
.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key .It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
These three files contain the private parts of the host keys. These three files contain the private parts of the host keys.
These files should only be owned by root, readable only by root, and not These files should only be owned by root, readable only by root, and not
accessible to others. accessible to others.
Note that Note that
.Nm .Nm
does not start if this file is group/world-accessible. does not start if this file is group/world-accessible.
.It Pa /etc/ssh_host_key.pub, /etc/ssh_host_dsa_key.pub, /etc/ssh_host_rsa_key.pub .It Pa /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub, /etc/ssh/ssh_host_rsa_key.pub
These three files contain the public parts of the host keys. These three files contain the public parts of the host keys.
These files should be world-readable but writable only by These files should be world-readable but writable only by
root. root.
@ -1204,7 +1204,7 @@ and/or
.Pa id_rsa.pub .Pa id_rsa.pub
files into this file, as described in files into this file, as described in
.Xr ssh-keygen 1 . .Xr ssh-keygen 1 .
.It Pa "/etc/ssh_known_hosts" and "$HOME/.ssh/known_hosts" .It Pa "/etc/ssh/ssh_known_hosts" and "$HOME/.ssh/known_hosts"
These files are consulted when using rhosts with RSA host These files are consulted when using rhosts with RSA host
authentication or protocol version 2 hostbased authentication authentication or protocol version 2 hostbased authentication
to check the public key of the host. to check the public key of the host.
@ -1212,7 +1212,7 @@ The key must be listed in one of these files to be accepted.
The client uses the same files The client uses the same files
to verify that it is connecting to the correct remote host. to verify that it is connecting to the correct remote host.
These files should be writable only by root/the owner. These files should be writable only by root/the owner.
.Pa /etc/ssh_known_hosts .Pa /etc/ssh/ssh_known_hosts
should be world-readable, and should be world-readable, and
.Pa $HOME/.ssh/known_hosts .Pa $HOME/.ssh/known_hosts
can but need not be world-readable. can but need not be world-readable.
@ -1320,13 +1320,13 @@ something similar to:
.Ed .Ed
.Pp .Pp
If this file does not exist, If this file does not exist,
.Pa /etc/sshrc .Pa /etc/ssh/sshrc
is run, and if that is run, and if that
does not exist either, xauth is used to store the cookie. does not exist either, xauth is used to store the cookie.
.Pp .Pp
This file should be writable only by the user, and need not be This file should be writable only by the user, and need not be
readable by anyone else. readable by anyone else.
.It Pa /etc/sshrc .It Pa /etc/ssh/sshrc
Like Like
.Pa $HOME/.ssh/rc . .Pa $HOME/.ssh/rc .
This can be used to specify This can be used to specify

10
sshd_config
View File

@ -1,4 +1,4 @@
# $OpenBSD: sshd_config,v 1.46 2002/01/29 14:32:03 markus Exp $ # $OpenBSD: sshd_config,v 1.47 2002/02/09 17:37:34 deraadt Exp $
# This is the sshd server system-wide configuration file. See sshd(8) # This is the sshd server system-wide configuration file. See sshd(8)
# for more information. # for more information.
@ -16,10 +16,10 @@
#ListenAddress :: #ListenAddress ::
# HostKey for protocol version 1 # HostKey for protocol version 1
#HostKey /etc/ssh_host_key #HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2 # HostKeys for protocol version 2
#HostKey /etc/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key # Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 3600 #KeyRegenerationInterval 3600
@ -44,7 +44,7 @@
#RhostsAuthentication no #RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files # Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes #IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no #RhostsRSAAuthentication no
# similar for protocol version 2 # similar for protocol version 2
#HostbasedAuthentication no #HostbasedAuthentication no