mirror of git://anongit.mindrot.org/openssh.git
- djm@cvs.openbsd.org 2005/04/21 06:17:50
[ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
[sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
variable, so don't say that we do (bz #623); ok deraadt@
This commit is contained in:
Damien Miller
parent
a31c929f36
commit
167ea5d026
|
|
@ -23,6 +23,10 @@
|
|||
- jakob@cvs.openbsd.org 2005/04/20 10:05:45
|
||||
[dns.c]
|
||||
do not try to look up SSHFP for numerical hostname. ok djm@
|
||||
- djm@cvs.openbsd.org 2005/04/21 06:17:50
|
||||
[ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh.1 ssh_config.5 sshd.8]
|
||||
[sshd_config.5] OpenSSH doesn't ever look at the $HOME environment
|
||||
variable, so don't say that we do (bz #623); ok deraadt@
|
||||
|
||||
20050524
|
||||
- (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
|
||||
|
|
@ -2522,4 +2526,4 @@
|
|||
- (djm) Trim deprecated options from INSTALL. Mention UsePAM
|
||||
- (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
|
||||
|
||||
$Id: ChangeLog,v 1.3767 2005/05/26 02:03:31 djm Exp $
|
||||
$Id: ChangeLog,v 1.3768 2005/05/26 02:04:02 djm Exp $
|
||||
|
|
|
|||
14
ssh-add.1
14
ssh-add.1
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-add.1,v 1.42 2005/03/01 17:32:19 jmc Exp $
|
||||
.\" $OpenBSD: ssh-add.1,v 1.43 2005/04/21 06:17:50 djm Exp $
|
||||
.\"
|
||||
.\" -*- nroff -*-
|
||||
.\"
|
||||
|
|
@ -57,10 +57,10 @@
|
|||
adds RSA or DSA identities to the authentication agent,
|
||||
.Xr ssh-agent 1 .
|
||||
When run without arguments, it adds the files
|
||||
.Pa $HOME/.ssh/id_rsa ,
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/id_rsa ,
|
||||
.Pa ~/.ssh/id_dsa
|
||||
and
|
||||
.Pa $HOME/.ssh/identity .
|
||||
.Pa ~/.ssh/identity .
|
||||
Alternative file names can be given on the command line.
|
||||
If any file requires a passphrase,
|
||||
.Nm
|
||||
|
|
@ -142,11 +142,11 @@ agent.
|
|||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
.It Pa $HOME/.ssh/identity
|
||||
.It Pa ~/.ssh/identity
|
||||
Contains the protocol version 1 RSA authentication identity of the user.
|
||||
.It Pa $HOME/.ssh/id_dsa
|
||||
.It Pa ~/.ssh/id_dsa
|
||||
Contains the protocol version 2 DSA authentication identity of the user.
|
||||
.It Pa $HOME/.ssh/id_rsa
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
Contains the protocol version 2 RSA authentication identity of the user.
|
||||
.El
|
||||
.Pp
|
||||
|
|
|
|||
14
ssh-agent.1
14
ssh-agent.1
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-agent.1,v 1.41 2004/07/11 17:48:47 deraadt Exp $
|
||||
.\" $OpenBSD: ssh-agent.1,v 1.42 2005/04/21 06:17:50 djm Exp $
|
||||
.\"
|
||||
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -111,10 +111,10 @@ Keys are added using
|
|||
When executed without arguments,
|
||||
.Xr ssh-add 1
|
||||
adds the files
|
||||
.Pa $HOME/.ssh/id_rsa ,
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/id_rsa ,
|
||||
.Pa ~/.ssh/id_dsa
|
||||
and
|
||||
.Pa $HOME/.ssh/identity .
|
||||
.Pa ~/.ssh/identity .
|
||||
If the identity has a passphrase,
|
||||
.Xr ssh-add 1
|
||||
asks for the passphrase (using a small X11 application if running
|
||||
|
|
@ -179,11 +179,11 @@ The agent exits automatically when the command given on the command
|
|||
line terminates.
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
.It Pa $HOME/.ssh/identity
|
||||
.It Pa ~/.ssh/identity
|
||||
Contains the protocol version 1 RSA authentication identity of the user.
|
||||
.It Pa $HOME/.ssh/id_dsa
|
||||
.It Pa ~/.ssh/id_dsa
|
||||
Contains the protocol version 2 DSA authentication identity of the user.
|
||||
.It Pa $HOME/.ssh/id_rsa
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
Contains the protocol version 2 RSA authentication identity of the user.
|
||||
.It Pa /tmp/ssh-XXXXXXXX/agent.<ppid>
|
||||
Unix-domain sockets used to contain the connection to the
|
||||
|
|
|
|||
26
ssh-keygen.1
26
ssh-keygen.1
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-keygen.1,v 1.67 2005/03/14 10:09:03 dtucker Exp $
|
||||
.\" $OpenBSD: ssh-keygen.1,v 1.68 2005/04/21 06:17:50 djm Exp $
|
||||
.\"
|
||||
.\" -*- nroff -*-
|
||||
.\"
|
||||
|
|
@ -129,10 +129,10 @@ section for details.
|
|||
Normally each user wishing to use SSH
|
||||
with RSA or DSA authentication runs this once to create the authentication
|
||||
key in
|
||||
.Pa $HOME/.ssh/identity ,
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/identity ,
|
||||
.Pa ~/.ssh/id_dsa
|
||||
or
|
||||
.Pa $HOME/.ssh/id_rsa .
|
||||
.Pa ~/.ssh/id_rsa .
|
||||
Additionally, the system administrator may use this to generate host keys,
|
||||
as seen in
|
||||
.Pa /etc/rc .
|
||||
|
|
@ -381,7 +381,7 @@ It is important that this file contains moduli of a range of bit lengths and
|
|||
that both ends of a connection share common moduli.
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
.It Pa $HOME/.ssh/identity
|
||||
.It Pa ~/.ssh/identity
|
||||
Contains the protocol version 1 RSA authentication identity of the user.
|
||||
This file should not be readable by anyone but the user.
|
||||
It is possible to
|
||||
|
|
@ -392,14 +392,14 @@ This file is not automatically accessed by
|
|||
but it is offered as the default file for the private key.
|
||||
.Xr ssh 1
|
||||
will read this file when a login attempt is made.
|
||||
.It Pa $HOME/.ssh/identity.pub
|
||||
.It Pa ~/.ssh/identity.pub
|
||||
Contains the protocol version 1 RSA public key for authentication.
|
||||
The contents of this file should be added to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
on all machines
|
||||
where the user wishes to log in using RSA authentication.
|
||||
There is no need to keep the contents of this file secret.
|
||||
.It Pa $HOME/.ssh/id_dsa
|
||||
.It Pa ~/.ssh/id_dsa
|
||||
Contains the protocol version 2 DSA authentication identity of the user.
|
||||
This file should not be readable by anyone but the user.
|
||||
It is possible to
|
||||
|
|
@ -410,14 +410,14 @@ This file is not automatically accessed by
|
|||
but it is offered as the default file for the private key.
|
||||
.Xr ssh 1
|
||||
will read this file when a login attempt is made.
|
||||
.It Pa $HOME/.ssh/id_dsa.pub
|
||||
.It Pa ~/.ssh/id_dsa.pub
|
||||
Contains the protocol version 2 DSA public key for authentication.
|
||||
The contents of this file should be added to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
on all machines
|
||||
where the user wishes to log in using public key authentication.
|
||||
There is no need to keep the contents of this file secret.
|
||||
.It Pa $HOME/.ssh/id_rsa
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
Contains the protocol version 2 RSA authentication identity of the user.
|
||||
This file should not be readable by anyone but the user.
|
||||
It is possible to
|
||||
|
|
@ -428,10 +428,10 @@ This file is not automatically accessed by
|
|||
but it is offered as the default file for the private key.
|
||||
.Xr ssh 1
|
||||
will read this file when a login attempt is made.
|
||||
.It Pa $HOME/.ssh/id_rsa.pub
|
||||
.It Pa ~/.ssh/id_rsa.pub
|
||||
Contains the protocol version 2 RSA public key for authentication.
|
||||
The contents of this file should be added to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
on all machines
|
||||
where the user wishes to log in using public key authentication.
|
||||
There is no need to keep the contents of this file secret.
|
||||
|
|
|
|||
70
ssh.1
70
ssh.1
|
|
@ -34,7 +34,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh.1,v 1.206 2005/04/14 12:30:30 jmc Exp $
|
||||
.\" $OpenBSD: ssh.1,v 1.207 2005/04/21 06:17:50 djm Exp $
|
||||
.Dd September 25, 1999
|
||||
.Dt SSH 1
|
||||
.Os
|
||||
|
|
@ -109,9 +109,9 @@ or
|
|||
.Pa /etc/shosts.equiv
|
||||
on the remote machine, and the user names are
|
||||
the same on both sides, or if the files
|
||||
.Pa $HOME/.rhosts
|
||||
.Pa ~/.rhosts
|
||||
or
|
||||
.Pa $HOME/.shosts
|
||||
.Pa ~/.shosts
|
||||
exist in the user's home directory on the
|
||||
remote machine and contain a line containing the name of the client
|
||||
machine and the name of the user on that machine, the user is
|
||||
|
|
@ -120,7 +120,7 @@ Additionally, if the server can verify the client's
|
|||
host key (see
|
||||
.Pa /etc/ssh/ssh_known_hosts
|
||||
and
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
in the
|
||||
.Sx FILES
|
||||
section), only then is login permitted.
|
||||
|
|
@ -128,7 +128,7 @@ This authentication method closes security holes due to IP
|
|||
spoofing, DNS spoofing and routing spoofing.
|
||||
[Note to the administrator:
|
||||
.Pa /etc/hosts.equiv ,
|
||||
.Pa $HOME/.rhosts ,
|
||||
.Pa ~/.rhosts ,
|
||||
and the rlogin/rsh protocol in general, are inherently insecure and should be
|
||||
disabled if security is desired.]
|
||||
.Pp
|
||||
|
|
@ -144,7 +144,7 @@ key pair for authentication purposes.
|
|||
The server knows the public key, and only the user knows the private key.
|
||||
.Pp
|
||||
The file
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
lists the public keys that are permitted for logging in.
|
||||
When the user logs in, the
|
||||
.Nm
|
||||
|
|
@ -165,18 +165,18 @@ implements the RSA authentication protocol automatically.
|
|||
The user creates his/her RSA key pair by running
|
||||
.Xr ssh-keygen 1 .
|
||||
This stores the private key in
|
||||
.Pa $HOME/.ssh/identity
|
||||
.Pa ~/.ssh/identity
|
||||
and stores the public key in
|
||||
.Pa $HOME/.ssh/identity.pub
|
||||
.Pa ~/.ssh/identity.pub
|
||||
in the user's home directory.
|
||||
The user should then copy the
|
||||
.Pa identity.pub
|
||||
to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
in his/her home directory on the remote machine (the
|
||||
.Pa authorized_keys
|
||||
file corresponds to the conventional
|
||||
.Pa $HOME/.rhosts
|
||||
.Pa ~/.rhosts
|
||||
file, and has one key
|
||||
per line, though the lines can be very long).
|
||||
After this, the user can log in without giving the password.
|
||||
|
|
@ -206,12 +206,12 @@ password authentication are tried.
|
|||
The public key method is similar to RSA authentication described
|
||||
in the previous section and allows the RSA or DSA algorithm to be used:
|
||||
The client uses his private key,
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/id_dsa
|
||||
or
|
||||
.Pa $HOME/.ssh/id_rsa ,
|
||||
.Pa ~/.ssh/id_rsa ,
|
||||
to sign the session identifier and sends the result to the server.
|
||||
The server checks whether the matching public key is listed in
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
and grants access if both the key is found and the signature is correct.
|
||||
The session identifier is derived from a shared Diffie-Hellman value
|
||||
and is only known to the client and the server.
|
||||
|
|
@ -365,7 +365,7 @@ electronic purse; another is going through firewalls.
|
|||
automatically maintains and checks a database containing
|
||||
identifications for all hosts it has ever been used with.
|
||||
Host keys are stored in
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
in the user's home directory.
|
||||
Additionally, the file
|
||||
.Pa /etc/ssh/ssh_known_hosts
|
||||
|
|
@ -522,7 +522,7 @@ the system-wide configuration file
|
|||
.Pq Pa /etc/ssh/ssh_config
|
||||
will be ignored.
|
||||
The default for the per-user configuration file is
|
||||
.Pa $HOME/.ssh/config .
|
||||
.Pa ~/.ssh/config .
|
||||
.It Fl f
|
||||
Requests
|
||||
.Nm
|
||||
|
|
@ -548,11 +548,11 @@ private RSA key.
|
|||
Selects a file from which the identity (private key) for
|
||||
RSA or DSA authentication is read.
|
||||
The default is
|
||||
.Pa $HOME/.ssh/identity
|
||||
.Pa ~/.ssh/identity
|
||||
for protocol version 1, and
|
||||
.Pa $HOME/.ssh/id_rsa
|
||||
.Pa ~/.ssh/id_rsa
|
||||
and
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/id_dsa
|
||||
for protocol version 2.
|
||||
Identity files may also be specified on
|
||||
a per-host basis in the configuration file.
|
||||
|
|
@ -941,7 +941,7 @@ Set to the name of the user logging in.
|
|||
Additionally,
|
||||
.Nm
|
||||
reads
|
||||
.Pa $HOME/.ssh/environment ,
|
||||
.Pa ~/.ssh/environment ,
|
||||
and adds lines of the format
|
||||
.Dq VARNAME=value
|
||||
to the environment if the file exists and if users are allowed to
|
||||
|
|
@ -952,13 +952,13 @@ option in
|
|||
.Xr sshd_config 5 .
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
.It Pa $HOME/.ssh/known_hosts
|
||||
.It Pa ~/.ssh/known_hosts
|
||||
Records host keys for all hosts the user has logged into that are not
|
||||
in
|
||||
.Pa /etc/ssh/ssh_known_hosts .
|
||||
See
|
||||
.Xr sshd 8 .
|
||||
.It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
|
||||
.It Pa ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
|
||||
Contains the authentication identity of the user.
|
||||
They are for protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
|
||||
These files
|
||||
|
|
@ -970,21 +970,21 @@ ignores a private key file if it is accessible by others.
|
|||
It is possible to specify a passphrase when
|
||||
generating the key; the passphrase will be used to encrypt the
|
||||
sensitive part of this file using 3DES.
|
||||
.It Pa $HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub
|
||||
.It Pa ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
|
||||
Contains the public key for authentication (public part of the
|
||||
identity file in human-readable form).
|
||||
The contents of the
|
||||
.Pa $HOME/.ssh/identity.pub
|
||||
.Pa ~/.ssh/identity.pub
|
||||
file should be added to the file
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
on all machines
|
||||
where the user wishes to log in using protocol version 1 RSA authentication.
|
||||
The contents of the
|
||||
.Pa $HOME/.ssh/id_dsa.pub
|
||||
.Pa ~/.ssh/id_dsa.pub
|
||||
and
|
||||
.Pa $HOME/.ssh/id_rsa.pub
|
||||
.Pa ~/.ssh/id_rsa.pub
|
||||
file should be added to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
on all machines
|
||||
where the user wishes to log in using protocol version 2 DSA/RSA authentication.
|
||||
These files are not
|
||||
|
|
@ -992,13 +992,13 @@ sensitive and can (but need not) be readable by anyone.
|
|||
These files are
|
||||
never used automatically and are not necessary; they are only provided for
|
||||
the convenience of the user.
|
||||
.It Pa $HOME/.ssh/config
|
||||
.It Pa ~/.ssh/config
|
||||
This is the per-user configuration file.
|
||||
The file format and configuration options are described in
|
||||
.Xr ssh_config 5 .
|
||||
Because of the potential for abuse, this file must have strict permissions:
|
||||
read/write for the user, and not accessible by others.
|
||||
.It Pa $HOME/.ssh/authorized_keys
|
||||
.It Pa ~/.ssh/authorized_keys
|
||||
Lists the public keys (RSA/DSA) that can be used for logging in as this user.
|
||||
The format of this file is described in the
|
||||
.Xr sshd 8
|
||||
|
|
@ -1058,7 +1058,7 @@ be setuid root when that authentication method is used.
|
|||
By default
|
||||
.Nm
|
||||
is not setuid root.
|
||||
.It Pa $HOME/.rhosts
|
||||
.It Pa ~/.rhosts
|
||||
This file is used in
|
||||
.Cm RhostsRSAAuthentication
|
||||
and
|
||||
|
|
@ -1088,12 +1088,12 @@ authentication before permitting log in.
|
|||
If the server machine does not have the client's host key in
|
||||
.Pa /etc/ssh/ssh_known_hosts ,
|
||||
it can be stored in
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
.Pa ~/.ssh/known_hosts .
|
||||
The easiest way to do this is to
|
||||
connect back to the client from the server machine using ssh; this
|
||||
will automatically add the host key to
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
.It Pa $HOME/.shosts
|
||||
.Pa ~/.ssh/known_hosts .
|
||||
.It Pa ~/.shosts
|
||||
This file is used exactly the same way as
|
||||
.Pa .rhosts .
|
||||
The purpose for
|
||||
|
|
@ -1133,7 +1133,7 @@ when the user logs in just before the user's shell (or command) is started.
|
|||
See the
|
||||
.Xr sshd 8
|
||||
manual page for more information.
|
||||
.It Pa $HOME/.ssh/rc
|
||||
.It Pa ~/.ssh/rc
|
||||
Commands in this file are executed by
|
||||
.Nm
|
||||
when the user logs in just before the user's shell (or command) is
|
||||
|
|
@ -1141,7 +1141,7 @@ started.
|
|||
See the
|
||||
.Xr sshd 8
|
||||
manual page for more information.
|
||||
.It Pa $HOME/.ssh/environment
|
||||
.It Pa ~/.ssh/environment
|
||||
Contains additional definitions for environment variables, see section
|
||||
.Sx ENVIRONMENT
|
||||
above.
|
||||
|
|
|
|||
20
ssh_config.5
20
ssh_config.5
|
|
@ -34,7 +34,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh_config.5,v 1.49 2005/03/16 11:10:38 jmc Exp $
|
||||
.\" $OpenBSD: ssh_config.5,v 1.50 2005/04/21 06:17:50 djm Exp $
|
||||
.Dd September 25, 1999
|
||||
.Dt SSH_CONFIG 5
|
||||
.Os
|
||||
|
|
@ -43,7 +43,7 @@
|
|||
.Nd OpenSSH SSH client configuration files
|
||||
.Sh SYNOPSIS
|
||||
.Bl -tag -width Ds -compact
|
||||
.It Pa $HOME/.ssh/config
|
||||
.It Pa ~/.ssh/config
|
||||
.It Pa /etc/ssh/ssh_config
|
||||
.El
|
||||
.Sh DESCRIPTION
|
||||
|
|
@ -55,7 +55,7 @@ the following order:
|
|||
command-line options
|
||||
.It
|
||||
user's configuration file
|
||||
.Pq Pa $HOME/.ssh/config
|
||||
.Pq Pa ~/.ssh/config
|
||||
.It
|
||||
system-wide configuration file
|
||||
.Pq Pa /etc/ssh/ssh_config
|
||||
|
|
@ -411,7 +411,7 @@ Note that this option applies to protocol version 2 only.
|
|||
Indicates that
|
||||
.Nm ssh
|
||||
should hash host names and addresses when they are added to
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
.Pa ~/.ssh/known_hosts .
|
||||
These hashed names may be used normally by
|
||||
.Nm ssh
|
||||
and
|
||||
|
|
@ -457,11 +457,11 @@ specifications).
|
|||
Specifies a file from which the user's RSA or DSA authentication identity
|
||||
is read.
|
||||
The default is
|
||||
.Pa $HOME/.ssh/identity
|
||||
.Pa ~/.ssh/identity
|
||||
for protocol version 1, and
|
||||
.Pa $HOME/.ssh/id_rsa
|
||||
.Pa ~/.ssh/id_rsa
|
||||
and
|
||||
.Pa $HOME/.ssh/id_dsa
|
||||
.Pa ~/.ssh/id_dsa
|
||||
for protocol version 2.
|
||||
Additionally, any identities represented by the authentication agent
|
||||
will be used for authentication.
|
||||
|
|
@ -751,7 +751,7 @@ If this flag is set to
|
|||
.Dq yes ,
|
||||
.Nm ssh
|
||||
will never automatically add host keys to the
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
file, and refuses to connect to hosts whose host key has changed.
|
||||
This provides maximum protection against trojan horse attacks,
|
||||
however, can be annoying when the
|
||||
|
|
@ -823,7 +823,7 @@ having to remember to give the user name on the command line.
|
|||
.It Cm UserKnownHostsFile
|
||||
Specifies a file to use for the user
|
||||
host key database instead of
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
.Pa ~/.ssh/known_hosts .
|
||||
.It Cm VerifyHostKeyDNS
|
||||
Specifies whether to verify the remote key using DNS and SSHFP resource
|
||||
records.
|
||||
|
|
@ -856,7 +856,7 @@ The default is
|
|||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
.It Pa $HOME/.ssh/config
|
||||
.It Pa ~/.ssh/config
|
||||
This is the per-user configuration file.
|
||||
The format of this file is described above.
|
||||
This file is used by the
|
||||
|
|
|
|||
30
sshd.8
30
sshd.8
|
|
@ -34,7 +34,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd.8,v 1.206 2005/03/01 14:59:49 jmc Exp $
|
||||
.\" $OpenBSD: sshd.8,v 1.207 2005/04/21 06:17:50 djm Exp $
|
||||
.Dd September 25, 1999
|
||||
.Dt SSHD 8
|
||||
.Os
|
||||
|
|
@ -350,7 +350,7 @@ If the login is on a tty, and no command has been specified,
|
|||
prints last login time and
|
||||
.Pa /etc/motd
|
||||
(unless prevented in the configuration file or by
|
||||
.Pa $HOME/.hushlogin ;
|
||||
.Pa ~/.hushlogin ;
|
||||
see the
|
||||
.Sx FILES
|
||||
section).
|
||||
|
|
@ -367,7 +367,7 @@ Changes to run with normal user privileges.
|
|||
Sets up basic environment.
|
||||
.It
|
||||
Reads the file
|
||||
.Pa $HOME/.ssh/environment ,
|
||||
.Pa ~/.ssh/environment ,
|
||||
if it exists, and users are allowed to change their environment.
|
||||
See the
|
||||
.Cm PermitUserEnvironment
|
||||
|
|
@ -377,7 +377,7 @@ option in
|
|||
Changes to user's home directory.
|
||||
.It
|
||||
If
|
||||
.Pa $HOME/.ssh/rc
|
||||
.Pa ~/.ssh/rc
|
||||
exists, runs it; else if
|
||||
.Pa /etc/ssh/sshrc
|
||||
exists, runs
|
||||
|
|
@ -390,7 +390,7 @@ authentication protocol and cookie in standard input.
|
|||
Runs user's shell or command.
|
||||
.El
|
||||
.Sh AUTHORIZED_KEYS FILE FORMAT
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
is the default file that lists the public keys that are
|
||||
permitted for RSA authentication in protocol version 1
|
||||
and for public key authentication (PubkeyAuthentication)
|
||||
|
|
@ -528,7 +528,7 @@ permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
|
|||
The
|
||||
.Pa /etc/ssh/ssh_known_hosts
|
||||
and
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
files contain host public keys for all known hosts.
|
||||
The global file should
|
||||
be prepared by the administrator (optional), and the per-user file is
|
||||
|
|
@ -639,7 +639,7 @@ listening for connections (if there are several daemons running
|
|||
concurrently for different ports, this contains the process ID of the one
|
||||
started last).
|
||||
The content of this file is not sensitive; it can be world-readable.
|
||||
.It Pa $HOME/.ssh/authorized_keys
|
||||
.It Pa ~/.ssh/authorized_keys
|
||||
Lists the public keys (RSA or DSA) that can be used to log into the user's account.
|
||||
This file must be readable by root (which may on some machines imply
|
||||
it being world-readable if the user's home directory resides on an NFS
|
||||
|
|
@ -653,7 +653,7 @@ and/or
|
|||
.Pa id_rsa.pub
|
||||
files into this file, as described in
|
||||
.Xr ssh-keygen 1 .
|
||||
.It Pa "/etc/ssh/ssh_known_hosts", "$HOME/.ssh/known_hosts"
|
||||
.It Pa "/etc/ssh/ssh_known_hosts", "~/.ssh/known_hosts"
|
||||
These files are consulted when using rhosts with RSA host
|
||||
authentication or protocol version 2 hostbased authentication
|
||||
to check the public key of the host.
|
||||
|
|
@ -663,12 +663,12 @@ to verify that it is connecting to the correct remote host.
|
|||
These files should be writable only by root/the owner.
|
||||
.Pa /etc/ssh/ssh_known_hosts
|
||||
should be world-readable, and
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
can, but need not be, world-readable.
|
||||
.It Pa /etc/motd
|
||||
See
|
||||
.Xr motd 5 .
|
||||
.It Pa $HOME/.hushlogin
|
||||
.It Pa ~/.hushlogin
|
||||
This file is used to suppress printing the last login time and
|
||||
.Pa /etc/motd ,
|
||||
if
|
||||
|
|
@ -691,7 +691,7 @@ The file should be world-readable.
|
|||
Access controls that should be enforced by tcp-wrappers are defined here.
|
||||
Further details are described in
|
||||
.Xr hosts_access 5 .
|
||||
.It Pa $HOME/.rhosts
|
||||
.It Pa ~/.rhosts
|
||||
This file is used during
|
||||
.Cm RhostsRSAAuthentication
|
||||
and
|
||||
|
|
@ -709,7 +709,7 @@ It is also possible to use netgroups in the file.
|
|||
Either host or user
|
||||
name may be of the form +@groupname to specify all hosts or all users
|
||||
in the group.
|
||||
.It Pa $HOME/.shosts
|
||||
.It Pa ~/.shosts
|
||||
For ssh,
|
||||
this file is exactly the same as for
|
||||
.Pa .rhosts .
|
||||
|
|
@ -758,7 +758,7 @@ This is processed exactly as
|
|||
.Pa /etc/hosts.equiv .
|
||||
However, this file may be useful in environments that want to run both
|
||||
rsh/rlogin and ssh.
|
||||
.It Pa $HOME/.ssh/environment
|
||||
.It Pa ~/.ssh/environment
|
||||
This file is read into the environment at login (if it exists).
|
||||
It can only contain empty lines, comment lines (that start with
|
||||
.Ql # ) ,
|
||||
|
|
@ -769,7 +769,7 @@ Environment processing is disabled by default and is
|
|||
controlled via the
|
||||
.Cm PermitUserEnvironment
|
||||
option.
|
||||
.It Pa $HOME/.ssh/rc
|
||||
.It Pa ~/.ssh/rc
|
||||
If this file exists, it is run with
|
||||
.Pa /bin/sh
|
||||
after reading the
|
||||
|
|
@ -814,7 +814,7 @@ This file should be writable only by the user, and need not be
|
|||
readable by anyone else.
|
||||
.It Pa /etc/ssh/sshrc
|
||||
Like
|
||||
.Pa $HOME/.ssh/rc .
|
||||
.Pa ~/.ssh/rc .
|
||||
This can be used to specify
|
||||
machine-specific login-time initializations globally.
|
||||
This file should be writable only by root, and should be world-readable.
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.40 2005/03/18 17:05:00 jmc Exp $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.41 2005/04/21 06:17:50 djm Exp $
|
||||
.Dd September 25, 1999
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
|
|
@ -327,7 +327,7 @@ The default is
|
|||
Specifies whether
|
||||
.Nm sshd
|
||||
should ignore the user's
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
.Pa ~/.ssh/known_hosts
|
||||
during
|
||||
.Cm RhostsRSAAuthentication
|
||||
or
|
||||
|
|
|
|||
Loading…
Reference in New Issue