mirror of
git://anongit.mindrot.org/openssh.git
synced 2025-01-03 00:02:05 +00:00
- OpenBSD CVS updates:
- [atomicio.c auth-krb4.c bufaux.c channels.c compress.c fingerprint.c]
[packet.h radix.c rsa.c scp.c ssh-agent.c ssh-keygen.c sshconnect.c]
[sshd.c]
pedantic: signed vs. unsigned, void*-arithm, etc
- [ssh.1 sshd.8]
Various cleanups and standardizations.
This commit is contained in:
Damien Miller
parent
d6121d2972
commit
7684ee17ee
@ -5,6 +5,13 @@
|
||||
<jmknoble@pobox.com>
|
||||
- Checks for 64 bit int types. Problem report from Mats Fredholm
|
||||
<matsf@init.se>
|
||||
- OpenBSD CVS updates:
|
||||
- [atomicio.c auth-krb4.c bufaux.c channels.c compress.c fingerprint.c]
|
||||
[packet.h radix.c rsa.c scp.c ssh-agent.c ssh-keygen.c sshconnect.c]
|
||||
[sshd.c]
|
||||
pedantic: signed vs. unsigned, void*-arithm, etc
|
||||
- [ssh.1 sshd.8]
|
||||
Various cleanups and standardizations.
|
||||
|
||||
20000316
|
||||
- Fixed configure not passing LDFLAGS to Solaris. Report from David G.
|
||||
|
||||
@ -24,7 +24,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: atomicio.c,v 1.9 2000/03/09 10:27:50 damien Exp $");
|
||||
RCSID("$Id: atomicio.c,v 1.10 2000/03/17 12:40:15 damien Exp $");
|
||||
|
||||
#include "xmalloc.h"
|
||||
#include "ssh.h"
|
||||
@ -33,12 +33,13 @@ RCSID("$Id: atomicio.c,v 1.9 2000/03/09 10:27:50 damien Exp $");
|
||||
* ensure all of data on socket comes through. f==read || f==write
|
||||
*/
|
||||
ssize_t
|
||||
atomicio(f, fd, s, n)
|
||||
atomicio(f, fd, _s, n)
|
||||
ssize_t (*f) ();
|
||||
int fd;
|
||||
void *s;
|
||||
void *_s;
|
||||
size_t n;
|
||||
{
|
||||
char *s = _s;
|
||||
ssize_t res, pos = 0;
|
||||
|
||||
while (n > pos) {
|
||||
|
||||
@ -186,19 +186,20 @@ auth_krb4(const char *server_user, KTEXT auth, char **client)
|
||||
KTEXT_ST reply;
|
||||
char instance[INST_SZ];
|
||||
int r, s;
|
||||
socklen_t slen;
|
||||
u_int cksum;
|
||||
Key_schedule schedule;
|
||||
struct sockaddr_in local, foreign;
|
||||
|
||||
s = packet_get_connection_in();
|
||||
|
||||
r = sizeof(local);
|
||||
slen = sizeof(local);
|
||||
memset(&local, 0, sizeof(local));
|
||||
if (getsockname(s, (struct sockaddr *) & local, &r) < 0)
|
||||
if (getsockname(s, (struct sockaddr *) & local, &slen) < 0)
|
||||
debug("getsockname failed: %.100s", strerror(errno));
|
||||
r = sizeof(foreign);
|
||||
slen = sizeof(foreign);
|
||||
memset(&foreign, 0, sizeof(foreign));
|
||||
if (getpeername(s, (struct sockaddr *) & foreign, &r) < 0) {
|
||||
if (getpeername(s, (struct sockaddr *) & foreign, &slen) < 0) {
|
||||
debug("getpeername failed: %.100s", strerror(errno));
|
||||
fatal_cleanup();
|
||||
}
|
||||
|
||||
8
bufaux.c
8
bufaux.c
@ -15,7 +15,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: bufaux.c,v 1.7 1999/11/25 00:54:58 damien Exp $");
|
||||
RCSID("$Id: bufaux.c,v 1.8 2000/03/17 12:40:15 damien Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
|
||||
@ -39,7 +39,7 @@ buffer_put_bignum(Buffer *buffer, BIGNUM *value)
|
||||
{
|
||||
int bits = BN_num_bits(value);
|
||||
int bin_size = (bits + 7) / 8;
|
||||
char *buf = xmalloc(bin_size);
|
||||
char unsigned *buf = xmalloc(bin_size);
|
||||
int oi;
|
||||
char msg[2];
|
||||
|
||||
@ -53,7 +53,7 @@ buffer_put_bignum(Buffer *buffer, BIGNUM *value)
|
||||
PUT_16BIT(msg, bits);
|
||||
buffer_append(buffer, msg, 2);
|
||||
/* Store the binary data. */
|
||||
buffer_append(buffer, buf, oi);
|
||||
buffer_append(buffer, (char *)buf, oi);
|
||||
|
||||
memset(buf, 0, bin_size);
|
||||
xfree(buf);
|
||||
@ -75,7 +75,7 @@ buffer_get_bignum(Buffer *buffer, BIGNUM *value)
|
||||
bytes = (bits + 7) / 8;
|
||||
if (buffer_len(buffer) < bytes)
|
||||
fatal("buffer_get_bignum: input buffer too small");
|
||||
bin = buffer_ptr(buffer);
|
||||
bin = (unsigned char*) buffer_ptr(buffer);
|
||||
BN_bin2bn(bin, bytes, value);
|
||||
buffer_consume(buffer, bytes);
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: channels.c,v 1.18 2000/03/11 09:45:41 damien Exp $");
|
||||
RCSID("$Id: channels.c,v 1.19 2000/03/17 12:40:15 damien Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
#include "packet.h"
|
||||
@ -1041,7 +1041,7 @@ channel_input_port_open(int payload_len)
|
||||
int remote_channel, sock = 0, newch, i;
|
||||
u_short host_port;
|
||||
char *host, *originator_string;
|
||||
int host_len, originator_len;
|
||||
unsigned int host_len, originator_len;
|
||||
struct addrinfo hints, *ai, *aitop;
|
||||
char ntop[NI_MAXHOST], strport[NI_MAXSERV];
|
||||
int gaierr;
|
||||
@ -1341,7 +1341,7 @@ x11_input_open(int payload_len)
|
||||
int remote_channel, display_number, sock = 0, newch;
|
||||
const char *display;
|
||||
char buf[1024], *cp, *remote_host;
|
||||
int remote_len;
|
||||
unsigned int remote_len;
|
||||
struct addrinfo hints, *ai, *aitop;
|
||||
char strport[NI_MAXSERV];
|
||||
int gaierr;
|
||||
|
||||
12
compress.c
12
compress.c
@ -14,7 +14,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: compress.c,v 1.3 1999/11/25 00:54:59 damien Exp $");
|
||||
RCSID("$Id: compress.c,v 1.4 2000/03/17 12:40:16 damien Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
#include "buffer.h"
|
||||
@ -75,13 +75,13 @@ buffer_compress(Buffer * input_buffer, Buffer * output_buffer)
|
||||
return;
|
||||
|
||||
/* Input is the contents of the input buffer. */
|
||||
outgoing_stream.next_in = buffer_ptr(input_buffer);
|
||||
outgoing_stream.next_in = (unsigned char *) buffer_ptr(input_buffer);
|
||||
outgoing_stream.avail_in = buffer_len(input_buffer);
|
||||
|
||||
/* Loop compressing until deflate() returns with avail_out != 0. */
|
||||
do {
|
||||
/* Set up fixed-size output buffer. */
|
||||
outgoing_stream.next_out = buf;
|
||||
outgoing_stream.next_out = (unsigned char *)buf;
|
||||
outgoing_stream.avail_out = sizeof(buf);
|
||||
|
||||
/* Compress as much data into the buffer as possible. */
|
||||
@ -124,10 +124,10 @@ buffer_uncompress(Buffer * input_buffer, Buffer * output_buffer)
|
||||
char buf[4096];
|
||||
int status;
|
||||
|
||||
incoming_stream.next_in = buffer_ptr(input_buffer);
|
||||
incoming_stream.next_in = (unsigned char *) buffer_ptr(input_buffer);
|
||||
incoming_stream.avail_in = buffer_len(input_buffer);
|
||||
|
||||
incoming_stream.next_out = buf;
|
||||
incoming_stream.next_out = (unsigned char *) buf;
|
||||
incoming_stream.avail_out = sizeof(buf);
|
||||
|
||||
for (;;) {
|
||||
@ -136,7 +136,7 @@ buffer_uncompress(Buffer * input_buffer, Buffer * output_buffer)
|
||||
case Z_OK:
|
||||
buffer_append(output_buffer, buf,
|
||||
sizeof(buf) - incoming_stream.avail_out);
|
||||
incoming_stream.next_out = buf;
|
||||
incoming_stream.next_out = (unsigned char *) buf;
|
||||
incoming_stream.avail_out = sizeof(buf);
|
||||
break;
|
||||
case Z_STREAM_END:
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: fingerprint.c,v 1.4 1999/11/24 16:15:25 markus Exp $");
|
||||
RCSID("$Id: fingerprint.c,v 1.5 2000/03/16 20:56:14 markus Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
#include "xmalloc.h"
|
||||
@ -51,7 +51,7 @@ fingerprint(BIGNUM *e, BIGNUM *n)
|
||||
static char retval[80];
|
||||
MD5_CTX md;
|
||||
unsigned char d[16];
|
||||
char *buf;
|
||||
unsigned char *buf;
|
||||
int nlen, elen;
|
||||
|
||||
nlen = BN_num_bytes(n);
|
||||
|
||||
6
packet.h
6
packet.h
@ -13,7 +13,7 @@
|
||||
*
|
||||
*/
|
||||
|
||||
/* RCSID("$Id: packet.h,v 1.9 2000/01/14 04:45:51 damien Exp $"); */
|
||||
/* RCSID("$Id: packet.h,v 1.10 2000/03/17 12:40:16 damien Exp $"); */
|
||||
|
||||
#ifndef PACKET_H
|
||||
#define PACKET_H
|
||||
@ -151,7 +151,7 @@ char *packet_get_string(unsigned int *length_ptr);
|
||||
* The error message should not contain a newline. The total length of the
|
||||
* message must not exceed 1024 bytes.
|
||||
*/
|
||||
void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2)));;
|
||||
void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2)));
|
||||
|
||||
/*
|
||||
* Sends a diagnostic message to the other side. This message can be sent at
|
||||
@ -163,7 +163,7 @@ void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1,
|
||||
* remote side protocol flags do not indicate that it supports SSH_MSG_DEBUG,
|
||||
* this will do nothing.
|
||||
*/
|
||||
void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));;
|
||||
void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));
|
||||
|
||||
/* Checks if there is any buffered output, and tries to write some of the output. */
|
||||
void packet_write_poll(void);
|
||||
|
||||
4
radix.c
4
radix.c
@ -213,7 +213,7 @@ creds_to_radix(CREDENTIALS *creds, unsigned char *buf)
|
||||
p += creds->ticket_st.length;
|
||||
len = p - temp;
|
||||
|
||||
return (uuencode(temp, len, buf));
|
||||
return (uuencode((unsigned char *)temp, len, (char *)buf));
|
||||
}
|
||||
|
||||
int
|
||||
@ -225,7 +225,7 @@ radix_to_creds(const char *buf, CREDENTIALS *creds)
|
||||
char version;
|
||||
char temp[2048];
|
||||
|
||||
if (!(len = uudecode(buf, temp, sizeof(temp))))
|
||||
if (!(len = uudecode(buf, (unsigned char *)temp, sizeof(temp))))
|
||||
return 0;
|
||||
|
||||
p = temp;
|
||||
|
||||
6
rsa.c
6
rsa.c
@ -35,7 +35,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: rsa.c,v 1.10 2000/03/09 10:27:51 damien Exp $");
|
||||
RCSID("$Id: rsa.c,v 1.11 2000/03/17 12:40:16 damien Exp $");
|
||||
|
||||
#include "rsa.h"
|
||||
#include "ssh.h"
|
||||
@ -145,7 +145,7 @@ rsa_generate_key(RSA *prv, RSA *pub, unsigned int bits)
|
||||
void
|
||||
rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
|
||||
{
|
||||
char *inbuf, *outbuf;
|
||||
unsigned char *inbuf, *outbuf;
|
||||
int len, ilen, olen;
|
||||
|
||||
if (BN_num_bits(key->e) < 2 || !BN_is_odd(key->e))
|
||||
@ -173,7 +173,7 @@ rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
|
||||
void
|
||||
rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
|
||||
{
|
||||
char *inbuf, *outbuf;
|
||||
unsigned char *inbuf, *outbuf;
|
||||
int len, ilen, olen;
|
||||
|
||||
olen = BN_num_bytes(key->n);
|
||||
|
||||
6
scp.c
6
scp.c
@ -45,7 +45,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: scp.c,v 1.17 2000/03/09 10:27:51 damien Exp $");
|
||||
RCSID("$Id: scp.c,v 1.18 2000/03/17 12:40:16 damien Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
#include "xmalloc.h"
|
||||
@ -1008,7 +1008,7 @@ run_err(const char *fmt,...)
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: scp.c,v 1.17 2000/03/09 10:27:51 damien Exp $
|
||||
* $Id: scp.c,v 1.18 2000/03/17 12:40:16 damien Exp $
|
||||
*/
|
||||
|
||||
char *
|
||||
@ -1120,7 +1120,7 @@ alarmtimer(int wait)
|
||||
}
|
||||
|
||||
void
|
||||
updateprogressmeter(int sig)
|
||||
updateprogressmeter(int ignore)
|
||||
{
|
||||
int save_errno = errno;
|
||||
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
/* $OpenBSD: ssh-agent.c,v 1.25 2000/01/02 21:51:03 markus Exp $ */
|
||||
/* $OpenBSD: ssh-agent.c,v 1.26 2000/03/16 20:56:14 markus Exp $ */
|
||||
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
@ -9,7 +9,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$OpenBSD: ssh-agent.c,v 1.25 2000/01/02 21:51:03 markus Exp $");
|
||||
RCSID("$OpenBSD: ssh-agent.c,v 1.26 2000/03/16 20:56:14 markus Exp $");
|
||||
|
||||
#include "ssh.h"
|
||||
#include "rsa.h"
|
||||
@ -417,6 +417,7 @@ after_select(fd_set *readset, fd_set *writeset)
|
||||
{
|
||||
unsigned int i;
|
||||
int len, sock;
|
||||
socklen_t slen;
|
||||
char buf[1024];
|
||||
struct sockaddr_un sunaddr;
|
||||
|
||||
@ -426,8 +427,8 @@ after_select(fd_set *readset, fd_set *writeset)
|
||||
break;
|
||||
case AUTH_SOCKET:
|
||||
if (FD_ISSET(sockets[i].fd, readset)) {
|
||||
len = sizeof(sunaddr);
|
||||
sock = accept(sockets[i].fd, (struct sockaddr *) & sunaddr, &len);
|
||||
slen = sizeof(sunaddr);
|
||||
sock = accept(sockets[i].fd, (struct sockaddr *) & sunaddr, &slen);
|
||||
if (sock < 0) {
|
||||
perror("accept from AUTH_SOCKET");
|
||||
break;
|
||||
|
||||
@ -7,7 +7,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$Id: ssh-keygen.c,v 1.11 2000/03/09 10:27:51 damien Exp $");
|
||||
RCSID("$Id: ssh-keygen.c,v 1.12 2000/03/17 12:40:17 damien Exp $");
|
||||
|
||||
#include "rsa.h"
|
||||
#include "ssh.h"
|
||||
@ -85,6 +85,7 @@ do_fingerprint(struct passwd *pw)
|
||||
RSA *public_key;
|
||||
char *comment = NULL, *cp, *ep, line[16*1024];
|
||||
int i, skip = 0, num = 1, invalid = 1;
|
||||
unsigned int ignore;
|
||||
struct stat st;
|
||||
|
||||
if (!have_identity)
|
||||
@ -142,7 +143,7 @@ do_fingerprint(struct passwd *pw)
|
||||
*cp++ = '\0';
|
||||
}
|
||||
ep = cp;
|
||||
if (auth_rsa_read_key(&cp, &i, e, n)) {
|
||||
if (auth_rsa_read_key(&cp, &ignore, e, n)) {
|
||||
invalid = 0;
|
||||
comment = *cp ? cp : comment;
|
||||
printf("%d %s %s\n", BN_num_bits(n),
|
||||
|
||||
496
ssh.1
496
ssh.1
@ -9,7 +9,7 @@
|
||||
.\"
|
||||
.\" Created: Sat Apr 22 21:55:14 1995 ylo
|
||||
.\"
|
||||
.\" $Id: ssh.1,v 1.18 2000/03/09 10:27:52 damien Exp $
|
||||
.\" $Id: ssh.1,v 1.19 2000/03/17 12:40:17 damien Exp $
|
||||
.\"
|
||||
.Dd September 25, 1999
|
||||
.Dt SSH 1
|
||||
@ -52,9 +52,11 @@
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
(Secure Shell) is a program for logging into a remote machine and for
|
||||
executing commands on a remote machine. It is intended to replace
|
||||
executing commands on a remote machine.
|
||||
It is intended to replace
|
||||
rlogin and rsh, and provide secure encrypted communications between
|
||||
two untrusted hosts over an insecure network. X11 connections and
|
||||
two untrusted hosts over an insecure network.
|
||||
X11 connections and
|
||||
arbitrary TCP/IP ports can also be forwarded over the secure channel.
|
||||
.Pp
|
||||
.Nm
|
||||
@ -76,15 +78,16 @@ or
|
||||
exists in the user's home directory on the
|
||||
remote machine and contains a line containing the name of the client
|
||||
machine and the name of the user on that machine, the user is
|
||||
permitted to log in. This form of authentication alone is normally not
|
||||
permitted to log in.
|
||||
This form of authentication alone is normally not
|
||||
allowed by the server because it is not secure.
|
||||
.Pp
|
||||
The second (and primary) authentication method is the
|
||||
.Pa rhosts
|
||||
or
|
||||
.Pa hosts.equiv
|
||||
method combined with RSA-based host authentication. It
|
||||
means that if the login would be permitted by
|
||||
method combined with RSA-based host authentication.
|
||||
It means that if the login would be permitted by
|
||||
.Pa \&.rhosts ,
|
||||
.Pa \&.shosts ,
|
||||
.Pa /etc/hosts.equiv ,
|
||||
@ -97,10 +100,10 @@ and
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
in the
|
||||
.Sx FILES
|
||||
section), only then login is
|
||||
permitted. This authentication method closes security holes due to IP
|
||||
spoofing, DNS spoofing and routing spoofing. [Note to the
|
||||
administrator:
|
||||
section), only then login is permitted.
|
||||
This authentication method closes security holes due to IP
|
||||
spoofing, DNS spoofing and routing spoofing.
|
||||
[Note to the administrator:
|
||||
.Pa /etc/hosts.equiv ,
|
||||
.Pa \&.rhosts ,
|
||||
and the rlogin/rsh protocol in general, are inherently insecure and should be
|
||||
@ -112,34 +115,39 @@ supports RSA based authentication.
|
||||
The scheme is based on public-key cryptography: there are cryptosystems
|
||||
where encryption and decryption are done using separate keys, and it
|
||||
is not possible to derive the decryption key from the encryption key.
|
||||
RSA is one such system. The idea is that each user creates a public/private
|
||||
key pair for authentication purposes. The
|
||||
server knows the public key, and only the user knows the private key.
|
||||
RSA is one such system.
|
||||
The idea is that each user creates a public/private
|
||||
key pair for authentication purposes.
|
||||
The server knows the public key, and only the user knows the private key.
|
||||
The file
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
lists the public keys that are permitted for logging
|
||||
in. When the user logs in, the
|
||||
in.
|
||||
When the user logs in, the
|
||||
.Nm
|
||||
program tells the server which key pair it would like to use for
|
||||
authentication. The server checks if this key is permitted, and if
|
||||
authentication.
|
||||
The server checks if this key is permitted, and if
|
||||
so, sends the user (actually the
|
||||
.Nm
|
||||
program running on behalf of the user) a challenge, a random number,
|
||||
encrypted by the user's public key. The challenge can only be
|
||||
decrypted using the proper private key. The user's client then decrypts the
|
||||
encrypted by the user's public key.
|
||||
The challenge can only be
|
||||
decrypted using the proper private key.
|
||||
The user's client then decrypts the
|
||||
challenge using the private key, proving that he/she knows the private
|
||||
key but without disclosing it to the server.
|
||||
.Pp
|
||||
.Nm
|
||||
implements the RSA authentication protocol automatically. The user
|
||||
creates his/her RSA key pair by running
|
||||
implements the RSA authentication protocol automatically.
|
||||
The user creates his/her RSA key pair by running
|
||||
.Xr ssh-keygen 1 .
|
||||
This stores the private key in
|
||||
.Pa \&.ssh/identity
|
||||
and the public key in
|
||||
.Pa \&.ssh/identity.pub
|
||||
in the user's home directory. The user should then
|
||||
copy the
|
||||
in the user's home directory.
|
||||
The user should then copy the
|
||||
.Pa identity.pub
|
||||
to
|
||||
.Pa \&.ssh/authorized_keys
|
||||
@ -148,24 +156,28 @@ in his/her home directory on the remote machine (the
|
||||
file corresponds to the conventional
|
||||
.Pa \&.rhosts
|
||||
file, and has one key
|
||||
per line, though the lines can be very long). After this, the user
|
||||
can log in without giving the password. RSA authentication is much
|
||||
per line, though the lines can be very long).
|
||||
After this, the user can log in without giving the password.
|
||||
RSA authentication is much
|
||||
more secure than rhosts authentication.
|
||||
.Pp
|
||||
The most convenient way to use RSA authentication may be with an
|
||||
authentication agent. See
|
||||
authentication agent.
|
||||
See
|
||||
.Xr ssh-agent 1
|
||||
for more information.
|
||||
.Pp
|
||||
If other authentication methods fail,
|
||||
.Nm
|
||||
prompts the user for a password. The password is sent to the remote
|
||||
prompts the user for a password.
|
||||
The password is sent to the remote
|
||||
host for checking; however, since all communications are encrypted,
|
||||
the password cannot be seen by someone listening on the network.
|
||||
.Pp
|
||||
When the user's identity has been accepted by the server, the server
|
||||
either executes the given command, or logs into the machine and gives
|
||||
the user a normal shell on the remote machine. All communication with
|
||||
the user a normal shell on the remote machine.
|
||||
All communication with
|
||||
the remote command or shell will be automatically encrypted.
|
||||
.Pp
|
||||
If a pseudo-terminal has been allocated (normal login session), the
|
||||
@ -182,19 +194,22 @@ the session blocks waiting for forwarded X11 or TCP/IP
|
||||
connections to terminate, it can be backgrounded with
|
||||
.Ic ~&
|
||||
(this should not be used while the user shell is active, as it can cause the
|
||||
shell to hang). All available escapes can be listed with
|
||||
shell to hang).
|
||||
All available escapes can be listed with
|
||||
.Ic ~? .
|
||||
.Pp
|
||||
A single tilde character can be sent as
|
||||
.Ic ~~
|
||||
(or by following the tilde by a character other than those described above).
|
||||
The escape character must always follow a newline to be interpreted as
|
||||
special. The escape character can be changed in configuration files
|
||||
or on the command line.
|
||||
special.
|
||||
The escape character can be changed in configuration files
|
||||
or on the command line.
|
||||
.Pp
|
||||
If no pseudo tty has been allocated, the
|
||||
session is transparent and can be used to reliably transfer binary
|
||||
data. On most systems, setting the escape character to
|
||||
data.
|
||||
On most systems, setting the escape character to
|
||||
.Dq none
|
||||
will also make the session transparent even if a tty is used.
|
||||
.Pp
|
||||
@ -210,7 +225,8 @@ environment variable is set), the connection to the X11 display is
|
||||
automatically forwarded to the remote side in such a way that any X11
|
||||
programs started from the shell (or command) will go through the
|
||||
encrypted channel, and the connection to the real X server will be made
|
||||
from the local machine. The user should not manually set
|
||||
from the local machine.
|
||||
The user should not manually set
|
||||
.Ev DISPLAY .
|
||||
Forwarding of X11 connections can be
|
||||
configured on the command line or in configuration files.
|
||||
@ -220,7 +236,8 @@ The
|
||||
value set by
|
||||
.Nm
|
||||
will point to the server machine, but with a display number greater
|
||||
than zero. This is normal, and happens because
|
||||
than zero.
|
||||
This is normal, and happens because
|
||||
.Nm
|
||||
creates a
|
||||
.Dq proxy
|
||||
@ -232,7 +249,8 @@ will also automatically set up Xauthority data on the server machine.
|
||||
For this purpose, it will generate a random authorization cookie,
|
||||
store it in Xauthority on the server, and verify that any forwarded
|
||||
connections carry this cookie and replace it by the real cookie when
|
||||
the connection is opened. The real authentication cookie is never
|
||||
the connection is opened.
|
||||
The real authentication cookie is never
|
||||
sent to the server machine (and no cookies are sent in the plain).
|
||||
.Pp
|
||||
If the user is using an authentication agent, the connection to the agent
|
||||
@ -240,25 +258,29 @@ is automatically forwarded to the remote side unless disabled on
|
||||
command line or in a configuration file.
|
||||
.Pp
|
||||
Forwarding of arbitrary TCP/IP connections over the secure channel can
|
||||
be specified either on command line or in a configuration file. One
|
||||
possible application of TCP/IP forwarding is a secure connection to an
|
||||
be specified either on command line or in a configuration file.
|
||||
One possible application of TCP/IP forwarding is a secure connection to an
|
||||
electronic purse; another is going trough firewalls.
|
||||
.Pp
|
||||
.Nm
|
||||
automatically maintains and checks a database containing RSA-based
|
||||
identifications for all hosts it has ever been used with. The
|
||||
database is stored in
|
||||
identifications for all hosts it has ever been used with.
|
||||
The database is stored in
|
||||
.Pa \&.ssh/known_hosts
|
||||
in the user's home directory. Additionally, the file
|
||||
in the user's home directory.
|
||||
Additionally, the file
|
||||
.Pa /etc/ssh_known_hosts
|
||||
is automatically checked for known hosts. Any new hosts are
|
||||
automatically added to the user's file. If a host's identification
|
||||
is automatically checked for known hosts.
|
||||
Any new hosts are automatically added to the user's file.
|
||||
If a host's identification
|
||||
ever changes,
|
||||
.Nm
|
||||
warns about this and disables password authentication to prevent a
|
||||
trojan horse from getting the user's password. Another purpose of
|
||||
trojan horse from getting the user's password.
|
||||
Another purpose of
|
||||
this mechanism is to prevent man-in-the-middle attacks which could
|
||||
otherwise be used to circumvent the encryption. The
|
||||
otherwise be used to circumvent the encryption.
|
||||
The
|
||||
.Cm StrictHostKeyChecking
|
||||
option (see below) can be used to prevent logins to machines whose
|
||||
host key is not known or has changed.
|
||||
@ -270,7 +292,8 @@ also be specified on a per-host basis in the configuration file.
|
||||
.It Fl c Ar blowfish|3des
|
||||
Selects the cipher to use for encrypting the session.
|
||||
.Ar 3des
|
||||
is used by default. It is believed to be secure.
|
||||
is used by default.
|
||||
It is believed to be secure.
|
||||
.Ar 3des
|
||||
(triple-des) is an encrypt-decrypt-encrypt triple with three different keys.
|
||||
It is presumably more secure than the
|
||||
@ -278,26 +301,28 @@ It is presumably more secure than the
|
||||
cipher which is no longer supported in ssh.
|
||||
.Ar blowfish
|
||||
is a fast block cipher, it appears very secure and is much faster than
|
||||
.Ar 3des .
|
||||
.Ar 3des .
|
||||
.It Fl e Ar ch|^ch|none
|
||||
Sets the escape character for sessions with a pty (default:
|
||||
.Ql ~ ) .
|
||||
The escape character is only recognized at the beginning of a line. The
|
||||
escape character followed by a dot
|
||||
The escape character is only recognized at the beginning of a line.
|
||||
The escape character followed by a dot
|
||||
.Pq Ql \&.
|
||||
closes the connection, followed
|
||||
by control-Z suspends the connection, and followed by itself sends the
|
||||
escape character once. Setting the character to
|
||||
escape character once.
|
||||
Setting the character to
|
||||
.Dq none
|
||||
disables any escapes and makes the session fully transparent.
|
||||
.It Fl f
|
||||
Requests
|
||||
.Nm
|
||||
to go to background just before command execution. This is useful
|
||||
if
|
||||
to go to background just before command execution.
|
||||
This is useful if
|
||||
.Nm
|
||||
is going to ask for passwords or passphrases, but the user
|
||||
wants it in the background. This implies
|
||||
wants it in the background.
|
||||
This implies
|
||||
.Fl n .
|
||||
The recommended way to start X11 programs at a remote site is with
|
||||
something like
|
||||
@ -306,11 +331,13 @@ something like
|
||||
Allows remote hosts to connect to local forwarded ports.
|
||||
.It Fl i Ar identity_file
|
||||
Selects the file from which the identity (private key) for
|
||||
RSA authentication is read. Default is
|
||||
RSA authentication is read.
|
||||
Default is
|
||||
.Pa \&.ssh/identity
|
||||
in the user's home directory. Identity files may also be specified on
|
||||
a per-host basis in the configuration file. It is possible to have
|
||||
multiple
|
||||
in the user's home directory.
|
||||
Identity files may also be specified on
|
||||
a per-host basis in the configuration file.
|
||||
It is possible to have multiple
|
||||
.Fl i
|
||||
options (and multiple identities specified in
|
||||
configuration files).
|
||||
@ -318,16 +345,17 @@ configuration files).
|
||||
Disables forwarding of Kerberos tickets and AFS tokens. This may
|
||||
also be specified on a per-host basis in the configuration file.
|
||||
.It Fl l Ar login_name
|
||||
Specifies the user to log in as on the remote machine. This may also
|
||||
be specified on a per-host basis in the configuration file.
|
||||
Specifies the user to log in as on the remote machine.
|
||||
This also may be specified on a per-host basis in the configuration file.
|
||||
.It Fl n
|
||||
Redirects stdin from
|
||||
.Pa /dev/null
|
||||
(actually, prevents reading from stdin).
|
||||
This must be used when
|
||||
.Nm
|
||||
is run in the background. A common trick is to use this to run X11
|
||||
programs in a remote machine. For example,
|
||||
is run in the background.
|
||||
A common trick is to use this to run X11 programs on a remote machine.
|
||||
For example,
|
||||
.Ic ssh -n shadows.cs.hut.fi emacs &
|
||||
will start an emacs on shadows.cs.hut.fi, and the X11
|
||||
connection will be automatically forwarded over an encrypted channel.
|
||||
@ -342,10 +370,11 @@ option.)
|
||||
.It Fl o Ar option
|
||||
Can be used to give options in the format used in the config file.
|
||||
This is useful for specifying options for which there is no separate
|
||||
command-line flag. The option has the same format as a line in the
|
||||
configuration file.
|
||||
command-line flag.
|
||||
The option has the same format as a line in the configuration file.
|
||||
.It Fl p Ar port
|
||||
Port to connect to on the remote host. This can be specified on a
|
||||
Port to connect to on the remote host.
|
||||
This can be specified on a
|
||||
per-host basis in the configuration file.
|
||||
.It Fl P
|
||||
Use a non-privileged port for outgoing connections.
|
||||
@ -356,35 +385,40 @@ Note that this option turns off
|
||||
and
|
||||
.Cm RhostsRSAAuthentication .
|
||||
.It Fl q
|
||||
Quiet mode. Causes all warning and diagnostic messages to be
|
||||
suppressed. Only fatal errors are displayed.
|
||||
Quiet mode.
|
||||
Causes all warning and diagnostic messages to be suppressed.
|
||||
Only fatal errors are displayed.
|
||||
.It Fl t
|
||||
Force pseudo-tty allocation. This can be used to execute arbitary
|
||||
screen-based programs on a remote machine, which can be very useful
|
||||
e.g. when implementing menu services.
|
||||
Force pseudo-tty allocation.
|
||||
This can be used to execute arbitary
|
||||
screen-based programs on a remote machine, which can be very useful,
|
||||
e.g., when implementing menu services.
|
||||
.It Fl v
|
||||
Verbose mode. Causes
|
||||
Verbose mode.
|
||||
Causes
|
||||
.Nm
|
||||
to print debugging messages about its progress. This is helpful in
|
||||
to print debugging messages about its progress.
|
||||
This is helpful in
|
||||
debugging connection, authentication, and configuration problems.
|
||||
The verbose mode is also used to display
|
||||
.Xr skey 1
|
||||
challenges, if the user entered "s/key" as password.
|
||||
.It Fl x
|
||||
Disables X11 forwarding. This can also be specified on a per-host
|
||||
basis in a configuration file.
|
||||
Disables X11 forwarding.
|
||||
This can also be specified on a per-host basis in a configuration file.
|
||||
.It Fl X
|
||||
Enables X11 forwarding.
|
||||
.It Fl C
|
||||
Requests compression of all data (including stdin, stdout, stderr, and
|
||||
data for forwarded X11 and TCP/IP connections). The compression
|
||||
algorithm is the same used by
|
||||
data for forwarded X11 and TCP/IP connections).
|
||||
The compression algorithm is the same used by
|
||||
.Xr gzip 1 ,
|
||||
and the
|
||||
.Dq level
|
||||
can be controlled by the
|
||||
.Cm CompressionLevel
|
||||
option (see below). Compression is desirable on modem lines and other
|
||||
option (see below).
|
||||
Compression is desirable on modem lines and other
|
||||
slow connections, but will only slow down things on fast networks.
|
||||
The default value can be set on a host-by-host basis in the
|
||||
configuration files; see the
|
||||
@ -392,8 +426,8 @@ configuration files; see the
|
||||
option below.
|
||||
.It Fl L Ar port:host:hostport
|
||||
Specifies that the given port on the local (client) host is to be
|
||||
forwarded to the given host and port on the remote side. This works
|
||||
by allocating a socket to listen to
|
||||
forwarded to the given host and port on the remote side.
|
||||
This works by allocating a socket to listen to
|
||||
.Ar port
|
||||
on the local side, and whenever a connection is made to this port, the
|
||||
connection is forwarded over the secure channel, and a connection is
|
||||
@ -401,14 +435,15 @@ made to
|
||||
.Ar host
|
||||
port
|
||||
.Ar hostport
|
||||
from the remote machine. Port forwardings can also be specified in the
|
||||
configuration file. Only root can forward privileged ports.
|
||||
from the remote machine.
|
||||
Port forwardings can also be specified in the configuration file.
|
||||
Only root can forward privileged ports.
|
||||
IPv6 addresses can be specified with an alternative syntax:
|
||||
.Ar port/host/hostport
|
||||
.It Fl R Ar port:host:hostport
|
||||
Specifies that the given port on the remote (server) host is to be
|
||||
forwarded to the given host and port on the local side. This works
|
||||
by allocating a socket to listen to
|
||||
forwarded to the given host and port on the local side.
|
||||
This works by allocating a socket to listen to
|
||||
.Ar port
|
||||
on the remote side, and whenever a connection is made to this port, the
|
||||
connection is forwarded over the secure channel, and a connection is
|
||||
@ -416,8 +451,9 @@ made to
|
||||
.Ar host
|
||||
port
|
||||
.Ar hostport
|
||||
from the local machine. Port forwardings can also be specified in the
|
||||
configuration file. Privileged ports can be forwarded only when
|
||||
from the local machine.
|
||||
Port forwardings can also be specified in the configuration file.
|
||||
Privileged ports can be forwarded only when
|
||||
logging in as root on the remote machine.
|
||||
.It Fl 4
|
||||
Forces
|
||||
@ -436,10 +472,12 @@ command line options, user's configuration file
|
||||
and system-wide configuration file
|
||||
.Pq Pa /etc/ssh_config .
|
||||
For each parameter, the first obtained value
|
||||
will be used. The configuration files contain sections bracketed by
|
||||
"Host" specifications, and that section is only applied for hosts that
|
||||
match one of the patterns given in the specification. The matched
|
||||
host name is the one given on the command line.
|
||||
will be used.
|
||||
The configuration files contain sections bracketed by
|
||||
.Dq Host
|
||||
specifications, and that section is only applied for hosts that
|
||||
match one of the patterns given in the specification.
|
||||
The matched host name is the one given on the command line.
|
||||
.Pp
|
||||
Since the first obtained value for each parameter is used, more
|
||||
host-specific declarations should be given near the beginning of the
|
||||
@ -466,10 +504,12 @@ given after the keyword.
|
||||
and
|
||||
.Ql ?
|
||||
can be used as wildcards in the
|
||||
patterns. A single
|
||||
patterns.
|
||||
A single
|
||||
.Ql \&*
|
||||
as a pattern can be used to provide global
|
||||
defaults for all hosts. The host is the
|
||||
defaults for all hosts.
|
||||
The host is the
|
||||
.Ar hostname
|
||||
argument given on the command line (i.e., the name is not converted to
|
||||
a canonicalized host name before matching).
|
||||
@ -482,9 +522,10 @@ or
|
||||
.It Cm BatchMode
|
||||
If set to
|
||||
.Dq yes ,
|
||||
passphrase/password querying will be disabled. This
|
||||
option is useful in scripts and other batch jobs where you have no
|
||||
user to supply the password. The argument must be
|
||||
passphrase/password querying will be disabled.
|
||||
This option is useful in scripts and other batch jobs where you have no
|
||||
user to supply the password.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -498,33 +539,37 @@ If the option is set to
|
||||
.Dq no ,
|
||||
the check will not be executed.
|
||||
.It Cm Cipher
|
||||
Specifies the cipher to use for encrypting the session. Currently,
|
||||
Specifies the cipher to use for encrypting the session.
|
||||
Currently,
|
||||
.Dq blowfish ,
|
||||
and
|
||||
.Dq 3des
|
||||
are supported. The default is
|
||||
are supported.
|
||||
The default is
|
||||
.Dq 3des .
|
||||
.It Cm Compression
|
||||
Specifies whether to use compression. The argument must be
|
||||
Specifies whether to use compression.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
.It Cm CompressionLevel
|
||||
Specifies the compression level to use if compression is enable. The
|
||||
argument must be an integer from 1 (fast) to 9 (slow, best). The
|
||||
default level is 6, which is good for most applications. The meaning
|
||||
of the values is the same as in
|
||||
Specifies the compression level to use if compression is enable.
|
||||
The argument must be an integer from 1 (fast) to 9 (slow, best).
|
||||
The default level is 6, which is good for most applications.
|
||||
The meaning of the values is the same as in
|
||||
.Xr gzip 1 .
|
||||
.It Cm ConnectionAttempts
|
||||
Specifies the number of tries (one per second) to make before falling
|
||||
back to rsh or exiting. The argument must be an integer. This may be
|
||||
useful in scripts if the connection sometimes fails.
|
||||
back to rsh or exiting.
|
||||
The argument must be an integer.
|
||||
This may be useful in scripts if the connection sometimes fails.
|
||||
.It Cm EscapeChar
|
||||
Sets the escape character (default:
|
||||
.Ql ~ ) .
|
||||
The escape character can also
|
||||
be set on the command line. The argument should be a single
|
||||
character,
|
||||
be set on the command line.
|
||||
The argument should be a single character,
|
||||
.Ql ^
|
||||
followed by a letter, or
|
||||
.Dq none
|
||||
@ -539,13 +584,15 @@ fails due to a connection refused error (there is no
|
||||
listening on the remote host),
|
||||
.Xr rsh 1
|
||||
should automatically be used instead (after a suitable warning about
|
||||
the session being unencrypted). The argument must be
|
||||
the session being unencrypted).
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
.It Cm ForwardAgent
|
||||
Specifies whether the connection to the authentication agent (if any)
|
||||
will be forwarded to the remote machine. The argument must be
|
||||
will be forwarded to the remote machine.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -553,7 +600,8 @@ or
|
||||
Specifies whether X11 connections will be automatically redirected
|
||||
over the secure channel and
|
||||
.Ev DISPLAY
|
||||
set. The argument must be
|
||||
set.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -572,10 +620,10 @@ The default is
|
||||
Specifies a file to use instead of
|
||||
.Pa /etc/ssh_known_hosts .
|
||||
.It Cm HostName
|
||||
Specifies the real host name to log into. This can be used to specify
|
||||
nicnames or abbreviations for hosts. Default is the name given on the
|
||||
command line. Numeric IP addresses are also permitted (both on the
|
||||
command line and in
|
||||
Specifies the real host name to log into.
|
||||
This can be used to specify nicknames or abbreviations for hosts.
|
||||
Default is the name given on the command line.
|
||||
Numeric IP addresses are also permitted (both on the command line and in
|
||||
.Cm HostName
|
||||
specifications).
|
||||
.It Cm IdentityFile
|
||||
@ -584,22 +632,26 @@ is read (default
|
||||
.Pa .ssh/identity
|
||||
in the user's home directory).
|
||||
Additionally, any identities represented by the authentication agent
|
||||
will be used for authentication. The file name may use the tilde
|
||||
syntax to refer to a user's home directory. It is possible to have
|
||||
will be used for authentication.
|
||||
The file name may use the tilde
|
||||
syntax to refer to a user's home directory.
|
||||
It is possible to have
|
||||
multiple identity files specified in configuration files; all these
|
||||
identities will be tried in sequence.
|
||||
.It Cm KeepAlive
|
||||
Specifies whether the system should send keepalive messages to the
|
||||
other side. If they are sent, death of the connection or crash of one
|
||||
of the machines will be properly noticed. However, this means that
|
||||
other side.
|
||||
If they are sent, death of the connection or crash of one
|
||||
of the machines will be properly noticed.
|
||||
However, this means that
|
||||
connections will die if the route is down temporarily, and some people
|
||||
find it annoying.
|
||||
.Pp
|
||||
The default is
|
||||
.Dq yes
|
||||
(to send keepalives), and the client will notice
|
||||
if the network goes down or the remote host dies. This is important
|
||||
in scripts, and many users want it too.
|
||||
if the network goes down or the remote host dies.
|
||||
This is important in scripts, and many users want it too.
|
||||
.Pp
|
||||
To disable keepalives, the value should be set to
|
||||
.Dq no
|
||||
@ -619,11 +671,12 @@ or
|
||||
.Dq no .
|
||||
.It Cm LocalForward
|
||||
Specifies that a TCP/IP port on the local machine be forwarded over
|
||||
the secure channel to given host:port from the remote machine. The
|
||||
first argument must be a port number, and the second must be
|
||||
host:port. Multiple forwardings may be specified, and additional
|
||||
forwardings can be given on the command line. Only the root can
|
||||
forward privileged ports.
|
||||
the secure channel to given host:port from the remote machine.
|
||||
The first argument must be a port number, and the second must be
|
||||
host:port.
|
||||
Multiple forwardings may be specified, and additional
|
||||
forwardings can be given on the command line.
|
||||
Only the superuser can forward privileged ports.
|
||||
.It Cm LogLevel
|
||||
Gives the verbosity level that is used when logging messages from
|
||||
.Nm ssh .
|
||||
@ -634,25 +687,33 @@ The default is INFO.
|
||||
Specifies the number of password prompts before giving up. The
|
||||
argument to this keyword must be an integer. Default is 3.
|
||||
.It Cm PasswordAuthentication
|
||||
Specifies whether to use password authentication. The argument to
|
||||
this keyword must be
|
||||
Specifies whether to use password authentication.
|
||||
The argument to this keyword must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
.It Cm Port
|
||||
Specifies the port number to connect on the remote host. Default is
|
||||
22.
|
||||
Specifies the port number to connect on the remote host.
|
||||
Default is 22.
|
||||
.It Cm ProxyCommand
|
||||
Specifies the command to use to connect to the server. The command
|
||||
string extends to the end of the line, and is executed with /bin/sh.
|
||||
In the command string, %h will be substituted by the host name to
|
||||
connect and %p by the port. The command can be basically anything,
|
||||
and should read from its stdin and write to its stdout. It should
|
||||
eventually connect an
|
||||
Specifies the command to use to connect to the server.
|
||||
The command
|
||||
string extends to the end of the line, and is executed with
|
||||
.Pa /bin/sh .
|
||||
In the command string,
|
||||
.Ql %h
|
||||
will be substituted by the host name to
|
||||
connect and
|
||||
.Ql %p
|
||||
by the port.
|
||||
The command can be basically anything,
|
||||
and should read from its standard input and write to its standard output.
|
||||
It should eventually connect an
|
||||
.Xr sshd 8
|
||||
server running on some machine, or execute
|
||||
.Ic sshd -i
|
||||
somewhere. Host key management will be done using the
|
||||
somewhere.
|
||||
Host key management will be done using the
|
||||
HostName of the host being connected (defaulting to the name typed by
|
||||
the user).
|
||||
Note that
|
||||
@ -661,32 +722,37 @@ is not available for connects with a proxy command.
|
||||
.Pp
|
||||
.It Cm RemoteForward
|
||||
Specifies that a TCP/IP port on the remote machine be forwarded over
|
||||
the secure channel to given host:port from the local machine. The
|
||||
first argument must be a port number, and the second must be
|
||||
host:port. Multiple forwardings may be specified, and additional
|
||||
forwardings can be given on the command line. Only the root can
|
||||
forward privileged ports.
|
||||
the secure channel to given host:port from the local machine.
|
||||
The first argument must be a port number, and the second must be
|
||||
host:port.
|
||||
Multiple forwardings may be specified, and additional
|
||||
forwardings can be given on the command line.
|
||||
Only the superuser can forward privileged ports.
|
||||
.It Cm RhostsAuthentication
|
||||
Specifies whether to try rhosts based authentication. Note that this
|
||||
Specifies whether to try rhosts based authentication.
|
||||
Note that this
|
||||
declaration only affects the client side and has no effect whatsoever
|
||||
on security. Disabling rhosts authentication may reduce
|
||||
on security.
|
||||
Disabling rhosts authentication may reduce
|
||||
authentication time on slow connections when rhosts authentication is
|
||||
not used. Most servers do not permit RhostsAuthentication because it
|
||||
is not secure (see RhostsRSAAuthentication). The argument to this
|
||||
keyword must be
|
||||
not used.
|
||||
Most servers do not permit RhostsAuthentication because it
|
||||
is not secure (see RhostsRSAAuthentication).
|
||||
The argument to this keyword must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
.It Cm RhostsRSAAuthentication
|
||||
Specifies whether to try rhosts based authentication with RSA host
|
||||
authentication. This is the primary authentication method for most
|
||||
sites. The argument must be
|
||||
authentication.
|
||||
This is the primary authentication method for most sites.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
.It Cm RSAAuthentication
|
||||
Specifies whether to try RSA authentication. The argument to this
|
||||
keyword must be
|
||||
Specifies whether to try RSA authentication.
|
||||
The argument to this keyword must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -696,8 +762,8 @@ running.
|
||||
.It Cm SkeyAuthentication
|
||||
Specifies whether to use
|
||||
.Xr skey 1
|
||||
authentication. The argument to
|
||||
this keyword must be
|
||||
authentication.
|
||||
The argument to this keyword must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -709,16 +775,19 @@ If this flag is set to
|
||||
.Nm
|
||||
ssh will never automatically add host keys to the
|
||||
.Pa $HOME/.ssh/known_hosts
|
||||
file, and refuses to connect hosts whose host key has changed. This
|
||||
provides maximum protection against trojan horse attacks. However, it
|
||||
can be somewhat annoying if you don't have good
|
||||
file, and refuses to connect hosts whose host key has changed.
|
||||
This provides maximum protection against trojan horse attacks.
|
||||
However, it can be somewhat annoying if you don't have good
|
||||
.Pa /etc/ssh_known_hosts
|
||||
files installed and frequently
|
||||
connect new hosts. Basically this option forces the user to manually
|
||||
add any new hosts. Normally this option is disabled, and new hosts
|
||||
will automatically be added to the known host files. The host keys of
|
||||
known hosts will be verified automatically in either case. The
|
||||
argument must be
|
||||
connect new hosts.
|
||||
Basically this option forces the user to manually
|
||||
add any new hosts.
|
||||
Normally this option is disabled, and new hosts
|
||||
will automatically be added to the known host files.
|
||||
The host keys of
|
||||
known hosts will be verified automatically in either case.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -737,23 +806,26 @@ turns off
|
||||
and
|
||||
.Cm RhostsRSAAuthentication .
|
||||
.It Cm User
|
||||
Specifies the user to log in as. This can be useful if you have a
|
||||
different user name in different machines. This saves the trouble of
|
||||
Specifies the user to log in as.
|
||||
This can be useful if you have a different user name on different machines.
|
||||
This saves the trouble of
|
||||
having to remember to give the user name on the command line.
|
||||
.It Cm UserKnownHostsFile
|
||||
Specifies a file to use instead of
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
.It Cm UseRsh
|
||||
Specifies that rlogin/rsh should be used for this host. It is
|
||||
possible that the host does not at all support the
|
||||
Specifies that rlogin/rsh should be used for this host.
|
||||
It is possible that the host does not at all support the
|
||||
.Nm
|
||||
protocol. This causes
|
||||
protocol.
|
||||
This causes
|
||||
.Nm
|
||||
to immediately exec
|
||||
to immediately execute
|
||||
.Xr rsh 1 .
|
||||
All other options (except
|
||||
.Cm HostName )
|
||||
are ignored if this has been specified. The argument must be
|
||||
are ignored if this has been specified.
|
||||
The argument must be
|
||||
.Dq yes
|
||||
or
|
||||
.Dq no .
|
||||
@ -764,15 +836,17 @@ will normally set the following environment variables:
|
||||
.It Ev DISPLAY
|
||||
The
|
||||
.Ev DISPLAY
|
||||
variable indicates the location of the X11 server. It is
|
||||
automatically set by
|
||||
variable indicates the location of the X11 server.
|
||||
It is automatically set by
|
||||
.Nm
|
||||
to point to a value of the form
|
||||
.Dq hostname:n
|
||||
where hostname indicates
|
||||
the host where the shell runs, and n is an integer >= 1. Ssh uses
|
||||
this special value to forward X11 connections over the secure
|
||||
channel. The user should normally not set DISPLAY explicitly, as that
|
||||
the host where the shell runs, and n is an integer >= 1.
|
||||
.Nm
|
||||
uses this special value to forward X11 connections over the secure
|
||||
channel.
|
||||
The user should normally not set DISPLAY explicitly, as that
|
||||
will render the X11 connection insecure (and will require the user to
|
||||
manually copy any required authorization cookies).
|
||||
.It Ev HOME
|
||||
@ -783,7 +857,7 @@ Synonym for
|
||||
set for compatibility with systems that use this variable.
|
||||
.It Ev MAIL
|
||||
Set to point the user's mailbox.
|
||||
.It Ev PATH
|
||||
.It Ev PATH
|
||||
Set to the default
|
||||
.Ev PATH ,
|
||||
as specified when compiling
|
||||
@ -792,12 +866,14 @@ as specified when compiling
|
||||
indicates the path of a unix-domain socket used to communicate with the
|
||||
agent.
|
||||
.It Ev SSH_CLIENT
|
||||
Identifies the client end of the connection. The variable contains
|
||||
Identifies the client end of the connection.
|
||||
The variable contains
|
||||
three space-separated values: client ip-address, client port number,
|
||||
and server port number.
|
||||
.It Ev SSH_TTY
|
||||
This is set to the name of the tty (path to the device) associated
|
||||
with the current shell or command. If the current session has no tty,
|
||||
with the current shell or command.
|
||||
If the current session has no tty,
|
||||
this variable is not set.
|
||||
.It Ev TZ
|
||||
The timezone variable is set to indicate the present timezone if it
|
||||
@ -823,7 +899,8 @@ in
|
||||
See
|
||||
.Xr sshd 8 .
|
||||
.It Pa $HOME/.ssh/identity
|
||||
Contains the RSA authentication identity of the user. This file
|
||||
Contains the RSA authentication identity of the user.
|
||||
This file
|
||||
contains sensitive data and should be readable by the user but not
|
||||
accessible by others (read/write/execute).
|
||||
Note that
|
||||
@ -834,39 +911,50 @@ generating the key; the passphrase will be used to encrypt the
|
||||
sensitive part of this file using 3DES.
|
||||
.It Pa $HOME/.ssh/identity.pub
|
||||
Contains the public key for authentication (public part of the
|
||||
identity file in human-readable form). The contents of this file
|
||||
should be added to
|
||||
identity file in human-readable form).
|
||||
The contents of this file should be added to
|
||||
.Pa $HOME/.ssh/authorized_keys
|
||||
on all machines
|
||||
where you wish to log in using RSA authentication. This file is not
|
||||
sensitive and can (but need not) be readable by anyone. This file is
|
||||
where you wish to log in using RSA authentication.
|
||||
This file is not
|
||||
sensitive and can (but need not) be readable by anyone.
|
||||
This file is
|
||||
never used automatically and is not necessary; it is only provided for
|
||||
the convenience of the user.
|
||||
.It Pa $HOME/.ssh/config
|
||||
This is the per-user configuration file. The format of this file is
|
||||
described above. This file is used by the
|
||||
This is the per-user configuration file.
|
||||
The format of this file is described above.
|
||||
This file is used by the
|
||||
.Nm
|
||||
client. This file does not usually contain any sensitive information,
|
||||
client.
|
||||
This file does not usually contain any sensitive information,
|
||||
but the recommended permissions are read/write for the user, and not
|
||||
accessible by others.
|
||||
.It Pa $HOME/.ssh/authorized_keys
|
||||
Lists the RSA keys that can be used for logging in as this user. The
|
||||
format of this file is described in the
|
||||
Lists the RSA keys that can be used for logging in as this user.
|
||||
The format of this file is described in the
|
||||
.Xr sshd 8
|
||||
manual page. In the simplest form the format is the same as the .pub
|
||||
manual page.
|
||||
In the simplest form the format is the same as the .pub
|
||||
identity files (that is, each line contains the number of bits in
|
||||
modulus, public exponent, modulus, and comment fields, separated by
|
||||
spaces). This file is not highly sensitive, but the recommended
|
||||
spaces).
|
||||
This file is not highly sensitive, but the recommended
|
||||
permissions are read/write for the user, and not accessible by others.
|
||||
.It Pa /etc/ssh_known_hosts
|
||||
Systemwide list of known host keys. This file should be prepared by the
|
||||
Systemwide list of known host keys.
|
||||
This file should be prepared by the
|
||||
system administrator to contain the public host keys of all machines in the
|
||||
organization. This file should be world-readable. This file contains
|
||||
organization.
|
||||
This file should be world-readable.
|
||||
This file contains
|
||||
public keys, one per line, in the following format (fields separated
|
||||
by spaces): system name, number of bits in modulus, public exponent,
|
||||
modulus, and optional comment field. When different names are used
|
||||
modulus, and optional comment field.
|
||||
When different names are used
|
||||
for the same machine, all such names should be listed, separated by
|
||||
commas. The format is described on the
|
||||
commas.
|
||||
The format is described on the
|
||||
.Xr sshd 8
|
||||
manual page.
|
||||
.Pp
|
||||
@ -878,32 +966,37 @@ does not convert the user-supplied name to a canonical name before
|
||||
checking the key, because someone with access to the name servers
|
||||
would then be able to fool host authentication.
|
||||
.It Pa /etc/ssh_config
|
||||
Systemwide configuration file. This file provides defaults for those
|
||||
Systemwide configuration file.
|
||||
This file provides defaults for those
|
||||
values that are not specified in the user's configuration file, and
|
||||
for those users who do not have a configuration file. This file must
|
||||
be world-readable.
|
||||
for those users who do not have a configuration file.
|
||||
This file must be world-readable.
|
||||
.It Pa $HOME/.rhosts
|
||||
This file is used in
|
||||
.Pa \&.rhosts
|
||||
authentication to list the
|
||||
host/user pairs that are permitted to log in. (Note that this file is
|
||||
host/user pairs that are permitted to log in.
|
||||
(Note that this file is
|
||||
also used by rlogin and rsh, which makes using this file insecure.)
|
||||
Each line of the file contains a host name (in the canonical form
|
||||
returned by name servers), and then a user name on that host,
|
||||
separated by a space. One some machines this file may need to be
|
||||
separated by a space.
|
||||
One some machines this file may need to be
|
||||
world-readable if the user's home directory is on a NFS partition,
|
||||
because
|
||||
.Xr sshd 8
|
||||
reads it as root. Additionally, this file must be owned by the user,
|
||||
and must not have write permissions for anyone else. The recommended
|
||||
reads it as root.
|
||||
Additionally, this file must be owned by the user,
|
||||
and must not have write permissions for anyone else.
|
||||
The recommended
|
||||
permission for most machines is read/write for the user, and not
|
||||
accessible by others.
|
||||
.Pp
|
||||
Note that by default
|
||||
.Xr sshd 8
|
||||
will be installed so that it requires successful RSA host
|
||||
authentication before permitting \s+2.\s0rhosts authentication. If your
|
||||
server machine does not have the client's host key in
|
||||
authentication before permitting \s+2.\s0rhosts authentication.
|
||||
If your server machine does not have the client's host key in
|
||||
.Pa /etc/ssh_known_hosts ,
|
||||
you can store it in
|
||||
.Pa $HOME/.ssh/known_hosts .
|
||||
@ -923,14 +1016,18 @@ or
|
||||
.Xr rsh 1 .
|
||||
.It Pa /etc/hosts.equiv
|
||||
This file is used during
|
||||
.Pa \&.rhosts authentication. It contains
|
||||
.Pa \&.rhosts authentication.
|
||||
It contains
|
||||
canonical hosts names, one per line (the full format is described on
|
||||
the
|
||||
.Xr sshd 8
|
||||
manual page). If the client host is found in this file, login is
|
||||
manual page).
|
||||
If the client host is found in this file, login is
|
||||
automatically permitted provided client and server user names are the
|
||||
same. Additionally, successful RSA host authentication is normally
|
||||
required. This file should only be writable by root.
|
||||
same.
|
||||
Additionally, successful RSA host authentication is normally
|
||||
required.
|
||||
This file should only be writable by root.
|
||||
.It Pa /etc/shosts.equiv
|
||||
This file is processed exactly as
|
||||
.Pa /etc/hosts.equiv .
|
||||
@ -962,7 +1059,8 @@ is required for proper operation.
|
||||
.Sh AUTHOR
|
||||
OpenSSH
|
||||
is a derivative of the original (free) ssh 1.2.12 release by Tatu Ylonen,
|
||||
but with bugs removed and newer features re-added. Rapidly after the
|
||||
but with bugs removed and newer features re-added.
|
||||
Rapidly after the
|
||||
1.2.12 release, newer versions of the original ssh bore successively
|
||||
more restrictive licenses, and thus demand for a free version was born.
|
||||
This version of OpenSSH
|
||||
|
||||
30
sshconnect.c
30
sshconnect.c
@ -8,7 +8,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$OpenBSD: sshconnect.c,v 1.56 2000/02/18 08:50:33 markus Exp $");
|
||||
RCSID("$OpenBSD: sshconnect.c,v 1.57 2000/03/16 20:56:14 markus Exp $");
|
||||
|
||||
#ifdef HAVE_OPENSSL
|
||||
#include <openssl/bn.h>
|
||||
@ -638,6 +638,7 @@ try_kerberos_authentication()
|
||||
char *realm;
|
||||
CREDENTIALS cred;
|
||||
int r, type, plen;
|
||||
socklen_t slen;
|
||||
Key_schedule schedule;
|
||||
u_long checksum, cksum;
|
||||
MSG_DAT msg_data;
|
||||
@ -680,16 +681,16 @@ try_kerberos_authentication()
|
||||
/* Zero the buffer. */
|
||||
(void) memset(auth.dat, 0, MAX_KTXT_LEN);
|
||||
|
||||
r = sizeof(local);
|
||||
slen = sizeof(local);
|
||||
memset(&local, 0, sizeof(local));
|
||||
if (getsockname(packet_get_connection_in(),
|
||||
(struct sockaddr *) & local, &r) < 0)
|
||||
(struct sockaddr *) & local, &slen) < 0)
|
||||
debug("getsockname failed: %s", strerror(errno));
|
||||
|
||||
r = sizeof(foreign);
|
||||
slen = sizeof(foreign);
|
||||
memset(&foreign, 0, sizeof(foreign));
|
||||
if (getpeername(packet_get_connection_in(),
|
||||
(struct sockaddr *) & foreign, &r) < 0) {
|
||||
(struct sockaddr *) & foreign, &slen) < 0) {
|
||||
debug("getpeername failed: %s", strerror(errno));
|
||||
fatal_cleanup();
|
||||
}
|
||||
@ -751,7 +752,7 @@ send_kerberos_tgt()
|
||||
CREDENTIALS *creds;
|
||||
char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
|
||||
int r, type, plen;
|
||||
unsigned char buffer[8192];
|
||||
char buffer[8192];
|
||||
struct stat st;
|
||||
|
||||
/* Don't do anything if we don't have any tickets. */
|
||||
@ -772,11 +773,11 @@ send_kerberos_tgt()
|
||||
debug("Kerberos V4 ticket expired: %s", TKT_FILE);
|
||||
return 0;
|
||||
}
|
||||
creds_to_radix(creds, buffer);
|
||||
creds_to_radix(creds, (unsigned char *)buffer);
|
||||
xfree(creds);
|
||||
|
||||
packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
|
||||
packet_put_string((char *) buffer, strlen(buffer));
|
||||
packet_put_string(buffer, strlen(buffer));
|
||||
packet_send();
|
||||
packet_write_wait();
|
||||
|
||||
@ -798,7 +799,7 @@ send_afs_tokens(void)
|
||||
struct ClearToken ct;
|
||||
int i, type, len, plen;
|
||||
char buf[2048], *p, *server_cell;
|
||||
unsigned char buffer[8192];
|
||||
char buffer[8192];
|
||||
|
||||
/* Move over ktc_GetToken, here's something leaner. */
|
||||
for (i = 0; i < 100; i++) { /* just in case */
|
||||
@ -840,10 +841,10 @@ send_afs_tokens(void)
|
||||
creds.pinst[0] = '\0';
|
||||
|
||||
/* Encode token, ship it off. */
|
||||
if (!creds_to_radix(&creds, buffer))
|
||||
if (!creds_to_radix(&creds, (unsigned char*) buffer))
|
||||
break;
|
||||
packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
|
||||
packet_put_string((char *) buffer, strlen(buffer));
|
||||
packet_put_string(buffer, strlen(buffer));
|
||||
packet_send();
|
||||
packet_write_wait();
|
||||
|
||||
@ -867,7 +868,9 @@ send_afs_tokens(void)
|
||||
int
|
||||
try_skey_authentication()
|
||||
{
|
||||
int type, i, payload_len;
|
||||
int type, i;
|
||||
int payload_len;
|
||||
unsigned int clen;
|
||||
char *challenge, *response;
|
||||
|
||||
debug("Doing skey authentication.");
|
||||
@ -887,7 +890,8 @@ try_skey_authentication()
|
||||
debug("No challenge for skey authentication.");
|
||||
return 0;
|
||||
}
|
||||
challenge = packet_get_string(&payload_len);
|
||||
challenge = packet_get_string(&clen);
|
||||
packet_integrity_check(payload_len, (4 + clen), type);
|
||||
if (options.cipher == SSH_CIPHER_NONE)
|
||||
log("WARNING: Encryption is disabled! "
|
||||
"Reponse will be transmitted in clear text.");
|
||||
|
||||
4
sshd.8
4
sshd.8
@ -9,7 +9,7 @@
|
||||
.\"
|
||||
.\" Created: Sat Apr 22 21:55:14 1995 ylo
|
||||
.\"
|
||||
.\" $Id: sshd.8,v 1.13 2000/03/09 10:27:53 damien Exp $
|
||||
.\" $Id: sshd.8,v 1.14 2000/03/17 12:40:18 damien Exp $
|
||||
.\"
|
||||
.Dd September 25, 1999
|
||||
.Dt SSHD 8
|
||||
@ -147,7 +147,7 @@ is normally not run
|
||||
from inetd because it needs to generate the server key before it can
|
||||
respond to the client, and this may take tens of seconds. Clients
|
||||
would have to wait too long if the key was regenerated every time.
|
||||
However, with small key sizes (e.g. 512) using
|
||||
However, with small key sizes (e.g., 512) using
|
||||
.Nm
|
||||
from inetd may
|
||||
be feasible.
|
||||
|
||||
18
sshd.c
18
sshd.c
@ -11,7 +11,7 @@
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
RCSID("$OpenBSD: sshd.c,v 1.91 2000/03/09 19:31:47 markus Exp $");
|
||||
RCSID("$OpenBSD: sshd.c,v 1.92 2000/03/16 20:56:15 markus Exp $");
|
||||
|
||||
#include "xmalloc.h"
|
||||
#include "rsa.h"
|
||||
@ -1202,7 +1202,8 @@ void
|
||||
do_authentication()
|
||||
{
|
||||
struct passwd *pw, pwcopy;
|
||||
int plen, ulen;
|
||||
int plen;
|
||||
unsigned int ulen;
|
||||
char *user;
|
||||
|
||||
/* Get the name of the user that we wish to log in as. */
|
||||
@ -1304,7 +1305,9 @@ do_authloop(struct passwd * pw)
|
||||
BIGNUM *n;
|
||||
char *client_user = NULL, *password = NULL;
|
||||
char user[1024];
|
||||
int plen, dlen, nlen, ulen, elen;
|
||||
unsigned int dlen;
|
||||
int plen, nlen, elen;
|
||||
unsigned int ulen;
|
||||
int type = 0;
|
||||
void (*authlog) (const char *fmt,...) = verbose;
|
||||
|
||||
@ -1608,7 +1611,7 @@ do_fake_authloop(char *user)
|
||||
(void)packet_read(&plen);
|
||||
#else /* SKEY */
|
||||
int type = packet_read(&plen);
|
||||
int dlen;
|
||||
unsigned int dlen;
|
||||
char *password, *skeyinfo;
|
||||
/* Try to send a fake s/key challenge. */
|
||||
if (options.skey_authentication == 1 &&
|
||||
@ -1697,6 +1700,8 @@ do_authenticated(struct passwd * pw)
|
||||
int row, col, xpixel, ypixel, screen;
|
||||
char ttyname[64];
|
||||
char *command, *term = NULL, *display = NULL, *proto = NULL, *data = NULL;
|
||||
int plen;
|
||||
unsigned int dlen;
|
||||
int n_bytes;
|
||||
|
||||
/*
|
||||
@ -1720,7 +1725,6 @@ do_authenticated(struct passwd * pw)
|
||||
* or a command.
|
||||
*/
|
||||
while (1) {
|
||||
int plen, dlen;
|
||||
|
||||
/* Get a packet from the client. */
|
||||
type = packet_read(&plen);
|
||||
@ -1799,7 +1803,7 @@ do_authenticated(struct passwd * pw)
|
||||
if (display)
|
||||
packet_disconnect("Protocol error: X11 display already set.");
|
||||
{
|
||||
int proto_len, data_len;
|
||||
unsigned int proto_len, data_len;
|
||||
proto = packet_get_string(&proto_len);
|
||||
data = packet_get_string(&data_len);
|
||||
packet_integrity_check(plen, 4 + proto_len + 4 + data_len + 4, type);
|
||||
@ -1881,7 +1885,7 @@ do_authenticated(struct passwd * pw)
|
||||
goto do_forced_command;
|
||||
/* Get command from the packet. */
|
||||
{
|
||||
int dlen;
|
||||
unsigned int dlen;
|
||||
command = packet_get_string(&dlen);
|
||||
debug("Executing command '%.500s'", command);
|
||||
packet_integrity_check(plen, 4 + dlen, type);
|
||||
|
||||
Loading…
Reference in New Issue
Block a user