Fix bug that disabled gssapi-keyex, external-keyx, and gssapi methods on the client-side.

[gssapi-openssh.git] / openssh / sshd.8

diff --git a/openssh/sshd.8 b/openssh/sshd.8
index 522279ee351d4594db1033ae8746c59035510f46..a4b9e90c718a10380fd78c0dbbf0676c76c2b246 100644 (file)
--- a/openssh/sshd.8
+++ b/openssh/sshd.8
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"

-.\" $OpenBSD: sshd.8,v 1.234 2006/08/21 08:15:57 dtucker Exp $
-.Dd September 25, 1999
+.\" $OpenBSD: sshd.8,v 1.247 2008/10/03 13:08:12 jmc Exp $
+.Dd $Mdocdate: October 3 2008 $

 .Dt SSHD 8
 .Os
 .Sh NAME
 .Dt SSHD 8
 .Os
 .Sh NAME


@@ -44,8 +44,9 @@
 .Sh SYNOPSIS
 .Nm sshd
 .Bk -words
 .Sh SYNOPSIS
 .Nm sshd
 .Bk -words

-.Op Fl 46Ddeiqt
+.Op Fl 46DdeiqTt

 .Op Fl b Ar bits
 .Op Fl b Ar bits

+.Op Fl C Ar connection_spec

 .Op Fl f Ar config_file
 .Op Fl g Ar login_grace_time
 .Op Fl h Ar host_key_file
 .Op Fl f Ar config_file
 .Op Fl g Ar login_grace_time
 .Op Fl h Ar host_key_file


@@ -58,8 +59,11 @@
 .Nm
 (OpenSSH Daemon) is the daemon program for
 .Xr ssh 1 .
 .Nm
 (OpenSSH Daemon) is the daemon program for
 .Xr ssh 1 .

-Together these programs replace rlogin and rsh, and
-provide secure encrypted communications between two untrusted hosts
+Together these programs replace
+.Xr rlogin 1
+and
+.Xr rsh 1 ,
+and provide secure encrypted communications between two untrusted hosts

 over an insecure network.
 .Pp
 .Nm
 over an insecure network.
 .Pp
 .Nm


@@ -96,7 +100,25 @@ Forces
 to use IPv6 addresses only.
 .It Fl b Ar bits
 Specifies the number of bits in the ephemeral protocol version 1
 to use IPv6 addresses only.
 .It Fl b Ar bits
 Specifies the number of bits in the ephemeral protocol version 1

-server key (default 768).
+server key (default 1024).
+.It Fl C Ar connection_spec
+Specify the connection parameters to use for the
+.Fl T
+extended test mode.
+If provided, any
+.Cm Match
+directives in the configuration file
+that would apply to the specified user, host, and address will be set before
+the configuration is written to standard output.
+The connection parameters are supplied as keyword=value pairs.
+The keywords are
+.Dq user ,
+.Dq host ,
+and
+.Dq addr .
+All are required and may be supplied in any order, either with multiple
+.Fl C
+options or as a comma-separated list.

 .It Fl D
 When this option is specified,
 .Nm
 .It Fl D
 When this option is specified,
 .Nm


@@ -117,7 +139,7 @@ Maximum is 3.
 When this option is specified,
 .Nm
 will send the output to the standard error instead of the system log.
 When this option is specified,
 .Nm
 will send the output to the standard error instead of the system log.

-.It Fl f Ar configuration_file
+.It Fl f Ar config_file

 Specifies the name of the configuration file.
 The default is
 .Pa /etc/ssh/sshd_config .
 Specifies the name of the configuration file.
 The default is
 .Pa /etc/ssh/sshd_config .


@@ -188,6 +210,15 @@ Quiet mode.
 Nothing is sent to the system log.
 Normally the beginning,
 authentication, and termination of each connection is logged.
 Nothing is sent to the system log.
 Normally the beginning,
 authentication, and termination of each connection is logged.

+.It Fl T
+Extended test mode.
+Check the validity of the configuration file, output the effective configuration
+to stdout and then exit.
+Optionally,
+.Cm Match
+rules may be applied by specifying the connection parameters using one or more
+.Fl C
+options.

 .It Fl t
 Test mode.
 Only check the validity of the configuration file and sanity of the keys.
 .It Fl t
 Test mode.
 Only check the validity of the configuration file and sanity of the keys.


@@ -273,7 +304,7 @@ The client selects the encryption algorithm
 to use from those offered by the server.
 Additionally, session integrity is provided
 through a cryptographic message authentication code
 to use from those offered by the server.
 Additionally, session integrity is provided
 through a cryptographic message authentication code

-(hmac-sha1 or hmac-md5).
+(hmac-md5, hmac-sha1, umac-64 or hmac-ripemd160).

 .Pp
 Finally, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using
 .Pp
 Finally, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using


@@ -299,8 +330,9 @@ on Tru64,
 a leading
 .Ql \&*LOCKED\&*
 on FreeBSD and a leading
 a leading
 .Ql \&*LOCKED\&*
 on FreeBSD and a leading

-.Ql \&!!
-on Linux).  If there is a requirement to disable password authentication
+.Ql \&!
+on most Linuxes).
+If there is a requirement to disable password authentication

 for the account while allowing still public-key, then the passwd field
 should be set to something other than these values (eg
 .Ql NP
 for the account while allowing still public-key, then the passwd field
 should be set to something other than these values (eg
 .Ql NP


@@ -499,23 +531,27 @@ This option is automatically disabled if
 .Cm UseLogin
 is enabled.
 .It Cm from="pattern-list"
 .Cm UseLogin
 is enabled.
 .It Cm from="pattern-list"

-Specifies that in addition to public key authentication, the canonical name
-of the remote host must be present in the comma-separated list of
-patterns.
-The purpose
-of this option is to optionally increase security: public key authentication
-by itself does not trust the network or name servers or anything (but
-the key); however, if somebody somehow steals the key, the key
-permits an intruder to log in from anywhere in the world.
-This additional option makes using a stolen key more difficult (name
-servers and/or routers would have to be compromised in addition to
-just the key).
-.Pp
+Specifies that in addition to public key authentication, either the canonical
+name of the remote host or its IP address must be present in the
+comma-separated list of patterns.

 See
 .Sx PATTERNS
 in
 .Xr ssh_config 5
 for more information on patterns.
 See
 .Sx PATTERNS
 in
 .Xr ssh_config 5
 for more information on patterns.

+.Pp
+In addition to the wildcard matching that may be applied to hostnames or
+addresses, a
+.Cm from
+stanza may match IP addressess using CIDR address/masklen notation.
+.Pp
+The purpose of this option is to optionally increase security: public key
+authentication by itself does not trust the network or name servers or
+anything (but the key); however, if somebody somehow steals the key, the key
+permits an intruder to log in from anywhere in the world.
+This additional option makes using a stolen key more difficult (name
+servers and/or routers would have to be compromised in addition to
+just the key).

 .It Cm no-agent-forwarding
 Forbids authentication agent forwarding when this key is used for
 authentication.
 .It Cm no-agent-forwarding
 Forbids authentication agent forwarding when this key is used for
 authentication.


@@ -527,6 +563,9 @@ This might be used, e.g. in connection with the
 option.
 .It Cm no-pty
 Prevents tty allocation (a request to allocate a pty will fail).
 option.
 .It Cm no-pty
 Prevents tty allocation (a request to allocate a pty will fail).

+.It Cm no-user-rc
+Disables execution of
+.Pa ~/.ssh/rc .

 .It Cm no-X11-forwarding
 Forbids X11 forwarding when this key is used for authentication.
 Any X11 forward requests by the client will return an error.
 .It Cm no-X11-forwarding
 Forbids X11 forwarding when this key is used for authentication.
 Any X11 forward requests by the client will return an error.


@@ -678,6 +717,13 @@ This file is used in exactly the same way as
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp

+.It ~/.ssh/
+This directory is the default location for all user-specific configuration
+and authentication information.
+There is no general requirement to keep the entire contents of this directory
+secret, but the recommended permissions are read/write/execute for the user,
+and not accessible by others.
+.Pp

 .It ~/.ssh/authorized_keys
 Lists the public keys (RSA/DSA) that can be used for logging in as this user.
 The format of this file is described above.
 .It ~/.ssh/authorized_keys
 Lists the public keys (RSA/DSA) that can be used for logging in as this user.
 The format of this file is described above.


@@ -695,8 +741,6 @@ will not allow it to be used unless the
 .Cm StrictModes
 option has been set to
 .Dq no .
 .Cm StrictModes
 option has been set to
 .Dq no .

-The recommended permissions can be set by executing
-.Dq chmod go-w ~/ ~/.ssh ~/.ssh/authorized_keys .

 .Pp
 .It ~/.ssh/environment
 This file is read into the environment at login (if it exists).
 .Pp
 .It ~/.ssh/environment
 This file is read into the environment at login (if it exists).


@@ -758,15 +802,6 @@ This file is used in exactly the same way as
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp

-.It /etc/ssh/ssh_known_hosts
-Systemwide list of known host keys.
-This file should be prepared by the
-system administrator to contain the public host keys of all machines in the
-organization.
-The format of this file is described above.
-This file should be writable only by root/the owner and
-should be world-readable.
-.Pp

 .It /etc/ssh/ssh_host_key
 .It /etc/ssh/ssh_host_dsa_key
 .It /etc/ssh/ssh_host_rsa_key
 .It /etc/ssh/ssh_host_key
 .It /etc/ssh/ssh_host_dsa_key
 .It /etc/ssh/ssh_host_rsa_key


@@ -790,6 +825,15 @@ the user so their contents can be copied to known hosts files.
 These files are created using
 .Xr ssh-keygen 1 .
 .Pp
 These files are created using
 .Xr ssh-keygen 1 .
 .Pp

+.It /etc/ssh/ssh_known_hosts
+Systemwide list of known host keys.
+This file should be prepared by the
+system administrator to contain the public host keys of all machines in the
+organization.
+The format of this file is described above.
+This file should be writable only by root/the owner and
+should be world-readable.
+.Pp

 .It /etc/ssh/sshd_config
 Contains configuration data for
 .Nm sshd .
 .It /etc/ssh/sshd_config
 Contains configuration data for
 .Nm sshd .


@@ -826,6 +870,7 @@ The content of this file is not sensitive; it can be world-readable.
 .Xr ssh-add 1 ,
 .Xr ssh-agent 1 ,
 .Xr ssh-keygen 1 ,
 .Xr ssh-add 1 ,
 .Xr ssh-agent 1 ,
 .Xr ssh-keygen 1 ,

+.Xr ssh-keyscan 1 ,

 .Xr chroot 2 ,
 .Xr hosts_access 5 ,
 .Xr login.conf 5 ,
 .Xr chroot 2 ,
 .Xr hosts_access 5 ,
 .Xr login.conf 5 ,