initialize pointers to avoid compiler warnings

[gssapi-openssh.git] / openssh / sshd.8

diff --git a/openssh/sshd.8 b/openssh/sshd.8
index 34413e2a7f2388cfd05aefcbfab3e12108798657..fdff4ac9166d2a20fd9f9c0a69d6ea57fb7cf746 100644 (file)
--- a/openssh/sshd.8
+++ b/openssh/sshd.8
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"

-.\" $OpenBSD: sshd.8,v 1.200 2003/10/08 08:27:36 jmc Exp $
+.\" $OpenBSD: sshd.8,v 1.208 2005/06/08 03:50:00 djm Exp $

 .Dd September 25, 1999
 .Dt SSHD 8
 .Os
 .Dd September 25, 1999
 .Dt SSHD 8
 .Os


@@ -80,7 +80,7 @@ supports both SSH protocol version 1 and 2 simultaneously.
 works as follows:
 .Ss SSH protocol version 1
 Each host has a host-specific RSA key
 works as follows:
 .Ss SSH protocol version 1
 Each host has a host-specific RSA key

-(normally 1024 bits) used to identify the host.
+(normally 2048 bits) used to identify the host.

 Additionally, when
 the daemon starts, it generates a server RSA key (normally 768 bits).
 This key is normally regenerated every hour if it has been used, and
 Additionally, when
 the daemon starts, it generates a server RSA key (normally 768 bits).
 This key is normally regenerated every hour if it has been used, and


@@ -106,8 +106,6 @@ to use from those offered by the server.
 Next, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using
 .Em .rhosts
 Next, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using
 .Em .rhosts

-authentication,
-.Em .rhosts

 authentication combined with RSA host
 authentication, RSA challenge-response authentication, or password
 based authentication.
 authentication combined with RSA host
 authentication, RSA challenge-response authentication, or password
 based authentication.


@@ -135,11 +133,6 @@ or
 .Ql \&*NP\&*
 ).
 .Pp
 .Ql \&*NP\&*
 ).
 .Pp

-.Em rhosts
-authentication is normally disabled
-because it is fundamentally insecure, but can be enabled in the server
-configuration file if desired.
-System security is not improved unless

 .Nm rshd ,
 .Nm rlogind ,
 and
 .Nm rshd ,
 .Nm rlogind ,
 and


@@ -196,7 +189,7 @@ configuration file.
 .Nm
 rereads its configuration file when it receives a hangup signal,
 .Dv SIGHUP ,
 .Nm
 rereads its configuration file when it receives a hangup signal,
 .Dv SIGHUP ,

-by executing itself with the name it was started as, i.e.,
+by executing itself with the name and options it was started with, e.g.,

 .Pa /usr/sbin/sshd .
 .Pp
 The options are as follows:
 .Pa /usr/sbin/sshd .
 .Pp
 The options are as follows:


@@ -357,7 +350,7 @@ If the login is on a tty, and no command has been specified,
 prints last login time and
 .Pa /etc/motd
 (unless prevented in the configuration file or by
 prints last login time and
 .Pa /etc/motd
 (unless prevented in the configuration file or by

-.Pa $HOME/.hushlogin ;
+.Pa ~/.hushlogin ;

 see the
 .Sx FILES
 section).
 see the
 .Sx FILES
 section).


@@ -374,7 +367,7 @@ Changes to run with normal user privileges.
 Sets up basic environment.
 .It
 Reads the file
 Sets up basic environment.
 .It
 Reads the file

-.Pa $HOME/.ssh/environment ,
+.Pa ~/.ssh/environment ,

 if it exists, and users are allowed to change their environment.
 See the
 .Cm PermitUserEnvironment
 if it exists, and users are allowed to change their environment.
 See the
 .Cm PermitUserEnvironment


@@ -384,7 +377,7 @@ option in
 Changes to user's home directory.
 .It
 If
 Changes to user's home directory.
 .It
 If

-.Pa $HOME/.ssh/rc
+.Pa ~/.ssh/rc

 exists, runs it; else if
 .Pa /etc/ssh/sshrc
 exists, runs
 exists, runs it; else if
 .Pa /etc/ssh/sshrc
 exists, runs


@@ -397,7 +390,7 @@ authentication protocol and cookie in standard input.
 Runs user's shell or command.
 .El
 .Sh AUTHORIZED_KEYS FILE FORMAT
 Runs user's shell or command.
 .El
 .Sh AUTHORIZED_KEYS FILE FORMAT

-.Pa $HOME/.ssh/authorized_keys
+.Pa ~/.ssh/authorized_keys

 is the default file that lists the public keys that are
 permitted for RSA authentication in protocol version 1
 and for public key authentication (PubkeyAuthentication)
 is the default file that lists the public keys that are
 permitted for RSA authentication in protocol version 1
 and for public key authentication (PubkeyAuthentication)


@@ -427,7 +420,9 @@ or
 .Dq ssh-rsa .
 .Pp
 Note that lines in this file are usually several hundred bytes long
 .Dq ssh-rsa .
 .Pp
 Note that lines in this file are usually several hundred bytes long

-(because of the size of the public key encoding).
+(because of the size of the public key encoding) up to a limit of
+8 kilobytes, which permits DSA keys up to 8 kilobits and RSA
+keys up to 16 kilobits.

 You don't want to type them in; instead, copy the
 .Pa identity.pub ,
 .Pa id_dsa.pub
 You don't want to type them in; instead, copy the
 .Pa identity.pub ,
 .Pa id_dsa.pub


@@ -533,7 +528,7 @@ permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
 The
 .Pa /etc/ssh/ssh_known_hosts
 and
 The
 .Pa /etc/ssh/ssh_known_hosts
 and

-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts

 files contain host public keys for all known hosts.
 The global file should
 be prepared by the administrator (optional), and the per-user file is
 files contain host public keys for all known hosts.
 The global file should
 be prepared by the administrator (optional), and the per-user file is


@@ -558,6 +553,14 @@ to indicate negation: if the host name matches a negated
 pattern, it is not accepted (by that line) even if it matched another
 pattern on the line.
 .Pp
 pattern, it is not accepted (by that line) even if it matched another
 pattern on the line.
 .Pp

+Alternately, hostnames may be stored in a hashed form which hides host names
+and addresses should the file's contents be disclosed.
+Hashed hostnames start with a
+.Ql |
+character.
+Only one hashed hostname may appear on a single line and none of the above
+negation or wildcard operators may be applied.
+.Pp

 Bits, exponent, and modulus are taken directly from the RSA host key; they
 can be obtained, e.g., from
 .Pa /etc/ssh/ssh_host_key.pub .
 Bits, exponent, and modulus are taken directly from the RSA host key; they
 can be obtained, e.g., from
 .Pa /etc/ssh/ssh_host_key.pub .


@@ -589,6 +592,11 @@ and adding the host names at the front.
 closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
 cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....=
 .Ed
 closenet,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
 cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....=
 .Ed

+.Bd -literal
+# A hashed hostname
+|1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa
+AAAA1234.....=
+.Ed

 .Sh FILES
 .Bl -tag -width Ds
 .It Pa /etc/ssh/sshd_config
 .Sh FILES
 .Bl -tag -width Ds
 .It Pa /etc/ssh/sshd_config


@@ -631,7 +639,7 @@ listening for connections (if there are several daemons running
 concurrently for different ports, this contains the process ID of the one
 started last).
 The content of this file is not sensitive; it can be world-readable.
 concurrently for different ports, this contains the process ID of the one
 started last).
 The content of this file is not sensitive; it can be world-readable.

-.It Pa $HOME/.ssh/authorized_keys
+.It Pa ~/.ssh/authorized_keys

 Lists the public keys (RSA or DSA) that can be used to log into the user's account.
 This file must be readable by root (which may on some machines imply
 it being world-readable if the user's home directory resides on an NFS
 Lists the public keys (RSA or DSA) that can be used to log into the user's account.
 This file must be readable by root (which may on some machines imply
 it being world-readable if the user's home directory resides on an NFS


@@ -645,7 +653,7 @@ and/or
 .Pa id_rsa.pub
 files into this file, as described in
 .Xr ssh-keygen 1 .
 .Pa id_rsa.pub
 files into this file, as described in
 .Xr ssh-keygen 1 .

-.It Pa "/etc/ssh/ssh_known_hosts", "$HOME/.ssh/known_hosts"
+.It Pa "/etc/ssh/ssh_known_hosts", "~/.ssh/known_hosts"

 These files are consulted when using rhosts with RSA host
 authentication or protocol version 2 hostbased authentication
 to check the public key of the host.
 These files are consulted when using rhosts with RSA host
 authentication or protocol version 2 hostbased authentication
 to check the public key of the host.


@@ -655,8 +663,22 @@ to verify that it is connecting to the correct remote host.
 These files should be writable only by root/the owner.
 .Pa /etc/ssh/ssh_known_hosts
 should be world-readable, and
 These files should be writable only by root/the owner.
 .Pa /etc/ssh/ssh_known_hosts
 should be world-readable, and

-.Pa $HOME/.ssh/known_hosts
+.Pa ~/.ssh/known_hosts

 can, but need not be, world-readable.
 can, but need not be, world-readable.

+.It Pa /etc/motd
+See
+.Xr motd 5 .
+.It Pa ~/.hushlogin
+This file is used to suppress printing the last login time and
+.Pa /etc/motd ,
+if
+.Cm PrintLastLog
+and
+.Cm PrintMotd ,
+respectively,
+are enabled.
+It does not suppress printing of the banner specified by
+.Cm Banner .

 .It Pa /etc/nologin
 If this file exists,
 .Nm
 .It Pa /etc/nologin
 If this file exists,
 .Nm


@@ -669,8 +691,12 @@ The file should be world-readable.
 Access controls that should be enforced by tcp-wrappers are defined here.
 Further details are described in
 .Xr hosts_access 5 .
 Access controls that should be enforced by tcp-wrappers are defined here.
 Further details are described in
 .Xr hosts_access 5 .

-.It Pa $HOME/.rhosts
-This file contains host-username pairs, separated by a space, one per
+.It Pa ~/.rhosts
+This file is used during
+.Cm RhostsRSAAuthentication
+and
+.Cm HostbasedAuthentication
+and contains host-username pairs, separated by a space, one per

 line.
 The given user on the corresponding host is permitted to log in
 without a password.
 line.
 The given user on the corresponding host is permitted to log in
 without a password.


@@ -683,7 +709,7 @@ It is also possible to use netgroups in the file.
 Either host or user
 name may be of the form +@groupname to specify all hosts or all users
 in the group.
 Either host or user
 name may be of the form +@groupname to specify all hosts or all users
 in the group.

-.It Pa $HOME/.shosts
+.It Pa ~/.shosts

 For ssh,
 this file is exactly the same as for
 .Pa .rhosts .
 For ssh,
 this file is exactly the same as for
 .Pa .rhosts .


@@ -691,7 +717,9 @@ However, this file is
 not used by rlogin and rshd, so using this permits access using SSH only.
 .It Pa /etc/hosts.equiv
 This file is used during
 not used by rlogin and rshd, so using this permits access using SSH only.
 .It Pa /etc/hosts.equiv
 This file is used during

-.Em rhosts
+.Cm RhostsRSAAuthentication
+and
+.Cm HostbasedAuthentication

 authentication.
 In the simplest form, this file contains host names, one per line.
 Users on
 authentication.
 In the simplest form, this file contains host names, one per line.
 Users on


@@ -710,7 +738,7 @@ Negated entries start with
 If the client host/user is successfully matched in this file, login is
 automatically permitted provided the client and server user names are the
 same.
 If the client host/user is successfully matched in this file, login is
 automatically permitted provided the client and server user names are the
 same.

-Additionally, successful RSA host authentication is normally required.
+Additionally, successful client host key authentication is required.

 This file must be writable only by root; it is recommended
 that it be world-readable.
 .Pp
 This file must be writable only by root; it is recommended
 that it be world-readable.
 .Pp


@@ -730,7 +758,7 @@ This is processed exactly as
 .Pa /etc/hosts.equiv .
 However, this file may be useful in environments that want to run both
 rsh/rlogin and ssh.
 .Pa /etc/hosts.equiv .
 However, this file may be useful in environments that want to run both
 rsh/rlogin and ssh.

-.It Pa $HOME/.ssh/environment
+.It Pa ~/.ssh/environment

 This file is read into the environment at login (if it exists).
 It can only contain empty lines, comment lines (that start with
 .Ql # ) ,
 This file is read into the environment at login (if it exists).
 It can only contain empty lines, comment lines (that start with
 .Ql # ) ,


@@ -741,7 +769,7 @@ Environment processing is disabled by default and is
 controlled via the
 .Cm PermitUserEnvironment
 option.
 controlled via the
 .Cm PermitUserEnvironment
 option.

-.It Pa $HOME/.ssh/rc
+.It Pa ~/.ssh/rc

 If this file exists, it is run with
 .Pa /bin/sh
 after reading the
 If this file exists, it is run with
 .Pa /bin/sh
 after reading the


@@ -786,7 +814,7 @@ This file should be writable only by the user, and need not be
 readable by anyone else.
 .It Pa /etc/ssh/sshrc
 Like
 readable by anyone else.
 .It Pa /etc/ssh/sshrc
 Like

-.Pa $HOME/.ssh/rc .
+.Pa ~/.ssh/rc .

 This can be used to specify
 machine-specific login-time initializations globally.
 This file should be writable only by root, and should be world-readable.
 This can be used to specify
 machine-specific login-time initializations globally.
 This file should be writable only by root, and should be world-readable.