| blob | 8df637833249d476b30179ca2ee94208c83b9f33 |
1 '\" te
2 .\" To view license terms, attribution, and copyright for OpenSSH, the default path is /var/sadm/pkg/SUNWsshdr/install/copyright. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the
3 .\" installed location.
4 .\" Portions Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
5 .TH SSHD 1M "Oct 29, 2015"
6 .SH NAME
7 sshd \- secure shell daemon
8 .SH SYNOPSIS
9 .LP
10 .nf
11 \fBsshd\fR [\fB-deiqtD46\fR] [\fB-b\fR \fIbits\fR] [\fB-f\fR \fIconfig_file\fR]
12 [\fB-g\fR \fIlogin_grace_time\fR] [\fB-h\fR \fIhost_key_file\fR]
13 [\fB-k\fR \fIkey_gen_time\fR] [\fB-p\fR \fIport\fR] [\fB-V\fR \fIclient_protocol_id\fR]
14 .fi
16 .SH DESCRIPTION
17 .LP
18 The \fBsshd\fR (Secure Shell daemon) is the daemon program for \fBssh\fR(1).
19 Together these programs replace \fBrlogin\fR and \fBrsh\fR, and provide secure
20 encrypted communications between two untrusted hosts over an insecure network.
21 The programs are intended to be as easy to install and use as possible.
22 .sp
23 .LP
24 \fBsshd\fR is the daemon that listens for connections from clients. It forks a
25 new daemon for each incoming connection. The forked daemons handle key
26 exchange, encryption, authentication, command execution, and data exchange.
27 .sp
28 .LP
29 This implementation of \fBsshd\fR supports both SSH protocol versions 1 and 2
30 simultaneously. Because of security weaknesses in the v1 protocol, sites should
31 run only v2, if possible. In the default configuration, only protocol v2 is
32 enabled for the server. To enable v1 and v2 simultaneously, see the
33 instructions in \fBsshd_config\fR(4).
34 .sp
35 .LP
36 Support for v1 is provided to help sites with existing \fBssh\fR v1 clients and
37 servers to transition to v2. v1 might not be supported in a future release.
38 .SS "SSH Protocol Version 1"
39 .LP
40 Each host has a host-specific RSA key (normally 1024 bits) used to identify the
41 host. Additionally, when the daemon starts, it generates a server RSA key
42 (normally 768 bits). This key is normally regenerated every hour if it has been
43 used, and is never stored on disk.
44 .sp
45 .LP
46 Whenever a client connects the daemon responds with its public host and server
47 keys. The client compares the RSA host key against its own database to verify
48 that it has not changed. The client then generates a 256-bit random number. It
49 encrypts this random number using both the host key and the server key, and
50 sends the encrypted number to the server. Both sides then use this random
51 number as a session key which is used to encrypt all further communications in
52 the session. The rest of the session is encrypted using a conventional cipher,
53 currently Blowfish or 3DES, with 3DES being used by default. The client selects
54 the encryption algorithm to use from those offered by the server.
55 .sp
56 .LP
57 Next, the server and the client enter an authentication dialog. The client
58 tries to authenticate itself using \fB\&.rhosts\fR authentication,
59 \fB\&.rhosts\fR authentication combined with RSA host authentication, RSA
60 challenge-response authentication, or password-based authentication.
61 .sp
62 .LP
63 Rhosts authentication is normally disabled because it is fundamentally
64 insecure, but can be enabled in the server configuration file if desired.
65 System security is not improved unless \fBrshd\fR(1M), \fBrlogind\fR(1M),
66 \fBrexecd\fR(1M), and \fBrexd\fR(1M) are disabled (thus completely disabling
67 \fBrlogin\fR(1) and \fBrsh\fR(1) into the machine).
68 .SS "SSH Protocol Version 2"
69 .LP
70 Version 2 works similarly to version 1: Each host has a host-specific DSA/RSA
71 key. However, when the daemon starts, it does not generate a server key.
72 Forward security is provided through a Diffie-Hellman key agreement. This key
73 agreement results in a shared session key. The rest of the session is encrypted
74 using a symmetric cipher, currently 128-bit AES, Blowfish, 3DES, or AES. The
75 client selects the encryption algorithm to use from those offered by the
76 server. Additionally, session integrity is provided through a cryptographic
77 message authentication code (\fBhmac-sha1\fR or \fBhmac-md5\fR).
78 .sp
79 .LP
80 Protocol version 2 provides a public key based user authentication method
81 (PubKeyAuthentication) GSS-API based user authentication, conventional password
82 authentication, and a generic prompt/reply protocol for password-based
83 authentication.
84 .SS "Command Execution and Data Forwarding"
85 .LP
86 If the client successfully authenticates itself, a dialog for preparing the
87 session is entered. At this time the client can request things like allocating
88 a pseudo-tty, forwarding X11 connections, forwarding TCP/IP connections, or
89 forwarding the authentication agent connection over the secure channel.
90 .sp
91 .LP
92 Finally, the client either requests a shell or execution of a command. The
93 sides then enter session mode. In this mode, either side may send data at any
94 time, and such data is forwarded to/from the shell or command on the server
95 side, and the user terminal on the client side.
96 .sp
97 .LP
98 When the user program terminates and all forwarded X11 and other connections
99 have been closed, the server sends command exit status to the client, and both
100 sides exit.
101 .sp
102 .LP
103 \fBsshd\fR can be configured using command-line options or the configuration
104 file \fB/etc/ssh/ssh_config\fR, described in \fBssh_config\fR(4). Command-line
105 options override values specified in the configuration file.
106 .sp
107 .LP
108 \fBsshd\fR rereads its configuration file when it receives a hangup signal,
109 \fBSIGHUP\fR, by executing itself with the name it was started as, that is,
110 \fB/usr/lib/ssh/sshd\fR.
111 .SS "Host Access Control"
112 .LP
113 The \fBsshd\fR daemon uses TCP Wrappers to restrict access to hosts. It uses
114 the service name of \fBsshd\fR for \fBhosts_access()\fR. For more information
115 on TCP Wrappers see \fBtcpd(1M)\fR and \fBhosts_access(3)\fR man pages, which
116 are part of the \fBSUNWsfman\fR package (they are not SunOS man pages). TCP
117 wrappers binaries, including \fBlibwrap\fR, are in \fBSUNWtcpd\fR, a required
118 package for \fBSUNWsshdu\fR, the package containing \fBsshd\fR.
119 .SH OPTIONS
120 .LP
121 The options for \fBsshd\fR are as follows:
122 .sp
123 .ne 2
124 .na
125 \fB\fB-b\fR \fIbits\fR\fR
126 .ad
127 .sp .6
128 .RS 4n
129 Specifies the number of bits in the server key (the default is 768).
130 .RE
132 .sp
133 .ne 2
134 .na
135 \fB\fB-d\fR\fR
136 .ad
137 .sp .6
138 .RS 4n
139 Debug mode. The server sends verbose debug output to the system log, and does
140 not put itself in the background. The server also will not fork and will only
141 process one connection. This option is only intended for debugging for the
142 server. Multiple \fB-d\fR options increase the debugging level. Maximum is 3.
143 .RE
145 .sp
146 .ne 2
147 .na
148 \fB\fB-e\fR\fR
149 .ad
150 .sp .6
151 .RS 4n
152 When this option is specified, \fBsshd\fR will send the output to standard
153 error instead of to the system log.
154 .RE
156 .sp
157 .ne 2
158 .na
159 \fB\fB-f\fR \fIconfiguration_file\fR\fR
160 .ad
161 .sp .6
162 .RS 4n
163 Specifies the name of the configuration file. The default is
164 \fB/etc/ssh/sshd_config\fR. \fBsshd\fR refuses to start if there is no
165 configuration file.
166 .RE
168 .sp
169 .ne 2
170 .na
171 \fB\fB-g\fR \fIlogin_grace_time\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Gives the grace time for clients to authenticate themselves (the default is 300
176 seconds). If the client fails to authenticate the user within this number of
177 seconds, the server disconnects and exits. A value of zero indicates no limit.
178 .RE
180 .sp
181 .ne 2
182 .na
183 \fB\fB-h\fR \fIhost_key_file\fR\fR
184 .ad
185 .sp .6
186 .RS 4n
187 Specifies a file from which a host key is read. This option must be given if
188 \fBsshd\fR is not run as root (as the normal host key files are normally not
189 readable by anyone but root). The default is \fB/etc/ssh/ssh_host_key\fR for
190 protocol version 1, and \fB/etc/ssh/ssh_host_rsa_key\fR and
191 \fB/etc/ssh/ssh_host_dsa_key\fR for protocol version 2. It is possible to have
192 multiple host key files for the different protocol versions and host key
193 algorithms.
194 .RE
196 .sp
197 .ne 2
198 .na
199 \fB\fB-i\fR\fR
200 .ad
201 .sp .6
202 .RS 4n
203 Specifies that \fBsshd\fR is being run from \fBinetd\fR. \fBsshd\fR is normally
204 not run from \fBinetd\fR because it needs to generate the server key before it
205 can respond to the client, and this may take tens of seconds. Clients would
206 have to wait too long if the key was regenerated every time. However, with
207 small key sizes (for example, 512) using \fBsshd\fR from \fBinetd\fR may be
208 reasonable.
209 .RE
211 .sp
212 .ne 2
213 .na
214 \fB\fB-k\fR \fIkey_gen_time\fR\fR
215 .ad
216 .sp .6
217 .RS 4n
218 (SSHv1-specific) Specifies how often the server key is regenerated (the default
219 is 3600 seconds, or one hour). The motivation for regenerating the key fairly
220 often is that the key is not stored anywhere, and after about an hour, it
221 becomes impossible to recover the key for decrypting intercepted communications
222 even if the machine is cracked into or physically seized. A value of zero
223 indicates that the key will never be regenerated.
224 .RE
226 .sp
227 .ne 2
228 .na
229 \fB\fB-o\fR \fIoption\fR\fR
230 .ad
231 .sp .6
232 .RS 4n
233 Can be used to specify options in the format used in the configuration file.
234 This is useful for specifying options for which there are no separate
235 command-line flags.
236 .RE
238 .sp
239 .ne 2
240 .na
241 \fB\fB-p\fR \fIport\fR\fR
242 .ad
243 .sp .6
244 .RS 4n
245 Specifies the port on which the server listens for connections (the default is
246 22).
247 .RE
249 .sp
250 .ne 2
251 .na
252 \fB\fB-q\fR\fR
253 .ad
254 .sp .6
255 .RS 4n
256 Quiet mode. Nothing is sent to the system log. Normally the beginning,
257 authentication, and termination of each connection is logged.
258 .RE
260 .sp
261 .ne 2
262 .na
263 \fB\fB-t\fR\fR
264 .ad
265 .sp .6
266 .RS 4n
267 Test mode. Check only the validity of the configuration file and the sanity of
268 the keys. This is useful for updating sshd reliably as configuration options
269 might change.
270 .RE
272 .sp
273 .ne 2
274 .na
275 \fB\fB-D\fR\fR
276 .ad
277 .sp .6
278 .RS 4n
279 When this option is specified \fBsshd\fR does not detach and does not become a
280 daemon. This allows easy monitoring of \fBsshd\fR.
281 .RE
283 .sp
284 .ne 2
285 .na
286 \fB\fB-4\fR\fR
287 .ad
288 .sp .6
289 .RS 4n
290 Forces \fBsshd\fR to use IPv4 addresses only.
291 .RE
293 .sp
294 .ne 2
295 .na
296 \fB\fB-6\fR\fR
297 .ad
298 .sp .6
299 .RS 4n
300 Forces \fBsshd\fR to use IPv6 addresses only.
301 .RE
303 .SH EXTENDED DESCRIPTION
304 .SS "\fBauthorized_keys\fR File Format"
305 .LP
306 The \fB$HOME/.ssh/authorized_keys\fR file lists the public keys that are
307 permitted for RSA authentication in protocol version 1 and for public key
308 authentication (\fBPubkeyAuthentication\fR) in protocol version 2. The
309 \fBAuthorizedKeysFile\fR configuration option can be used to specify an
310 alternative file.
311 .sp
312 .LP
313 Each line of the file contains one key (empty lines and lines starting with a
314 hash mark [\fB#\fR] are ignored as comments).
315 .sp
316 .LP
317 For each RSA key for protocol version 1, the file consists of the following
318 space-separated fields:
319 .sp
320 .in +2
321 .nf
322 \fIoptions\fR \fIbits\fR \fIexponent\fR \fImodulus\fR \fIcomment\fR
323 .fi
324 .in -2
325 .sp
327 .sp
328 .LP
329 For the public key for protocol version 2, the file consists of the following
330 space-separated fields:
331 .sp
332 .in +2
333 .nf
334 \fIoptions\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
335 .fi
336 .in -2
337 .sp
339 .sp
340 .LP
341 For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
342 \fBssh-dsa\fR.
343 .sp
344 .LP
345 The options field is optional; its presence is determined by whether the line
346 starts with a number. (The option field never starts with a number.) The bits,
347 exponent, and modulus fields give the RSA key; the comment field is a
348 convenient place for you to identify the key.
349 .sp
350 .LP
351 Lines in this file are usually several hundred bytes long (because of the size
352 of the key modulus). You will find it very inconvenient to type them in;
353 instead, copy the public key file and edit it.
354 .sp
355 .LP
356 Permissions of this file must be set so that it is not world or group writable.
357 See the \fBStrictModes\fR option of \fBsshd_config\fR(4).
358 .sp
359 .LP
360 The options (if present) consist of comma-separated option specifications. No
361 spaces are permitted, except within double quotes. The following option
362 specifications are supported:
363 .sp
364 .ne 2
365 .na
366 \fB\fBfrom="\fIpattern-list\fR"\fR\fR
367 .ad
368 .sp .6
369 .RS 4n
370 Specifies that, in addition to public key authentication, the canonical name of
371 the remote host must be present in the comma-separated list of patterns
372 (`\fB*\fR' and `\fB?\fR' serve as wildcards). The list can also contain negated
373 patterns by prefixing the patterns with `\fB!\fR'. If the canonical host name
374 matches a negated pattern, the key is not accepted.
375 .sp
376 The purpose of this option is to give you the option of increasing security:
377 public key authentication by itself does not trust the network or name servers
378 or anything but the key. However, if someone manages to steal the key,
379 possession of the key would permit the intruder to log in from anywhere in the
380 world. This option makes using a stolen key more difficult, because name
381 servers and routers would have to be compromised, in addition to just the key.
382 .RE
384 .sp
385 .ne 2
386 .na
387 \fB\fBcommand="\fIcommand\fR"\fR\fR
388 .ad
389 .sp .6
390 .RS 4n
391 Specifies that the \fIcommand\fR is executed whenever this key is used for
392 authentication. The command supplied by the user (if any) is ignored. The
393 command is run on a \fBpty\fR if the client requests a \fBpty\fR; otherwise it
394 is run without a \fBtty\fR. If an 8-bit clean channel is required, one must not
395 request a \fBpty\fR or should specify \fBno-pty\fR. You can include a quote in
396 the command by escaping it with a backslash. This option might be useful to
397 restrict certain public keys from performing a specific operation. An example
398 is a key that permits remote backups but nothing else. Note that the client can
399 specify TCP/IP and/or X11 forwarding unless they are explicitly prohibited from
400 doing so. Also note that this option applies to shell, command, or subsystem
401 execution.
402 .RE
404 .sp
405 .ne 2
406 .na
407 \fB\fBenvironment="\fINAME\fR=\fIvalue\fR"\fR\fR
408 .ad
409 .sp .6
410 .RS 4n
411 Specifies that the string \fINAME\fR=\fIvalue\fR is to be added to the
412 environment when logging in using this key. Environment variables set this way
413 override other default environment values. Multiple options of this type are
414 permitted. Environment processing is disabled by default and is controlled via
415 the \fBPermitUserEnvironment\fR option.
416 .RE
418 .sp
419 .ne 2
420 .na
421 \fB\fBno-port-forwarding\fR\fR
422 .ad
423 .sp .6
424 .RS 4n
425 Forbids TCP/IP forwarding when this key is used for authentication. Any port
426 forward requests by the client will return an error. This might be used, for
427 example, in connection with the \fBcommand\fR option.
428 .RE
430 .sp
431 .ne 2
432 .na
433 \fB\fBno-X11-forwarding\fR\fR
434 .ad
435 .sp .6
436 .RS 4n
437 Forbids X11 forwarding when this key is used for authentication. Any X11
438 forward requests by the client will return an error.
439 .RE
441 .sp
442 .ne 2
443 .na
444 \fB\fBno-agent-forwarding\fR\fR
445 .ad
446 .sp .6
447 .RS 4n
448 Forbids authentication agent forwarding when this key is used for
449 authentication.
450 .RE
452 .sp
453 .ne 2
454 .na
455 \fB\fBno-pty\fR\fR
456 .ad
457 .sp .6
458 .RS 4n
459 Prevents \fBtty\fR allocation (a request to allocate a \fBpty\fR will fail).
460 .RE
462 .sp
463 .ne 2
464 .na
465 \fB\fBpermitopen="\fIhost\fR:\fIport\fR"\fR\fR
466 .ad
467 .sp .6
468 .RS 4n
469 Limit local \fBssh\fR \fB-L\fR port forwarding such that it can connect only to
470 the specified host and port. IPv6 addresses can be specified with an
471 alternative syntax: \fIhost\fR/\fIport\fR. You can invoke multiple
472 \fBpermitopen\fR options, with each instance separated by a comma. No pattern
473 matching is performed on the specified hostnames. They must be literal domains
474 or addresses.
475 .RE
477 .SS "\fBssh_known_hosts\fR File Format"
478 .LP
479 The \fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR files
480 contain host public keys for all known hosts. The global file should be
481 prepared by the administrator (optional), and the per-user file is maintained
482 automatically: whenever the user connects from an unknown host its key is added
483 to the per-user file.
484 .sp
485 .LP
486 For the RSA key for protocol version 1, these files consist of the following
487 space-separated fields:
488 .sp
489 .in +2
490 .nf
491 \fIhostnames\fR \fIbits\fR \fIexponent\fR \fImodulus\fR \fIcomment\fR
492 .fi
493 .in -2
494 .sp
496 .sp
497 .LP
498 For the public key for protocol version 2, these files consist of the following
499 space-separated fields:
500 .sp
501 .in +2
502 .nf
503 \fIhostnames\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
504 .fi
505 .in -2
506 .sp
508 .sp
509 .LP
510 For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
511 \fBssh-dsa\fR.
512 .sp
513 .LP
514 Hostnames is a comma-separated list of patterns (\fB*\fR and \fB?\fR act as
515 wildcards); each pattern in turn is matched against the canonical host name
516 (when authenticating a client) or against the user-supplied name (when
517 authenticating a server). A pattern can also be preceded by \fB!\fR to indicate
518 negation: if the host name matches a negated pattern, it is not accepted (by
519 that line) even if it matched another pattern on the line.
520 .sp
521 .LP
522 Alternately, hostnames can be stored in a hashed form, which hides host names
523 and addresses should the file's contents be disclosed. Hashed hostnames start
524 with a vertical bar (\fB|\fR) character. Only one hashed hostname can appear on
525 a single line and none of the above negation or wildcard operators may be
526 applied.
527 .sp
528 .LP
529 Bits, exponent, and modulus are taken directly from the RSA host key; they can
530 be obtained, for example, from \fB/etc/ssh/ssh_host_rsa_key.pub\fR. The
531 optional comment field continues to the end of the line, and is not used.
532 .sp
533 .LP
534 Lines starting with a hash mark (\fB#\fR) and empty lines are ignored as
535 comments.
536 .sp
537 .LP
538 When performing host authentication, authentication is accepted if any matching
539 line has the proper key. It is thus permissible (but not recommended) to have
540 several lines or different host keys for the same names. This will inevitably
541 happen when short forms of host names from different domains are put in the
542 file. It is possible that the files contain conflicting information;
543 authentication is accepted if valid information can be found from either file.
544 .sp
545 .LP
546 The lines in these files are typically hundreds of characters long. You should
547 definitely not type in the host keys by hand. Rather, generate them by a script
548 or by taking \fB/etc/ssh/ssh_host_rsa_key.pub\fR and adding the host names at
549 the front.
550 .SH ENVIRONMENT VARIABLES
551 .LP
552 \fBsshd\fR sets the following environment variables for commands executed by
553 \fBssh\fR users:
554 .sp
555 .ne 2
556 .na
557 \fB\fBDISPLAY\fR\fR
558 .ad
559 .sp .6
560 .RS 4n
561 Indicates the location of the X11 server. It is automatically set by \fBsshd\fR
562 to point to a value of the form \fIhostname\fR:\fIn\fR, where \fIhostname\fR
563 indicates the host where the shell runs, and \fIn\fR is an integer greater than
564 or equal to 1. \fBssh\fR uses this special value to forward X11 connections
565 over the secure channel. Unless you have important reasons to do otherwise, you
566 should not set \fBDISPLAY\fR explicitly, as that will render the X11 connection
567 insecure and will require you to manually copy any required authorization
568 cookies.
569 .RE
571 .sp
572 .ne 2
573 .na
574 \fB\fBHOME\fR\fR
575 .ad
576 .sp .6
577 .RS 4n
578 Set to the path of the user's home directory.
579 .RE
581 .sp
582 .ne 2
583 .na
584 \fB\fBLANG\fR, \fBLC_ALL\fR, \fBLC_COLLATE\fR, \fBLC_CTYPE\fR,
585 \fBLC_MESSAGES\fR, \fBLC_MONETARY\fR, \fBLC_NUMERIC\fR, \fBLC_TIME\fR\fR
586 .ad
587 .sp .6
588 .RS 4n
589 A locale setting. The locale defaults to that of \fBsshd\fR (usually the
590 system-wide default locale), or is negotiated between the client and server
591 during initial key exchange (as per RFC 4253).
592 .sp
593 Following initial key exchange, each of the variables can be overriden in the
594 following sequence:
595 .RS +4
596 .TP
597 1.
598 If a locale setting is set in a client's environment and that client
599 supports "Environment Variable Passing" (see RFC 4254), then the setting will
600 be passed over to the server side.
601 .RE
602 .RS +4
603 .TP
604 2.
605 If the public key authentication method was used to authenticate the server
606 and the \fBPermitUserEnvironment\fR variable in \fBsshd_config\fR(4) is set to
607 \fByes\fR on the server side, then the setting can be changed through the use
608 of the \fBenvironment\fR option in the client's \fBAuthorizedKeysFile\fR file.
609 .RE
610 .RS +4
611 .TP
612 3.
613 The setting can be change in the client's \fB~/.ssh/environment\fR file on
614 the server.
615 .RE
616 See \fBPermitUserEnvironment\fR in \fBsshd_config\fR(4) as to when the
617 \fBAuthorizedKeysFile\fR and \fB~/.ssh/environment\fR files are processed and
618 used for setting the user environment.
619 .RE
621 .sp
622 .ne 2
623 .na
624 \fB\fBLOGNAME\fR\fR
625 .ad
626 .sp .6
627 .RS 4n
628 Synonym for \fBUSER\fR. Set for compatibility with systems that use this
629 variable.
630 .RE
632 .sp
633 .ne 2
634 .na
635 \fB\fBMAIL\fR\fR
636 .ad
637 .sp .6
638 .RS 4n
639 Set to point to the user's mailbox.
640 .RE
642 .sp
643 .ne 2
644 .na
645 \fB\fBSSH_AUTH_SOCK\fR\fR
646 .ad
647 .sp .6
648 .RS 4n
649 Indicates the path of a \fBunix-domain\fR socket used to communicate with the
650 agent.
651 .RE
653 .sp
654 .ne 2
655 .na
656 \fB\fBSSH_CONNECTION\fR\fR
657 .ad
658 .sp .6
659 .RS 4n
660 Identifies the client and server ends of the connection. The variable contains
661 four space-separated values: client IP address, client port number, server IP
662 address and server port number.
663 .RE
665 .sp
666 .ne 2
667 .na
668 \fB\fBSSH_CLIENT\fR\fR
669 .ad
670 .sp .6
671 .RS 4n
672 Identifies the client end of the connection. The variable contains three
673 space-separated values: client IP address, client port number, and server port
674 number.
675 .RE
677 .sp
678 .ne 2
679 .na
680 \fB\fBSSH_TTY\fR\fR
681 .ad
682 .sp .6
683 .RS 4n
684 Set to the name of the \fBtty\fR (path to the device) associated with the
685 current shell or command. If the current session has no \fBtty\fR, this
686 variable is not set.
687 .RE
689 .sp
690 .ne 2
691 .na
692 \fB\fBTZ\fR\fR
693 .ad
694 .sp .6
695 .RS 4n
696 Indicates the present timezone, if \fBTIMEZONE\fR is set in
697 \fB/etc/default/login\fR or if \fBTZ\fR was set when the daemon was started.
698 .RE
700 .sp
701 .ne 2
702 .na
703 \fB\fBHZ\fR\fR
704 .ad
705 .sp .6
706 .RS 4n
707 If set in \fB/etc/default/login\fR, the daemon sets it to the same value.
708 .RE
710 .sp
711 .ne 2
712 .na
713 \fB\fBSHELL\fR\fR
714 .ad
715 .sp .6
716 .RS 4n
717 The user's shell, if \fBALTSHELL=YES\fR in \fB/etc/default/login\fR.
718 .RE
720 .sp
721 .ne 2
722 .na
723 \fB\fBPATH\fR\fR
724 .ad
725 .sp .6
726 .RS 4n
727 Set to the value of \fBPATH\fR or \fBSUPATH\fR (see \fBlogin\fR(1)) in
728 \fB/etc/default/login\fR, or, if not set, to \fB/usr/bin:/bin\fR.
729 .RE
731 .sp
732 .ne 2
733 .na
734 \fB\fBUSER\fR\fR
735 .ad
736 .sp .6
737 .RS 4n
738 Set to the name of the user logging in.
739 .RE
741 .sp
742 .LP
743 Additionally, \fBsshd\fR reads \fB$HOME/.ssh/environment\fR and adds lines of
744 the format \fBVARNAME=\fIvalue\fR\fR to the environment.
745 .SH EXAMPLES
746 .LP
747 In the following examples, certain lines might wrap due to line length limits
748 in your display. You should nevertheless consider the wrapped line as a single
749 line.
750 .LP
751 \fBExample 1 \fR\fBauthorized_key\fR File Entries
752 .sp
753 .LP
754 The following are examples of \fBauthorized_key\fR file entries for protocol 1:
756 .sp
757 .in +2
758 .nf
759 1024 33 12121...312314325 ylo@foo.bar
761 from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
763 command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 backup.hut.fi
764 .fi
765 .in -2
766 .sp
768 .LP
769 \fBExample 2 \fR\fBauthorized_key\fR File Entries for Protocol 2
770 .sp
771 .LP
772 The following are examples of \fBauthorized_key\fR file entries for protocol 2:
774 .sp
775 .in +2
776 .nf
777 ssh-rsa AAAAB3NzaC1y.....EU88ovYKg4GfclWGCFYTuw8= ylo@foo.bar
778 from="*.niksula.hut.fi" ssh-rsa AAAAB3NzaC...uw8= ylo@niksula
779 command="dump /home",no-pty,no-port-forwarding ssh-rsa AA..8= backup.hut.fi
780 .fi
781 .in -2
782 .sp
784 .LP
785 \fBExample 3 \fR\fBssh_known_hosts\fR File Entries for Protocol 1
786 .sp
787 .LP
788 The following are examples of \fBssh_known_hosts\fR file entries for protocol
789 1:
791 .sp
792 .in +2
793 .nf
794 closenet,closenet.hut.fi,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
795 .fi
796 .in -2
797 .sp
799 .LP
800 \fBExample 4 \fR\fBssh_known_hosts\fR File Entries for Protocol 2
801 .sp
802 .LP
803 The following are examples of \fBssh_known_hosts\fR file entries for protocol
804 2:
806 .sp
807 .in +2
808 .nf
809 closenet,closenet.hut.fi,...,130.233.208.41 ssh-rsa AA..8= closenet.hut.fi
810 .fi
811 .in -2
812 .sp
814 .SH EXIT STATUS
815 .LP
816 The following exit values are returned:
817 .sp
818 .ne 2
819 .na
820 \fB\fB0\fR\fR
821 .ad
822 .RS 13n
823 Successful completion.
824 .RE
826 .sp
827 .ne 2
828 .na
829 \fB>\fB0\fR\fR
830 .ad
831 .RS 13n
832 An error occurred.
833 .RE
835 .SH FILES
836 .ne 2
837 .na
838 \fB\fB/etc/default/login\fR\fR
839 .ad
840 .sp .6
841 .RS 4n
842 Contains defaults for several \fBsshd_config\fR parameters, environment
843 variables, and other environmental factors.
844 .sp
845 The following parameters affect environment variables (see \fBlogin\fR(1) and
846 descriptions of these variables, above):
847 .RS +4
848 .TP
849 .ie t \(bu
850 .el o
851 \fBTIMEZONE\fR
852 .RE
853 .RS +4
854 .TP
855 .ie t \(bu
856 .el o
857 \fBHZ\fR
858 .RE
859 .RS +4
860 .TP
861 .ie t \(bu
862 .el o
863 \fBALTSHELL\fR
864 .RE
865 .RS +4
866 .TP
867 .ie t \(bu
868 .el o
869 \fBPATH\fR
870 .RE
871 .RS +4
872 .TP
873 .ie t \(bu
874 .el o
875 \fBSUPATH\fR
876 .RE
877 The following \fB/etc/default/login\fR parameters supply default values for
878 corresponding \fBsshd_config\fR(4) parameters:
879 .RS +4
880 .TP
881 .ie t \(bu
882 .el o
883 \fBCONSOLE\fR (see \fBPermitRootLogin\fR in \fBsshd_config\fR(4))
884 .RE
885 .RS +4
886 .TP
887 .ie t \(bu
888 .el o
889 \fBPASSREQ\fR (see \fBPermitEmptyPasswords\fR in \fBsshd_config\fR(4))
890 .RE
891 .RS +4
892 .TP
893 .ie t \(bu
894 .el o
895 \fBTIMEOUT\fR (see \fBLoginGraceTime\fR in \fBsshd_config\fR(4))
896 .RE
897 The following \fB/etc/default/login\fR parameters:
898 .RS +4
899 .TP
900 .ie t \(bu
901 .el o
902 \fBUMASK\fR
903 .RE
904 .RS +4
905 .TP
906 .ie t \(bu
907 .el o
908 \fBULIMIT\fR
909 .RE
910 \&...set the \fBumask\fR(2) and file size limit of, respectively, the shells
911 and commands spawned by \fBsshd\fR.
912 .sp
913 Finally, two \fB/etc/default/login\fR parameters affect the maximum allowed
914 login attempts per-connection using interactive user authentication methods
915 (for example, \fBkeyboard-interactive\fR but not \fBpublickey\fR), as per
916 \fBlogin\fR(1):
917 .RS +4
918 .TP
919 .ie t \(bu
920 .el o
921 \fBRETRIES\fR
922 .RE
923 .RS +4
924 .TP
925 .ie t \(bu
926 .el o
927 \fBSYSLOG_FAILED_LOGINS\fR
928 .RE
929 .RE
931 .sp
932 .ne 2
933 .na
934 \fB\fB/etc/ssh/sshd_config\fR\fR
935 .ad
936 .sp .6
937 .RS 4n
938 Contains configuration data for \fBsshd\fR. This file should be writable by
939 root only, but it is recommended (though not necessary) that it be
940 world-readable.
941 .RE
943 .sp
944 .ne 2
945 .na
946 \fB\fB/etc/ssh/ssh_host_key\fR\fR
947 .ad
948 .br
949 .na
950 \fB\fB/etc/ssh/ssh_host_dsa_key\fR\fR
951 .ad
952 .br
953 .na
954 \fB\fB/etc/ssh/ssh_host_rsa_key\fR\fR
955 .ad
956 .sp .6
957 .RS 4n
958 Contains the private part of the host key. This file should only be owned by
959 root, readable only by root, and not accessible to others. \fBsshd\fR does not
960 start if this file is group/world-accessible.
961 .RE
963 .sp
964 .ne 2
965 .na
966 \fB\fB/etc/ssh/ssh_host_key.pub\fR\fR
967 .ad
968 .br
969 .na
970 \fB\fB/etc/ssh/ssh_host_dsa_key.pub\fR\fR
971 .ad
972 .br
973 .na
974 \fB\fB/etc/ssh/ssh_host_rsa_key.pub\fR\fR
975 .ad
976 .sp .6
977 .RS 4n
978 Contains the public part of the host key. This file should be world-readable
979 but writable only by root. Its contents should match the private part. This
980 file is not used for encryption; it is provided only for the convenience of the
981 user so its contents can be copied to known hosts files. These two files are
982 created using \fBssh-keygen\fR(1).
983 .RE
985 .sp
986 .ne 2
987 .na
988 \fB\fB/var/run/sshd.pid\fR\fR
989 .ad
990 .sp .6
991 .RS 4n
992 Contains the process ID of the \fBsshd\fR listening for connections. If there
993 are several daemons running concurrently for different ports, this contains the
994 pid of the one started last. The content of this file is not sensitive; it can
995 be world-readable. You can use the \fBPidFile\fR keyword in \fBsshd_config\fR
996 to specify a file other than \fB/var/run/sshd.pid\fR. See \fBsshd_config\fR(4).
997 .RE
999 .sp
1000 .ne 2
1001 .na
1002 \fB\fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR\fR
1003 .ad
1004 .sp .6
1005 .RS 4n
1006 These files are consulted when using \fBrhosts\fR with public key host
1007 authentication to check the public key of the host. The key must be listed in
1008 one of these files to be accepted. The client uses the same files to verify
1009 that the remote host is the one it intended to connect. These files should be
1010 writable only by root or the owner. \fB/etc/ssh/ssh_known_hosts\fR should be
1011 world-readable, and \fB$HOME/.ssh/known_hosts\fR can but need not be
1012 world-readable.
1013 .RE
1015 .sp
1016 .ne 2
1017 .na
1018 \fB\fB/etc/nologin\fR\fR
1019 .ad
1020 .sp .6
1021 .RS 4n
1022 If this file exists, \fBsshd\fR refuses to let anyone except root log in. The
1023 contents of the file are displayed to anyone trying to log in, and non-root
1024 connections are refused. The file should be world-readable.
1025 .RE
1027 .sp
1028 .ne 2
1029 .na
1030 \fB\fB$HOME/.ssh/authorized_keys\fR\fR
1031 .ad
1032 .sp .6
1033 .RS 4n
1034 Lists the public keys (RSA or DSA) that can be used to log into the user's
1035 account. This file must be readable by root. This might, on some machines,
1036 imply that it is world-readable if the user's home directory resides on an NFS
1037 volume. It is recommended that it not be accessible by others. The format of
1038 this file is described above. Users will place the contents of their
1039 \fBidentity.pub\fR, \fBid_dsa.pub\fR and/or \fBid_rsa.pub\fR files into this
1040 file, as described in \fBssh-keygen\fR(1).
1041 .RE
1043 .sp
1044 .ne 2
1045 .na
1046 \fB\fB$HOME/.rhosts\fR\fR
1047 .ad
1048 .sp .6
1049 .RS 4n
1050 This file contains host-username pairs, separated by a space, one per line. The
1051 given user on the corresponding host is permitted to log in without password.
1052 The same file is used by \fBrlogind\fR and \fBrshd\fR. The file must be
1053 writable only by the user; it is recommended that it not be accessible by
1054 others. It is also possible to use \fBnetgroups\fR in the file. Either host or
1055 user name may be of the form \fB+@\fIgroupname\fR\fR to specify all hosts or
1056 all users in the group.
1057 .RE
1059 .sp
1060 .ne 2
1061 .na
1062 \fB\fB$HOME/.shosts\fR\fR
1063 .ad
1064 .sp .6
1065 .RS 4n
1066 For \fBssh\fR, this file is exactly the same as for \fB\&.rhosts\fR. However,
1067 this file is not used by \fBrlogin\fR and \fBrshd\fR, so using this permits
1068 access using SSH only.
1069 .RE
1071 .sp
1072 .ne 2
1073 .na
1074 \fB\fB/etc/hosts.equiv\fR\fR
1075 .ad
1076 .sp .6
1077 .RS 4n
1078 This file is used during \fB\&.rhosts\fR authentication. In its simplest form,
1079 this file contains host names, one per line. Users on these hosts are permitted
1080 to log in without a password, provided they have the same user name on both
1081 machines. The host name can also be followed by a user name; such users are
1082 permitted to log in as any user on this machine (except root). Additionally,
1083 the syntax \fB+@\fIgroup\fR\fR can be used to specify netgroups. Negated
1084 entries start with a hyphen (\fB-\fR).
1085 .sp
1086 If the client host/user is successfully matched in this file, login is
1087 automatically permitted, provided the client and server user names are the
1088 same. Additionally, successful RSA host authentication is normally required.
1089 This file must be writable only by root; it is recommended that it be
1090 world-readable.
1091 .sp
1092 Warning: It is almost never a good idea to use user names in \fBhosts.equiv\fR.
1093 Beware that it really means that the named user(s) can log in as anybody, which
1094 includes \fBbin\fR, \fBdaemon\fR, \fBadm\fR, and other accounts that own
1095 critical binaries and directories. For practical purposes, using a user name
1096 grants the user root access. Probably the only valid use for user names is in
1097 negative entries. This warning also applies to \fBrsh\fR/\fBrlogin\fR.
1098 .RE
1100 .sp
1101 .ne 2
1102 .na
1103 \fB\fB/etc/ssh/moduli\fR\fR
1104 .ad
1105 .sp .6
1106 .RS 4n
1107 A private file.
1108 .RE
1110 .sp
1111 .ne 2
1112 .na
1113 \fB\fB/etc/ssh/shosts.equiv\fR\fR
1114 .ad
1115 .sp .6
1116 .RS 4n
1117 This file is processed exactly as \fB/etc/hosts.equiv\fR. However, this file
1118 might be useful in environments that want to run both \fBrsh\fR/\fBrlogin\fR
1119 and \fBssh\fR.
1120 .RE
1122 .sp
1123 .ne 2
1124 .na
1125 \fB\fB$HOME/.ssh/environment\fR\fR
1126 .ad
1127 .sp .6
1128 .RS 4n
1129 This file is read into the environment at login (if it exists). It can contain
1130 only empty lines, comment lines (that start with \fB#\fR), and assignment lines
1131 of the form \fB\fIname\fR=\fIvalue\fR\fR. The file should be writable only by
1132 the user; it need not be readable by anyone else. Environment processing is
1133 disabled by default and is controlled by means of the
1134 \fBPermitUserEnvironment\fR option.
1135 .RE
1137 .sp
1138 .ne 2
1139 .na
1140 \fB\fB$HOME/.ssh/rc\fR\fR
1141 .ad
1142 .sp .6
1143 .RS 4n
1144 If this file exists, it is run with \fB/bin/sh\fR after reading the environment
1145 files but before starting the user's shell or command. If X11 spoofing is in
1146 use, this will receive the \fBproto cookie\fR pair in standard input (and
1147 \fBDISPLAY\fR in environment). This must call \fBxauth\fR in that case.
1148 .sp
1149 The primary purpose of \fB$HOME/.ssh/rc\fR is to run any initialization
1150 routines that might be needed before the user's home directory becomes
1151 accessible; AFS is a particular example of such an environment. If this file
1152 exists, it is run with \fB/bin/sh\fR after reading the environment files, but
1153 before starting the user's shell or command. It must not produce any output on
1154 stdout; stderr must be used instead. If X11 forwarding is in use, it will
1155 receive the \fBproto cookie\fR pair in its standard input and \fBDISPLAY\fR in
1156 its environment. The script must call \fBxauth\fR because \fBsshd\fR will not
1157 run \fBxauth\fR automatically to add X11 cookies.
1158 .sp
1159 This file will probably contain some initialization code followed by something
1160 similar to:
1161 .sp
1162 .in +2
1163 .nf
1164 if read proto cookie && [ -n "$DISPLAY" ]
1165 then
1166 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]
1167 then
1168 # X11UseLocalhost=yes
1169 echo add unix:`echo $DISPLAY |
1170 cut -c11-` $proto $cookie
1171 else
1172 # X11UseLocalhost=no
1173 echo add $DISPLAY $proto $cookie
1174 fi | xauth -q -
1175 fi
1176 .fi
1177 .in -2
1178 .sp
1180 If this file does not exist, \fB/etc/ssh/sshrc\fR is run, and if that does not
1181 exist, \fBxauth\fR is used to store the cookie. \fB$HOME/.ssh/rc\fR should be
1182 writable only by the user, and need not be readable by anyone else.
1183 .RE
1185 .sp
1186 .ne 2
1187 .na
1188 \fB\fB/etc/ssh/sshrc\fR\fR
1189 .ad
1190 .sp .6
1191 .RS 4n
1192 Similar to \fB$HOME/.ssh/rc\fR. This can be used to specify machine-specific
1193 login-time initializations globally. This file should be writable only by root,
1194 and should be world-readable.
1195 .RE
1197 .SH SECURITY
1198 .LP
1199 \fBsshd\fR supports the use of several user authentication mechanisms: a public
1200 key system where keys are associated with users (through users'
1201 \fBauthorized_keys\fR files), a public key system where keys are associated
1202 with hosts (see the \fBHostbasedAuthentication\fR configuration parameter), a
1203 GSS-API based method (see the \fBGssAuthentication\fR and \fBGssKeyEx\fR
1204 configuration parameters) and three initial authentication methods: \fBnone\fR,
1205 \fBpassword\fR, and a generic prompt/reply protocol,
1206 \fBkeyboard-interactive\fR.
1207 .sp
1208 .LP
1209 \fBsshd\fR negotiates the use of the GSS-API with clients only if it has a
1210 GSS-API acceptor credential for the "host" service. This means that, for
1211 GSS-API based authentication, the server must have a Kerberos V \fBkeytab\fR
1212 entry (see below) or the equivalent for any other GSS-API mechanism that might
1213 be installed.
1214 .sp
1215 .LP
1216 In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
1217 Kerberos principal must exist for each Fully Qualified Domain Name associated
1218 with the \fBin.sshd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
1219 must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
1220 \fBin.sshd\fR server. An example principal might be:
1221 .sp
1222 .LP
1223 \fBhost/bigmachine.eng.example.com\fR
1224 .sp
1225 .LP
1226 See \fBkadmin\fR(1M) for instructions on adding a principal to a
1227 \fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
1228 authentication.
1229 .sp
1230 .LP
1231 GSS-API authorization is covered in \fBgss_auth_rules\fR(5).
1232 .sp
1233 .LP
1234 \fBsshd\fR uses \fBpam\fR(3PAM) for the three initial authentication methods as
1235 well as for account management, session management, and password management for
1236 all authentication methods.
1237 .sp
1238 .LP
1239 Specifically, \fBsshd\fR calls \fBpam_authenticate()\fR for the "none,"
1240 "password" and "keyboard-interactive" SSHv2 \fBuserauth\fR types, as well as
1241 for for the null and password authentication methods for SSHv1. Other SSHv2
1242 authentication methods do not call \fBpam_authenticate()\fR.
1243 \fBpam_acct_mgmt()\fR is called for each authentication method that succeeds.
1244 .sp
1245 .LP
1246 \fBpam_setcred()\fR and \fBpam_open_session()\fR are called when authentication
1247 succeeds and \fBpam_close_session()\fR is called when connections are closed.
1248 .sp
1249 .LP
1250 \fBpam_open_session()\fR and \fBpam_close_session()\fR are also called when
1251 SSHv2 channels with \fBpty\fRs are opened and closed.
1252 .sp
1253 .LP
1254 Each SSHv2 \fBuserauth\fR type has its own PAM service name:
1255 .sp
1257 .sp
1258 .TS
1259 box;
1260 c | c
1261 l | l .
1262 SSHv2 Userauth PAM Service Name
1263 _
1264 none sshd-none
1265 _
1266 password sshd-password
1267 _
1268 keyboard-interactive sshd-kbdint
1269 _
1270 pubkey sshd-pubkey
1271 _
1272 hostbased sshd-hostbased
1273 _
1274 gssapi-with-mic sshd-gssapi
1275 _
1276 gssapi-keyex sshd-gssapi
1277 .TE
1279 .sp
1280 .LP
1281 For SSHv1, \fBsshd-v1\fR is always used.
1282 .sp
1283 .LP
1284 If \fBpam_acct_mgmt()\fR returns \fBPAM_NEW_AUTHTOK_REQD\fR (indicating that
1285 the user's authentication tokens have expired), then \fBsshd\fR forces the use
1286 of "keyboard-interactive" \fBuserauth\fR, if version 2 of the protocol is in
1287 use. The "keyboard-interactive" \fBuserauth\fR will call \fBpam_chauthtok()\fR
1288 if \fBpam_acct_mgmt()\fR once again returns \fBPAM_NEW_AUTHTOK_REQD\fR. By this
1289 means, administrators are able to control what authentication methods are
1290 allowed for SSHv2 on a per-user basis.
1291 .SS "Setting up Host-based Authentication"
1292 .LP
1293 To establish host-based authentication, you must perform the following steps:
1294 .RS +4
1295 .TP
1296 .ie t \(bu
1297 .el o
1298 Configure the client.
1299 .RE
1300 .RS +4
1301 .TP
1302 .ie t \(bu
1303 .el o
1304 Configure the server.
1305 .RE
1306 .RS +4
1307 .TP
1308 .ie t \(bu
1309 .el o
1310 Publish known hosts.
1311 .RE
1312 .RS +4
1313 .TP
1314 .ie t \(bu
1315 .el o
1316 Make appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR.
1317 .RE
1318 .sp
1319 .LP
1320 These steps are expanded in the following paragraphs.
1321 .RS +4
1322 .TP
1323 .ie t \(bu
1324 .el o
1325 On a client machine, in the system-wide client configuration file,
1326 \fB/etc/ssh/ssh_config\fR, you must have the entry:
1327 .sp
1328 .in +2
1329 .nf
1330 HostbasedAuthentication yes
1331 .fi
1332 .in -2
1334 See \fBssh_config\fR(4) and \fBssh-keysign\fR(1M).
1335 .RE
1336 .RS +4
1337 .TP
1338 .ie t \(bu
1339 .el o
1340 On the server, in the system-wide server configuration file,
1341 \fB/etc/ssh/sshd_config\fR, you must have the entry:
1342 .sp
1343 .in +2
1344 .nf
1345 HostbasedAuthentication yes
1346 .fi
1347 .in -2
1349 If per-user \fB\&.shost\fR files are to be allowed (see last step), in the same
1350 file, you must have:
1351 .sp
1352 .in +2
1353 .nf
1354 IgnoreRhosts no
1355 .fi
1356 .in -2
1358 See \fBsshd_config\fR(4) for a description of these keywords.
1359 .RE
1360 .RS +4
1361 .TP
1362 .ie t \(bu
1363 .el o
1364 To publish known hosts, you must have entries for the clients from which users
1365 will be allowed host-based authentication. Make these entries in either or both
1366 of the system-wide file (\fB/etc/ssh/ssh_known_hosts\fR) or the per-user file
1367 (\fB~/.ssh/known_hosts\fR).
1368 .RE
1369 .RS +4
1370 .TP
1371 .ie t \(bu
1372 .el o
1373 Note that \fBsshd\fR uses \fB\&.shosts\fR, not \fB\&.rhosts\fR. If you want the
1374 functionality provided by \fB\&.rhosts\fR, but do not want to use \fBrlogin\fR
1375 or \fBrsh\fR because of their security shortcomings, you can use
1376 \fB\&.shosts\fR in conjunction with \fBsshd\fR. To use this feature, make
1377 appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR, in the
1378 format specified in \fBrhosts\fR(4).
1379 .sp
1380 For the vast majority of network environments, \fB\&.shosts\fR is preferred
1381 over \fB\&.rhosts\fR.
1382 .RE
1383 .SH ATTRIBUTES
1384 .LP
1385 See \fBattributes\fR(5) for descriptions of the following attributes:
1386 .sp
1388 .sp
1389 .TS
1390 box;
1391 c | c
1392 l | l .
1393 ATTRIBUTE TYPE ATTRIBUTE VALUE
1394 _
1395 Interface Stability Evolving
1396 .TE
1398 .sp
1399 .LP
1400 The interface stability of \fB/etc/ssh/moduli\fR is Private.
1401 .SH SEE ALSO
1402 .LP
1403 \fBlogin\fR(1), \fBscp\fR(1), \fBssh\fR(1), \fBssh-add\fR(1),
1404 \fBssh-agent\fR(1), \fBssh-keygen\fR(1), \fBsvcs\fR(1),
1405 \fBkadmin\fR(1M), \fBsftp-server\fR(1M), \fBssh-keysign\fR(1M),
1406 \fBsvcadm\fR(1M), \fBpam\fR(3PAM), \fBrhosts\fR(4), \fBssh_config\fR(4),
1407 \fBsshd_config\fR(4), \fBattributes\fR(5), \fBgss_auth_rules\fR(5),
1408 \fBkerberos\fR(5), \fBpam_roles\fR(5), \fBsmf\fR(5)
1409 .sp
1410 .LP
1411 \fI\fR
1412 .SH NOTES
1413 .LP
1414 The \fBsshd\fR service is managed by the service management facility,
1415 \fBsmf\fR(5), under the service identifier:
1416 .sp
1417 .in +2
1418 .nf
1419 svc:/network/ssh:default
1420 .fi
1421 .in -2
1422 .sp
1424 .sp
1425 .LP
1426 Administrative actions on this service, such as enabling, disabling, or
1427 requesting restart, can be performed using \fBsvcadm\fR(1M). The service's
1428 status can be queried using the \fBsvcs\fR(1) command.
1429 .sp
1430 .LP
1431 \fBsshd\fR always sets \fBPAM_RHOST\fR and sets \fBPAM_AUSER\fR in the case of
1432 host-based \fBuserauth\fR. This behavior allows for remote logins to roles
1433 using host-based authentication. See \fBpam_roles\fR(5).