| blob | e01b7c746b896da4845250b1b11ceef177fc1bd6 |
1 '\" te
2 .\" To view license terms, attribution, and copyright for OpenSSH, the default path is /var/sadm/pkg/SUNWsshdr/install/copyright. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the
3 .\" installed location.
4 .\" Portions Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
5 .TH SSHD 1M "Oct 29, 2015"
6 .SH NAME
7 sshd \- secure shell daemon
8 .SH SYNOPSIS
9 .LP
10 .nf
11 \fBsshd\fR [\fB-deiqtD46\fR] [\fB-b\fR \fIbits\fR] [\fB-f\fR \fIconfig_file\fR]
12 [\fB-g\fR \fIlogin_grace_time\fR] [\fB-h\fR \fIhost_key_file\fR]
13 [\fB-k\fR \fIkey_gen_time\fR] [\fB-p\fR \fIport\fR] [\fB-V\fR \fIclient_protocol_id\fR]
14 .fi
16 .SH DESCRIPTION
17 .sp
18 .LP
19 The \fBsshd\fR (Secure Shell daemon) is the daemon program for \fBssh\fR(1).
20 Together these programs replace \fBrlogin\fR and \fBrsh\fR, and provide secure
21 encrypted communications between two untrusted hosts over an insecure network.
22 The programs are intended to be as easy to install and use as possible.
23 .sp
24 .LP
25 \fBsshd\fR is the daemon that listens for connections from clients. It forks a
26 new daemon for each incoming connection. The forked daemons handle key
27 exchange, encryption, authentication, command execution, and data exchange.
28 .sp
29 .LP
30 This implementation of \fBsshd\fR supports both SSH protocol versions 1 and 2
31 simultaneously. Because of security weaknesses in the v1 protocol, sites should
32 run only v2, if possible. In the default configuration, only protocol v2 is
33 enabled for the server. To enable v1 and v2 simultaneously, see the
34 instructions in \fBsshd_config\fR(4).
35 .sp
36 .LP
37 Support for v1 is provided to help sites with existing \fBssh\fR v1 clients and
38 servers to transition to v2. v1 might not be supported in a future release.
39 .SS "SSH Protocol Version 1"
40 .sp
41 .LP
42 Each host has a host-specific RSA key (normally 1024 bits) used to identify the
43 host. Additionally, when the daemon starts, it generates a server RSA key
44 (normally 768 bits). This key is normally regenerated every hour if it has been
45 used, and is never stored on disk.
46 .sp
47 .LP
48 Whenever a client connects the daemon responds with its public host and server
49 keys. The client compares the RSA host key against its own database to verify
50 that it has not changed. The client then generates a 256-bit random number. It
51 encrypts this random number using both the host key and the server key, and
52 sends the encrypted number to the server. Both sides then use this random
53 number as a session key which is used to encrypt all further communications in
54 the session. The rest of the session is encrypted using a conventional cipher,
55 currently Blowfish or 3DES, with 3DES being used by default. The client selects
56 the encryption algorithm to use from those offered by the server.
57 .sp
58 .LP
59 Next, the server and the client enter an authentication dialog. The client
60 tries to authenticate itself using \fB\&.rhosts\fR authentication,
61 \fB\&.rhosts\fR authentication combined with RSA host authentication, RSA
62 challenge-response authentication, or password-based authentication.
63 .sp
64 .LP
65 Rhosts authentication is normally disabled because it is fundamentally
66 insecure, but can be enabled in the server configuration file if desired.
67 System security is not improved unless \fBrshd\fR(1M), \fBrlogind\fR(1M),
68 \fBrexecd\fR(1M), and \fBrexd\fR(1M) are disabled (thus completely disabling
69 \fBrlogin\fR(1) and \fBrsh\fR(1) into the machine).
70 .SS "SSH Protocol Version 2"
71 .sp
72 .LP
73 Version 2 works similarly to version 1: Each host has a host-specific DSA/RSA
74 key. However, when the daemon starts, it does not generate a server key.
75 Forward security is provided through a Diffie-Hellman key agreement. This key
76 agreement results in a shared session key. The rest of the session is encrypted
77 using a symmetric cipher, currently 128-bit AES, Blowfish, 3DES, or AES. The
78 client selects the encryption algorithm to use from those offered by the
79 server. Additionally, session integrity is provided through a cryptographic
80 message authentication code (\fBhmac-sha1\fR or \fBhmac-md5\fR).
81 .sp
82 .LP
83 Protocol version 2 provides a public key based user authentication method
84 (PubKeyAuthentication) GSS-API based user authentication, conventional password
85 authentication, and a generic prompt/reply protocol for password-based
86 authentication.
87 .SS "Command Execution and Data Forwarding"
88 .sp
89 .LP
90 If the client successfully authenticates itself, a dialog for preparing the
91 session is entered. At this time the client can request things like allocating
92 a pseudo-tty, forwarding X11 connections, forwarding TCP/IP connections, or
93 forwarding the authentication agent connection over the secure channel.
94 .sp
95 .LP
96 Finally, the client either requests a shell or execution of a command. The
97 sides then enter session mode. In this mode, either side may send data at any
98 time, and such data is forwarded to/from the shell or command on the server
99 side, and the user terminal on the client side.
100 .sp
101 .LP
102 When the user program terminates and all forwarded X11 and other connections
103 have been closed, the server sends command exit status to the client, and both
104 sides exit.
105 .sp
106 .LP
107 \fBsshd\fR can be configured using command-line options or the configuration
108 file \fB/etc/ssh/ssh_config\fR, described in \fBssh_config\fR(4). Command-line
109 options override values specified in the configuration file.
110 .sp
111 .LP
112 \fBsshd\fR rereads its configuration file when it receives a hangup signal,
113 \fBSIGHUP\fR, by executing itself with the name it was started as, that is,
114 \fB/usr/lib/ssh/sshd\fR.
115 .SS "Host Access Control"
116 .sp
117 .LP
118 The \fBsshd\fR daemon uses TCP Wrappers to restrict access to hosts. It uses
119 the service name of \fBsshd\fR for \fBhosts_access()\fR. For more information
120 on TCP Wrappers see \fBtcpd(1M)\fR and \fBhosts_access(3)\fR man pages, which
121 are part of the \fBSUNWsfman\fR package (they are not SunOS man pages). TCP
122 wrappers binaries, including \fBlibwrap\fR, are in \fBSUNWtcpd\fR, a required
123 package for \fBSUNWsshdu\fR, the package containing \fBsshd\fR.
124 .SH OPTIONS
125 .sp
126 .LP
127 The options for \fBsshd\fR are as follows:
128 .sp
129 .ne 2
130 .na
131 \fB\fB-b\fR \fIbits\fR\fR
132 .ad
133 .sp .6
134 .RS 4n
135 Specifies the number of bits in the server key (the default is 768).
136 .RE
138 .sp
139 .ne 2
140 .na
141 \fB\fB-d\fR\fR
142 .ad
143 .sp .6
144 .RS 4n
145 Debug mode. The server sends verbose debug output to the system log, and does
146 not put itself in the background. The server also will not fork and will only
147 process one connection. This option is only intended for debugging for the
148 server. Multiple \fB-d\fR options increase the debugging level. Maximum is 3.
149 .RE
151 .sp
152 .ne 2
153 .na
154 \fB\fB-e\fR\fR
155 .ad
156 .sp .6
157 .RS 4n
158 When this option is specified, \fBsshd\fR will send the output to standard
159 error instead of to the system log.
160 .RE
162 .sp
163 .ne 2
164 .na
165 \fB\fB-f\fR \fIconfiguration_file\fR\fR
166 .ad
167 .sp .6
168 .RS 4n
169 Specifies the name of the configuration file. The default is
170 \fB/etc/ssh/sshd_config\fR. \fBsshd\fR refuses to start if there is no
171 configuration file.
172 .RE
174 .sp
175 .ne 2
176 .na
177 \fB\fB-g\fR \fIlogin_grace_time\fR\fR
178 .ad
179 .sp .6
180 .RS 4n
181 Gives the grace time for clients to authenticate themselves (the default is 300
182 seconds). If the client fails to authenticate the user within this number of
183 seconds, the server disconnects and exits. A value of zero indicates no limit.
184 .RE
186 .sp
187 .ne 2
188 .na
189 \fB\fB-h\fR \fIhost_key_file\fR\fR
190 .ad
191 .sp .6
192 .RS 4n
193 Specifies a file from which a host key is read. This option must be given if
194 \fBsshd\fR is not run as root (as the normal host key files are normally not
195 readable by anyone but root). The default is \fB/etc/ssh/ssh_host_key\fR for
196 protocol version 1, and \fB/etc/ssh/ssh_host_rsa_key\fR and
197 \fB/etc/ssh/ssh_host_dsa_key\fR for protocol version 2. It is possible to have
198 multiple host key files for the different protocol versions and host key
199 algorithms.
200 .RE
202 .sp
203 .ne 2
204 .na
205 \fB\fB-i\fR\fR
206 .ad
207 .sp .6
208 .RS 4n
209 Specifies that \fBsshd\fR is being run from \fBinetd\fR. \fBsshd\fR is normally
210 not run from \fBinetd\fR because it needs to generate the server key before it
211 can respond to the client, and this may take tens of seconds. Clients would
212 have to wait too long if the key was regenerated every time. However, with
213 small key sizes (for example, 512) using \fBsshd\fR from \fBinetd\fR may be
214 reasonable.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fB-k\fR \fIkey_gen_time\fR\fR
221 .ad
222 .sp .6
223 .RS 4n
224 (SSHv1-specific) Specifies how often the server key is regenerated (the default
225 is 3600 seconds, or one hour). The motivation for regenerating the key fairly
226 often is that the key is not stored anywhere, and after about an hour, it
227 becomes impossible to recover the key for decrypting intercepted communications
228 even if the machine is cracked into or physically seized. A value of zero
229 indicates that the key will never be regenerated.
230 .RE
232 .sp
233 .ne 2
234 .na
235 \fB\fB-o\fR \fIoption\fR\fR
236 .ad
237 .sp .6
238 .RS 4n
239 Can be used to specify options in the format used in the configuration file.
240 This is useful for specifying options for which there are no separate
241 command-line flags.
242 .RE
244 .sp
245 .ne 2
246 .na
247 \fB\fB-p\fR \fIport\fR\fR
248 .ad
249 .sp .6
250 .RS 4n
251 Specifies the port on which the server listens for connections (the default is
252 22).
253 .RE
255 .sp
256 .ne 2
257 .na
258 \fB\fB-q\fR\fR
259 .ad
260 .sp .6
261 .RS 4n
262 Quiet mode. Nothing is sent to the system log. Normally the beginning,
263 authentication, and termination of each connection is logged.
264 .RE
266 .sp
267 .ne 2
268 .na
269 \fB\fB-t\fR\fR
270 .ad
271 .sp .6
272 .RS 4n
273 Test mode. Check only the validity of the configuration file and the sanity of
274 the keys. This is useful for updating sshd reliably as configuration options
275 might change.
276 .RE
278 .sp
279 .ne 2
280 .na
281 \fB\fB-D\fR\fR
282 .ad
283 .sp .6
284 .RS 4n
285 When this option is specified \fBsshd\fR does not detach and does not become a
286 daemon. This allows easy monitoring of \fBsshd\fR.
287 .RE
289 .sp
290 .ne 2
291 .na
292 \fB\fB-4\fR\fR
293 .ad
294 .sp .6
295 .RS 4n
296 Forces \fBsshd\fR to use IPv4 addresses only.
297 .RE
299 .sp
300 .ne 2
301 .na
302 \fB\fB-6\fR\fR
303 .ad
304 .sp .6
305 .RS 4n
306 Forces \fBsshd\fR to use IPv6 addresses only.
307 .RE
309 .SH EXTENDED DESCRIPTION
310 .SS "\fBauthorized_keys\fR File Format"
311 .sp
312 .LP
313 The \fB$HOME/.ssh/authorized_keys\fR file lists the public keys that are
314 permitted for RSA authentication in protocol version 1 and for public key
315 authentication (\fBPubkeyAuthentication\fR) in protocol version 2. The
316 \fBAuthorizedKeysFile\fR configuration option can be used to specify an
317 alternative file.
318 .sp
319 .LP
320 Each line of the file contains one key (empty lines and lines starting with a
321 hash mark [\fB#\fR] are ignored as comments).
322 .sp
323 .LP
324 For each RSA key for protocol version 1, the file consists of the following
325 space-separated fields:
326 .sp
327 .in +2
328 .nf
329 \fIoptions\fR \fIbits\fR \fIexponent\fR \fImodulus\fR \fIcomment\fR
330 .fi
331 .in -2
332 .sp
334 .sp
335 .LP
336 For the public key for protocol version 2, the file consists of the following
337 space-separated fields:
338 .sp
339 .in +2
340 .nf
341 \fIoptions\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
342 .fi
343 .in -2
344 .sp
346 .sp
347 .LP
348 For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
349 \fBssh-dsa\fR.
350 .sp
351 .LP
352 The options field is optional; its presence is determined by whether the line
353 starts with a number. (The option field never starts with a number.) The bits,
354 exponent, and modulus fields give the RSA key; the comment field is a
355 convenient place for you to identify the key.
356 .sp
357 .LP
358 Lines in this file are usually several hundred bytes long (because of the size
359 of the key modulus). You will find it very inconvenient to type them in;
360 instead, copy the public key file and edit it.
361 .sp
362 .LP
363 Permissions of this file must be set so that it is not world or group writable.
364 See the \fBStrictModes\fR option of \fBsshd_config\fR(4).
365 .sp
366 .LP
367 The options (if present) consist of comma-separated option specifications. No
368 spaces are permitted, except within double quotes. The following option
369 specifications are supported:
370 .sp
371 .ne 2
372 .na
373 \fB\fBfrom="\fIpattern-list\fR"\fR\fR
374 .ad
375 .sp .6
376 .RS 4n
377 Specifies that, in addition to public key authentication, the canonical name of
378 the remote host must be present in the comma-separated list of patterns
379 (`\fB*\fR' and `\fB?\fR' serve as wildcards). The list can also contain negated
380 patterns by prefixing the patterns with `\fB!\fR'. If the canonical host name
381 matches a negated pattern, the key is not accepted.
382 .sp
383 The purpose of this option is to give you the option of increasing security:
384 public key authentication by itself does not trust the network or name servers
385 or anything but the key. However, if someone manages to steal the key,
386 possession of the key would permit the intruder to log in from anywhere in the
387 world. This option makes using a stolen key more difficult, because name
388 servers and routers would have to be compromised, in addition to just the key.
389 .RE
391 .sp
392 .ne 2
393 .na
394 \fB\fBcommand="\fIcommand\fR"\fR\fR
395 .ad
396 .sp .6
397 .RS 4n
398 Specifies that the \fIcommand\fR is executed whenever this key is used for
399 authentication. The command supplied by the user (if any) is ignored. The
400 command is run on a \fBpty\fR if the client requests a \fBpty\fR; otherwise it
401 is run without a \fBtty\fR. If an 8-bit clean channel is required, one must not
402 request a \fBpty\fR or should specify \fBno-pty\fR. You can include a quote in
403 the command by escaping it with a backslash. This option might be useful to
404 restrict certain public keys from performing a specific operation. An example
405 is a key that permits remote backups but nothing else. Note that the client can
406 specify TCP/IP and/or X11 forwarding unless they are explicitly prohibited from
407 doing so. Also note that this option applies to shell, command, or subsystem
408 execution.
409 .RE
411 .sp
412 .ne 2
413 .na
414 \fB\fBenvironment="\fINAME\fR=\fIvalue\fR"\fR\fR
415 .ad
416 .sp .6
417 .RS 4n
418 Specifies that the string \fINAME\fR=\fIvalue\fR is to be added to the
419 environment when logging in using this key. Environment variables set this way
420 override other default environment values. Multiple options of this type are
421 permitted. Environment processing is disabled by default and is controlled via
422 the \fBPermitUserEnvironment\fR option.
423 .RE
425 .sp
426 .ne 2
427 .na
428 \fB\fBno-port-forwarding\fR\fR
429 .ad
430 .sp .6
431 .RS 4n
432 Forbids TCP/IP forwarding when this key is used for authentication. Any port
433 forward requests by the client will return an error. This might be used, for
434 example, in connection with the \fBcommand\fR option.
435 .RE
437 .sp
438 .ne 2
439 .na
440 \fB\fBno-X11-forwarding\fR\fR
441 .ad
442 .sp .6
443 .RS 4n
444 Forbids X11 forwarding when this key is used for authentication. Any X11
445 forward requests by the client will return an error.
446 .RE
448 .sp
449 .ne 2
450 .na
451 \fB\fBno-agent-forwarding\fR\fR
452 .ad
453 .sp .6
454 .RS 4n
455 Forbids authentication agent forwarding when this key is used for
456 authentication.
457 .RE
459 .sp
460 .ne 2
461 .na
462 \fB\fBno-pty\fR\fR
463 .ad
464 .sp .6
465 .RS 4n
466 Prevents \fBtty\fR allocation (a request to allocate a \fBpty\fR will fail).
467 .RE
469 .sp
470 .ne 2
471 .na
472 \fB\fBpermitopen="\fIhost\fR:\fIport\fR"\fR\fR
473 .ad
474 .sp .6
475 .RS 4n
476 Limit local \fBssh\fR \fB-L\fR port forwarding such that it can connect only to
477 the specified host and port. IPv6 addresses can be specified with an
478 alternative syntax: \fIhost\fR/\fIport\fR. You can invoke multiple
479 \fBpermitopen\fR options, with each instance separated by a comma. No pattern
480 matching is performed on the specified hostnames. They must be literal domains
481 or addresses.
482 .RE
484 .SS "\fBssh_known_hosts\fR File Format"
485 .sp
486 .LP
487 The \fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR files
488 contain host public keys for all known hosts. The global file should be
489 prepared by the administrator (optional), and the per-user file is maintained
490 automatically: whenever the user connects from an unknown host its key is added
491 to the per-user file.
492 .sp
493 .LP
494 For the RSA key for protocol version 1, these files consist of the following
495 space-separated fields:
496 .sp
497 .in +2
498 .nf
499 \fIhostnames\fR \fIbits\fR \fIexponent\fR \fImodulus\fR \fIcomment\fR
500 .fi
501 .in -2
502 .sp
504 .sp
505 .LP
506 For the public key for protocol version 2, these files consist of the following
507 space-separated fields:
508 .sp
509 .in +2
510 .nf
511 \fIhostnames\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
512 .fi
513 .in -2
514 .sp
516 .sp
517 .LP
518 For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
519 \fBssh-dsa\fR.
520 .sp
521 .LP
522 Hostnames is a comma-separated list of patterns (\fB*\fR and \fB?\fR act as
523 wildcards); each pattern in turn is matched against the canonical host name
524 (when authenticating a client) or against the user-supplied name (when
525 authenticating a server). A pattern can also be preceded by \fB!\fR to indicate
526 negation: if the host name matches a negated pattern, it is not accepted (by
527 that line) even if it matched another pattern on the line.
528 .sp
529 .LP
530 Alternately, hostnames can be stored in a hashed form, which hides host names
531 and addresses should the file's contents be disclosed. Hashed hostnames start
532 with a vertical bar (\fB|\fR) character. Only one hashed hostname can appear on
533 a single line and none of the above negation or wildcard operators may be
534 applied.
535 .sp
536 .LP
537 Bits, exponent, and modulus are taken directly from the RSA host key; they can
538 be obtained, for example, from \fB/etc/ssh/ssh_host_rsa_key.pub\fR. The
539 optional comment field continues to the end of the line, and is not used.
540 .sp
541 .LP
542 Lines starting with a hash mark (\fB#\fR) and empty lines are ignored as
543 comments.
544 .sp
545 .LP
546 When performing host authentication, authentication is accepted if any matching
547 line has the proper key. It is thus permissible (but not recommended) to have
548 several lines or different host keys for the same names. This will inevitably
549 happen when short forms of host names from different domains are put in the
550 file. It is possible that the files contain conflicting information;
551 authentication is accepted if valid information can be found from either file.
552 .sp
553 .LP
554 The lines in these files are typically hundreds of characters long. You should
555 definitely not type in the host keys by hand. Rather, generate them by a script
556 or by taking \fB/etc/ssh/ssh_host_rsa_key.pub\fR and adding the host names at
557 the front.
558 .SH ENVIRONMENT VARIABLES
559 .sp
560 .LP
561 \fBsshd\fR sets the following environment variables for commands executed by
562 \fBssh\fR users:
563 .sp
564 .ne 2
565 .na
566 \fB\fBDISPLAY\fR\fR
567 .ad
568 .sp .6
569 .RS 4n
570 Indicates the location of the X11 server. It is automatically set by \fBsshd\fR
571 to point to a value of the form \fIhostname\fR:\fIn\fR, where \fIhostname\fR
572 indicates the host where the shell runs, and \fIn\fR is an integer greater than
573 or equal to 1. \fBssh\fR uses this special value to forward X11 connections
574 over the secure channel. Unless you have important reasons to do otherwise, you
575 should not set \fBDISPLAY\fR explicitly, as that will render the X11 connection
576 insecure and will require you to manually copy any required authorization
577 cookies.
578 .RE
580 .sp
581 .ne 2
582 .na
583 \fB\fBHOME\fR\fR
584 .ad
585 .sp .6
586 .RS 4n
587 Set to the path of the user's home directory.
588 .RE
590 .sp
591 .ne 2
592 .na
593 \fB\fBLANG\fR, \fBLC_ALL\fR, \fBLC_COLLATE\fR, \fBLC_CTYPE\fR,
594 \fBLC_MESSAGES\fR, \fBLC_MONETARY\fR, \fBLC_NUMERIC\fR, \fBLC_TIME\fR\fR
595 .ad
596 .sp .6
597 .RS 4n
598 A locale setting. The locale defaults to that of \fBsshd\fR (usually the
599 system-wide default locale), or is negotiated between the client and server
600 during initial key exchange (as per RFC 4253).
601 .sp
602 Following initial key exchange, each of the variables can be overriden in the
603 following sequence:
604 .RS +4
605 .TP
606 1.
607 If a locale setting is set in a client's environment and that client
608 supports "Environment Variable Passing" (see RFC 4254), then the setting will
609 be passed over to the server side.
610 .RE
611 .RS +4
612 .TP
613 2.
614 If the public key authentication method was used to authenticate the server
615 and the \fBPermitUserEnvironment\fR variable in \fBsshd_config\fR(4) is set to
616 \fByes\fR on the server side, then the setting can be changed through the use
617 of the \fBenvironment\fR option in the client's \fBAuthorizedKeysFile\fR file.
618 .RE
619 .RS +4
620 .TP
621 3.
622 The setting can be change in the client's \fB~/.ssh/environment\fR file on
623 the server.
624 .RE
625 See \fBPermitUserEnvironment\fR in \fBsshd_config\fR(4) as to when the
626 \fBAuthorizedKeysFile\fR and \fB~/.ssh/environment\fR files are processed and
627 used for setting the user environment.
628 .RE
630 .sp
631 .ne 2
632 .na
633 \fB\fBLOGNAME\fR\fR
634 .ad
635 .sp .6
636 .RS 4n
637 Synonym for \fBUSER\fR. Set for compatibility with systems that use this
638 variable.
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fB\fBMAIL\fR\fR
645 .ad
646 .sp .6
647 .RS 4n
648 Set to point to the user's mailbox.
649 .RE
651 .sp
652 .ne 2
653 .na
654 \fB\fBSSH_AUTH_SOCK\fR\fR
655 .ad
656 .sp .6
657 .RS 4n
658 Indicates the path of a \fBunix-domain\fR socket used to communicate with the
659 agent.
660 .RE
662 .sp
663 .ne 2
664 .na
665 \fB\fBSSH_CONNECTION\fR\fR
666 .ad
667 .sp .6
668 .RS 4n
669 Identifies the client and server ends of the connection. The variable contains
670 four space-separated values: client IP address, client port number, server IP
671 address and server port number.
672 .RE
674 .sp
675 .ne 2
676 .na
677 \fB\fBSSH_CLIENT\fR\fR
678 .ad
679 .sp .6
680 .RS 4n
681 Identifies the client end of the connection. The variable contains three
682 space-separated values: client IP address, client port number, and server port
683 number.
684 .RE
686 .sp
687 .ne 2
688 .na
689 \fB\fBSSH_TTY\fR\fR
690 .ad
691 .sp .6
692 .RS 4n
693 Set to the name of the \fBtty\fR (path to the device) associated with the
694 current shell or command. If the current session has no \fBtty\fR, this
695 variable is not set.
696 .RE
698 .sp
699 .ne 2
700 .na
701 \fB\fBTZ\fR\fR
702 .ad
703 .sp .6
704 .RS 4n
705 Indicates the present timezone, if \fBTIMEZONE\fR is set in
706 \fB/etc/default/login\fR or if \fBTZ\fR was set when the daemon was started.
707 .RE
709 .sp
710 .ne 2
711 .na
712 \fB\fBHZ\fR\fR
713 .ad
714 .sp .6
715 .RS 4n
716 If set in \fB/etc/default/login\fR, the daemon sets it to the same value.
717 .RE
719 .sp
720 .ne 2
721 .na
722 \fB\fBSHELL\fR\fR
723 .ad
724 .sp .6
725 .RS 4n
726 The user's shell, if \fBALTSHELL=YES\fR in \fB/etc/default/login\fR.
727 .RE
729 .sp
730 .ne 2
731 .na
732 \fB\fBPATH\fR\fR
733 .ad
734 .sp .6
735 .RS 4n
736 Set to the value of \fBPATH\fR or \fBSUPATH\fR (see \fBlogin\fR(1)) in
737 \fB/etc/default/login\fR, or, if not set, to \fB/usr/bin:/bin\fR.
738 .RE
740 .sp
741 .ne 2
742 .na
743 \fB\fBUSER\fR\fR
744 .ad
745 .sp .6
746 .RS 4n
747 Set to the name of the user logging in.
748 .RE
750 .sp
751 .LP
752 Additionally, \fBsshd\fR reads \fB$HOME/.ssh/environment\fR and adds lines of
753 the format \fBVARNAME=\fIvalue\fR\fR to the environment.
754 .SH EXAMPLES
755 .sp
756 .LP
757 In the following examples, certain lines might wrap due to line length limits
758 in your display. You should nevertheless consider the wrapped line as a single
759 line.
760 .LP
761 \fBExample 1 \fR\fBauthorized_key\fR File Entries
762 .sp
763 .LP
764 The following are examples of \fBauthorized_key\fR file entries for protocol 1:
766 .sp
767 .in +2
768 .nf
769 1024 33 12121...312314325 ylo@foo.bar
771 from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
773 command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 backup.hut.fi
774 .fi
775 .in -2
776 .sp
778 .LP
779 \fBExample 2 \fR\fBauthorized_key\fR File Entries for Protocol 2
780 .sp
781 .LP
782 The following are examples of \fBauthorized_key\fR file entries for protocol 2:
784 .sp
785 .in +2
786 .nf
787 ssh-rsa AAAAB3NzaC1y.....EU88ovYKg4GfclWGCFYTuw8= ylo@foo.bar
788 from="*.niksula.hut.fi" ssh-rsa AAAAB3NzaC...uw8= ylo@niksula
789 command="dump /home",no-pty,no-port-forwarding ssh-rsa AA..8= backup.hut.fi
790 .fi
791 .in -2
792 .sp
794 .LP
795 \fBExample 3 \fR\fBssh_known_hosts\fR File Entries for Protocol 1
796 .sp
797 .LP
798 The following are examples of \fBssh_known_hosts\fR file entries for protocol
799 1:
801 .sp
802 .in +2
803 .nf
804 closenet,closenet.hut.fi,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
805 .fi
806 .in -2
807 .sp
809 .LP
810 \fBExample 4 \fR\fBssh_known_hosts\fR File Entries for Protocol 2
811 .sp
812 .LP
813 The following are examples of \fBssh_known_hosts\fR file entries for protocol
814 2:
816 .sp
817 .in +2
818 .nf
819 closenet,closenet.hut.fi,...,130.233.208.41 ssh-rsa AA..8= closenet.hut.fi
820 .fi
821 .in -2
822 .sp
824 .SH EXIT STATUS
825 .sp
826 .LP
827 The following exit values are returned:
828 .sp
829 .ne 2
830 .na
831 \fB\fB0\fR\fR
832 .ad
833 .RS 13n
834 Successful completion.
835 .RE
837 .sp
838 .ne 2
839 .na
840 \fB>\fB0\fR\fR
841 .ad
842 .RS 13n
843 An error occurred.
844 .RE
846 .SH FILES
847 .sp
848 .ne 2
849 .na
850 \fB\fB/etc/default/login\fR\fR
851 .ad
852 .sp .6
853 .RS 4n
854 Contains defaults for several \fBsshd_config\fR parameters, environment
855 variables, and other environmental factors.
856 .sp
857 The following parameters affect environment variables (see \fBlogin\fR(1) and
858 descriptions of these variables, above):
859 .RS +4
860 .TP
861 .ie t \(bu
862 .el o
863 \fBTIMEZONE\fR
864 .RE
865 .RS +4
866 .TP
867 .ie t \(bu
868 .el o
869 \fBHZ\fR
870 .RE
871 .RS +4
872 .TP
873 .ie t \(bu
874 .el o
875 \fBALTSHELL\fR
876 .RE
877 .RS +4
878 .TP
879 .ie t \(bu
880 .el o
881 \fBPATH\fR
882 .RE
883 .RS +4
884 .TP
885 .ie t \(bu
886 .el o
887 \fBSUPATH\fR
888 .RE
889 The following \fB/etc/default/login\fR parameters supply default values for
890 corresponding \fBsshd_config\fR(4) parameters:
891 .RS +4
892 .TP
893 .ie t \(bu
894 .el o
895 \fBCONSOLE\fR (see \fBPermitRootLogin\fR in \fBsshd_config\fR(4))
896 .RE
897 .RS +4
898 .TP
899 .ie t \(bu
900 .el o
901 \fBPASSREQ\fR (see \fBPermitEmptyPasswords\fR in \fBsshd_config\fR(4))
902 .RE
903 .RS +4
904 .TP
905 .ie t \(bu
906 .el o
907 \fBTIMEOUT\fR (see \fBLoginGraceTime\fR in \fBsshd_config\fR(4))
908 .RE
909 The following \fB/etc/default/login\fR parameters:
910 .RS +4
911 .TP
912 .ie t \(bu
913 .el o
914 \fBUMASK\fR
915 .RE
916 .RS +4
917 .TP
918 .ie t \(bu
919 .el o
920 \fBULIMIT\fR
921 .RE
922 \&...set the \fBumask\fR(2) and file size limit of, respectively, the shells
923 and commands spawned by \fBsshd\fR.
924 .sp
925 Finally, two \fB/etc/default/login\fR parameters affect the maximum allowed
926 login attempts per-connection using interactive user authentication methods
927 (for example, \fBkeyboard-interactive\fR but not \fBpublickey\fR), as per
928 \fBlogin\fR(1):
929 .RS +4
930 .TP
931 .ie t \(bu
932 .el o
933 \fBRETRIES\fR
934 .RE
935 .RS +4
936 .TP
937 .ie t \(bu
938 .el o
939 \fBSYSLOG_FAILED_LOGINS\fR
940 .RE
941 .RE
943 .sp
944 .ne 2
945 .na
946 \fB\fB/etc/ssh/sshd_config\fR\fR
947 .ad
948 .sp .6
949 .RS 4n
950 Contains configuration data for \fBsshd\fR. This file should be writable by
951 root only, but it is recommended (though not necessary) that it be
952 world-readable.
953 .RE
955 .sp
956 .ne 2
957 .na
958 \fB\fB/etc/ssh/ssh_host_key\fR\fR
959 .ad
960 .br
961 .na
962 \fB\fB/etc/ssh/ssh_host_dsa_key\fR\fR
963 .ad
964 .br
965 .na
966 \fB\fB/etc/ssh/ssh_host_rsa_key\fR\fR
967 .ad
968 .sp .6
969 .RS 4n
970 Contains the private part of the host key. This file should only be owned by
971 root, readable only by root, and not accessible to others. \fBsshd\fR does not
972 start if this file is group/world-accessible.
973 .RE
975 .sp
976 .ne 2
977 .na
978 \fB\fB/etc/ssh/ssh_host_key.pub\fR\fR
979 .ad
980 .br
981 .na
982 \fB\fB/etc/ssh/ssh_host_dsa_key.pub\fR\fR
983 .ad
984 .br
985 .na
986 \fB\fB/etc/ssh/ssh_host_rsa_key.pub\fR\fR
987 .ad
988 .sp .6
989 .RS 4n
990 Contains the public part of the host key. This file should be world-readable
991 but writable only by root. Its contents should match the private part. This
992 file is not used for encryption; it is provided only for the convenience of the
993 user so its contents can be copied to known hosts files. These two files are
994 created using \fBssh-keygen\fR(1).
995 .RE
997 .sp
998 .ne 2
999 .na
1000 \fB\fB/var/run/sshd.pid\fR\fR
1001 .ad
1002 .sp .6
1003 .RS 4n
1004 Contains the process ID of the \fBsshd\fR listening for connections. If there
1005 are several daemons running concurrently for different ports, this contains the
1006 pid of the one started last. The content of this file is not sensitive; it can
1007 be world-readable. You can use the \fBPidFile\fR keyword in \fBsshd_config\fR
1008 to specify a file other than \fB/var/run/sshd.pid\fR. See \fBsshd_config\fR(4).
1009 .RE
1011 .sp
1012 .ne 2
1013 .na
1014 \fB\fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR\fR
1015 .ad
1016 .sp .6
1017 .RS 4n
1018 These files are consulted when using \fBrhosts\fR with public key host
1019 authentication to check the public key of the host. The key must be listed in
1020 one of these files to be accepted. The client uses the same files to verify
1021 that the remote host is the one it intended to connect. These files should be
1022 writable only by root or the owner. \fB/etc/ssh/ssh_known_hosts\fR should be
1023 world-readable, and \fB$HOME/.ssh/known_hosts\fR can but need not be
1024 world-readable.
1025 .RE
1027 .sp
1028 .ne 2
1029 .na
1030 \fB\fB/etc/nologin\fR\fR
1031 .ad
1032 .sp .6
1033 .RS 4n
1034 If this file exists, \fBsshd\fR refuses to let anyone except root log in. The
1035 contents of the file are displayed to anyone trying to log in, and non-root
1036 connections are refused. The file should be world-readable.
1037 .RE
1039 .sp
1040 .ne 2
1041 .na
1042 \fB\fB$HOME/.ssh/authorized_keys\fR\fR
1043 .ad
1044 .sp .6
1045 .RS 4n
1046 Lists the public keys (RSA or DSA) that can be used to log into the user's
1047 account. This file must be readable by root. This might, on some machines,
1048 imply that it is world-readable if the user's home directory resides on an NFS
1049 volume. It is recommended that it not be accessible by others. The format of
1050 this file is described above. Users will place the contents of their
1051 \fBidentity.pub\fR, \fBid_dsa.pub\fR and/or \fBid_rsa.pub\fR files into this
1052 file, as described in \fBssh-keygen\fR(1).
1053 .RE
1055 .sp
1056 .ne 2
1057 .na
1058 \fB\fB$HOME/.rhosts\fR\fR
1059 .ad
1060 .sp .6
1061 .RS 4n
1062 This file contains host-username pairs, separated by a space, one per line. The
1063 given user on the corresponding host is permitted to log in without password.
1064 The same file is used by \fBrlogind\fR and \fBrshd\fR. The file must be
1065 writable only by the user; it is recommended that it not be accessible by
1066 others. It is also possible to use \fBnetgroups\fR in the file. Either host or
1067 user name may be of the form \fB+@\fIgroupname\fR\fR to specify all hosts or
1068 all users in the group.
1069 .RE
1071 .sp
1072 .ne 2
1073 .na
1074 \fB\fB$HOME/.shosts\fR\fR
1075 .ad
1076 .sp .6
1077 .RS 4n
1078 For \fBssh\fR, this file is exactly the same as for \fB\&.rhosts\fR. However,
1079 this file is not used by \fBrlogin\fR and \fBrshd\fR, so using this permits
1080 access using SSH only.
1081 .RE
1083 .sp
1084 .ne 2
1085 .na
1086 \fB\fB/etc/hosts.equiv\fR\fR
1087 .ad
1088 .sp .6
1089 .RS 4n
1090 This file is used during \fB\&.rhosts\fR authentication. In its simplest form,
1091 this file contains host names, one per line. Users on these hosts are permitted
1092 to log in without a password, provided they have the same user name on both
1093 machines. The host name can also be followed by a user name; such users are
1094 permitted to log in as any user on this machine (except root). Additionally,
1095 the syntax \fB+@\fIgroup\fR\fR can be used to specify netgroups. Negated
1096 entries start with a hyphen (\fB-\fR).
1097 .sp
1098 If the client host/user is successfully matched in this file, login is
1099 automatically permitted, provided the client and server user names are the
1100 same. Additionally, successful RSA host authentication is normally required.
1101 This file must be writable only by root; it is recommended that it be
1102 world-readable.
1103 .sp
1104 Warning: It is almost never a good idea to use user names in \fBhosts.equiv\fR.
1105 Beware that it really means that the named user(s) can log in as anybody, which
1106 includes \fBbin\fR, \fBdaemon\fR, \fBadm\fR, and other accounts that own
1107 critical binaries and directories. For practical purposes, using a user name
1108 grants the user root access. Probably the only valid use for user names is in
1109 negative entries. This warning also applies to \fBrsh\fR/\fBrlogin\fR.
1110 .RE
1112 .sp
1113 .ne 2
1114 .na
1115 \fB\fB/etc/ssh/moduli\fR\fR
1116 .ad
1117 .sp .6
1118 .RS 4n
1119 A private file.
1120 .RE
1122 .sp
1123 .ne 2
1124 .na
1125 \fB\fB/etc/ssh/shosts.equiv\fR\fR
1126 .ad
1127 .sp .6
1128 .RS 4n
1129 This file is processed exactly as \fB/etc/hosts.equiv\fR. However, this file
1130 might be useful in environments that want to run both \fBrsh\fR/\fBrlogin\fR
1131 and \fBssh\fR.
1132 .RE
1134 .sp
1135 .ne 2
1136 .na
1137 \fB\fB$HOME/.ssh/environment\fR\fR
1138 .ad
1139 .sp .6
1140 .RS 4n
1141 This file is read into the environment at login (if it exists). It can contain
1142 only empty lines, comment lines (that start with \fB#\fR), and assignment lines
1143 of the form \fB\fIname\fR=\fIvalue\fR\fR. The file should be writable only by
1144 the user; it need not be readable by anyone else. Environment processing is
1145 disabled by default and is controlled by means of the
1146 \fBPermitUserEnvironment\fR option.
1147 .RE
1149 .sp
1150 .ne 2
1151 .na
1152 \fB\fB$HOME/.ssh/rc\fR\fR
1153 .ad
1154 .sp .6
1155 .RS 4n
1156 If this file exists, it is run with \fB/bin/sh\fR after reading the environment
1157 files but before starting the user's shell or command. If X11 spoofing is in
1158 use, this will receive the \fBproto cookie\fR pair in standard input (and
1159 \fBDISPLAY\fR in environment). This must call \fBxauth\fR in that case.
1160 .sp
1161 The primary purpose of \fB$HOME/.ssh/rc\fR is to run any initialization
1162 routines that might be needed before the user's home directory becomes
1163 accessible; AFS is a particular example of such an environment. If this file
1164 exists, it is run with \fB/bin/sh\fR after reading the environment files, but
1165 before starting the user's shell or command. It must not produce any output on
1166 stdout; stderr must be used instead. If X11 forwarding is in use, it will
1167 receive the \fBproto cookie\fR pair in its standard input and \fBDISPLAY\fR in
1168 its environment. The script must call \fBxauth\fR because \fBsshd\fR will not
1169 run \fBxauth\fR automatically to add X11 cookies.
1170 .sp
1171 This file will probably contain some initialization code followed by something
1172 similar to:
1173 .sp
1174 .in +2
1175 .nf
1176 if read proto cookie && [ -n "$DISPLAY" ]
1177 then
1178 if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]
1179 then
1180 # X11UseLocalhost=yes
1181 echo add unix:`echo $DISPLAY |
1182 cut -c11-` $proto $cookie
1183 else
1184 # X11UseLocalhost=no
1185 echo add $DISPLAY $proto $cookie
1186 fi | xauth -q -
1187 fi
1188 .fi
1189 .in -2
1190 .sp
1192 If this file does not exist, \fB/etc/ssh/sshrc\fR is run, and if that does not
1193 exist, \fBxauth\fR is used to store the cookie. \fB$HOME/.ssh/rc\fR should be
1194 writable only by the user, and need not be readable by anyone else.
1195 .RE
1197 .sp
1198 .ne 2
1199 .na
1200 \fB\fB/etc/ssh/sshrc\fR\fR
1201 .ad
1202 .sp .6
1203 .RS 4n
1204 Similar to \fB$HOME/.ssh/rc\fR. This can be used to specify machine-specific
1205 login-time initializations globally. This file should be writable only by root,
1206 and should be world-readable.
1207 .RE
1209 .SH SECURITY
1210 .sp
1211 .LP
1212 \fBsshd\fR supports the use of several user authentication mechanisms: a public
1213 key system where keys are associated with users (through users'
1214 \fBauthorized_keys\fR files), a public key system where keys are associated
1215 with hosts (see the \fBHostbasedAuthentication\fR configuration parameter), a
1216 GSS-API based method (see the \fBGssAuthentication\fR and \fBGssKeyEx\fR
1217 configuration parameters) and three initial authentication methods: \fBnone\fR,
1218 \fBpassword\fR, and a generic prompt/reply protocol,
1219 \fBkeyboard-interactive\fR.
1220 .sp
1221 .LP
1222 \fBsshd\fR negotiates the use of the GSS-API with clients only if it has a
1223 GSS-API acceptor credential for the "host" service. This means that, for
1224 GSS-API based authentication, the server must have a Kerberos V \fBkeytab\fR
1225 entry (see below) or the equivalent for any other GSS-API mechanism that might
1226 be installed.
1227 .sp
1228 .LP
1229 In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
1230 Kerberos principal must exist for each Fully Qualified Domain Name associated
1231 with the \fBin.sshd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
1232 must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
1233 \fBin.sshd\fR server. An example principal might be:
1234 .sp
1235 .LP
1236 \fBhost/bigmachine.eng.example.com\fR
1237 .sp
1238 .LP
1239 See \fBkadmin\fR(1M) for instructions on adding a principal to a
1240 \fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
1241 authentication.
1242 .sp
1243 .LP
1244 GSS-API authorization is covered in \fBgss_auth_rules\fR(5).
1245 .sp
1246 .LP
1247 \fBsshd\fR uses \fBpam\fR(3PAM) for the three initial authentication methods as
1248 well as for account management, session management, and password management for
1249 all authentication methods.
1250 .sp
1251 .LP
1252 Specifically, \fBsshd\fR calls \fBpam_authenticate()\fR for the "none,"
1253 "password" and "keyboard-interactive" SSHv2 \fBuserauth\fR types, as well as
1254 for for the null and password authentication methods for SSHv1. Other SSHv2
1255 authentication methods do not call \fBpam_authenticate()\fR.
1256 \fBpam_acct_mgmt()\fR is called for each authentication method that succeeds.
1257 .sp
1258 .LP
1259 \fBpam_setcred()\fR and \fBpam_open_session()\fR are called when authentication
1260 succeeds and \fBpam_close_session()\fR is called when connections are closed.
1261 .sp
1262 .LP
1263 \fBpam_open_session()\fR and \fBpam_close_session()\fR are also called when
1264 SSHv2 channels with \fBpty\fRs are opened and closed.
1265 .sp
1266 .LP
1267 Each SSHv2 \fBuserauth\fR type has its own PAM service name:
1268 .sp
1270 .sp
1271 .TS
1272 box;
1273 c | c
1274 l | l .
1275 SSHv2 Userauth PAM Service Name
1276 _
1277 none sshd-none
1278 _
1279 password sshd-password
1280 _
1281 keyboard-interactive sshd-kbdint
1282 _
1283 pubkey sshd-pubkey
1284 _
1285 hostbased sshd-hostbased
1286 _
1287 gssapi-with-mic sshd-gssapi
1288 _
1289 gssapi-keyex sshd-gssapi
1290 .TE
1292 .sp
1293 .LP
1294 For SSHv1, \fBsshd-v1\fR is always used.
1295 .sp
1296 .LP
1297 If \fBpam_acct_mgmt()\fR returns \fBPAM_NEW_AUTHTOK_REQD\fR (indicating that
1298 the user's authentication tokens have expired), then \fBsshd\fR forces the use
1299 of "keyboard-interactive" \fBuserauth\fR, if version 2 of the protocol is in
1300 use. The "keyboard-interactive" \fBuserauth\fR will call \fBpam_chauthtok()\fR
1301 if \fBpam_acct_mgmt()\fR once again returns \fBPAM_NEW_AUTHTOK_REQD\fR. By this
1302 means, administrators are able to control what authentication methods are
1303 allowed for SSHv2 on a per-user basis.
1304 .SS "Setting up Host-based Authentication"
1305 .sp
1306 .LP
1307 To establish host-based authentication, you must perform the following steps:
1308 .RS +4
1309 .TP
1310 .ie t \(bu
1311 .el o
1312 Configure the client.
1313 .RE
1314 .RS +4
1315 .TP
1316 .ie t \(bu
1317 .el o
1318 Configure the server.
1319 .RE
1320 .RS +4
1321 .TP
1322 .ie t \(bu
1323 .el o
1324 Publish known hosts.
1325 .RE
1326 .RS +4
1327 .TP
1328 .ie t \(bu
1329 .el o
1330 Make appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR.
1331 .RE
1332 .sp
1333 .LP
1334 These steps are expanded in the following paragraphs.
1335 .RS +4
1336 .TP
1337 .ie t \(bu
1338 .el o
1339 On a client machine, in the system-wide client configuration file,
1340 \fB/etc/ssh/ssh_config\fR, you must have the entry:
1341 .sp
1342 .in +2
1343 .nf
1344 HostbasedAuthentication yes
1345 .fi
1346 .in -2
1348 See \fBssh_config\fR(4) and \fBssh-keysign\fR(1M).
1349 .RE
1350 .RS +4
1351 .TP
1352 .ie t \(bu
1353 .el o
1354 On the server, in the system-wide server configuration file,
1355 \fB/etc/ssh/sshd_config\fR, you must have the entry:
1356 .sp
1357 .in +2
1358 .nf
1359 HostbasedAuthentication yes
1360 .fi
1361 .in -2
1363 If per-user \fB\&.shost\fR files are to be allowed (see last step), in the same
1364 file, you must have:
1365 .sp
1366 .in +2
1367 .nf
1368 IgnoreRhosts no
1369 .fi
1370 .in -2
1372 See \fBsshd_config\fR(4) for a description of these keywords.
1373 .RE
1374 .RS +4
1375 .TP
1376 .ie t \(bu
1377 .el o
1378 To publish known hosts, you must have entries for the clients from which users
1379 will be allowed host-based authentication. Make these entries in either or both
1380 of the system-wide file (\fB/etc/ssh/ssh_known_hosts\fR) or the per-user file
1381 (\fB~/.ssh/known_hosts\fR).
1382 .RE
1383 .RS +4
1384 .TP
1385 .ie t \(bu
1386 .el o
1387 Note that \fBsshd\fR uses \fB\&.shosts\fR, not \fB\&.rhosts\fR. If you want the
1388 functionality provided by \fB\&.rhosts\fR, but do not want to use \fBrlogin\fR
1389 or \fBrsh\fR because of their security shortcomings, you can use
1390 \fB\&.shosts\fR in conjunction with \fBsshd\fR. To use this feature, make
1391 appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR, in the
1392 format specified in \fBrhosts\fR(4).
1393 .sp
1394 For the vast majority of network environments, \fB\&.shosts\fR is preferred
1395 over \fB\&.rhosts\fR.
1396 .RE
1397 .SH ATTRIBUTES
1398 .sp
1399 .LP
1400 See \fBattributes\fR(5) for descriptions of the following attributes:
1401 .sp
1403 .sp
1404 .TS
1405 box;
1406 c | c
1407 l | l .
1408 ATTRIBUTE TYPE ATTRIBUTE VALUE
1409 _
1410 Interface Stability Evolving
1411 .TE
1413 .sp
1414 .LP
1415 The interface stability of \fB/etc/ssh/moduli\fR is Private.
1416 .SH SEE ALSO
1417 .sp
1418 .LP
1419 \fBlogin\fR(1), \fBscp\fR(1), \fBssh\fR(1), \fBssh-add\fR(1),
1420 \fBssh-agent\fR(1), \fBssh-keygen\fR(1), \fBsvcs\fR(1),
1421 \fBkadmin\fR(1M), \fBsftp-server\fR(1M), \fBssh-keysign\fR(1M),
1422 \fBsvcadm\fR(1M), \fBpam\fR(3PAM), \fBrhosts\fR(4), \fBssh_config\fR(4),
1423 \fBsshd_config\fR(4), \fBattributes\fR(5), \fBgss_auth_rules\fR(5),
1424 \fBkerberos\fR(5), \fBpam_roles\fR(5), \fBsmf\fR(5)
1425 .sp
1426 .LP
1427 \fI\fR
1428 .SH NOTES
1429 .sp
1430 .LP
1431 The \fBsshd\fR service is managed by the service management facility,
1432 \fBsmf\fR(5), under the service identifier:
1433 .sp
1434 .in +2
1435 .nf
1436 svc:/network/ssh:default
1437 .fi
1438 .in -2
1439 .sp
1441 .sp
1442 .LP
1443 Administrative actions on this service, such as enabling, disabling, or
1444 requesting restart, can be performed using \fBsvcadm\fR(1M). The service's
1445 status can be queried using the \fBsvcs\fR(1) command.
1446 .sp
1447 .LP
1448 \fBsshd\fR always sets \fBPAM_RHOST\fR and sets \fBPAM_AUSER\fR in the case of
1449 host-based \fBuserauth\fR. This behavior allows for remote logins to roles
1450 using host-based authentication. See \fBpam_roles\fR(5).