--- old/usr/src/man/man1m/sshd.sunssh.1m	Tue Aug 16 19:27:18 2016
+++ /dev/null	Tue Aug 16 19:26:53 2016
@@ -1,1433 +0,0 @@
-'\" te
-.\" To view license terms, attribution, and copyright for OpenSSH, the default path is /var/sadm/pkg/SUNWsshdr/install/copyright. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the
-.\" installed location.
-.\" Portions Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
-.TH SSHD 1M "Oct 29, 2015"
-.SH NAME
-sshd \- secure shell daemon
-.SH SYNOPSIS
-.LP
-.nf
-\fBsshd\fR [\fB-deiqtD46\fR] [\fB-b\fR \fIbits\fR] [\fB-f\fR \fIconfig_file\fR]
-     [\fB-g\fR \fIlogin_grace_time\fR] [\fB-h\fR \fIhost_key_file\fR]
-     [\fB-k\fR \fIkey_gen_time\fR] [\fB-p\fR \fIport\fR] [\fB-V\fR \fIclient_protocol_id\fR]
-.fi
-
-.SH DESCRIPTION
-.LP
-The \fBsshd\fR (Secure Shell daemon) is the daemon program for \fBssh\fR(1).
-Together these programs replace \fBrlogin\fR and \fBrsh\fR, and provide secure
-encrypted communications between two untrusted hosts over an insecure network.
-The programs are intended to be as easy to install and use as possible.
-.sp
-.LP
-\fBsshd\fR is the daemon that listens for connections from clients. It forks a
-new daemon for each incoming connection. The forked daemons handle key
-exchange, encryption, authentication, command execution, and data exchange.
-.sp
-.LP
-This implementation of \fBsshd\fR supports both SSH protocol versions 1 and 2
-simultaneously. Because of security weaknesses in the v1 protocol, sites should
-run only v2, if possible. In the default configuration, only protocol v2 is
-enabled for the server. To enable v1 and v2 simultaneously, see the
-instructions in \fBsshd_config\fR(4).
-.sp
-.LP
-Support for v1 is provided to help sites with existing \fBssh\fR v1 clients and
-servers to transition to v2. v1 might not be supported in a future release.
-.SS "SSH Protocol Version 1"
-.LP
-Each host has a host-specific RSA key (normally 1024 bits) used to identify the
-host. Additionally, when the daemon starts, it generates a server RSA key
-(normally 768 bits). This key is normally regenerated every hour if it has been
-used, and is never stored on disk.
-.sp
-.LP
-Whenever a client connects the daemon responds with its public host and server
-keys. The client compares the RSA host key against its own database to verify
-that it has not changed. The client then generates a 256-bit random number. It
-encrypts this random number using both the host key and the server key, and
-sends the encrypted number to the server. Both sides then use this random
-number as a session key which is used to encrypt all further communications in
-the session. The rest of the session is encrypted using a conventional cipher,
-currently Blowfish or 3DES, with 3DES being used by default. The client selects
-the encryption algorithm to use from those offered by the server.
-.sp
-.LP
-Next, the server and the client enter an authentication dialog. The client
-tries to authenticate itself using \fB\&.rhosts\fR authentication,
-\fB\&.rhosts\fR authentication combined with RSA host authentication, RSA
-challenge-response authentication, or password-based authentication.
-.sp
-.LP
-Rhosts authentication is normally disabled because it is fundamentally
-insecure, but can be enabled in the server configuration file if desired.
-System security is not improved unless \fBrshd\fR(1M), \fBrlogind\fR(1M),
-\fBrexecd\fR(1M), and \fBrexd\fR(1M) are disabled (thus completely disabling
-\fBrlogin\fR(1) and \fBrsh\fR(1) into the machine).
-.SS "SSH Protocol Version 2"
-.LP
-Version 2 works similarly to version 1: Each host has a host-specific DSA/RSA
-key. However, when the daemon starts, it does not generate a server key.
-Forward security is provided through a Diffie-Hellman key agreement. This key
-agreement results in a shared session key. The rest of the session is encrypted
-using a symmetric cipher, currently 128-bit AES, Blowfish, 3DES, or AES. The
-client selects the encryption algorithm to use from those offered by the
-server. Additionally, session integrity is provided through a cryptographic
-message authentication code (\fBhmac-sha1\fR or \fBhmac-md5\fR).
-.sp
-.LP
-Protocol version 2 provides a public key based user authentication method
-(PubKeyAuthentication) GSS-API based user authentication, conventional password
-authentication, and a generic prompt/reply protocol for password-based
-authentication.
-.SS "Command Execution and Data Forwarding"
-.LP
-If the client successfully authenticates itself, a dialog for preparing the
-session is entered. At this time the client can request things like allocating
-a pseudo-tty, forwarding X11 connections, forwarding TCP/IP connections, or
-forwarding the authentication agent connection over the secure channel.
-.sp
-.LP
-Finally, the client either requests a shell or execution of a command. The
-sides then enter session mode. In this mode, either side may send data at any
-time, and such data is forwarded to/from the shell or command on the server
-side, and the user terminal on the client side.
-.sp
-.LP
-When the user program terminates and all forwarded X11 and other connections
-have been closed, the server sends command exit status to the client, and both
-sides exit.
-.sp
-.LP
-\fBsshd\fR can be configured using command-line options or the configuration
-file \fB/etc/ssh/ssh_config\fR, described in \fBssh_config\fR(4). Command-line
-options override values specified in the configuration file.
-.sp
-.LP
-\fBsshd\fR rereads its configuration file when it receives a hangup signal,
-\fBSIGHUP\fR, by executing itself with the name it was started as, that is,
-\fB/usr/lib/ssh/sshd\fR.
-.SS "Host Access Control"
-.LP
-The \fBsshd\fR daemon uses TCP Wrappers to restrict access to hosts. It uses
-the service name of \fBsshd\fR for \fBhosts_access()\fR. For more information
-on TCP Wrappers see \fBtcpd(1M)\fR and \fBhosts_access(3)\fR man pages, which
-are part of the \fBSUNWsfman\fR package (they are not SunOS man pages). TCP
-wrappers binaries, including \fBlibwrap\fR, are in \fBSUNWtcpd\fR, a required
-package for \fBSUNWsshdu\fR, the package containing \fBsshd\fR.
-.SH OPTIONS
-.LP
-The options for \fBsshd\fR are as follows:
-.sp
-.ne 2
-.na
-\fB\fB-b\fR \fIbits\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies the number of bits in the server key (the default is 768).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-d\fR\fR
-.ad
-.sp .6
-.RS 4n
-Debug mode. The server sends verbose debug output to the system log, and does
-not put itself in the background. The server also will not fork and will only
-process one connection. This option is only intended for debugging for the
-server. Multiple \fB-d\fR options increase the debugging level. Maximum is 3.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-e\fR\fR
-.ad
-.sp .6
-.RS 4n
-When this option is specified, \fBsshd\fR will send the output to standard
-error instead of to the system log.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-f\fR \fIconfiguration_file\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies the name of the configuration file. The default is
-\fB/etc/ssh/sshd_config\fR. \fBsshd\fR refuses to start if there is no
-configuration file.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-g\fR \fIlogin_grace_time\fR\fR
-.ad
-.sp .6
-.RS 4n
-Gives the grace time for clients to authenticate themselves (the default is 300
-seconds). If the client fails to authenticate the user within this number of
-seconds, the server disconnects and exits. A value of zero indicates no limit.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-h\fR \fIhost_key_file\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies a file from which a host key is read. This option must be given if
-\fBsshd\fR is not run as root (as the normal host key files are normally not
-readable by anyone but root). The default is \fB/etc/ssh/ssh_host_key\fR for
-protocol version 1, and \fB/etc/ssh/ssh_host_rsa_key\fR and
-\fB/etc/ssh/ssh_host_dsa_key\fR for protocol version 2. It is possible to have
-multiple host key files for the different protocol versions and host key
-algorithms.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-i\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies that \fBsshd\fR is being run from \fBinetd\fR. \fBsshd\fR is normally
-not run from \fBinetd\fR because it needs to generate the server key before it
-can respond to the client, and this may take tens of seconds. Clients would
-have to wait too long if the key was regenerated every time. However, with
-small key sizes (for example, 512) using \fBsshd\fR from \fBinetd\fR may be
-reasonable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-k\fR \fIkey_gen_time\fR\fR
-.ad
-.sp .6
-.RS 4n
-(SSHv1-specific) Specifies how often the server key is regenerated (the default
-is 3600 seconds, or one hour). The motivation for regenerating the key fairly
-often is that the key is not stored anywhere, and after about an hour, it
-becomes impossible to recover the key for decrypting intercepted communications
-even if the machine is cracked into or physically seized. A value of zero
-indicates that the key will never be regenerated.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-o\fR \fIoption\fR\fR
-.ad
-.sp .6
-.RS 4n
-Can be used to specify options in the format used in the configuration file.
-This is useful for specifying options for which there are no separate
-command-line flags.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-p\fR \fIport\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies the port on which the server listens for connections (the default is
-22).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-q\fR\fR
-.ad
-.sp .6
-.RS 4n
-Quiet mode. Nothing is sent to the system log. Normally the beginning,
-authentication, and termination of each connection is logged.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-t\fR\fR
-.ad
-.sp .6
-.RS 4n
-Test mode. Check only the validity of the configuration file and the sanity of
-the keys. This is useful for updating sshd reliably as configuration options
-might change.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-D\fR\fR
-.ad
-.sp .6
-.RS 4n
-When this option is specified \fBsshd\fR does not detach and does not become a
-daemon. This allows easy monitoring of \fBsshd\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-4\fR\fR
-.ad
-.sp .6
-.RS 4n
-Forces \fBsshd\fR to use IPv4 addresses only.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB-6\fR\fR
-.ad
-.sp .6
-.RS 4n
-Forces \fBsshd\fR to use IPv6 addresses only.
-.RE
-
-.SH EXTENDED DESCRIPTION
-.SS "\fBauthorized_keys\fR File Format"
-.LP
-The \fB$HOME/.ssh/authorized_keys\fR file lists the public keys that are
-permitted for RSA authentication in protocol version 1 and for public key
-authentication (\fBPubkeyAuthentication\fR) in protocol version 2. The
-\fBAuthorizedKeysFile\fR configuration option can be used to specify an
-alternative file.
-.sp
-.LP
-Each line of the file contains one key (empty lines and lines starting with a
-hash mark [\fB#\fR] are ignored as comments).
-.sp
-.LP
-For each RSA key for protocol version 1, the file consists of the following
-space-separated fields:
-.sp
-.in +2
-.nf
-\fIoptions\fR  \fIbits\fR  \fIexponent\fR  \fImodulus\fR  \fIcomment\fR
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-For the public key for protocol version 2, the file consists of the following
-space-separated fields:
-.sp
-.in +2
-.nf
-\fIoptions\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
-\fBssh-dsa\fR.
-.sp
-.LP
-The options field is optional; its presence is determined by whether the line
-starts with a number. (The option field never starts with a number.) The bits,
-exponent, and modulus fields give the RSA key; the comment field is a
-convenient place for you to identify the key.
-.sp
-.LP
-Lines in this file are usually several hundred bytes long (because of the size
-of the key modulus). You will find it very inconvenient to type them in;
-instead, copy the public key file and edit it.
-.sp
-.LP
-Permissions of this file must be set so that it is not world or group writable.
-See the \fBStrictModes\fR option of \fBsshd_config\fR(4).
-.sp
-.LP
-The options (if present) consist of comma-separated option specifications. No
-spaces are permitted, except within double quotes. The following option
-specifications are supported:
-.sp
-.ne 2
-.na
-\fB\fBfrom="\fIpattern-list\fR"\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies that, in addition to public key authentication, the canonical name of
-the remote host must be present in the comma-separated list of patterns
-(`\fB*\fR' and `\fB?\fR' serve as wildcards). The list can also contain negated
-patterns by prefixing the patterns with `\fB!\fR'. If the canonical host name
-matches a negated pattern, the key is not accepted.
-.sp
-The purpose of this option is to give you the option of increasing security:
-public key authentication by itself does not trust the network or name servers
-or anything but the key. However, if someone manages to steal the key,
-possession of the key would permit the intruder to log in from anywhere in the
-world. This option makes using a stolen key more difficult, because name
-servers and routers would have to be compromised, in addition to just the key.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBcommand="\fIcommand\fR"\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies that the \fIcommand\fR is executed whenever this key is used for
-authentication. The command supplied by the user (if any) is ignored. The
-command is run on a \fBpty\fR if the client requests a \fBpty\fR; otherwise it
-is run without a \fBtty\fR. If an 8-bit clean channel is required, one must not
-request a \fBpty\fR or should specify \fBno-pty\fR. You can include a quote in
-the command by escaping it with a backslash. This option might be useful to
-restrict certain public keys from performing a specific operation. An example
-is a key that permits remote backups but nothing else. Note that the client can
-specify TCP/IP and/or X11 forwarding unless they are explicitly prohibited from
-doing so. Also note that this option applies to shell, command, or subsystem
-execution.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBenvironment="\fINAME\fR=\fIvalue\fR"\fR\fR
-.ad
-.sp .6
-.RS 4n
-Specifies that the string \fINAME\fR=\fIvalue\fR is to be added to the
-environment when logging in using this key. Environment variables set this way
-override other default environment values. Multiple options of this type are
-permitted. Environment processing is disabled by default and is controlled via
-the \fBPermitUserEnvironment\fR option.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBno-port-forwarding\fR\fR
-.ad
-.sp .6
-.RS 4n
-Forbids TCP/IP forwarding when this key is used for authentication. Any port
-forward requests by the client will return an error. This might be used, for
-example, in connection with the \fBcommand\fR option.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBno-X11-forwarding\fR\fR
-.ad
-.sp .6
-.RS 4n
-Forbids X11 forwarding when this key is used for authentication. Any X11
-forward requests by the client will return an error.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBno-agent-forwarding\fR\fR
-.ad
-.sp .6
-.RS 4n
-Forbids authentication agent forwarding when this key is used for
-authentication.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBno-pty\fR\fR
-.ad
-.sp .6
-.RS 4n
-Prevents \fBtty\fR allocation (a request to allocate a \fBpty\fR will fail).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBpermitopen="\fIhost\fR:\fIport\fR"\fR\fR
-.ad
-.sp .6
-.RS 4n
-Limit local \fBssh\fR \fB-L\fR port forwarding such that it can connect only to
-the specified host and port. IPv6 addresses can be specified with an
-alternative syntax: \fIhost\fR/\fIport\fR. You can invoke multiple
-\fBpermitopen\fR options, with each instance separated by a comma. No pattern
-matching is performed on the specified hostnames. They must be literal domains
-or addresses.
-.RE
-
-.SS "\fBssh_known_hosts\fR File Format"
-.LP
-The \fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR files
-contain host public keys for all known hosts. The global file should be
-prepared by the administrator (optional), and the per-user file is maintained
-automatically: whenever the user connects from an unknown host its key is added
-to the per-user file.
-.sp
-.LP
-For the RSA key for protocol version 1, these files consist of the following
-space-separated fields:
-.sp
-.in +2
-.nf
-\fIhostnames\fR  \fIbits\fR  \fIexponent\fR  \fImodulus\fR  \fIcomment\fR
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-For the public key for protocol version 2, these files consist of the following
-space-separated fields:
-.sp
-.in +2
-.nf
-\fIhostnames\fR \fIkey-type\fR \fIbase64-encoding-key\fR \fIcomment\fR
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-For protocol version 2, \fIkey-type\fR is one of \fBssh-rsa\fR or
-\fBssh-dsa\fR.
-.sp
-.LP
-Hostnames is a comma-separated list of patterns (\fB*\fR and \fB?\fR act as
-wildcards); each pattern in turn is matched against the canonical host name
-(when authenticating a client) or against the user-supplied name (when
-authenticating a server). A pattern can also be preceded by \fB!\fR to indicate
-negation: if the host name matches a negated pattern, it is not accepted (by
-that line) even if it matched another pattern on the line.
-.sp
-.LP
-Alternately, hostnames can be stored in a hashed form, which hides host names
-and addresses should the file's contents be disclosed. Hashed hostnames start
-with a vertical bar (\fB|\fR) character. Only one hashed hostname can appear on
-a single line and none of the above negation or wildcard operators may be
-applied.
-.sp
-.LP
-Bits, exponent, and modulus are taken directly from the RSA host key; they can
-be obtained, for example, from \fB/etc/ssh/ssh_host_rsa_key.pub\fR. The
-optional comment field continues to the end of the line, and is not used.
-.sp
-.LP
-Lines starting with a hash mark (\fB#\fR) and empty lines are ignored as
-comments.
-.sp
-.LP
-When performing host authentication, authentication is accepted if any matching
-line has the proper key. It is thus permissible (but not recommended) to have
-several lines or different host keys for the same names. This will inevitably
-happen when short forms of host names from different domains are put in the
-file. It is possible that the files contain conflicting information;
-authentication is accepted if valid information can be found from either file.
-.sp
-.LP
-The lines in these files are typically hundreds of characters long. You should
-definitely not type in the host keys by hand. Rather, generate them by a script
-or by taking \fB/etc/ssh/ssh_host_rsa_key.pub\fR and adding the host names at
-the front.
-.SH ENVIRONMENT VARIABLES
-.LP
-\fBsshd\fR sets the following environment variables for commands executed by
-\fBssh\fR users:
-.sp
-.ne 2
-.na
-\fB\fBDISPLAY\fR\fR
-.ad
-.sp .6
-.RS 4n
-Indicates the location of the X11 server. It is automatically set by \fBsshd\fR
-to point to a value of the form \fIhostname\fR:\fIn\fR, where \fIhostname\fR
-indicates the host where the shell runs, and \fIn\fR is an integer greater than
-or equal to 1. \fBssh\fR uses this special value to forward X11 connections
-over the secure channel. Unless you have important reasons to do otherwise, you
-should not set \fBDISPLAY\fR explicitly, as that will render the X11 connection
-insecure and will require you to manually copy any required authorization
-cookies.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBHOME\fR\fR
-.ad
-.sp .6
-.RS 4n
-Set to the path of the user's home directory.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBLANG\fR, \fBLC_ALL\fR, \fBLC_COLLATE\fR, \fBLC_CTYPE\fR,
-\fBLC_MESSAGES\fR, \fBLC_MONETARY\fR, \fBLC_NUMERIC\fR, \fBLC_TIME\fR\fR
-.ad
-.sp .6
-.RS 4n
-A locale setting. The locale defaults to that of \fBsshd\fR (usually the
-system-wide default locale), or is negotiated between the client and server
-during initial key exchange (as per RFC 4253).
-.sp
-Following initial key exchange, each of the variables can be overriden in the
-following sequence:
-.RS +4
-.TP
-1.
-If a locale setting is set in a client's environment and that client
-supports "Environment Variable Passing" (see RFC 4254), then the setting will
-be passed over to the server side.
-.RE
-.RS +4
-.TP
-2.
-If the public key authentication method was used to authenticate the server
-and the \fBPermitUserEnvironment\fR variable in \fBsshd_config\fR(4) is set to
-\fByes\fR on the server side, then the setting can be changed through the use
-of the \fBenvironment\fR option in the client's \fBAuthorizedKeysFile\fR file.
-.RE
-.RS +4
-.TP
-3.
-The setting can be change in the client's \fB~/.ssh/environment\fR file on
-the server.
-.RE
-See \fBPermitUserEnvironment\fR in \fBsshd_config\fR(4) as to when the
-\fBAuthorizedKeysFile\fR and \fB~/.ssh/environment\fR files are processed and
-used for setting the user environment.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBLOGNAME\fR\fR
-.ad
-.sp .6
-.RS 4n
-Synonym for \fBUSER\fR. Set for compatibility with systems that use this
-variable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBMAIL\fR\fR
-.ad
-.sp .6
-.RS 4n
-Set to point to the user's mailbox.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBSSH_AUTH_SOCK\fR\fR
-.ad
-.sp .6
-.RS 4n
-Indicates the path of a \fBunix-domain\fR socket used to communicate with the
-agent.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBSSH_CONNECTION\fR\fR
-.ad
-.sp .6
-.RS 4n
-Identifies the client and server ends of the connection. The variable contains
-four space-separated values: client IP address, client port number, server IP
-address and server port number.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBSSH_CLIENT\fR\fR
-.ad
-.sp .6
-.RS 4n
-Identifies the client end of the connection. The variable contains three
-space-separated values: client IP address, client port number, and server port
-number.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBSSH_TTY\fR\fR
-.ad
-.sp .6
-.RS 4n
-Set to the name of the \fBtty\fR (path to the device) associated with the
-current shell or command. If the current session has no \fBtty\fR, this
-variable is not set.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBTZ\fR\fR
-.ad
-.sp .6
-.RS 4n
-Indicates the present timezone, if \fBTIMEZONE\fR is set in
-\fB/etc/default/login\fR or if \fBTZ\fR was set when the daemon was started.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBHZ\fR\fR
-.ad
-.sp .6
-.RS 4n
-If set in \fB/etc/default/login\fR, the daemon sets it to the same value.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBSHELL\fR\fR
-.ad
-.sp .6
-.RS 4n
-The user's shell, if \fBALTSHELL=YES\fR in \fB/etc/default/login\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBPATH\fR\fR
-.ad
-.sp .6
-.RS 4n
-Set to the value of \fBPATH\fR or \fBSUPATH\fR (see \fBlogin\fR(1)) in
-\fB/etc/default/login\fR, or, if not set, to \fB/usr/bin:/bin\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fBUSER\fR\fR
-.ad
-.sp .6
-.RS 4n
-Set to the name of the user logging in.
-.RE
-
-.sp
-.LP
-Additionally, \fBsshd\fR reads \fB$HOME/.ssh/environment\fR and adds lines of
-the format \fBVARNAME=\fIvalue\fR\fR to the environment.
-.SH EXAMPLES
-.LP
-In the following examples, certain lines might wrap due to line length limits
-in your display. You should nevertheless consider the wrapped line as a single
-line.
-.LP
-\fBExample 1 \fR\fBauthorized_key\fR File Entries
-.sp
-.LP
-The following are examples of \fBauthorized_key\fR file entries for protocol 1:
-
-.sp
-.in +2
-.nf
-1024 33 12121...312314325 ylo@foo.bar
-
-from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
-
-command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 backup.hut.fi
-.fi
-.in -2
-.sp
-
-.LP
-\fBExample 2 \fR\fBauthorized_key\fR File Entries for Protocol 2
-.sp
-.LP
-The following are examples of \fBauthorized_key\fR file entries for protocol 2:
-
-.sp
-.in +2
-.nf
-ssh-rsa AAAAB3NzaC1y.....EU88ovYKg4GfclWGCFYTuw8= ylo@foo.bar
-from="*.niksula.hut.fi" ssh-rsa AAAAB3NzaC...uw8= ylo@niksula
-command="dump /home",no-pty,no-port-forwarding ssh-rsa AA..8= backup.hut.fi
-.fi
-.in -2
-.sp
-
-.LP
-\fBExample 3 \fR\fBssh_known_hosts\fR File Entries for Protocol 1
-.sp
-.LP
-The following are examples of \fBssh_known_hosts\fR file entries for protocol
-1:
-
-.sp
-.in +2
-.nf
-closenet,closenet.hut.fi,...,130.233.208.41 1024 37 159...93 closenet.hut.fi
-.fi
-.in -2
-.sp
-
-.LP
-\fBExample 4 \fR\fBssh_known_hosts\fR File Entries for Protocol 2
-.sp
-.LP
-The following are examples of \fBssh_known_hosts\fR file entries for protocol
-2:
-
-.sp
-.in +2
-.nf
-closenet,closenet.hut.fi,...,130.233.208.41 ssh-rsa AA..8= closenet.hut.fi
-.fi
-.in -2
-.sp
-
-.SH EXIT STATUS
-.LP
-The following exit values are returned:
-.sp
-.ne 2
-.na
-\fB\fB0\fR\fR
-.ad
-.RS 13n
-Successful completion.
-.RE
-
-.sp
-.ne 2
-.na
-\fB>\fB0\fR\fR
-.ad
-.RS 13n
-An error occurred.
-.RE
-
-.SH FILES
-.ne 2
-.na
-\fB\fB/etc/default/login\fR\fR
-.ad
-.sp .6
-.RS 4n
-Contains defaults for several \fBsshd_config\fR parameters, environment
-variables, and other environmental factors.
-.sp
-The following parameters affect environment variables (see \fBlogin\fR(1) and
-descriptions of these variables, above):
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBTIMEZONE\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBHZ\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBALTSHELL\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBPATH\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBSUPATH\fR
-.RE
-The following \fB/etc/default/login\fR parameters supply default values for
-corresponding \fBsshd_config\fR(4) parameters:
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBCONSOLE\fR (see \fBPermitRootLogin\fR in \fBsshd_config\fR(4))
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBPASSREQ\fR (see \fBPermitEmptyPasswords\fR in \fBsshd_config\fR(4))
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBTIMEOUT\fR (see \fBLoginGraceTime\fR in \fBsshd_config\fR(4))
-.RE
-The following \fB/etc/default/login\fR parameters:
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBUMASK\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBULIMIT\fR
-.RE
-\&...set the \fBumask\fR(2) and file size limit of, respectively, the shells
-and commands spawned by \fBsshd\fR.
-.sp
-Finally, two \fB/etc/default/login\fR parameters affect the maximum allowed
-login attempts per-connection using interactive user authentication methods
-(for example, \fBkeyboard-interactive\fR but not \fBpublickey\fR), as per
-\fBlogin\fR(1):
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBRETRIES\fR
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-\fBSYSLOG_FAILED_LOGINS\fR
-.RE
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/sshd_config\fR\fR
-.ad
-.sp .6
-.RS 4n
-Contains configuration data for \fBsshd\fR. This file should be writable by
-root only, but it is recommended (though not necessary) that it be
-world-readable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/ssh_host_key\fR\fR
-.ad
-.br
-.na
-\fB\fB/etc/ssh/ssh_host_dsa_key\fR\fR
-.ad
-.br
-.na
-\fB\fB/etc/ssh/ssh_host_rsa_key\fR\fR
-.ad
-.sp .6
-.RS 4n
-Contains the private part of the host key. This file should only be owned by
-root, readable only by root, and not accessible to others. \fBsshd\fR does not
-start if this file is group/world-accessible.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/ssh_host_key.pub\fR\fR
-.ad
-.br
-.na
-\fB\fB/etc/ssh/ssh_host_dsa_key.pub\fR\fR
-.ad
-.br
-.na
-\fB\fB/etc/ssh/ssh_host_rsa_key.pub\fR\fR
-.ad
-.sp .6
-.RS 4n
-Contains the public part of the host key. This file should be world-readable
-but writable only by root. Its contents should match the private part. This
-file is not used for encryption; it is provided only for the convenience of the
-user so its contents can be copied to known hosts files. These two files are
-created using \fBssh-keygen\fR(1).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/var/run/sshd.pid\fR\fR
-.ad
-.sp .6
-.RS 4n
-Contains the process ID of the \fBsshd\fR listening for connections. If there
-are several daemons running concurrently for different ports, this contains the
-pid of the one started last. The content of this file is not sensitive; it can
-be world-readable. You can use the \fBPidFile\fR keyword in \fBsshd_config\fR
-to specify a file other than \fB/var/run/sshd.pid\fR. See \fBsshd_config\fR(4).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/ssh_known_hosts\fR and \fB$HOME/.ssh/known_hosts\fR\fR
-.ad
-.sp .6
-.RS 4n
-These files are consulted when using \fBrhosts\fR with public key host
-authentication to check the public key of the host. The key must be listed in
-one of these files to be accepted. The client uses the same files to verify
-that the remote host is the one it intended to connect. These files should be
-writable only by root or the owner. \fB/etc/ssh/ssh_known_hosts\fR should be
-world-readable, and \fB$HOME/.ssh/known_hosts\fR can but need not be
-world-readable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/nologin\fR\fR
-.ad
-.sp .6
-.RS 4n
-If this file exists, \fBsshd\fR refuses to let anyone except root log in. The
-contents of the file are displayed to anyone trying to log in, and non-root
-connections are refused. The file should be world-readable.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB$HOME/.ssh/authorized_keys\fR\fR
-.ad
-.sp .6
-.RS 4n
-Lists the public keys (RSA or DSA) that can be used to log into the user's
-account. This file must be readable by root. This might, on some machines,
-imply that it is world-readable if the user's home directory resides on an NFS
-volume. It is recommended that it not be accessible by others. The format of
-this file is described above. Users will place the contents of their
-\fBidentity.pub\fR, \fBid_dsa.pub\fR and/or \fBid_rsa.pub\fR files into this
-file, as described in \fBssh-keygen\fR(1).
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB$HOME/.rhosts\fR\fR
-.ad
-.sp .6
-.RS 4n
-This file contains host-username pairs, separated by a space, one per line. The
-given user on the corresponding host is permitted to log in without password.
-The same file is used by \fBrlogind\fR and \fBrshd\fR. The file must be
-writable only by the user; it is recommended that it not be accessible by
-others. It is also possible to use \fBnetgroups\fR in the file. Either host or
-user name may be of the form \fB+@\fIgroupname\fR\fR to specify all hosts or
-all users in the group.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB$HOME/.shosts\fR\fR
-.ad
-.sp .6
-.RS 4n
-For \fBssh\fR, this file is exactly the same as for \fB\&.rhosts\fR. However,
-this file is not used by \fBrlogin\fR and \fBrshd\fR, so using this permits
-access using SSH only.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/hosts.equiv\fR\fR
-.ad
-.sp .6
-.RS 4n
-This file is used during \fB\&.rhosts\fR authentication. In its simplest form,
-this file contains host names, one per line. Users on these hosts are permitted
-to log in without a password, provided they have the same user name on both
-machines. The host name can also be followed by a user name; such users are
-permitted to log in as any user on this machine (except root). Additionally,
-the syntax \fB+@\fIgroup\fR\fR can be used to specify netgroups. Negated
-entries start with a hyphen (\fB-\fR).
-.sp
-If the client host/user is successfully matched in this file, login is
-automatically permitted, provided the client and server user names are the
-same. Additionally, successful RSA host authentication is normally required.
-This file must be writable only by root; it is recommended that it be
-world-readable.
-.sp
-Warning: It is almost never a good idea to use user names in \fBhosts.equiv\fR.
-Beware that it really means that the named user(s) can log in as anybody, which
-includes \fBbin\fR, \fBdaemon\fR, \fBadm\fR, and other accounts that own
-critical binaries and directories. For practical purposes, using a user name
-grants the user root access. Probably the only valid use for user names is in
-negative entries. This warning also applies to \fBrsh\fR/\fBrlogin\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/moduli\fR\fR
-.ad
-.sp .6
-.RS 4n
-A private file.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/shosts.equiv\fR\fR
-.ad
-.sp .6
-.RS 4n
-This file is processed exactly as \fB/etc/hosts.equiv\fR. However, this file
-might be useful in environments that want to run both \fBrsh\fR/\fBrlogin\fR
-and \fBssh\fR.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB$HOME/.ssh/environment\fR\fR
-.ad
-.sp .6
-.RS 4n
-This file is read into the environment at login (if it exists). It can contain
-only empty lines, comment lines (that start with \fB#\fR), and assignment lines
-of the form \fB\fIname\fR=\fIvalue\fR\fR. The file should be writable only by
-the user; it need not be readable by anyone else. Environment processing is
-disabled by default and is controlled by means of the
-\fBPermitUserEnvironment\fR option.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB$HOME/.ssh/rc\fR\fR
-.ad
-.sp .6
-.RS 4n
-If this file exists, it is run with \fB/bin/sh\fR after reading the environment
-files but before starting the user's shell or command. If X11 spoofing is in
-use, this will receive the \fBproto cookie\fR pair in standard input (and
-\fBDISPLAY\fR in environment). This must call \fBxauth\fR in that case.
-.sp
-The primary purpose of \fB$HOME/.ssh/rc\fR is to run any initialization
-routines that might be needed before the user's home directory becomes
-accessible; AFS is a particular example of such an environment. If this file
-exists, it is run with \fB/bin/sh\fR after reading the environment files, but
-before starting the user's shell or command. It must not produce any output on
-stdout; stderr must be used instead. If X11 forwarding is in use, it will
-receive the \fBproto cookie\fR pair in its standard input and \fBDISPLAY\fR in
-its environment. The script must call \fBxauth\fR because \fBsshd\fR will not
-run \fBxauth\fR automatically to add X11 cookies.
-.sp
-This file will probably contain some initialization code followed by something
-similar to:
-.sp
-.in +2
-.nf
-if read proto cookie && [ -n "$DISPLAY" ]
-then
-  if [ `echo $DISPLAY | cut -c1-10`  =  'localhost:' ]
-  then
-    # X11UseLocalhost=yes
-    echo add unix:`echo $DISPLAY |
-    cut -c11-` $proto $cookie
-  else
-    # X11UseLocalhost=no
-    echo add $DISPLAY $proto $cookie
-  fi | xauth -q -
-fi
-.fi
-.in -2
-.sp
-
-If this file does not exist, \fB/etc/ssh/sshrc\fR is run, and if that does not
-exist, \fBxauth\fR is used to store the cookie. \fB$HOME/.ssh/rc\fR should be
-writable only by the user, and need not be readable by anyone else.
-.RE
-
-.sp
-.ne 2
-.na
-\fB\fB/etc/ssh/sshrc\fR\fR
-.ad
-.sp .6
-.RS 4n
-Similar to \fB$HOME/.ssh/rc\fR. This can be used to specify machine-specific
-login-time initializations globally. This file should be writable only by root,
-and should be world-readable.
-.RE
-
-.SH SECURITY
-.LP
-\fBsshd\fR supports the use of several user authentication mechanisms: a public
-key system where keys are associated with users (through users'
-\fBauthorized_keys\fR files), a public key system where keys are associated
-with hosts (see the \fBHostbasedAuthentication\fR configuration parameter), a
-GSS-API based method (see the \fBGssAuthentication\fR and \fBGssKeyEx\fR
-configuration parameters) and three initial authentication methods: \fBnone\fR,
-\fBpassword\fR, and a generic prompt/reply protocol,
-\fBkeyboard-interactive\fR.
-.sp
-.LP
-\fBsshd\fR negotiates the use of the GSS-API with clients only if it has a
-GSS-API acceptor credential for the "host" service. This means that, for
-GSS-API based authentication, the server must have a Kerberos V \fBkeytab\fR
-entry (see below) or the equivalent for any other GSS-API mechanism that might
-be installed.
-.sp
-.LP
-In order for Kerberos authentication to work, a \fBhost/\fR\fI<FQDN>\fR
-Kerberos principal must exist for each Fully Qualified Domain Name associated
-with the \fBin.sshd\fR server. Each of these \fBhost/\fR\fI<FQDN>\fR principals
-must have a \fBkeytab\fR entry in the \fB/etc/krb5/krb5.keytab\fR file on the
-\fBin.sshd\fR server. An example principal might be:
-.sp
-.LP
-\fBhost/bigmachine.eng.example.com\fR
-.sp
-.LP
-See \fBkadmin\fR(1M) for instructions on adding a principal to a
-\fBkrb5.keytab\fR file. See \fI\fR for a discussion of Kerberos
-authentication.
-.sp
-.LP
-GSS-API authorization is covered in \fBgss_auth_rules\fR(5).
-.sp
-.LP
-\fBsshd\fR uses \fBpam\fR(3PAM) for the three initial authentication methods as
-well as for account management, session management, and password management for
-all authentication methods.
-.sp
-.LP
-Specifically, \fBsshd\fR calls \fBpam_authenticate()\fR for the "none,"
-"password" and "keyboard-interactive" SSHv2 \fBuserauth\fR types, as well as
-for for the null and password authentication methods for SSHv1. Other SSHv2
-authentication methods do not call \fBpam_authenticate()\fR.
-\fBpam_acct_mgmt()\fR is called for each authentication method that succeeds.
-.sp
-.LP
-\fBpam_setcred()\fR and \fBpam_open_session()\fR are called when authentication
-succeeds and \fBpam_close_session()\fR is called when connections are closed.
-.sp
-.LP
-\fBpam_open_session()\fR and \fBpam_close_session()\fR are also called when
-SSHv2 channels with \fBpty\fRs are opened and closed.
-.sp
-.LP
-Each SSHv2 \fBuserauth\fR type has its own PAM service name:
-.sp
-
-.sp
-.TS
-box;
-c | c
-l | l .
-SSHv2 Userauth	PAM Service Name
-_
-none	sshd-none
-_
-password	sshd-password
-_
-keyboard-interactive	sshd-kbdint
-_
-pubkey	sshd-pubkey
-_
-hostbased	sshd-hostbased
-_
-gssapi-with-mic	sshd-gssapi
-_
-gssapi-keyex	sshd-gssapi
-.TE
-
-.sp
-.LP
-For SSHv1, \fBsshd-v1\fR is always used.
-.sp
-.LP
-If \fBpam_acct_mgmt()\fR returns \fBPAM_NEW_AUTHTOK_REQD\fR (indicating that
-the user's authentication tokens have expired), then \fBsshd\fR forces the use
-of "keyboard-interactive" \fBuserauth\fR, if version 2 of the protocol is in
-use. The "keyboard-interactive" \fBuserauth\fR will call \fBpam_chauthtok()\fR
-if \fBpam_acct_mgmt()\fR once again returns \fBPAM_NEW_AUTHTOK_REQD\fR. By this
-means, administrators are able to control what authentication methods are
-allowed for SSHv2 on a per-user basis.
-.SS "Setting up Host-based Authentication"
-.LP
-To establish host-based authentication, you must perform the following steps:
-.RS +4
-.TP
-.ie t \(bu
-.el o
-Configure the client.
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-Configure the server.
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-Publish known hosts.
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-Make appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR.
-.RE
-.sp
-.LP
-These steps are expanded in the following paragraphs.
-.RS +4
-.TP
-.ie t \(bu
-.el o
-On a client machine, in the system-wide client configuration file,
-\fB/etc/ssh/ssh_config\fR, you must have the entry:
-.sp
-.in +2
-.nf
-HostbasedAuthentication yes
-.fi
-.in -2
-
-See \fBssh_config\fR(4) and \fBssh-keysign\fR(1M).
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-On the server, in the system-wide server configuration file,
-\fB/etc/ssh/sshd_config\fR, you must have the entry:
-.sp
-.in +2
-.nf
-HostbasedAuthentication yes
-.fi
-.in -2
-
-If per-user \fB\&.shost\fR files are to be allowed (see last step), in the same
-file, you must have:
-.sp
-.in +2
-.nf
-IgnoreRhosts no
-.fi
-.in -2
-
-See \fBsshd_config\fR(4) for a description of these keywords.
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-To publish known hosts, you must have entries for the clients from which users
-will be allowed host-based authentication. Make these entries in either or both
-of the system-wide file (\fB/etc/ssh/ssh_known_hosts\fR) or the per-user file
-(\fB~/.ssh/known_hosts\fR).
-.RE
-.RS +4
-.TP
-.ie t \(bu
-.el o
-Note that \fBsshd\fR uses \fB\&.shosts\fR, not \fB\&.rhosts\fR. If you want the
-functionality provided by \fB\&.rhosts\fR, but do not want to use \fBrlogin\fR
-or \fBrsh\fR because of their security shortcomings, you can use
-\fB\&.shosts\fR in conjunction with \fBsshd\fR. To use this feature, make
-appropriate entries in \fB/etc/ssh/shosts.equiv\fR and \fB~/.shosts\fR, in the
-format specified in \fBrhosts\fR(4).
-.sp
-For the vast majority of network environments, \fB\&.shosts\fR is preferred
-over \fB\&.rhosts\fR.
-.RE
-.SH ATTRIBUTES
-.LP
-See \fBattributes\fR(5) for descriptions of the following attributes:
-.sp
-
-.sp
-.TS
-box;
-c | c
-l | l .
-ATTRIBUTE TYPE	ATTRIBUTE VALUE
-_
-Interface Stability	Evolving
-.TE
-
-.sp
-.LP
-The interface stability of \fB/etc/ssh/moduli\fR is Private.
-.SH SEE ALSO
-.LP
-\fBlogin\fR(1), \fBscp\fR(1), \fBssh\fR(1), \fBssh-add\fR(1),
-\fBssh-agent\fR(1), \fBssh-keygen\fR(1), \fBsvcs\fR(1),
-\fBkadmin\fR(1M), \fBsftp-server\fR(1M), \fBssh-keysign\fR(1M),
-\fBsvcadm\fR(1M), \fBpam\fR(3PAM), \fBrhosts\fR(4), \fBssh_config\fR(4),
-\fBsshd_config\fR(4), \fBattributes\fR(5), \fBgss_auth_rules\fR(5),
-\fBkerberos\fR(5), \fBpam_roles\fR(5), \fBsmf\fR(5)
-.sp
-.LP
-\fI\fR
-.SH NOTES
-.LP
-The \fBsshd\fR service is managed by the service management facility,
-\fBsmf\fR(5), under the service identifier:
-.sp
-.in +2
-.nf
-svc:/network/ssh:default
-.fi
-.in -2
-.sp
-
-.sp
-.LP
-Administrative actions on this service, such as enabling, disabling, or
-requesting restart, can be performed using \fBsvcadm\fR(1M). The service's
-status can be queried using the \fBsvcs\fR(1) command.
-.sp
-.LP
-\fBsshd\fR always sets \fBPAM_RHOST\fR and sets \fBPAM_AUSER\fR in the case of
-host-based \fBuserauth\fR. This behavior allows for remote logins to roles
-using host-based authentication. See \fBpam_roles\fR(5).
