upstream: Fill in missing man page bits for U2F security key support:
Mention the new key types, the ~/.ssh/id_ecdsa_sk file, ssh's SecurityKeyProvider keyword, the SSH_SK_PROVIDER environment variable, and ssh-keygen's new -w and -x options. Copy the ssh-sk-helper man page from ssh-pkcs11-helper with minimal substitutions. ok djm@ OpenBSD-Commit-ID: ef2e8f83d0c0ce11ad9b8c28945747e5ca337ac4
This commit is contained in:
naddy@openbsd.org
Damien Miller
parent
b236b27d6d
commit
aa4c640dc3
|
|
@ -124,8 +124,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o \
|
|||
sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-pledge.o \
|
||||
sandbox-solaris.o uidswap.o
|
||||
|
||||
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
|
||||
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
|
||||
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
|
||||
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
|
||||
MANTYPE = @MANTYPE@
|
||||
|
||||
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
|
||||
|
|
@ -372,6 +372,7 @@ install-files:
|
|||
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
|
||||
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
|
||||
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
|
||||
$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
|
||||
|
||||
install-sysconf:
|
||||
$(MKDIR_P) $(DESTDIR)$(sysconfdir)
|
||||
|
|
@ -444,6 +445,7 @@ uninstall:
|
|||
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
|
||||
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
|
||||
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
|
||||
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
|
||||
|
||||
regress-prep:
|
||||
$(MKDIR_P) `pwd`/regress/unittests/test_helper
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-add.1,v 1.71 2019/11/01 00:52:35 jmc Exp $
|
||||
.\" $OpenBSD: ssh-add.1,v 1.72 2019/11/07 08:38:38 naddy Exp $
|
||||
.\"
|
||||
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -35,7 +35,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd $Mdocdate: November 1 2019 $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSH-ADD 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -63,6 +63,7 @@ When run without arguments, it adds the files
|
|||
.Pa ~/.ssh/id_rsa ,
|
||||
.Pa ~/.ssh/id_dsa ,
|
||||
.Pa ~/.ssh/id_ecdsa ,
|
||||
.Pa ~/.ssh/id_ecdsa_sk ,
|
||||
and
|
||||
.Pa ~/.ssh/id_ed25519 .
|
||||
After loading a private key,
|
||||
|
|
@ -135,7 +136,7 @@ Be quiet after a successful operation.
|
|||
.It Fl S Ar provider
|
||||
Specifies a path to a security key provider library that will be used when
|
||||
adding any security key-hosted keys, overriding the default of using the
|
||||
.Ev "SSH_SK_PROVIDER"
|
||||
.Ev SSH_SK_PROVIDER
|
||||
environment variable to specify a provider.
|
||||
.It Fl s Ar pkcs11
|
||||
Add keys provided by the PKCS#11 shared library
|
||||
|
|
@ -205,6 +206,8 @@ hardware security keys.
|
|||
Contains the DSA authentication identity of the user.
|
||||
.It Pa ~/.ssh/id_ecdsa
|
||||
Contains the ECDSA authentication identity of the user.
|
||||
.It Pa ~/.ssh/id_ecdsa_sk
|
||||
Contains the security key-hosted ECDSA authentication identity of the user.
|
||||
.It Pa ~/.ssh/id_ed25519
|
||||
Contains the Ed25519 authentication identity of the user.
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
|
|
|
|||
36
ssh-keygen.1
36
ssh-keygen.1
|
|
@ -1,4 +1,4 @@
|
|||
.\" $OpenBSD: ssh-keygen.1,v 1.172 2019/10/22 08:50:35 jmc Exp $
|
||||
.\" $OpenBSD: ssh-keygen.1,v 1.173 2019/11/07 08:38:38 naddy Exp $
|
||||
.\"
|
||||
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -35,7 +35,7 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.Dd $Mdocdate: October 22 2019 $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSH-KEYGEN 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -48,8 +48,10 @@
|
|||
.Op Fl C Ar comment
|
||||
.Op Fl f Ar output_keyfile
|
||||
.Op Fl m Ar format
|
||||
.Op Fl t Cm dsa | ecdsa | ecdsa-sk | ed25519 | rsa
|
||||
.Op Fl N Ar new_passphrase
|
||||
.Op Fl t Cm dsa | ecdsa | ed25519 | rsa
|
||||
.Op Fl w Ar provider
|
||||
.Op Fl x Ar flags
|
||||
.Nm ssh-keygen
|
||||
.Fl p
|
||||
.Op Fl f Ar keyfile
|
||||
|
|
@ -188,6 +190,7 @@ with public key authentication runs this once to create the authentication
|
|||
key in
|
||||
.Pa ~/.ssh/id_dsa ,
|
||||
.Pa ~/.ssh/id_ecdsa ,
|
||||
.Pa ~/.ssh/id_ecdsa_sk ,
|
||||
.Pa ~/.ssh/id_ed25519
|
||||
or
|
||||
.Pa ~/.ssh/id_rsa .
|
||||
|
|
@ -248,7 +251,7 @@ should be placed to be activated.
|
|||
The options are as follows:
|
||||
.Bl -tag -width Ds
|
||||
.It Fl A
|
||||
For each of the key types (rsa, dsa, ecdsa and ed25519)
|
||||
For each of the key types (rsa, dsa, ecdsa, ecdsa-sk and ed25519)
|
||||
for which host keys
|
||||
do not exist, generate the host keys with the default key file path,
|
||||
an empty passphrase, default bits for the key type, and default comment.
|
||||
|
|
@ -282,7 +285,7 @@ flag determines the key length by selecting from one of three elliptic
|
|||
curve sizes: 256, 384 or 521 bits.
|
||||
Attempting to use bit lengths other than these three values for ECDSA keys
|
||||
will fail.
|
||||
Ed25519 keys have a fixed length and the
|
||||
ECDSA-SK and Ed25519 keys have a fixed length and the
|
||||
.Fl b
|
||||
flag will be ignored.
|
||||
.It Fl C Ar comment
|
||||
|
|
@ -583,11 +586,12 @@ section for details.
|
|||
Test DH group exchange candidate primes (generated using the
|
||||
.Fl G
|
||||
option) for safety.
|
||||
.It Fl t Cm dsa | ecdsa | ed25519 | rsa
|
||||
.It Fl t Cm dsa | ecdsa | ecdsa-sk | ed25519 | rsa
|
||||
Specifies the type of key to create.
|
||||
The possible values are
|
||||
.Dq dsa ,
|
||||
.Dq ecdsa ,
|
||||
.Dq ecdsa-sk ,
|
||||
.Dq ed25519 ,
|
||||
or
|
||||
.Dq rsa .
|
||||
|
|
@ -658,6 +662,14 @@ options increase the verbosity.
|
|||
The maximum is 3.
|
||||
.It Fl W Ar generator
|
||||
Specify desired generator when testing candidate moduli for DH-GEX.
|
||||
.It Fl w Ar provider
|
||||
Specifies a path to a security key provider library that will be used when
|
||||
creating any security key-hosted keys, overriding the default of using the
|
||||
.Ev SSH_SK_PROVIDER
|
||||
environment variable to specify a provider.
|
||||
.It Fl x Ar flags
|
||||
Specifies the security key flags to use when enrolling a security key-hosted
|
||||
key.
|
||||
.It Fl y
|
||||
This option will read a private
|
||||
OpenSSH format file and print an OpenSSH public key to stdout.
|
||||
|
|
@ -1020,13 +1032,20 @@ user1@example.com,user2@example.com ssh-rsa AAAAX1...
|
|||
# A key that is accepted only for file signing.
|
||||
user2@example.com namespaces="file" ssh-ed25519 AAA41...
|
||||
.Ed
|
||||
.Sh ENVIRONMENT
|
||||
.Bl -tag -width Ds
|
||||
.It Ev SSH_SK_PROVIDER
|
||||
Specifies the path to a security key provider library used to interact with
|
||||
hardware security keys.
|
||||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds -compact
|
||||
.It Pa ~/.ssh/id_dsa
|
||||
.It Pa ~/.ssh/id_ecdsa
|
||||
.It Pa ~/.ssh/id_ecdsa_sk
|
||||
.It Pa ~/.ssh/id_ed25519
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
Contains the DSA, ECDSA, Ed25519 or RSA
|
||||
Contains the DSA, ECDSA, security key-hosted ECDSA, Ed25519 or RSA
|
||||
authentication identity of the user.
|
||||
This file should not be readable by anyone but the user.
|
||||
It is possible to
|
||||
|
|
@ -1040,9 +1059,10 @@ will read this file when a login attempt is made.
|
|||
.Pp
|
||||
.It Pa ~/.ssh/id_dsa.pub
|
||||
.It Pa ~/.ssh/id_ecdsa.pub
|
||||
.It Pa ~/.ssh/id_ecdsa_sk.pub
|
||||
.It Pa ~/.ssh/id_ed25519.pub
|
||||
.It Pa ~/.ssh/id_rsa.pub
|
||||
Contains the DSA, ECDSA, Ed25519 or RSA
|
||||
Contains the DSA, ECDSA, security key-hosted ECDSA, Ed25519 or RSA
|
||||
public key for authentication.
|
||||
The contents of this file should be added to
|
||||
.Pa ~/.ssh/authorized_keys
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: ssh-keygen.c,v 1.359 2019/10/31 21:28:27 djm Exp $ */
|
||||
/* $OpenBSD: ssh-keygen.c,v 1.360 2019/11/07 08:38:38 naddy Exp $ */
|
||||
/*
|
||||
* Author: Tatu Ylonen <ylo@cs.hut.fi>
|
||||
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
|
||||
|
|
@ -2725,7 +2725,8 @@ usage(void)
|
|||
{
|
||||
fprintf(stderr,
|
||||
"usage: ssh-keygen [-q] [-b bits] [-C comment] [-f output_keyfile] [-m format]\n"
|
||||
" [-N new_passphrase] [-t dsa | ecdsa | ed25519 | rsa]\n"
|
||||
" [-t dsa | ecdsa | ecdsa-sk | ed25519 | rsa]\n"
|
||||
" [-N new_passphrase] [-w provider] [-x flags]\n"
|
||||
" ssh-keygen -p [-f keyfile] [-m format] [-N new_passphrase]\n"
|
||||
" [-P old_passphrase]\n"
|
||||
" ssh-keygen -i [-f input_keyfile] [-m key_format]\n"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,66 @@
|
|||
.\" $OpenBSD: ssh-sk-helper.8,v 1.1 2019/11/07 08:38:38 naddy Exp $
|
||||
.\"
|
||||
.\" Copyright (c) 2010 Markus Friedl. All rights reserved.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
.\" copyright notice and this permission notice appear in all copies.
|
||||
.\"
|
||||
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSH-SK-HELPER 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm ssh-sk-helper
|
||||
.Nd ssh-agent helper program for security key support
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl v
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
is used by
|
||||
.Xr ssh-agent 1
|
||||
to access keys provided by a security key.
|
||||
.Pp
|
||||
.Nm
|
||||
is not intended to be invoked by the user, but from
|
||||
.Xr ssh-agent 1 .
|
||||
.Pp
|
||||
A single option is supported:
|
||||
.Bl -tag -width Ds
|
||||
.It Fl v
|
||||
Verbose mode.
|
||||
Causes
|
||||
.Nm
|
||||
to print debugging messages about its progress.
|
||||
This is helpful in debugging problems.
|
||||
Multiple
|
||||
.Fl v
|
||||
options increase the verbosity.
|
||||
The maximum is 3.
|
||||
.Pp
|
||||
Note that
|
||||
.Xr ssh-agent 1
|
||||
will automatically pass the
|
||||
.Fl v
|
||||
flag to
|
||||
.Nm
|
||||
when it has itself been placed in debug mode.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr ssh 1 ,
|
||||
.Xr ssh-add 1 ,
|
||||
.Xr ssh-agent 1
|
||||
.Sh HISTORY
|
||||
.Nm
|
||||
first appeared in
|
||||
.Ox 6.7 .
|
||||
.Sh AUTHORS
|
||||
.An Damien Miller Aq Mt djm@openbsd.org
|
||||
17
ssh.1
17
ssh.1
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh.1,v 1.403 2019/06/12 11:31:50 jmc Exp $
|
||||
.Dd $Mdocdate: June 12 2019 $
|
||||
.\" $OpenBSD: ssh.1,v 1.404 2019/11/07 08:38:38 naddy Exp $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSH 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -279,6 +279,7 @@ public key authentication is read.
|
|||
The default is
|
||||
.Pa ~/.ssh/id_dsa ,
|
||||
.Pa ~/.ssh/id_ecdsa ,
|
||||
.Pa ~/.ssh/id_ecdsa_sk ,
|
||||
.Pa ~/.ssh/id_ed25519
|
||||
and
|
||||
.Pa ~/.ssh/id_rsa .
|
||||
|
|
@ -896,6 +897,8 @@ This stores the private key in
|
|||
(DSA),
|
||||
.Pa ~/.ssh/id_ecdsa
|
||||
(ECDSA),
|
||||
.Pa ~/.ssh/id_ecdsa_sk
|
||||
(security key-hosted ECDSA),
|
||||
.Pa ~/.ssh/id_ed25519
|
||||
(Ed25519),
|
||||
or
|
||||
|
|
@ -906,6 +909,8 @@ and stores the public key in
|
|||
(DSA),
|
||||
.Pa ~/.ssh/id_ecdsa.pub
|
||||
(ECDSA),
|
||||
.Pa ~/.ssh/id_ecdsa_sk.pub
|
||||
(security key-hosted ECDSA),
|
||||
.Pa ~/.ssh/id_ed25519.pub
|
||||
(Ed25519),
|
||||
or
|
||||
|
|
@ -1324,6 +1329,12 @@ More permanent VPNs are better provided by tools such as
|
|||
and
|
||||
.Xr isakmpd 8 .
|
||||
.Sh ENVIRONMENT
|
||||
.Bl -tag -width "SSH_ORIGINAL_COMMAND"
|
||||
.It Ev SSH_SK_PROVIDER
|
||||
Specifies the path to a security key provider library used to interact with
|
||||
hardware security keys.
|
||||
.Pp
|
||||
.El
|
||||
.Nm
|
||||
will normally set the following environment variables:
|
||||
.Bl -tag -width "SSH_ORIGINAL_COMMAND"
|
||||
|
|
@ -1484,6 +1495,7 @@ above.
|
|||
.Pp
|
||||
.It Pa ~/.ssh/id_dsa
|
||||
.It Pa ~/.ssh/id_ecdsa
|
||||
.It Pa ~/.ssh/id_ecdsa_sk
|
||||
.It Pa ~/.ssh/id_ed25519
|
||||
.It Pa ~/.ssh/id_rsa
|
||||
Contains the private key for authentication.
|
||||
|
|
@ -1498,6 +1510,7 @@ sensitive part of this file using AES-128.
|
|||
.Pp
|
||||
.It Pa ~/.ssh/id_dsa.pub
|
||||
.It Pa ~/.ssh/id_ecdsa.pub
|
||||
.It Pa ~/.ssh/id_ecdsa_sk.pub
|
||||
.It Pa ~/.ssh/id_ed25519.pub
|
||||
.It Pa ~/.ssh/id_rsa.pub
|
||||
Contains the public key for authentication.
|
||||
|
|
|
|||
31
ssh_config.5
31
ssh_config.5
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh_config.5,v 1.304 2019/09/13 04:52:34 djm Exp $
|
||||
.Dd $Mdocdate: September 13 2019 $
|
||||
.\" $OpenBSD: ssh_config.5,v 1.305 2019/11/07 08:38:38 naddy Exp $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSH_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -381,7 +381,9 @@ flag to
|
|||
via
|
||||
.Xr ssh-agent 1 ,
|
||||
or via a
|
||||
.Cm PKCS11Provider .
|
||||
.Cm PKCS11Provider
|
||||
or
|
||||
.Cm SecurityKeyProvider .
|
||||
.Pp
|
||||
Arguments to
|
||||
.Cm CertificateFile
|
||||
|
|
@ -808,7 +810,8 @@ ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
|
|
@ -840,7 +843,8 @@ ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
|
|
@ -883,6 +887,8 @@ even if
|
|||
.Xr ssh-agent 1
|
||||
or a
|
||||
.Cm PKCS11Provider
|
||||
or
|
||||
.Cm SecurityKeyProvider
|
||||
offers more identities.
|
||||
The argument to this keyword must be
|
||||
.Cm yes
|
||||
|
|
@ -919,11 +925,12 @@ or the tokens described in the
|
|||
.Sx TOKENS
|
||||
section.
|
||||
.It Cm IdentityFile
|
||||
Specifies a file from which the user's DSA, ECDSA, Ed25519 or RSA authentication
|
||||
identity is read.
|
||||
Specifies a file from which the user's DSA, ECDSA, security key-hosted ECDSA,
|
||||
Ed25519 or RSA authentication identity is read.
|
||||
The default is
|
||||
.Pa ~/.ssh/id_dsa ,
|
||||
.Pa ~/.ssh/id_ecdsa ,
|
||||
.Pa ~/.ssh/id_ecdsa_sk ,
|
||||
.Pa ~/.ssh/id_ed25519
|
||||
and
|
||||
.Pa ~/.ssh/id_rsa .
|
||||
|
|
@ -1315,12 +1322,15 @@ character, then the specified key types will be placed at the head of the
|
|||
default set.
|
||||
The default for this option is:
|
||||
.Bd -literal -offset 3n
|
||||
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
sk-ecdsa-sha2-nistp256@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
.Ed
|
||||
|
|
@ -1437,6 +1447,11 @@ an OpenSSH Key Revocation List (KRL) as generated by
|
|||
.Xr ssh-keygen 1 .
|
||||
For more information on KRLs, see the KEY REVOCATION LISTS section in
|
||||
.Xr ssh-keygen 1 .
|
||||
.It Cm SecurityKeyProvider
|
||||
Specifies a path to a security key provider library that will be used when
|
||||
loading any security key-hosted keys, overriding the default of using the
|
||||
.Ev SSH_SK_PROVIDER
|
||||
environment variable to specify a provider.
|
||||
.It Cm SendEnv
|
||||
Specifies what variables from the local
|
||||
.Xr environ 7
|
||||
|
|
|
|||
37
sshd.8
37
sshd.8
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd.8,v 1.304 2018/07/22 12:16:59 dtucker Exp $
|
||||
.Dd $Mdocdate: July 22 2018 $
|
||||
.\" $OpenBSD: sshd.8,v 1.305 2019/11/07 08:38:38 naddy Exp $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSHD 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -429,24 +429,35 @@ comments).
|
|||
Public keys consist of the following space-separated fields:
|
||||
options, keytype, base64-encoded key, comment.
|
||||
The options field is optional.
|
||||
The keytype is
|
||||
.Dq ecdsa-sha2-nistp256 ,
|
||||
.Dq ecdsa-sha2-nistp384 ,
|
||||
.Dq ecdsa-sha2-nistp521 ,
|
||||
.Dq ssh-ed25519 ,
|
||||
.Dq ssh-dss
|
||||
or
|
||||
.Dq ssh-rsa ;
|
||||
the comment field is not used for anything (but may be convenient for the
|
||||
The supported key types are:
|
||||
.Pp
|
||||
.Bl -item -compact -offset indent
|
||||
.It
|
||||
sk-ecdsa-sha2-nistp256@openssh.com
|
||||
.It
|
||||
ecdsa-sha2-nistp256
|
||||
.It
|
||||
ecdsa-sha2-nistp384
|
||||
.It
|
||||
ecdsa-sha2-nistp521
|
||||
.It
|
||||
ssh-ed25519
|
||||
.It
|
||||
ssh-dss
|
||||
.It
|
||||
ssh-rsa
|
||||
.El
|
||||
.Pp
|
||||
The comment field is not used for anything (but may be convenient for the
|
||||
user to identify the key).
|
||||
.Pp
|
||||
Note that lines in this file can be several hundred bytes long
|
||||
(because of the size of the public key encoding) up to a limit of
|
||||
8 kilobytes, which permits DSA keys up to 8 kilobits and RSA
|
||||
keys up to 16 kilobits.
|
||||
8 kilobytes, which permits RSA keys up to 16 kilobits.
|
||||
You don't want to type them in; instead, copy the
|
||||
.Pa id_dsa.pub ,
|
||||
.Pa id_ecdsa.pub ,
|
||||
.Pa id_ecdsa_sk.pub ,
|
||||
.Pa id_ed25519.pub ,
|
||||
or the
|
||||
.Pa id_rsa.pub
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.290 2019/09/06 14:45:34 naddy Exp $
|
||||
.Dd $Mdocdate: September 6 2019 $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.291 2019/11/07 08:38:38 naddy Exp $
|
||||
.Dd $Mdocdate: November 7 2019 $
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -690,7 +690,8 @@ ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
|
|
@ -768,7 +769,8 @@ ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
|||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
|
|
@ -1425,12 +1427,15 @@ character, then the specified key types will be placed at the head of the
|
|||
default set.
|
||||
The default for this option is:
|
||||
.Bd -literal -offset 3n
|
||||
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp256-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp384-cert-v01@openssh.com,
|
||||
ecdsa-sha2-nistp521-cert-v01@openssh.com,
|
||||
ssh-ed25519-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
|
||||
rsa-sha2-512-cert-v01@openssh.com,
|
||||
rsa-sha2-256-cert-v01@openssh.com,
|
||||
ssh-rsa-cert-v01@openssh.com,
|
||||
sk-ecdsa-sha2-nistp256@openssh.com,
|
||||
ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
|
||||
ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
|
||||
.Ed
|
||||
|
|
|
|||
Loading…
Reference in New Issue