Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 1 | SSH-KEYSIGN(8) System Manager's Manual SSH-KEYSIGN(8) |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 2 | |
| 3 | NAME |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 4 | ssh-keysign M-bM-^@M-^S ssh helper program for host-based authentication |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 5 | |
| 6 | SYNOPSIS |
| 7 | ssh-keysign |
| 8 | |
| 9 | DESCRIPTION |
| 10 | ssh-keysign is used by ssh(1) to access the local host keys and generate |
| 11 | the digital signature required during host-based authentication with SSH |
| 12 | protocol version 2. |
| 13 | |
| 14 | ssh-keysign is disabled by default and can only be enabled in the global |
| 15 | client configuration file /etc/ssh/ssh_config by setting EnableSSHKeysign |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 16 | to M-bM-^@M-^\yesM-bM-^@M-^]. |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 17 | |
| 18 | ssh-keysign is not intended to be invoked by the user, but from ssh(1). |
| 19 | See ssh(1) and sshd(8) for more information about host-based |
| 20 | authentication. |
| 21 | |
| 22 | FILES |
| 23 | /etc/ssh/ssh_config |
| 24 | Controls whether ssh-keysign is enabled. |
| 25 | |
| 26 | /etc/ssh/ssh_host_dsa_key |
| 27 | /etc/ssh/ssh_host_ecdsa_key |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 28 | /etc/ssh/ssh_host_ed25519_key |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 29 | /etc/ssh/ssh_host_rsa_key |
| 30 | These files contain the private parts of the host keys used to |
| 31 | generate the digital signature. They should be owned by root, |
| 32 | readable only by root, and not accessible to others. Since they |
| 33 | are readable only by root, ssh-keysign must be set-uid root if |
| 34 | host-based authentication is used. |
| 35 | |
| 36 | /etc/ssh/ssh_host_dsa_key-cert.pub |
| 37 | /etc/ssh/ssh_host_ecdsa_key-cert.pub |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 38 | /etc/ssh/ssh_host_ed25519_key-cert.pub |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 39 | /etc/ssh/ssh_host_rsa_key-cert.pub |
| 40 | If these files exist they are assumed to contain public |
| 41 | certificate information corresponding with the private keys |
| 42 | above. |
| 43 | |
| 44 | SEE ALSO |
| 45 | ssh(1), ssh-keygen(1), ssh_config(5), sshd(8) |
| 46 | |
| 47 | HISTORY |
| 48 | ssh-keysign first appeared in OpenBSD 3.2. |
| 49 | |
| 50 | AUTHORS |
| 51 | Markus Friedl <markus@openbsd.org> |
| 52 | |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 53 | OpenBSD 5.7 December 7, 2013 OpenBSD 5.7 |