1 '\" te
   2 .\" Copyright (c) 2003, Sun Microsystems, Inc. All Rights Reserved
   3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
   4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
   5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   6 .TH SSH-KEYSIGN 1M "Jun 9, 2004"
   7 .SH NAME
   8 ssh-keysign \- ssh helper program for host-based authentication
   9 .SH SYNOPSIS
  10 .LP
  11 .nf
  12 \fBssh-keysign\fR
  13 .fi
  14 
  15 .SH DESCRIPTION
  16 .LP
  17 \fBssh-keysign\fR is used by \fBssh\fR(1) to access the local host keys and
  18 generate the digital signature required during host-based authentication with
  19 SSH protocol version 2. This signature is of data that includes, among other
  20 items, the name of the client host and the name of the client user.
  21 .sp
  22 .LP
  23 \fBssh-keysign\fR is disabled by default and can be enabled only in the global
  24 client configuration file \fB/etc/ssh/ssh_config\fR by setting
  25 \fBHostbasedAuthentication\fR to \fByes\fR.
  26 .sp
  27 .LP
  28 \fBssh-keysign\fR is not intended to be invoked by the user, but from
  29 \fBssh\fR. See \fBssh\fR(1) and \fBsshd\fR(1M) for more information about
  30 host-based authentication.
  31 .SH FILES
  32 .ne 2
  33 .na
  34 \fB\fB/etc/ssh/ssh_config\fR\fR
  35 .ad
  36 .RS 29n
  37 Controls whether \fBssh-keysign\fR is enabled.
  38 .RE
  39 
  40 .sp
  41 .ne 2
  42 .na
  43 \fB\fB/etc/ssh/ssh_host_dsa_key\fR\fR
  44 .ad
  45 .br
  46 .na
  47 \fB\fB/etc/ssh/ssh_host_rsa_key\fR\fR
  48 .ad
  49 .RS 29n
  50 These files contain the private parts of the host keys used to generate the
  51 digital signature. They should be owned by root, readable only by root, and not
  52 accessible to others. Because they are readable only by root, \fBssh-keysign\fR
  53 must be \fBset-uid\fR root if host-based authentication is used.
  54 .RE
  55 
  56 .SH SECURITY
  57 .LP
  58 ssh-keysign will not sign host-based authentication data under the following
  59 conditions:
  60 .RS +4
  61 .TP
  62 .ie t \(bu
  63 .el o
  64 If the \fBHostbasedAuthentication\fR client configuration parameter is not set
  65 to \fByes\fR in \fB/etc/ssh/ssh_config\fR. This setting cannot be overriden in
  66 users' \fB~/.ssh/ssh_config\fR files.
  67 .RE
  68 .RS +4
  69 .TP
  70 .ie t \(bu
  71 .el o
  72 If the client hostname and username in \fB/etc/ssh/ssh_config\fR do not match
  73 the canonical hostname of the client where \fBssh-keysign\fR is invoked and the
  74 name of the user invoking \fBssh-keysign\fR.
  75 .RE
  76 .sp
  77 .LP
  78 In spite of \fBssh-keysign\fR's restrictions on the contents of the host-based
  79 authentication data, there remains the ability of users to use it as an avenue
  80 for obtaining the client's private host keys. For this reason host-based
  81 authentication is turned off by default.
  82 .SH ATTRIBUTES
  83 .LP
  84 See \fBattributes\fR(5) for descriptions of the following attributes:
  85 .sp
  86 
  87 .sp
  88 .TS
  89 box;
  90 c | c
  91 l | l .
  92 ATTRIBUTE TYPE  ATTRIBUTE VALUE
  93 _
  94 Interface Stability     Evolving
  95 .TE
  96 
  97 .SH SEE ALSO
  98 .LP
  99 \fBssh\fR(1), \fBsshd\fR(1M), \fBssh_config\fR(4), \fBattributes\fR(5)
 100 .SH AUTHORS
 101 .LP
 102 Markus Friedl, \fBmarkus@openbsd.org\fR
 103 .SH HISTORY
 104 .LP
 105 \fBssh-keysign\fR first appeared in Ox 3.2.