.TH SSH 1.SH NAMEssh, sshnet, scp, sshserve \- secure login and file copy from/to Unix or Plan 9.SH SYNOPSIS.B ssh[.B -CfiImPpRrw][.B -A.I authlist][.B -c.I cipherlist][.B -[lu].I user].RI [ user\fB@ ] host[.I cmd[.I args\&... ]].PP.B sshnet[.B -A.I authlist][.B -c.I cipherlist][.B -m.I mtpt][.B -s.I service].RI [ user\fB@ ] host.PP.B scp[host:]file [host:]file.br.B scp[host:]file ... [host:]dir.PP.B aux/sshserve[.B -p].I address.SH DESCRIPTION.I Sshallows authenticated login over an encrypted channel to hosts thatsupport the ssh protocol (see the RFCs listed below for encryption andauthentication details)..LP.I Sshtakes the host name of the machine to connect to as its mandatory argument.It may be specified as a domain name or an IP address.Normally, login is attempted using the user name from /dev/user..PPCommand-line options are:.TP.B -Cforce input to be read in cooked mode:``line at a time'' with local echo..TP.B -fenable agent forwarding.With this flag,.I sshuses SSH's agent forwarding protocol to allowprograms running on the remote server tointeract with.IR factotum (4)to perform RSA authentication..TP.B -iforce interactive mode.In interactive mode, .I sshprompts for passwords and confirmations ofnew host keys when necessary.(In non-interactive mode, password requestsare rejected and unrecognized host keys are cause for disconnecting.)By default, .I ssh runs in interactive mode only when its input file descriptor is .BR /dev/cons ..TP.B -Iforce non-interactive mode..TP.B -mdisable the .RB control- \emenu, described below..TP.B -pforce pseudoterminal request.The.I sshprotocol, grounded in Unix tradition,differentiates between connectionsthat request controlling pseudoterminalsand those that do not.By default, .I sshrequests a pseudoterminal only when no.I commandis given..TP.B -Pforce no pseudoterminal request..TP.B -rstrip carriage returns..TP.B -Rput the allocated pseudoterminal, if any, in raw mode..TP.B -wnotify the remote side whenever the window changes size..TP.BR - [ lu ] "\fI userspecify user name.This option is deprecated in favor of the.IB user @ hostnamesyntax..TP.B "-A\fI authlistspecify an ordered space-separated list of authentication protocols to try.The full set of authentication protocols is.B rsa(RSA using.IR factotum (4)to moderate key usage),.B password(use a password gathered from factotum),and.B tis(challenge-response).The default list is all three in that order..TP.B "-c\fI cipherlistspecify an ordered space-separated list of allowed ciphers to use when encrypting the channel.The full set of ciphers is.B des(standard DES),.B 3des(a somewhat doubtful variation on triple DES),.B blowfish(Bruce Schneier's Blowfish),.B rc4(RC4),and.B none(no encryption).The default cipher list is .B blowfish.B rc4.BR 3des ..PD.PPThe.RB control\- \echaracter is a local escape, as in.IR con (1).It prompts with.BR >>> .Legitimate responses to the prompt are.TP.B qExit..TP.B .Return from the escape..TP.B !cmdRun the command with the network connection as itsstandard input and standard output.Standard error will go to the screen..TP.B rToggle printing of carriage returns..PD.LPIf no command is specified,a login session is started on the remotehost.Otherwise, the command is executed with its arguments..LP.I Sshestablishes a connection with an ssh daemon on the remote host.The daemon sends to .I sshits RSA public host key and session key.Using these,.I sshsends a session key which, presumably, only thedaemon can decipher.  After this, both sides start encrypting theirdata with this session key..LPWhen the daemon's host key has been received,.I sshlooks it up in .B $home/lib/keyringand in .BR /sys/lib/ssh/keyring .Ifthe key is found there, and it matches the received key,.I sshis satisfied.  If not,.I sshreports this and offers to add the key to.BR $home/lib/keyring ..LPOver the encrypted channel,.I sshattempts to convince the daemon to accept the callusing the listed authentication protocols(see the.B -Aoption above)..LPThe preferred way to authenticate is a.IR netkey -stylechallenge/response or via a SecurID token..I Sshusers on other systems than Plan 9 should enable \s-2TIS_A\s0uthentication..LPWhen the connection is authenticated, the given command line,(by default, a login shell) is executed on the remote host..sp 1The SSH protocol allows clients to make outgoing TCP calls via the server..I Sshnetestablishes an SSH connection and, rather than execute a remote command,presents the remote server's TCP stack as a network stack(see the discussion of TCP in.IR ip (3))mounted at.I mtpt(default.BR /net ),optionally posting a 9P servicedescriptor for the new file system as.IB /srv/ service \fR.The.B -Aand.B -carguments are as in.IR ssh ..sp 1.I Scpuses.I sshto copy files from one host to another.  A remote file is identified bya host name, a colon and a file name (no spaces)..I Scpcan copy files from remote hosts and to remote hosts..sp 1.I Sshserveis the server that services.I sshcalls from remote hosts. The .B -Aand.B -coptions set valid authentication methods and ciphersas in.IR ssh ,except that there is no.B rsaauthentication method.Unlike in.IR ssh ,the list is not ordered: the server presents a set and the client makes the choice.The default sets are.B tisand.B blowfish.B rc4.BR 3des .By default, users start with the namespace defined in.BR /lib/namespace .Users in group.B noworldin.B /adm/usersstart with the namespace defined in.BR /lib/namespace.noworld ..I Sshservedoes not provide the TCP forwarding functionality usedby.IR sshnet ,because many Unix clients presentthis capability in an insecure manner..PP.I Sshserverequires that.IR factotum (4)hold the host key,identified by having attributes.B proto=rsa.BR service=sshserve .To generate a host key:.IP.EXauth/rsagen -t 'service=sshserve' >/mnt/factotum/ctl.EE.LPTo extract the public part of the host key in the formused by SSH key rings:.IP.EXgrep 'service=sshserve' /mnt/factotum/ctl | auth/rsa2ssh.EE.SH FILES.TP.B /sys/lib/ssh/keyringSystem key ring file containing public keys for remote ssh clients and servers..TP.B /usr/\fIuser\fP/lib/keyringPersonal key ring file containing public keys for remote ssh clients andservers..SH SOURCE.B /sys/src/cmd/ssh.SH "SEE ALSO".B /lib/rfc/rfc425[0-6].br.IR factotum (4),.IR authsrv (6),.IR rsa (8).SH BUGSOnly version 1 of the SSH protocol is implemented.