.TH SSH 1.SH NAMEssh, sshnet, scp, sshserve, ssh_genkey \- secure login and file copy from/to Unix or Plan 9.SH SYNOPSIS.B ssh[.B -CiImPprvw][.B -A.I authlist][.B -c.I cipherlist][.B -[lu].I user].RI [ user\fB@ ] host[.I cmd[.I args\&... ]].PP.B sshnet[.B -A.I authlist][.B -c.I cipherlist][.B -m.I mtpt].RI [ user\fB@ ] host.PP.B scp[host:]file [host:]file.br.B scp[host:]file ... [host:]dir.PP.B aux/sshserve[.B -p].I address.PP.B aux/ssh_genkey[.I basename].SH DESCRIPTION.I Sshallows authenticated login over an encrypted channel to hosts thatsupport the ssh protocol (see the RFC listed below for encryption andauthentication details)..LP.I Sshtakes the host name of the machine to connect to as its mandatory argument.It may be specified as a domain name or an IP address.Normally, login is attempted using the user name from /dev/user..PPCommand-line options are:.TP.B -Cforce input to be read in cooked mode:``line at a time'' with local echo..TP.B -iforce interactive mode.In interactive mode, .I sshprompts for passwords and confirmations ofnew host keys when necessary.(In non-interactive mode, password requestsare rejected and unrecognized host keys are cause for disconnecting.)By default, .I ssh runs in interactive mode only when its input file descriptor is .BR /dev/cons ..TP.B -Iforce non-interactive mode..TP.B -mdisable the .RB control- \emenu, described below..TP.B -pforce pseudoterminal request.The.I sshprotocol, grounded in Unix tradition,differentiates between connectionsthat request controlling pseudoterminalsand those that do not.By default, .I sshrequests a pseudoterminal only when no.I commandis given..TP.B -Pforce no pseudoterminal request..TP.B -rstrip carriage returns..TP.B -venable verbose feedback during the connection and authentication process. .TP.B -wnotify the remote side whenever the window changes size..TP.BR - [ lu ] "\fI userspecify user name.This option is deprecated in favor of the.IB user @ hostnamesyntax..TP.B "-A\fI authlistspecify an ordered space-separated list of authentication protocols to try.The full set of authentication protocols is.B rsa(RSA using.IR factotum (4)to moderate key usage),.B password(use a password gathered from factotum),and.B tis(challenge-response).The default list is all three in that order..TP.B "-c\fI cipherlistspecify an ordered space-separated list of allowed ciphers to use when encrypting the channel.The full set of ciphers is.B des(standard DES),.B 3des(a somewhat doubtful variation on triple DES),.B blowfish(Bruce Schneier's Blowfish),.B rc4(RC4),and.B none(no encryption).The default cipher list is .B blowfish.B rc4.BR 3des ..PD.PPThe.RB control\- \echaracter is a local escape, as in.IR con (1).It prompts with.BR >>> .Legitimate responses to the prompt are.TP.B qExit..TP.B .Return from the escape..TP.B !cmdRun the command with the network connection as itsstandard input and standard output.Standard error will go to the screen..TP.B rToggle printing of carriage returns..PD.LPIf no command is specified,a login session is started on the remotehost.Otherwise, the command is executed with its arguments..LP.I Sshestablishes a connection with an ssh daemon on the remote host.The daemon sends to .I sshits RSA public host key and session key.Using these,.I sshsends a session key which, presumably, only thedaemon can decipher.  After this, both sides start encrypting theirdata with this session key..LPWhen the daemon's host key has been received,.I sshlooks it up in .B $home/lib/keyringand in .BR /sys/lib/ssh/keyring .Ifthe key is found there, and it matches the received key,.I sshis satisfied.  If not,.I sshreports this and offers to add the key to.BR $home/lib/keyring ..LPOver the encrypted channel,.I sshattempts to convince the daemon to accept the callusing the listed authentication protocols(see the.B -Aoption above)..LPThe preferred way to authenticate is a.IR netkey -stylechallenge/response or via a SecurID token..I Sshusers on other systems than Plan 9 should enable \s-2TIS_A\s0uthentication..LPWhen the connection is authenticated, the given command line,(by default, a login shell) is executed on the remote host..sp 1The SSH protocol allows clients to make outgoing TCP calls via the server..I Sshnetestablishes an SSH connection and, rather than execute a remote command,presents the remote server's TCP stack as a network stack(see the discussion of TCP in.IR ip (3))mounted at.I mtpt(default.BR /net ).The.B -Aand.B -carguments are as in.IR ssh ..sp 1.I Scpuses.I sshto copy files from one host to another.  A remote file is identified bya host name, a colon and a file name (no spaces)..I Scpcan copy files from remote hosts and to remote hosts..sp 1.I Sshserveis the server that services.I sshcalls from remote hosts. The .B -Aand.B -coptions set valid authentication methods and ciphersas in.IR ssh ,except that there is no.B rsaauthentication method.Unlike in.IR ssh ,the list is not ordered: the server presents a set and the client makes the choice.The default sets are.B tisand.B blowfish.B rc4.BR 3des .By default, users start with the namespace defined in.BR /lib/namespace .Users in group.B noworldin.B /adm/usersstart with the namespace defined in.BR /lib/namespace.noworld ..I Sshservedoes not provide the TCP forwarding functionality usedby.IR sshnet ,because many Unix clients presentthis capability in an insecure manner..PP.I Ssh_genkeygenerates an RSA key set, writing theprivate key to.IB basename .secretand the public key to.IB basename .public\fR..I Ssh_genkeyalso writesa secret key in the style expected by factotumto.IB basename .secret.factotum\fR.The default .B basenameis .BR /sys/lib/ssh/hostkey ,so running it with no argumentswill generate an RSA key setfor the file server in use..SH FILES.TF /sys/lib/ssh/hostkey.public.TP.B /sys/lib/ssh/hostkey.publicPublic key for the host on which the program runs..TP.B /sys/lib/ssh/hostkey.secretSecret key for the host on which the program runs.  This file mustbe owned and be readable by bootes only..TP.B /sys/lib/ssh/keyringSystem keyring file containing public keys for remote ssh clients and servers..TP.B /usr/\fIuser\fP/lib/keyringPersonal keyring file containing public keys for remote ssh clients andservers..SH SOURCE.B /sys/src/cmd/ssh.SH "SEE ALSO".IR /sys/src/cmd/ssh/RFC*.br.IR factotum (4),.IR authsrv (6)