Man Openssh

Openssh Man Page
Openssh Client Download

The OpenSSH SSH daemon supports SSH protocol 2 only. Each host has a host-specific key, used to identify the host. Whenever a client connects, the daemon responds with its public host key. The client compares the host key against its own database to verify that it has not changed. Forward secrecy is provided through a Diffie-Hellman key agreement. This key agreement results in a shared session key. The rest of the session is encrypted using a symmetric cipher. The client selects the encryption algorithm to use from those offered by the server. Additionally, session integrity is provided through a cryptographic message authentication code (MAC).

Finally, the server and the client enter an authentication dialog. The client tries to authenticate itself using host-based authentication, public key authentication, challenge-response authentication, or password authentication.

If the client successfully authenticates itself, a dialog for preparing the session is entered. At this time the client may request things like allocating a pseudo-tty, forwarding X11 connections, forwarding TCP connections, or forwarding the authentication agent connection over the secure channel.

The OpenSSH SSH client supports SSH protocol 2. The methods available for authentication are: GSSAPI-based authentication, host-based authentication, public key authentication, challenge-response authentication, and password authentication.
From man ssh: /.ssh/identity /.ssh/iddsa /.ssh/idrsa Contains the private key for authentication. These files contain sensitive data and should be readable by the user but not acces- sible by others (read/write/execute). Ssh will simply ignore a private key file if it is accessible by others.

The ssh program on a host receives its configuration from either the command line or from configuration files /.ssh/config and /etc/ssh/sshconfig. Command-line options take precedence over configuration files. The user-specific configuration file /.ssh/config is used next. Finally, the global /etc/ssh/sshconfig file is used. The first obtained value for each configuration parameter will.

After this, the client either requests a shell or execution of a command. The sides then enter session mode. In this mode, either side may send data at any time, and such data is forwarded to/from the shell or command on the server side, and the user terminal in the client side.

When the user program terminates and all forwarded X11 and other connections have been closed, the server sends command exit status to the client, and both sides exit.

openssh-known-hosts

download, filter and merge known_hosts for OpenSSH

update-openssh-knwon-hosts - download, filter and merge known_hosts for OpenSSH

update-openssh-known-hosts manages downloading, filtering and mergeing of ssh_known_hosts files from anywhere into one local file for use by ssh(1).

Openssh Man Page

-f	treat every non-zero exit from download plugin as an error, see EXIT_IGNORE below.

Returns zero on success and anything else on error.

CONFDIR
Configuration directory, defaults to /etc/openssh-known-hosts. Currently there is only a sources subdirectory in it.
PLUGIN_PATH
Plugin search path, defaults to /usr/local/share/openssh-known-hosts/plugins:/usr/share/openssh-known-hosts/plugins.
CACHEDIR
Cache directory, defaults to /var/cache/openssh-known-hosts.
LOCK	Lockfile path, defaults to /var/lock/openssh-known-hosts.
OUTFILE
Output file name, defaults to /var/lib/openssh-known-hosts/ssh_known_hosts

A source definition is shell snippet dropped into CONFDIR/sources/ with a run-parts(8) compliant name. There are two variables not specific to a download plugin:

PLUGIN	name of the download plugin to use, searched for in PLUGIN_PATH.
EXIT_IGNORE
optional space-seperated list of exitcodes which should be ignored. Upon such exit code the previously downloaded version is used.

Download plugins are executables dropped into PLUGIN_PATH and referenced via the PLUGIN variable in the source definition. A plugin gets the variables set in the source definition in its environment. The working directory will be set to the source[aq]s cache directory. Everything a plugin has to do is to create a file named 'new'. 'current' must not be touched but can be used as a hint to skip downloading the same file again. stdout and stderr will be connected to 'log', which will be output on error. Plugins needn[aq]t create 'new' if it would be identical to 'current'.

Openssh Client Download

Place a file foo.filter next to your source definition foo. Each line shall contain a rule consisting of an action, a space and a pattern. The first rule with a matching pattern decides: If the action starts with a, o, p or y (for accept, admit, allow, ok, pass, permit, print, yes, ...) the hostname will be used, otherwise it is discarded. If a key has no hostnames left it is discarded as a whole.

ssh(1), sshd(8), ssh_config(5), curl(1), rsync(1), psql(1), run-parts(8)

Timo Weingärtner <timo>.