ssh-keygen.1 26.5 KB
Newer Older
1
.\"	$OpenBSD: ssh-keygen.1,v 1.150 2018/09/12 06:18:59 djm Exp $
2 3 4 5 6
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
.\"                    All rights reserved
.\"
7 8 9 10 11 12 13
.\" As far as I am concerned, the code I have written for this software
.\" can be used freely for any purpose.  Any derived versions of this
.\" software must be clearly marked as such, and if the derived work is
.\" incompatible with the protocol description in the RFC file, it must be
.\" called by a name other than "ssh" or "Secure Shell".
.\"
.\"
14 15 16
.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
17 18 19 20 21 22 23 24 25
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
26
.\"
27 28 29 30 31 32 33 34 35 36
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37
.\"
38
.Dd $Mdocdate: September 12 2018 $
39 40 41 42
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
.Nm ssh-keygen
43
.Nd authentication key generation, management and conversion
44
.Sh SYNOPSIS
45
.Bk -words
46
.Nm ssh-keygen
47
.Op Fl q
48
.Op Fl b Ar bits
jmc@openbsd.org's avatar
jmc@openbsd.org committed
49
.Op Fl t Cm dsa | ecdsa | ed25519 | rsa
50 51
.Op Fl N Ar new_passphrase
.Op Fl C Ar comment
52
.Op Fl f Ar output_keyfile
53 54 55 56
.Nm ssh-keygen
.Fl p
.Op Fl P Ar old_passphrase
.Op Fl N Ar new_passphrase
57
.Op Fl f Ar keyfile
58
.Nm ssh-keygen
59
.Fl i
60
.Op Fl m Ar key_format
61
.Op Fl f Ar input_keyfile
62
.Nm ssh-keygen
63
.Fl e
64
.Op Fl m Ar key_format
65
.Op Fl f Ar input_keyfile
66 67
.Nm ssh-keygen
.Fl y
68
.Op Fl f Ar input_keyfile
69
.Nm ssh-keygen
70 71 72
.Fl c
.Op Fl P Ar passphrase
.Op Fl C Ar comment
73 74 75
.Op Fl f Ar keyfile
.Nm ssh-keygen
.Fl l
naddy@openbsd.org's avatar
naddy@openbsd.org committed
76
.Op Fl v
djm@openbsd.org's avatar
djm@openbsd.org committed
77
.Op Fl E Ar fingerprint_hash
78 79 80
.Op Fl f Ar input_keyfile
.Nm ssh-keygen
.Fl B
81
.Op Fl f Ar input_keyfile
82
.Nm ssh-keygen
83
.Fl D Ar pkcs11
84
.Nm ssh-keygen
85 86
.Fl F Ar hostname
.Op Fl f Ar known_hosts_file
87
.Op Fl l
88 89 90 91 92 93 94
.Nm ssh-keygen
.Fl H
.Op Fl f Ar known_hosts_file
.Nm ssh-keygen
.Fl R Ar hostname
.Op Fl f Ar known_hosts_file
.Nm ssh-keygen
95 96 97
.Fl r Ar hostname
.Op Fl f Ar input_keyfile
.Op Fl g
98 99
.Nm ssh-keygen
.Fl G Ar output_file
100
.Op Fl v
101 102 103 104 105 106
.Op Fl b Ar bits
.Op Fl M Ar memory
.Op Fl S Ar start_point
.Nm ssh-keygen
.Fl T Ar output_file
.Fl f Ar input_file
107
.Op Fl v
108
.Op Fl a Ar rounds
109 110
.Op Fl J Ar num_lines
.Op Fl j Ar start_line
111
.Op Fl K Ar checkpt
112
.Op Fl W Ar generator
Damien Miller's avatar
Damien Miller committed
113 114 115 116
.Nm ssh-keygen
.Fl s Ar ca_key
.Fl I Ar certificate_identity
.Op Fl h
djm@openbsd.org's avatar
djm@openbsd.org committed
117 118
.Op Fl U
.Op Fl D Ar pkcs11_provider
Damien Miller's avatar
Damien Miller committed
119
.Op Fl n Ar principals
120
.Op Fl O Ar option
Damien Miller's avatar
Damien Miller committed
121
.Op Fl V Ar validity_interval
122
.Op Fl z Ar serial_number
Damien Miller's avatar
Damien Miller committed
123
.Ar
124 125 126
.Nm ssh-keygen
.Fl L
.Op Fl f Ar input_keyfile
127 128
.Nm ssh-keygen
.Fl A
djm@openbsd.org's avatar
djm@openbsd.org committed
129
.Op Fl f Ar prefix_path
130 131 132 133
.Nm ssh-keygen
.Fl k
.Fl f Ar krl_file
.Op Fl u
134 135
.Op Fl s Ar ca_public
.Op Fl z Ar version_number
136 137 138 139 140
.Ar
.Nm ssh-keygen
.Fl Q
.Fl f Ar krl_file
.Ar
141
.Ek
142
.Sh DESCRIPTION
143
.Nm
144
generates, manages and converts authentication keys for
145
.Xr ssh 1 .
146
.Nm
jmc@openbsd.org's avatar
jmc@openbsd.org committed
147
can create keys for use by SSH protocol version 2.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
148
.Pp
149
The type of key to be generated is specified with the
150
.Fl t
151
option.
152 153
If invoked without any arguments,
.Nm
naddy@openbsd.org's avatar
naddy@openbsd.org committed
154
will generate an RSA key.
155
.Pp
156 157 158 159 160 161 162
.Nm
is also used to generate groups for use in Diffie-Hellman group
exchange (DH-GEX).
See the
.Sx MODULI GENERATION
section for details.
.Pp
163 164 165
Finally,
.Nm
can be used to generate and update Key Revocation Lists, and to test whether
166 167
given keys have been revoked by one.
See the
168 169 170
.Sx KEY REVOCATION LISTS
section for details.
.Pp
171
Normally each user wishing to use SSH
172
with public key authentication runs this once to create the authentication
173
key in
174
.Pa ~/.ssh/id_dsa ,
175
.Pa ~/.ssh/id_ecdsa ,
176
.Pa ~/.ssh/id_ed25519
177
or
178
.Pa ~/.ssh/id_rsa .
179
Additionally, the system administrator may use this to generate host keys.
180 181
.Pp
Normally this program generates the key and asks for a file in which
Damien Miller's avatar
Damien Miller committed
182 183
to store the private key.
The public key is stored in a file with the same name but
184
.Dq .pub
Damien Miller's avatar
Damien Miller committed
185 186 187
appended.
The program also asks for a passphrase.
The passphrase may be empty to indicate no passphrase
188
(host keys must have an empty passphrase), or it may be a string of
Damien Miller's avatar
Damien Miller committed
189
arbitrary length.
190 191 192 193
A passphrase is similar to a password, except it can be a phrase with a
series of words, punctuation, numbers, whitespace, or any string of
characters you want.
Good passphrases are 10-30 characters long, are
194
not simple sentences or otherwise easily guessable (English
195
prose has only 1-2 bits of entropy per character, and provides very bad
196 197
passphrases), and contain a mix of upper and lowercase letters,
numbers, and non-alphanumeric characters.
Damien Miller's avatar
Damien Miller committed
198
The passphrase can be changed later by using the
199 200 201
.Fl p
option.
.Pp
Damien Miller's avatar
Damien Miller committed
202
There is no way to recover a lost passphrase.
203 204
If the passphrase is lost or forgotten, a new key must be generated
and the corresponding public key copied to other machines.
205
.Pp
djm@openbsd.org's avatar
djm@openbsd.org committed
206
For keys stored in the newer OpenSSH format,
207
there is also a comment field in the key file that is only for
Damien Miller's avatar
Damien Miller committed
208 209 210
convenience to the user to help identify the key.
The comment can tell what the key is for, or whatever is useful.
The comment is initialized to
211 212 213 214 215
.Dq user@host
when the key is created, but can be changed using the
.Fl c
option.
.Pp
216 217 218
After a key is generated, instructions below detail where the keys
should be placed to be activated.
.Pp
219 220
The options are as follows:
.Bl -tag -width Ds
221
.It Fl A
jmc@openbsd.org's avatar
jmc@openbsd.org committed
222
For each of the key types (rsa, dsa, ecdsa and ed25519)
223
for which host keys
224 225
do not exist, generate the host keys with the default key file path,
an empty passphrase, default bits for the key type, and default comment.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
226
If
djm@openbsd.org's avatar
djm@openbsd.org committed
227
.Fl f
jmc@openbsd.org's avatar
jmc@openbsd.org committed
228
has also been specified, its argument is used as a prefix to the
djm@openbsd.org's avatar
djm@openbsd.org committed
229
default path for the resulting host key files.
230
This is used by system administration scripts to generate new host keys.
231
.It Fl a Ar rounds
232 233
When saving a private key this option specifies the number of KDF
(key derivation function) rounds used.
234 235 236
Higher numbers result in slower passphrase verification and increased
resistance to brute-force password cracking (should the keys be stolen).
.Pp
jmc@openbsd.org's avatar
jmc@openbsd.org committed
237
When screening DH-GEX candidates (using the
238
.Fl T
239 240
command).
This option specifies the number of primality tests to perform.
241 242
.It Fl B
Show the bubblebabble digest of specified private or public key file.
243
.It Fl b Ar bits
Damien Miller's avatar
Damien Miller committed
244
Specifies the number of bits in the key to create.
djm@openbsd.org's avatar
djm@openbsd.org committed
245
For RSA keys, the minimum size is 1024 bits and the default is 2048 bits.
246
Generally, 2048 bits is considered sufficient.
247
DSA keys must be exactly 1024 bits as specified by FIPS 186-2.
248 249
For ECDSA keys, the
.Fl b
250
flag determines the key length by selecting from one of three elliptic
251 252 253
curve sizes: 256, 384 or 521 bits.
Attempting to use bit lengths other than these three values for ECDSA keys
will fail.
sobrado@openbsd.org's avatar
sobrado@openbsd.org committed
254
Ed25519 keys have a fixed length and the
255 256
.Fl b
flag will be ignored.
257 258
.It Fl C Ar comment
Provides a new comment.
259 260 261
.It Fl c
Requests changing the comment in the private and public key files.
The program will prompt for the file containing the private keys, for
262
the passphrase if the key has one, and for the new comment.
263
.It Fl D Ar pkcs11
264 265
Download the RSA public keys provided by the PKCS#11 shared library
.Ar pkcs11 .
266 267 268 269 270
When used in combination with
.Fl s ,
this option indicates that a CA key resides in a PKCS#11 token (see the
.Sx CERTIFICATES
section for details).
djm@openbsd.org's avatar
djm@openbsd.org committed
271 272 273 274 275 276 277 278
.It Fl E Ar fingerprint_hash
Specifies the hash algorithm used when displaying key fingerprints.
Valid options are:
.Dq md5
and
.Dq sha256 .
The default is
.Dq sha256 .
279
.It Fl e
280
This option will read a private or public OpenSSH key file and
281 282 283 284 285
print to stdout the key in one of the formats specified by the
.Fl m
option.
The default export format is
.Dq RFC4716 .
286
This option allows exporting OpenSSH keys for use by other programs, including
287
several commercial SSH implementations.
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305
.It Fl F Ar hostname
Search for the specified
.Ar hostname
in a
.Pa known_hosts
file, listing any occurrences found.
This option is useful to find hashed host names or addresses and may also be
used in conjunction with the
.Fl H
option to print found keys in a hashed format.
.It Fl f Ar filename
Specifies the filename of the key file.
.It Fl G Ar output_file
Generate candidate primes for DH-GEX.
These primes must be screened for
safety (using the
.Fl T
option) before use.
306
.It Fl g
307
Use generic DNS format when printing fingerprint resource records using the
308
.Fl r
309
command.
310 311 312
.It Fl H
Hash a
.Pa known_hosts
313 314 315 316
file.
This replaces all hostnames and addresses with hashed representations
within the specified file; the original content is moved to a file with
a .old suffix.
317 318 319 320 321 322 323 324
These hashes may be used normally by
.Nm ssh
and
.Nm sshd ,
but they do not reveal identifying information should the file's contents
be disclosed.
This option will not modify existing hashed hostnames and is therefore safe
to use on files that mix hashed and non-hashed names.
Damien Miller's avatar
Damien Miller committed
325 326 327 328 329 330
.It Fl h
When signing a key, create a host certificate instead of a user
certificate.
Please see the
.Sx CERTIFICATES
section for details.
331
.It Fl I Ar certificate_identity
Damien Miller's avatar
Damien Miller committed
332 333 334 335
Specify the key identity when signing a public key.
Please see the
.Sx CERTIFICATES
section for details.
336 337
.It Fl i
This option will read an unencrypted private (or public) key file
338 339 340
in the format specified by the
.Fl m
option and print an OpenSSH compatible private
341
(or public) key to stdout.
342 343 344 345
This option allows importing keys from other software, including several
commercial SSH implementations.
The default import format is
.Dq RFC4716 .
346 347 348 349 350 351 352 353 354 355
.It Fl J Ar num_lines
Exit after screening the specified number of lines
while performing DH candidate screening using the
.Fl T
option.
.It Fl j Ar start_line
Start screening at the specified line number
while performing DH candidate screening using the
.Fl T
option.
356 357 358 359 360 361 362 363
.It Fl K Ar checkpt
Write the last line processed to the file
.Ar checkpt
while performing DH candidate screening using the
.Fl T
option.
This will be used to skip lines in the input file that have already been
processed if the job is restarted.
364 365 366 367 368 369
.It Fl k
Generate a KRL file.
In this mode,
.Nm
will generate a KRL file at the location specified via the
.Fl f
370
flag that revokes every key or certificate presented on the command line.
371 372 373 374
Keys/certificates to be revoked may be specified by public key file or
using the format described in the
.Sx KEY REVOCATION LISTS
section.
375
.It Fl L
djm@openbsd.org's avatar
djm@openbsd.org committed
376
Prints the contents of one or more certificates.
377
.It Fl l
378
Show fingerprint of specified public key file.
379 380
For RSA and DSA keys
.Nm
381 382 383
tries to find the matching public key file and prints its fingerprint.
If combined with
.Fl v ,
jmc@openbsd.org's avatar
jmc@openbsd.org committed
384
a visual ASCII art representation of the key is supplied with the
djm@openbsd.org's avatar
djm@openbsd.org committed
385
fingerprint.
386 387 388
.It Fl M Ar memory
Specify the amount of memory to use (in megabytes) when generating
candidate moduli for DH-GEX.
389 390 391 392 393
.It Fl m Ar key_format
Specify a key format for the
.Fl i
(import) or
.Fl e
394
(export) conversion options.
395 396
The supported key formats are:
.Dq RFC4716
397
(RFC 4716/SSH2 public or private key),
398 399 400 401 402 403 404
.Dq PKCS8
(PEM PKCS8 public key)
or
.Dq PEM
(PEM public key).
The default conversion format is
.Dq RFC4716 .
405 406 407 408
Setting a format of
.Dq PEM
when generating or updating a supported private key type will cause the
key to be stored in the legacy PEM private key format.
409 410
.It Fl N Ar new_passphrase
Provides the new passphrase.
Damien Miller's avatar
Damien Miller committed
411 412 413 414 415 416 417
.It Fl n Ar principals
Specify one or more principals (user or host names) to be included in
a certificate when signing a key.
Multiple principals may be specified, separated by commas.
Please see the
.Sx CERTIFICATES
section for details.
418 419
.It Fl O Ar option
Specify a certificate option when signing a key.
Damien Miller's avatar
Damien Miller committed
420
This option may be specified multiple times.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
421
See also the
Damien Miller's avatar
Damien Miller committed
422
.Sx CERTIFICATES
jmc@openbsd.org's avatar
jmc@openbsd.org committed
423
section for further details.
djm@openbsd.org's avatar
djm@openbsd.org committed
424 425
.Pp
At present, no standard options are valid for host keys.
426
The options that are valid for user certificates are:
jmc@openbsd.org's avatar
jmc@openbsd.org committed
427 428
.Pp
.Bl -tag -width Ds -compact
429 430 431 432
.It Ic clear
Clear all enabled permissions.
This is useful for clearing the default set of permissions so permissions may
be added individually.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
.Pp
.It Ic critical : Ns Ar name Ns Op Ns = Ns Ar contents
.It Ic extension : Ns Ar name Ns Op Ns = Ns Ar contents
Includes an arbitrary certificate critical option or extension.
The specified
.Ar name
should include a domain suffix, e.g.\&
.Dq name@example.com .
If
.Ar contents
is specified then it is included as the contents of the extension/option
encoded as a string, otherwise the extension/option is created with no
contents (usually indicating a flag).
Extensions may be ignored by a client or server that does not recognise them,
whereas unknown critical options will cause the certificate to be refused.
.Pp
449 450 451 452 453
.It Ic force-command Ns = Ns Ar command
Forces the execution of
.Ar command
instead of any shell or command specified by the user when
the certificate is used for authentication.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
454
.Pp
Damien Miller's avatar
Damien Miller committed
455 456 457
.It Ic no-agent-forwarding
Disable
.Xr ssh-agent 1
458
forwarding (permitted by default).
jmc@openbsd.org's avatar
jmc@openbsd.org committed
459
.Pp
Damien Miller's avatar
Damien Miller committed
460
.It Ic no-port-forwarding
461
Disable port forwarding (permitted by default).
jmc@openbsd.org's avatar
jmc@openbsd.org committed
462
.Pp
Damien Miller's avatar
Damien Miller committed
463
.It Ic no-pty
464
Disable PTY allocation (permitted by default).
jmc@openbsd.org's avatar
jmc@openbsd.org committed
465
.Pp
Damien Miller's avatar
Damien Miller committed
466 467 468 469
.It Ic no-user-rc
Disable execution of
.Pa ~/.ssh/rc
by
470 471
.Xr sshd 8
(permitted by default).
jmc@openbsd.org's avatar
jmc@openbsd.org committed
472
.Pp
473 474
.It Ic no-x11-forwarding
Disable X11 forwarding (permitted by default).
jmc@openbsd.org's avatar
jmc@openbsd.org committed
475
.Pp
476 477 478 479
.It Ic permit-agent-forwarding
Allows
.Xr ssh-agent 1
forwarding.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
480
.Pp
Damien Miller's avatar
Damien Miller committed
481 482
.It Ic permit-port-forwarding
Allows port forwarding.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
483
.Pp
Damien Miller's avatar
Damien Miller committed
484 485
.It Ic permit-pty
Allows PTY allocation.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
486
.Pp
Damien Miller's avatar
Damien Miller committed
487 488 489 490 491
.It Ic permit-user-rc
Allows execution of
.Pa ~/.ssh/rc
by
.Xr sshd 8 .
jmc@openbsd.org's avatar
jmc@openbsd.org committed
492
.Pp
djm@openbsd.org's avatar
djm@openbsd.org committed
493
.It Ic permit-X11-forwarding
494
Allows X11 forwarding.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
495
.Pp
496
.It Ic source-address Ns = Ns Ar address_list
497
Restrict the source addresses from which the certificate is considered valid.
Damien Miller's avatar
Damien Miller committed
498 499 500 501 502
The
.Ar address_list
is a comma-separated list of one or more address/netmask pairs in CIDR
format.
.El
503 504
.It Fl P Ar passphrase
Provides the (old) passphrase.
505 506
.It Fl p
Requests changing the passphrase of a private key file instead of
Damien Miller's avatar
Damien Miller committed
507 508
creating a new private key.
The program will prompt for the file
509 510
containing the private key, for the old passphrase, and twice for the
new passphrase.
511 512
.It Fl Q
Test whether keys have been revoked in a KRL.
513 514 515
.It Fl q
Silence
.Nm ssh-keygen .
516 517 518
.It Fl R Ar hostname
Removes all keys belonging to
.Ar hostname
519
from a
520 521
.Pa known_hosts
file.
522
This option is useful to delete hashed hosts (see the
523 524
.Fl H
option above).
525 526 527 528
.It Fl r Ar hostname
Print the SSHFP fingerprint resource record named
.Ar hostname
for the specified public key file.
529 530
.It Fl S Ar start
Specify start point (in hex) when generating candidate moduli for DH-GEX.
Damien Miller's avatar
Damien Miller committed
531 532 533 534 535
.It Fl s Ar ca_key
Certify (sign) a public key using the specified CA key.
Please see the
.Sx CERTIFICATES
section for details.
536 537 538
.Pp
When generating a KRL,
.Fl s
539
specifies a path to a CA public key file used to revoke certificates directly
540 541 542 543
by key ID or serial number.
See the
.Sx KEY REVOCATION LISTS
section for details.
544 545 546 547
.It Fl T Ar output_file
Test DH group exchange candidate primes (generated using the
.Fl G
option) for safety.
jmc@openbsd.org's avatar
jmc@openbsd.org committed
548
.It Fl t Cm dsa | ecdsa | ed25519 | rsa
549 550
Specifies the type of key to create.
The possible values are
551
.Dq dsa ,
552 553
.Dq ecdsa ,
.Dq ed25519 ,
554
or
jmc@openbsd.org's avatar
jmc@openbsd.org committed
555
.Dq rsa .
djm@openbsd.org's avatar
djm@openbsd.org committed
556 557 558 559 560 561 562 563
.It Fl U
When used in combination with
.Fl s ,
this option indicates that a CA key resides in a
.Xr ssh-agent 1 .
See the
.Sx CERTIFICATES
section for more information.
564 565 566 567
.It Fl u
Update a KRL.
When specified with
.Fl k ,
568
keys listed via the command line are added to the existing KRL rather than
569
a new KRL being created.
Damien Miller's avatar
Damien Miller committed
570 571 572 573 574
.It Fl V Ar validity_interval
Specify a validity interval when signing a certificate.
A validity interval may consist of a single time, indicating that the
certificate is valid beginning now and expiring at that time, or may consist
of two times separated by a colon to indicate an explicit time interval.
575 576 577 578
.Pp
The start time may be specified as the string
.Dq always
to indicate the certificate has no specified start time,
579
a date in YYYYMMDD format, a time in YYYYMMDDHHMM[SS] format,
580 581
a relative time (to the current time) consisting of a minus sign followed by
an interval in the format described in the
582
TIME FORMATS section of
583
.Xr sshd_config 5 .
584
.Pp
585
The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMM[SS] time,
586 587 588
a relative time starting with a plus character or the string
.Dq forever
to indicate that the certificate has no expirty date.
Damien Miller's avatar
Damien Miller committed
589 590 591 592 593 594 595 596 597 598
.Pp
For example:
.Dq +52w1d
(valid from now to 52 weeks and one day from now),
.Dq -4w:+4w
(valid from four weeks ago to four weeks from now),
.Dq 20100101123000:20110101123000
(valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011),
.Dq -1d:20110101
(valid from yesterday to midnight, January 1st, 2011).
599 600
.Dq -1m:forever
(valid from one minute ago and never expiring).
601 602 603 604 605 606 607 608 609 610
.It Fl v
Verbose mode.
Causes
.Nm
to print debugging messages about its progress.
This is helpful for debugging moduli generation.
Multiple
.Fl v
options increase the verbosity.
The maximum is 3.
611 612 613 614 615
.It Fl W Ar generator
Specify desired generator when testing candidate moduli for DH-GEX.
.It Fl y
This option will read a private
OpenSSH format file and print an OpenSSH public key to stdout.
616 617 618 619
.It Fl z Ar serial_number
Specifies a serial number to be embedded in the certificate to distinguish
this certificate from others from the same CA.
The default serial number is zero.
620 621 622 623
.Pp
When generating a KRL, the
.Fl z
flag is used to specify a KRL version number.
624
.El
625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641
.Sh MODULI GENERATION
.Nm
may be used to generate groups for the Diffie-Hellman Group Exchange
(DH-GEX) protocol.
Generating these groups is a two-step process: first, candidate
primes are generated using a fast, but memory intensive process.
These candidate primes are then tested for suitability (a CPU-intensive
process).
.Pp
Generation of primes is performed using the
.Fl G
option.
The desired length of the primes may be specified by the
.Fl b
option.
For example:
.Pp
642
.Dl # ssh-keygen -G moduli-2048.candidates -b 2048
643 644 645 646 647 648 649
.Pp
By default, the search for primes begins at a random point in the
desired length range.
This may be overridden using the
.Fl S
option, which specifies a different start point (in hex).
.Pp
650
Once a set of candidates have been generated, they must be screened for
651 652 653 654 655 656 657 658 659 660 661
suitability.
This may be performed using the
.Fl T
option.
In this mode
.Nm
will read candidates from standard input (or a file specified using the
.Fl f
option).
For example:
.Pp
662
.Dl # ssh-keygen -T moduli-2048 -f moduli-2048.candidates
663 664 665 666 667 668 669 670 671 672
.Pp
By default, each candidate will be subjected to 100 primality tests.
This may be overridden using the
.Fl a
option.
The DH generator value will be chosen automatically for the
prime under consideration.
If a specific generator is desired, it may be requested using the
.Fl W
option.
673
Valid generator values are 2, 3, and 5.
674 675
.Pp
Screened DH groups may be installed in
676
.Pa /etc/ssh/moduli .
677 678
It is important that this file contains moduli of a range of bit lengths and
that both ends of a connection share common moduli.
Damien Miller's avatar
Damien Miller committed
679 680 681 682 683
.Sh CERTIFICATES
.Nm
supports signing of keys to produce certificates that may be used for
user or host authentication.
Certificates consist of a public key, some identity information, zero or
684
more principal (user or host) names and a set of options that
Damien Miller's avatar
Damien Miller committed
685 686 687 688 689 690 691 692 693 694
are signed by a Certification Authority (CA) key.
Clients or servers may then trust only the CA key and verify its signature
on a certificate rather than trusting many user/host keys.
Note that OpenSSH certificates are a different, and much simpler, format to
the X.509 certificates used in
.Xr ssl 8 .
.Pp
.Nm
supports two types of certificates: user and host.
User certificates authenticate users to servers, whereas host certificates
695 696
authenticate server hosts to users.
To generate a user certificate:
Damien Miller's avatar
Damien Miller committed
697 698 699 700
.Pp
.Dl $ ssh-keygen -s /path/to/ca_key -I key_id /path/to/user_key.pub
.Pp
The resultant certificate will be placed in
701
.Pa /path/to/user_key-cert.pub .
Damien Miller's avatar
Damien Miller committed
702 703 704 705 706 707 708
A host certificate requires the
.Fl h
option:
.Pp
.Dl $ ssh-keygen -s /path/to/ca_key -I key_id -h /path/to/host_key.pub
.Pp
The host certificate will be output to
709
.Pa /path/to/host_key-cert.pub .
710 711 712 713 714 715 716 717
.Pp
It is possible to sign using a CA key stored in a PKCS#11 token by
providing the token library using
.Fl D
and identifying the CA key by providing its public half as an argument
to
.Fl s :
.Pp
naddy@openbsd.org's avatar
naddy@openbsd.org committed
718
.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
719
.Pp
djm@openbsd.org's avatar
djm@openbsd.org committed
720 721 722 723 724 725 726 727
Similarly, it is possible for the CA key to be hosted in a
.Xr ssh-agent 1 .
This is indicated by the
.Fl U
flag and, again, the CA key must be identified by its public half.
.Pp
.Dl $ ssh-keygen -Us ca_key.pub -I key_id user_key.pub
.Pp
728
In all cases,
Damien Miller's avatar
Damien Miller committed
729 730 731 732 733 734 735 736 737 738
.Ar key_id
is a "key identifier" that is logged by the server when the certificate
is used for authentication.
.Pp
Certificates may be limited to be valid for a set of principal (user/host)
names.
By default, generated certificates are valid for all users or hosts.
To generate a certificate for a specified set of principals:
.Pp
.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
naddy@openbsd.org's avatar
naddy@openbsd.org committed
739
.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain host_key.pub"
Damien Miller's avatar
Damien Miller committed
740 741
.Pp
Additional limitations on the validity and use of user certificates may
742
be specified through certificate options.
743
A certificate option may disable features of the SSH session, may be
Damien Miller's avatar
Damien Miller committed
744 745
valid only when presented from particular source addresses or may
force the use of a specific command.
746
For a list of valid certificate options, see the documentation for the
Damien Miller's avatar
Damien Miller committed
747 748 749 750 751 752 753 754 755
.Fl O
option above.
.Pp
Finally, certificates may be defined with a validity lifetime.
The
.Fl V
option allows specification of certificate start and end times.
A certificate that is presented at a time outside this range will not be
considered valid.
756 757 758
By default, certificates are valid from
.Ux
Epoch to the distant future.
Damien Miller's avatar
Damien Miller committed
759 760 761 762 763 764 765
.Pp
For certificates to be used for user or host authentication, the CA
public key must be trusted by
.Xr sshd 8
or
.Xr ssh 1 .
Please refer to those manual pages for details.
766 767 768 769
.Sh KEY REVOCATION LISTS
.Nm
is able to manage OpenSSH format Key Revocation Lists (KRLs).
These binary files specify keys or certificates to be revoked using a
770
compact format, taking as little as one bit per certificate if they are being
771 772 773 774 775
revoked by serial number.
.Pp
KRLs may be generated using the
.Fl k
flag.
776
This option reads one or more files from the command line and generates a new
777 778 779 780 781 782 783 784 785 786 787 788 789 790
KRL.
The files may either contain a KRL specification (see below) or public keys,
listed one per line.
Plain public keys are revoked by listing their hash or contents in the KRL and
certificates revoked by serial number or key ID (if the serial is zero or
not available).
.Pp
Revoking keys using a KRL specification offers explicit control over the
types of record used to revoke keys and may be used to directly revoke
certificates by serial number or key ID without having the complete original
certificate on hand.
A KRL specification consists of lines containing one of the following directives
followed by a colon and some directive-specific information.
.Bl -tag -width Ds
791
.It Cm serial : Ar serial_number Ns Op - Ns Ar serial_number
792
Revokes a certificate with the specified serial number.
793
Serial numbers are 64-bit values, not including zero and may be expressed
794 795 796 797 798
in decimal, hex or octal.
If two serial numbers are specified separated by a hyphen, then the range
of serial numbers including and between each is revoked.
The CA key must have been specified on the
.Nm
799
command line using the
800 801 802 803 804 805
.Fl s
option.
.It Cm id : Ar key_id
Revokes a certificate with the specified key ID string.
The CA key must have been specified on the
.Nm
806
command line using the
807 808 809 810
.Fl s
option.
.It Cm key : Ar public_key
Revokes the specified key.
811
If a certificate is listed, then it is revoked as a plain public key.
812
.It Cm sha1 : Ar public_key
813 814 815 816 817 818
Revokes the specified key by including its SHA1 hash in the KRL.
.It Cm sha256 : Ar public_key
Revokes the specified key by including its SHA256 hash in the KRL.
KRLs that revoke keys by SHA256 hash are not supported by OpenSSH versions
prior to 7.9.
.It Cm hash : Ar fingerprint
819
Revokes a key using a fingerprint hash, as obtained from a
820 821 822 823 824 825 826
.Xr sshd 8
authentication log message or the
.Nm
.Fl l
flag.
Only SHA256 fingerprints are supported here and resultant KRLs are
not supported by OpenSSH versions prior to 7.9.
827 828 829 830 831 832
.El
.Pp
KRLs may be updated using the
.Fl u
flag in addition to
.Fl k .
833
When this option is specified, keys listed via the command line are merged into
834 835 836 837 838 839
the KRL, adding to those already there.
.Pp
It is also possible, given a KRL, to test whether it revokes a particular key
(or keys).
The
.Fl Q
jmc@openbsd.org's avatar
jmc@openbsd.org committed
840
flag will query an existing KRL, testing each key specified on the command line.
841
If any key listed on the command line has been revoked (or an error encountered)
842 843 844 845
then
.Nm
will exit with a non-zero exit status.
A zero exit status will only be returned if no key was revoked.
846
.Sh FILES
847
.Bl -tag -width Ds -compact
848
.It Pa ~/.ssh/id_dsa
849
.It Pa ~/.ssh/id_ecdsa
850
.It Pa ~/.ssh/id_ed25519
851
.It Pa ~/.ssh/id_rsa
naddy@openbsd.org's avatar
naddy@openbsd.org committed
852
Contains the DSA, ECDSA, Ed25519 or RSA
853
authentication identity of the user.
854 855 856
This file should not be readable by anyone but the user.
It is possible to
specify a passphrase when generating the key; that passphrase will be
857
used to encrypt the private part of this file using 128-bit AES.
858 859 860
This file is not automatically accessed by
.Nm
but it is offered as the default file for the private key.
861
.Xr ssh 1
862
will read this file when a login attempt is made.
863 864 865
.Pp
.It Pa ~/.ssh/id_dsa.pub
.It Pa ~/.ssh/id_ecdsa.pub
866
.It Pa ~/.ssh/id_ed25519.pub
867
.It Pa ~/.ssh/id_rsa.pub
naddy@openbsd.org's avatar
naddy@openbsd.org committed
868
Contains the DSA, ECDSA, Ed25519 or RSA
869
public key for authentication.
870
The contents of this file should be added to
871
.Pa ~/.ssh/authorized_keys
872
on all machines
873
where the user wishes to log in using public key authentication.
874
There is no need to keep the contents of this file secret.
875
.Pp
876
.It Pa /etc/ssh/moduli
877 878 879
Contains Diffie-Hellman groups used for DH-GEX.
The file format is described in
.Xr moduli 5 .
880
.El
881 882 883
.Sh SEE ALSO
.Xr ssh 1 ,
.Xr ssh-add 1 ,
Damien Miller's avatar
Damien Miller committed
884
.Xr ssh-agent 1 ,
885
.Xr moduli 5 ,
Ben Lindstrom's avatar
Ben Lindstrom committed
886
.Xr sshd 8
887
.Rs
888 889 890
.%R RFC 4716
.%T "The Secure Shell (SSH) Public Key File Format"
.%D 2006
891
.Re
892 893 894 895 896 897 898 899 900
.Sh AUTHORS
OpenSSH is a derivative of the original and free
ssh 1.2.12 release by Tatu Ylonen.
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
Theo de Raadt and Dug Song
removed many bugs, re-added newer features and
created OpenSSH.
Markus Friedl contributed the support for SSH
protocol versions 1.5 and 2.0.