Renamed open* -> * at request of Theo de Raadt <deraadt@cvs.openbsd.org>

12 files changed, 71 insertions, 2341 deletions

diff --git a/Makefile.in b/Makefile.in
index 2601404c..16bb16da 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -7,9 +7,9 @@ libdir=@libdir@
 CC=@CC@
 OPT_FLAGS=-g
 CFLAGS=$(OPT_FLAGS) -Wall -DETCDIR=\"@sysconfdir@\" @DEFS@
-TARGETS=bin/libopenssh.a bin/openssh bin/opensshd bin/openssh-add bin/openssh-keygen bin/openssh-agent bin/openscp
+TARGETS=bin/libssh.a bin/ssh bin/sshd bin/ssh-add bin/ssh-keygen bin/ssh-agent bin/scp
 LFLAGS=-L./bin
-LIBS=-lopenssh @LIBS@
+LIBS=-lssh @LIBS@
 AR=@AR@
 RANLIB=@RANLIB@
 
@@ -23,32 +23,32 @@ OBJS=	authfd.o authfile.o auth-passwd.o auth-rhosts.o auth-rh-rsa.o \
 
 all: $(OBJS) $(TARGETS)
 
-bin/libopenssh.a: authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o compat.o compress.o crc32.o deattack.o hostfile.o match.o mpaux.o nchan.o packet.o readpass.o rsa.o tildexpand.o ttymodes.o uidswap.o xmalloc.o helper.o rc4.o mktemp.o strlcpy.o
+bin/libssh.a: authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o compat.o compress.o crc32.o deattack.o hostfile.o match.o mpaux.o nchan.o packet.o readpass.o rsa.o tildexpand.o ttymodes.o uidswap.o xmalloc.o helper.o rc4.o mktemp.o strlcpy.o
 	[ -d bin ] || mkdir bin
 	$(AR) rv $@ $^
 	$(RANLIB) $@
 
-bin/openssh: ssh.o sshconnect.o log-client.o readconf.o clientloop.o
+bin/ssh: ssh.o sshconnect.o log-client.o readconf.o clientloop.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
-bin/opensshd:	sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o
+bin/sshd:	sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o log-server.o login.o servconf.o serverloop.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
-bin/openscp:	scp.o
+bin/scp:	scp.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
-bin/openssh-add: ssh-add.o log-client.o
+bin/ssh-add: ssh-add.o log-client.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
-bin/openssh-agent: ssh-agent.o log-client.o
+bin/ssh-agent: ssh-agent.o log-client.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
-bin/openssh-keygen: ssh-keygen.o log-client.o
+bin/ssh-keygen: ssh-keygen.o log-client.o
 	[ -d bin ] || mkdir bin
 	$(CC) -o $@ $^ $(LFLAGS) $(LIBS) 
 
@@ -59,13 +59,13 @@ install:
 	install -d $(bindir)
 	install -d $(sbindir)
 	install -d $(libdir)
-	install -c bin/openssh $(bindir)/openssh
-	install -c bin/openscp $(bindir)/openscp
-	install -c bin/openssh-add $(bindir)/openssh-add
-	install -c bin/openssh-agent $(bindir)/openssh-agent
-	install -c bin/openssh-keygen $(bindir)/openssh-keygen
-	install -c bin/opensshd $(sbindir)/opensshd
-	install -c bin/libopenssh.a $(libdir)/libopenssh.a
+	install -c bin/ssh $(bindir)/ssh
+	install -c bin/scp $(bindir)/scp
+	install -c bin/ssh-add $(bindir)/ssh-add
+	install -c bin/ssh-agent $(bindir)/ssh-agent
+	install -c bin/ssh-keygen $(bindir)/ssh-keygen
+	install -c bin/sshd $(sbindir)/sshd
+	install -c bin/libssh.a $(libdir)/libssh.a
 
 distclean: clean
 	rm -f Makefile config.h *~
diff --git a/openscp.1 b/openscp.1
deleted file mode 100644
index 6601ac65..00000000
--- a/openscp.1
+++ /dev/null
@@ -1,110 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" scp.1
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sun May  7 00:14:37 1995 ylo
-.\"
-.\" $Id: openscp.1,v 1.1 1999/10/28 04:03:14 damien Exp $
-.\"
-.Dd September 25, 1999
-.Dt SCP 1
-.Os
-.Sh NAME
-.Nm scp
-.Nd secure copy (remote file copy program)
-.Sh SYNOPSIS
-.Nm scp
-.Op Fl pqrvC
-.Op Fl P Ar port
-.Op Fl c Ar cipher
-.Op Fl i Ar identity_file
-.Sm off
-.Oo
-.Op Ar user@
-.Ar host1 No :
-.Oc Ns Ar file1
-.Sm on
-.Op Ar ...
-.Sm off
-.Oo
-.Op Ar user@
-.Ar host2 No :
-.Oc Ar file2
-.Sm on
-.Sh DESCRIPTION 
-.Nm
-copies files between hosts on a network.  It uses
-.Xr ssh 1
-for data transfer, and uses the same authentication and provides the
-same security as
-.Xr ssh 1 .
-Unlike
-.Xr rcp 1 ,
-.Nm
-will ask for passwords or passphrases if they are needed for
-authentication.
-.Pp
-Any file name may contain a host and user specification to indicate
-that the file is to be copied to/from that host.  Copies between two
-remote hosts are permitted.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl c Ar cipher
-Selects the cipher to use for encrypting the data transfer.  This
-option is directly passed to
-.Xr ssh 1 .
-.It Fl i Ar identity_file
-Selects the file from which the identity (private key) for RSA
-authentication is read.  This option is directly passed to
-.Xr ssh 1 .
-.It Fl p
-Preserves modification times, access times, and modes from the
-original file.
-.It Fl r
-Recursively copy entire directories.
-.It Fl v
-Verbose mode.  Causes
-.Nm
-and 
-.Xr ssh 1
-to print debugging messages about their progress.  This is helpful in
-debugging connection, authentication, and configuration problems.
-.It Fl B
-Selects batch mode (prevents asking for passwords or passphrases).
-.It Fl q
-Disables the progress meter.
-.It Fl C
-Compression enable.  Passes the
-.Fl C
-flag to
-.Xr ssh 1
-to enable compression.
-.It Fl P Ar port
-Specifies the port to connect to on the remote host.  Note that this
-option is written with a capital
-.Sq P ,
-because
-.Fl p
-is already reserved for preserving the times and modes of the file in
-.Xr rcp 1 .
-.Sh AUTHORS
-Timo Rinne <tri@iki.fi> and Tatu Ylonen <ylo@cs.hut.fi>
-.Sh HISTORY
-.Nm
-is based on the
-.Xr rcp 1
-program in BSD source code from the Regents of the University of
-California.
-.Sh SEE ALSO
-.Xr rcp 1 ,
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8
diff --git a/openssh-add.1 b/openssh-add.1
deleted file mode 100644
index fd0861fe..00000000
--- a/openssh-add.1
+++ /dev/null
@@ -1,116 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" ssh-add.1
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sat Apr 22 23:55:14 1995 ylo
-.\"
-.\" $Id: openssh-add.1,v 1.1 1999/10/28 04:03:14 damien Exp $
-.\"
-.Dd September 25, 1999
-.Dt SSH-ADD 1
-.Os
-.Sh NAME
-.Nm ssh-add
-.Nd adds identities for the authentication agent
-.Sh SYNOPSIS
-.Nm ssh-add
-.Op Fl ldD
-.Op Ar
-.Sh DESCRIPTION 
-.Nm
-adds identities to the authentication agent,
-.Xr ssh-agent 1 .
-When run without arguments, it adds the file
-.Pa $HOME/.ssh/identity .
-Alternative file names can be given on the
-command line.  If any file requires a passphrase,
-.Nm
-asks for the passphrase from the user. 
-The Passphrase it is read from the user's tty.  
-.Pp
-The authentication agent must be running and must be an ancestor of
-the current process for
-.Nm
-to work.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl l
-Lists all identities currently represented by the agent.
-.It Fl d
-Instead of adding the identity, removes the identity from the agent.
-.It Fl D
-Deletes all identities from the agent.
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.Pa $HOME/.ssh/identity
-Contains the RSA authentication identity of the user.  This file
-should not be readable by anyone but the user.
-Note that
-.Nm
-ignores this file if it is accessible by others.
-It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file.  This is the
-default file added by
-.Nm
-when no other files have been specified.
-.Pp
-If
-.Nm
-needs a passphrase, it will read the passphrase from the current
-terminal if it was run from a terminal.  If
-.Nm
-does not have a terminal associated with it but
-.Ev DISPLAY
-is set, it
-will open an X11 window to read the passphrase.  This is particularly
-useful when calling
-.Nm
-from a
-.Pa .Xsession
-or related script.  (Note that on some machines it
-may be necessary to redirect the input from
-.Pa /dev/null
-to make this work.)
-.Sh AUTHOR
-Tatu Ylonen <ylo@cs.hut.fi>
-.Pp
-OpenSSH
-is a derivative of the original (free) ssh 1.2.12 release, but with bugs
-removed and newer features re-added.   Rapidly after the 1.2.12 release,
-newer versions bore successively more restrictive licenses.  This version
-of OpenSSH
-.Bl -bullet
-.It
-has all components of a restrictive nature (ie. patents, see
-.Xr ssl 8 )
-directly removed from the source code; any licensed or patented components
-are chosen from
-external libraries.
-.It
-has been updated to support ssh protocol 1.5.
-.It
-contains added support for 
-.Xr kerberos 8
-authentication and ticket passing.
-.It
-supports one-time password authentication with
-.Xr skey 1 .
-.El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8 ,
-.Xr ssl 8
diff --git a/openssh-agent.1 b/openssh-agent.1
deleted file mode 100644
index df061df8..00000000
--- a/openssh-agent.1
+++ /dev/null
@@ -1,124 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" ssh-agent.1
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sat Apr 23 20:10:43 1995 ylo
-.\"
-.\" $Id: openssh-agent.1,v 1.1 1999/10/28 04:03:14 damien Exp $
-.\"
-.Dd September 25, 1999
-.Dt SSH-AGENT 1
-.Os
-.Sh NAME
-.Nm ssh-agent
-.Nd authentication agent
-.Sh SYNOPSIS
-.Nm ssh-agent 
-.Ar command
-.Sh DESCRIPTION 
-.Nm
-is a program to hold authentication private keys.  The
-idea is that
-.Nm
-is started in the beginning of an X-session or a login session, and
-all other windows or programs are started as children of the ssh-agent
-program (the
-.Ar command
-normally starts X or is the user shell).  Programs started under
-the agent inherit a connection to the agent, and the agent is
-automatically used for RSA authentication when logging to other
-machines using
-.Xr ssh 1 .
-.Pp
-The agent initially does not have any private keys.  Keys are added
-using
-.Xr ssh-add 1 .
-When executed without arguments, 
-.Xr ssh-add 1
-adds the 
-.Pa $HOME/.ssh/identity
-file.  If the identity has a passphrase, 
-.Xr ssh-add 1
-asks for the passphrase (using a small X11 application if running
-under X11, or from the terminal if running without X).  It then sends
-the identity to the agent.  Several identities can be stored in the
-agent; the agent can automatically use any of these identities.
-.Ic ssh-add -l
-displays the identities currently held by the agent.
-.Pp
-The idea is that the agent is run in the user's local PC, laptop, or
-terminal.  Authentication data need not be stored on any other
-machine, and authentication passphrases never go over the network.
-However, the connection to the agent is forwarded over SSH
-remote logins, and the user can thus use the privileges given by the
-identities anywhere in the network in a secure way.
-.Pp
-A connection to the agent is inherited by child programs:
-A unix-domain socket is created
-.Pq Pa /tmp/ssh-XXXX/agent.<pid> ,
-and the name of this socket is stored in the
-.Ev SSH_AUTH_SOCK
-environment
-variable.  The socket is made accessible only to the current user.
-This method is easily abused by root or another instance of the same
-user.
-.Pp
-The agent exits automatically when the command given on the command
-line terminates.
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
-Contains the RSA authentication identity of the user.  This file
-should not be readable by anyone but the user.  It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file.  This file
-is not used by
-.Nm
-but is normally added to the agent using
-.Xr ssh-add 1
-at login time.
-.It Pa /tmp/ssh-XXXX/agent.<pid> ,
-Unix-domain sockets used to contain the connection to the
-authentication agent.  These sockets should only be readable by the
-owner.  The sockets should get automatically removed when the agent
-exits.
-.Sh AUTHOR
-Tatu Ylonen <ylo@cs.hut.fi>
-.Pp
-OpenSSH
-is a derivative of the original (free) ssh 1.2.12 release, but with bugs
-removed and newer features re-added.   Rapidly after the 1.2.12 release,
-newer versions bore successively more restrictive licenses.  This version
-of OpenSSH
-.Bl -bullet
-.It
-has all components of a restrictive nature (ie. patents, see
-.Xr ssl 8 )
-directly removed from the source code; any licensed or patented components
-are chosen from
-external libraries.
-.It
-has been updated to support ssh protocol 1.5.
-.It
-contains added support for 
-.Xr kerberos 8
-authentication and ticket passing.
-.It
-supports one-time password authentication with
-.Xr skey 1 .
-.El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8 ,
-.Xr ssl 8
diff --git a/openssh-keygen.1 b/openssh-keygen.1
deleted file mode 100644
index c135be44..00000000
--- a/openssh-keygen.1
+++ /dev/null
@@ -1,155 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" ssh-keygen.1
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sat Apr 22 23:55:14 1995 ylo
-.\"
-.\" $Id: openssh-keygen.1,v 1.1 1999/10/28 04:03:14 damien Exp $
-.\"
-.Dd September 25, 1999
-.Dt SSH-KEYGEN 1
-.Os
-.Sh NAME
-.Nm ssh-keygen
-.Nd authentication key generation
-.Sh SYNOPSIS
-.Nm ssh-keygen
-.Op Fl q
-.Op Fl b Ar bits
-.Op Fl N Ar new_passphrase
-.Op Fl C Ar comment
-.Nm ssh-keygen
-.Fl p
-.Op Fl P Ar old_passphrase
-.Op Fl N Ar new_passphrase
-.Nm ssh-keygen
-.Fl c
-.Op Fl P Ar passphrase
-.Op Fl C Ar comment
-.Sh DESCRIPTION 
-.Nm
-generates and manages authentication keys for 
-.Xr ssh 1 .
-Normally each user wishing to use SSH
-with RSA authentication runs this once to create the authentication
-key in
-.Pa $HOME/.ssh/identity .
-Additionally, the system administrator may use this to generate host keys.
-.Pp
-Normally this program generates the key and asks for a file in which
-to store the private key.  The public key is stored in a file with the
-same name but
-.Dq .pub
-appended.  The program also asks for a
-passphrase.  The passphrase may be empty to indicate no passphrase
-(host keys must have empty passphrase), or it may be a string of
-arbitrary length.  Good passphrases are 10-30 characters long and are
-not simple sentences or otherwise easily guessable (English
-prose has only 1-2 bits of entropy per word, and provides very bad
-passphrases).  The passphrase can be changed later by using the
-.Fl p
-option.
-.Pp
-There is no way to recover a lost passphrase.  If the passphrase is
-lost or forgotten, you will have to generate a new key and copy the
-corresponding public key to other machines.
-.Pp
-There is also a comment field in the key file that is only for
-convenience to the user to help identify the key.  The comment can
-tell what the key is for, or whatever is useful.  The comment is
-initialized to
-.Dq user@host
-when the key is created, but can be changed using the
-.Fl c
-option.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl b Ar bits
-Specifies the number of bits in the key to create.  Minimum is 512
-bits.  Generally 1024 bits is considered sufficient, and key sizes
-above that no longer improve security but make things slower.  The
-default is 1024 bits.
-.It Fl c
-Requests changing the comment in the private and public key files.
-The program will prompt for the file containing the private keys, for
-passphrase if the key has one, and for the new comment.
-.It Fl p
-Requests changing the passphrase of a private key file instead of
-creating a new private key.  The program will prompt for the file
-containing the private key, for the old passphrase, and twice for the
-new passphrase.
-.It Fl q
-Silence
-.Nm ssh-keygen .
-Used by
-.Pa /etc/rc
-when creating a new key.
-.It Fl C Ar comment
-Provides the new comment.
-.It Fl N Ar new_passphrase
-Provides the new passphrase.
-.It Fl P Ar passphrase
-Provides the (old) passphrase.
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/random_seed
-Used for seeding the random number generator.  This file should not be
-readable by anyone but the user.  This file is created the first time
-the program is run, and is updated every time.
-.It Pa $HOME/.ssh/identity
-Contains the RSA authentication identity of the user.  This file
-should not be readable by anyone but the user.  It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file using 3DES.  This file
-is not automatically accessed by
-.Nm
-but it is offered as the default file for the private key.
-.It Pa $HOME/.ssh/identity.pub
-Contains the public key for authentication.  The contents of this file
-should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where you wish to log in using RSA authentication.  There is no
-need to keep the contents of this file secret.
-.Sh AUTHOR
-Tatu Ylonen <ylo@cs.hut.fi>
-.Pp
-OpenSSH
-is a derivative of the original (free) ssh 1.2.12 release, but with bugs
-removed and newer features re-added.   Rapidly after the 1.2.12 release,
-newer versions bore successively more restrictive licenses.  This version
-of OpenSSH
-.Bl -bullet
-.It
-has all components of a restrictive nature (ie. patents, see
-.Xr ssl 8 )
-directly removed from the source code; any licensed or patented components
-are chosen from
-external libraries.
-.It
-has been updated to support ssh protocol 1.5.
-.It
-contains added support for 
-.Xr kerberos 8
-authentication and ticket passing.
-.It
-supports one-time password authentication with
-.Xr skey 1 .
-.El
-.Pp
-The libraries described in
-.Xr ssl 8
-are required for proper operation.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1,
-.Xr sshd 8 ,
-.Xr ssl 8
diff --git a/openssh.1 b/openssh.1
deleted file mode 100644
index 21a4e63c..00000000
--- a/openssh.1
+++ /dev/null
@@ -1,966 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" ssh.1.in
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sat Apr 22 21:55:14 1995 ylo
-.\"
-.\" $Id: openssh.1,v 1.1 1999/10/28 04:03:14 damien Exp $
-.\"
-.Dd September 25, 1999
-.Dt SSH 1
-.Os
-.Sh NAME
-.Nm ssh
-.Nd OpenSSH secure shell client (remote login program)
-.Sh SYNOPSIS
-.Nm ssh
-.Op Fl l Ar login_name
-.Op Ar hostname | user@hostname
-.Op Ar command
-.Pp
-.Nm ssh
-.Op Fl afgknqtvxCPX
-.Op Fl c Ar blowfish | 3des
-.Op Fl e Ar escape_char
-.Op Fl i Ar identity_file
-.Op Fl l Ar login_name
-.Op Fl o Ar option
-.Op Fl p Ar port
-.Oo Fl L Xo
-.Sm off
-.Ar host :
-.Ar port :
-.Ar hostport
-.Sm on
-.Xc
-.Oc
-.Oo Fl R Xo
-.Sm off
-.Ar host :
-.Ar port :
-.Ar hostport
-.Sm on
-.Xc
-.Oc
-.Op Ar hostname | user@hostname
-.Op Ar command
-.Sh DESCRIPTION 
-.Nm
-(Secure Shell) is a program for logging into a remote machine and for
-executing commands on a remote machine.  It is intended to replace
-rlogin and rsh, and provide secure encrypted communications between
-two untrusted hosts over an insecure network.  X11 connections and
-arbitrary TCP/IP ports can also be forwarded over the secure channel.
-.Pp
-.Nm
-connects and logs into the specified 
-.Ar hostname .
-The user must prove
-his/her identity to the remote machine using one of several methods.
-.Pp
-First, if the machine the user logs in from is listed in
-.Pa /etc/hosts.equiv
-or
-.Pa /etc/openssh/shosts.equiv
-on the remote machine, and the user names are
-the same on both sides, the user is immediately permitted to log in.
-Second, if 
-.Pa \&.rhosts
-or
-.Pa \&.shosts
-exists in the user's home directory on the
-remote machine and contains a line containing the name of the client
-machine and the name of the user on that machine, the user is
-permitted to log in.  This form of authentication alone is normally not
-allowed by the server because it is not secure.
-.Pp
-The second (and primary) authentication method is the
-.Pa rhosts
-or
-.Pa hosts.equiv
-method combined with RSA-based host authentication.  It
-means that if the login would be permitted by
-.Pa \&.rhosts ,
-.Pa \&.shosts ,
-.Pa /etc/hosts.equiv ,
-or
-.Pa /etc/openssh/shosts.equiv ,
-and if additionally the server can verify the client's
-host key (see 
-.Pa /etc/openssh/ssh_known_hosts
-in the
-.Sx FILES
-section), only then login is
-permitted.  This authentication method closes security holes due to IP
-spoofing, DNS spoofing and routing spoofing.  [Note to the
-administrator:
-.Pa /etc/hosts.equiv ,
-.Pa \&.rhosts ,
-and the rlogin/rsh protocol in general, are inherently insecure and should be
-disabled if security is desired.]
-.Pp
-As a third authentication method, 
-.Nm
-supports RSA based authentication.
-The scheme is based on public-key cryptography: there are cryptosystems
-where encryption and decryption are done using separate keys, and it
-is not possible to derive the decryption key from the encryption key.
-RSA is one such system.  The idea is that each user creates a public/private 
-key pair for authentication purposes.  The
-server knows the public key, and only the user knows the private key.
-The file 
-.Pa $HOME/.ssh/authorized_keys
-lists the public keys that are permitted for logging
-in.  When the user logs in, the
-.Nm
-program tells the server which key pair it would like to use for
-authentication.  The server checks if this key is permitted, and if
-so, sends the user (actually the
-.Nm
-program running on behalf of the user) a challenge, a random number,
-encrypted by the user's public key.  The challenge can only be
-decrypted using the proper private key.  The user's client then decrypts the
-challenge using the private key, proving that he/she knows the private
-key but without disclosing it to the server.
-.Pp
-.Nm
-implements the RSA authentication protocol automatically.  The user
-creates his/her RSA key pair by running
-.Xr ssh-keygen 1 .
-This stores the private key in 
-.Pa \&.ssh/identity
-and the public key in
-.Pa \&.ssh/identity.pub
-in the user's home directory.  The user should then
-copy the 
-.Pa identity.pub
-to 
-.Pa \&.ssh/authorized_keys
-in his/her home directory on the remote machine (the 
-.Pa authorized_keys
-file corresponds to the conventional 
-.Pa \&.rhosts
-file, and has one key
-per line, though the lines can be very long).  After this, the user
-can log in without giving the password.  RSA authentication is much
-more secure than rhosts authentication.
-.Pp
-The most convenient way to use RSA authentication may be with an
-authentication agent.  See
-.Xr ssh-agent 1
-for more information.
-.Pp
-If other authentication methods fail, 
-.Nm
-prompts the user for a password.  The password is sent to the remote
-host for checking; however, since all communications are encrypted,
-the password cannot be seen by someone listening on the network.
-.Pp
-When the user's identity has been accepted by the server, the server
-either executes the given command, or logs into the machine and gives
-the user a normal shell on the remote machine.  All communication with
-the remote command or shell will be automatically encrypted.
-.Pp
-If a pseudo-terminal has been allocated (normal login session), the
-user can disconnect with
-.Ic ~. ,
-and suspend
-.Nm
-with
-.Ic ~^Z .
-All forwarded connections can be listed with
-.Ic ~# 
-and if
-the session blocks waiting for forwarded X11 or TCP/IP
-connections to terminate, it can be backgrounded with
-.Ic ~&
-(this should not be used while the user shell is active, as it can cause the
-shell to hang).  All available escapes can be listed with
-.Ic ~? .
-.Pp
-A single tilde character can be sent as
-.Ic ~~
-(or by following the tilde by a character other than those described above).
-The escape character must always follow a newline to be interpreted as
-special.  The escape character can be changed in configuration files
-or on the command line.  
-.Pp
-If no pseudo tty has been allocated, the
-session is transparent and can be used to reliably transfer binary
-data.  On most systems, setting the escape character to
-.Dq none
-will also make the session transparent even if a tty is used.
-.Pp
-The session terminates when the command or shell in on the remote
-machine exists and all X11 and TCP/IP connections have been closed.
-The exit status of the remote program is returned as the exit status
-of
-.Nm ssh .
-.Pp
-If the user is using X11 (the
-.Ev DISPLAY
-environment variable is set), the connection to the X11 display is
-automatically forwarded to the remote side in such a way that any X11
-programs started from the shell (or command) will go through the
-encrypted channel, and the connection to the real X server will be made
-from the local machine.  The user should not manually set
-.Ev DISPLAY .
-Forwarding of X11 connections can be
-configured on the command line or in configuration files.
-.Pp
-The
-.Ev DISPLAY 
-value set by
-.Nm
-will point to the server machine, but with a display number greater
-than zero.  This is normal, and happens because
-.Nm
-creates a
-.Dq proxy
-X server on the server machine for forwarding the
-connections over the encrypted channel.
-.Pp
-.Nm
-will also automatically set up Xauthority data on the server machine.
-For this purpose, it will generate a random authorization cookie,
-store it in Xauthority on the server, and verify that any forwarded
-connections carry this cookie and replace it by the real cookie when
-the connection is opened.  The real authentication cookie is never
-sent to the server machine (and no cookies are sent in the plain).
-.Pp
-If the user is using an authentication agent, the connection to the agent
-is automatically forwarded to the remote side unless disabled on
-command line or in a configuration file.
-.Pp
-Forwarding of arbitrary TCP/IP connections over the secure channel can
-be specified either on command line or in a configuration file.  One
-possible application of TCP/IP forwarding is a secure connection to an
-electronic purse; another is going trough firewalls.
-.Pp
-.Nm
-automatically maintains and checks a database containing RSA-based
-identifications for all hosts it has ever been used with.  The
-database is stored in 
-.Pa \&.ssh/known_hosts
-in the user's home directory.  Additionally, the file 
-.Pa /etc/openssh/ssh_known_hosts
-is automatically checked for known hosts.  Any new hosts are
-automatically added to the user's file.  If a host's identification
-ever changes,
-.Nm
-warns about this and disables password authentication to prevent a
-trojan horse from getting the user's password.  Another purpose of
-this mechanism is to prevent man-in-the-middle attacks which could
-otherwise be used to circumvent the encryption.  The
-.Cm StrictHostKeyChecking
-option (see below) can be used to prevent logins to machines whose
-host key is not known or has changed.
-.Sh OPTIONS
-.Bl -tag -width Ds
-.It Fl a
-Disables forwarding of the authentication agent connection. This may
-also be specified on a per-host basis in the configuration file.
-.It Fl c Ar blowfish|3des
-Selects the cipher to use for encrypting the session. 
-.Ar 3des
-is used by default.  It is believed to be secure. 
-.Ar 3des
-(triple-des) is an encrypt-decrypt-encrypt triple with three different keys.
-It is presumably more secure than the
-.Ar des
-cipher which is no longer supported in ssh.
-.Ar blowfish
-is a fast block cipher, it appears very secure and is much faster than
-.Ar 3des .  
-.It Fl e Ar ch|^ch|none
-Sets the escape character for sessions with a pty (default:
-.Ql ~ ) .
-The escape character is only recognized at the beginning of a line.  The
-escape character followed by a dot
-.Pq Ql \&.
-closes the connection, followed
-by control-Z suspends the connection, and followed by itself sends the
-escape character once.  Setting the character to
-.Dq none
-disables any escapes and makes the session fully transparent.
-.It Fl f
-Requests
-.Nm
-to go to background after authentication.  This is useful
-if
-.Nm
-is going to ask for passwords or passphrases, but the user
-wants it in the background.  This implies 
-.Fl n .
-The recommended way to start X11 programs at a remote site is with
-something like
-.Ic ssh -f host xterm .
-.It Fl i Ar identity_file
-Selects the file from which the identity (private key) for 
-RSA authentication is read.  Default is 
-.Pa \&.ssh/identity
-in the user's home directory.  Identity files may also be specified on
-a per-host basis in the configuration file.  It is possible to have
-multiple
-.Fl i
-options (and multiple identities specified in
-configuration files).
-.It Fl g
-Allows remote hosts to connect to local forwarded ports.
-.It Fl k
-Disables forwarding of Kerberos tickets and AFS tokens. This may
-also be specified on a per-host basis in the configuration file.
-.It Fl l Ar login_name
-Specifies the user to log in as on the remote machine.  This may also
-be specified on a per-host basis in the configuration file.
-.It Fl n
-Redirects stdin from
-.Pa /dev/null
-(actually, prevents reading from stdin).
-This must be used when
-.Nm
-is run in the background.  A common trick is to use this to run X11
-programs in a remote machine.  For example,
-.Ic ssh -n shadows.cs.hut.fi emacs &
-will start an emacs on shadows.cs.hut.fi, and the X11
-connection will be automatically forwarded over an encrypted channel.
-The
-.Nm
-program will be put in the background.
-(This does not work if
-.Nm
-needs to ask for a password or passphrase; see also the
-.Fl f
-option.)
-.It Fl o Ar option
-Can be used to give options in the format used in the config file.
-This is useful for specifying options for which there is no separate
-command-line flag.  The option has the same format as a line in the
-configuration file.
-.It Fl p Ar port
-Port to connect to on the remote host.  This can be specified on a
-per-host basis in the configuration file.
-.It Fl P
-Use a non-privileged port for outgoing connections.
-This can be used if your firewall does
-not permit connections from privileged ports.
-Note that this option turns of
-.Cm RhostsAuthentication
-and
-.Cm RhostsRSAAuthentication .
-.It Fl q
-Quiet mode.  Causes all warning and diagnostic messages to be
-suppressed.  Only fatal errors are displayed.
-.It Fl t
-Force pseudo-tty allocation.  This can be used to execute arbitary
-screen-based programs on a remote machine, which can be very useful
-e.g. when implementing menu services.
-.It Fl v
-Verbose mode.  Causes
-.Nm
-to print debugging messages about its progress.  This is helpful in
-debugging connection, authentication, and configuration problems.
-The verbose mode is also used to display
-.Xr skey 1
-challenges, if the user entered "s/key" as password.
-