diff options
Diffstat (limited to 'doc/using.but')
| -rw-r--r-- | doc/using.but | 66 |
1 files changed, 49 insertions, 17 deletions
diff --git a/doc/using.but b/doc/using.but index 02a67808..5865ac95 100644 --- a/doc/using.but +++ b/doc/using.but @@ -838,17 +838,23 @@ any case.) This option is equivalent to the port number control in the Session panel of the PuTTY configuration box (see \k{config-hostname}). -\S2{using-cmdline-pw} \i\c{-pw}: specify a \i{password} +\S2{using-cmdline-pw} \i\c{-pwfile} and \i\c{-pw}: specify a \i{password} A simple way to automate a remote login is to supply your password -on the command line. This is \e{not recommended} for reasons of -security. If you possibly can, we recommend you set up public-key -authentication instead. See \k{pubkey} for details. +on the command line. -Note that the \c{-pw} option only works when you are using the SSH -protocol. Due to fundamental limitations of Telnet, Rlogin, and -SUPDUP, these protocols do not support automated password -authentication. +The \c{-pwfile} option takes a file name as an argument. The first +line of text in that file will be used as your password. + +The \c{-pw} option takes the password itself as an argument. This is +\s{NOT SECURE} if anybody else uses the same computer, because the +whole command line (including the password) is likely to show up if +another user lists the running processes. \c{-pw} is retained for +backwards compatibility only; you should use \c{-pwfile} instead. + +Note that these options only work when you are using the SSH protocol. +Due to fundamental limitations of Telnet, Rlogin, and SUPDUP, these +protocols do not support automated password authentication. \S2{using-cmdline-agentauth} \i\c{-agent} and \i\c{-noagent}: control use of Pageant for authentication @@ -941,15 +947,19 @@ this: \c plink host1.example.com -nc host2.example.com:1234 -You might want to use this feature if you needed to make an SSH -connection to a target host which you can only reach by going -through a proxy host, and rather than using port forwarding you -prefer to use the local proxy feature (see \k{config-proxy-type} for -more about local proxies). In this situation you might select -\q{Local} proxy type, set your local proxy command to be \cq{plink -%proxyhost -nc %host:%port}, enter the target host name on the -Session panel, and enter the directly reachable proxy host name on -the Proxy panel. +This can be useful if you're trying to make a connection to a target +host which you can only reach by SSH forwarding through a proxy host. +One way to do this would be to have an existing SSH connection to the +proxy host, with a port forwarding, but if you prefer to have the +connection started on demand as needed, then this approach can also +work. + +However, this does depend on the program \e{using} the proxy being +able to run a subprocess in place of making a network connection. +PuTTY itself can do this using the \q{Local} proxy type, but there's a +built-in more flexible way using the \q{SSH} proxy type. (See +\k{config-proxy-type} for a description of both.) So this feature is +probably most useful with another client program as the end user. This feature is only available in SSH protocol version 2 (since the version 1 protocol assumes you will always want to run a shell). It @@ -1014,6 +1024,19 @@ This option is equivalent to the \q{Private key file for authentication} box in the Auth panel of the PuTTY configuration box (see \k{config-ssh-privkey}). +\S2{using-cmdline-cert} \i\c{-cert}: specify an SSH \i{certificate} + +The \c{-cert} option allows you to specify the name of a certificate +file containing a signed version of your public key. If you specify +this option, PuTTY will present that certificate in place of the plain +public key, whenever it tries to authenticate with a key that matches. +(This applies whether the key is stored in Pageant or loaded directly +from a file by PuTTY.) + +This option is equivalent to the \q{Certificate to use with the +private key} box in the Auth panel of the PuTTY configuration box (see +\k{config-ssh-cert}). + \S2{using-cmdline-no-trivial-auth} \i\c{-no-trivial-auth}: disconnect if SSH authentication succeeds trivially @@ -1152,3 +1175,12 @@ the extra protection), so it's reasonable to want to run Pageant but not PuTTY with the ACL restrictions. You can force Pageant to start subsidiary PuTTY processes with a restricted ACL if you also pass the \i\c{-restrict-putty-acl} option. + +\S2{using-cmdline-host-ca} \i{\c{-host-ca}}: launch the +\I{certificate}host CA configuration + +If you start PuTTY with the \c{-host-ca} option, it will not launch a +session at all. Instead, it will just display the configuration dialog +box for host certification authorities, as described in +\k{config-ssh-kex-cert}. When you dismiss that dialog box, PuTTY will +terminate. |