.\"
.\" Created: Sun May 7 00:14:37 1995 ylo
.\"
-.\" $OpenBSD: scp.1,v 1.114 2025/04/14 05:41:42 jmc Exp $
+.\" $OpenBSD: scp.1,v 1.115 2025/10/04 21:41:35 naddy Exp $
.\"
-.Dd $Mdocdate: April 14 2025 $
+.Dd $Mdocdate: October 4 2025 $
.Dt SCP 1
.Os
.Sh NAME
copies files between hosts on a network.
.Pp
.Nm
-uses the SFTP protocol over a
+uses the SFTP protocol over an
.Xr ssh 1
connection for data transfer, and uses the same authentication and provides
the same security as a login session.
-.\" $OpenBSD: ssh-agent.1,v 1.85 2025/05/21 12:12:20 djm Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.86 2025/10/04 21:41:35 naddy Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: May 21 2025 $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSH-AGENT 1
.Os
.Sh NAME
refuses signature requests for FIDO keys where the key application string
does not start with
.Dq ssh:
-and when the data to be signed does not appear to be a
+and when the data to be signed does not appear to be an
.Xr ssh 1
-user authentication request or a
+user authentication request or an
.Xr ssh-keygen 1
signature.
The default behaviour prevents forwarded access to a FIDO key from also
-.\" $OpenBSD: ssh-keygen.1,v 1.235 2025/05/24 03:40:54 dtucker Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.236 2025/10/04 21:41:35 naddy Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: May 24 2025 $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
.Fl s
or
.Fl Y Cm sign ,
-this option indicates that a CA key resides in a
+this option indicates that a CA key resides in an
.Xr ssh-agent 1 .
See the
.Sx CERTIFICATES
.Pp
.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
.Pp
-Similarly, it is possible for the CA key to be hosted in a
+Similarly, it is possible for the CA key to be hosted in an
.Xr ssh-agent 1 .
This is indicated by the
.Fl U
KRLs that revoke keys by SHA256 hash are not supported by OpenSSH versions
prior to 7.9.
.It Cm hash : Ar fingerprint
-Revokes a key using a fingerprint hash, as obtained from a
+Revokes a key using a fingerprint hash, as obtained from an
.Xr sshd 8
authentication log message or the
.Nm
-.\" $OpenBSD: ssh-keyscan.1,v 1.52 2024/06/17 08:30:29 djm Exp $
+.\" $OpenBSD: ssh-keyscan.1,v 1.53 2025/10/04 21:41:35 naddy Exp $
.\"
.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
.\"
.\" permitted provided that due credit is given to the author and the
.\" OpenBSD project by leaving this copyright notice intact.
.\"
-.Dd $Mdocdate: June 17 2024 $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSH-KEYSCAN 1
.Os
.Sh NAME
Request certificates from target hosts instead of plain keys.
.It Fl D
Print keys found as SSHFP DNS records.
-The default is to print keys in a format usable as a
+The default is to print keys in a format usable as an
.Xr ssh 1
.Pa known_hosts
file.
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.419 2025/08/18 18:39:33 caspar Exp $
-.Dd $Mdocdate: August 18 2025 $
+.\" $OpenBSD: ssh_config.5,v 1.420 2025/10/04 21:41:35 naddy Exp $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
.Xr ssh-agent 1 .
.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com
Open TCP or Unix socket (respectively) connections that have
-been established from a
+been established from an
.Xr ssh 1
local forwarding, i.e.\&
.Cm LocalForward
.Cm DynamicForward .
.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com
Open TCP or Unix socket (respectively) connections that have been
-established to a
+established to an
.Xr sshd 8
-listening on behalf of a
+listening on behalf of an
.Xr ssh 1
remote forwarding, i.e.\&
.Cm RemoteForward .
sequentially.
Setting this option will cause
.Xr ssh 1
-to connect to the target host by first making a
+to connect to the target host by first making an
.Xr ssh 1
connection to the specified
.Cm ProxyJump
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.327 2024/09/15 01:19:56 djm Exp $
-.Dd $Mdocdate: September 15 2024 $
+.\" $OpenBSD: sshd.8,v 1.328 2025/10/04 21:41:35 naddy Exp $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSHD 8
.Os
.Sh NAME
.Ev SSH_ORIGINAL_COMMAND
environment variable.
Note that this option applies to shell, command or subsystem execution.
-Also note that this command may be superseded by a
+Also note that this command may be superseded by an
.Xr sshd_config 5
.Cm ForceCommand
directive.
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd_config.5,v 1.384 2025/08/05 09:08:16 job Exp $
-.Dd $Mdocdate: August 5 2025 $
+.\" $OpenBSD: sshd_config.5,v 1.385 2025/10/04 21:41:35 naddy Exp $
+.Dd $Mdocdate: October 4 2025 $
.Dt SSHD_CONFIG 5
.Os
.Sh NAME
.Xr ssh-agent 1 .
.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com
Open TCP or Unix socket (respectively) connections that have
-been established from a
+been established from an
.Xr ssh 1
local forwarding, i.e.\&
.Cm LocalForward
.Cm DynamicForward .
.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com
Open TCP or Unix socket (respectively) connections that have been
-established to a
+established to an
.Xr sshd 8
-listening on behalf of a
+listening on behalf of an
.Xr ssh 1
remote forwarding, i.e.\&
.Cm RemoteForward .