diff --git a/appl/rsh/rsh.1 b/appl/rsh/rsh.1
index e24d3d2f9..34f9dd3a7 100644
--- a/appl/rsh/rsh.1
+++ b/appl/rsh/rsh.1
@@ -31,7 +31,7 @@
 .\" 
 .\"	$Id$
 .\"
-.Dd September 4, 2003
+.Dd February 20, 2004
 .Dt RSH 1
 .Os HEIMDAL
 .Sh NAME
@@ -140,11 +140,6 @@ Also settable via
 (see
 .Xr krb5.conf ) .
 .It Xo
-.Fl G
-.Xc
-The opposite of
-.Fl f .
-.It Xo
 .Fl F ,
 .Fl -forwardable
 .Xc
@@ -154,6 +149,49 @@ Also settable via
 (see
 .Xr krb5.conf ) .
 .It Xo
+.Fl l Ar string ,
+.Fl -user= Ns Ar string
+.Xc
+By default the remote username is the same as the local. The
+.Fl l
+option or the
+.Pa username@host
+format allow the remote name to be specified.
+.It Xo
+.Fl n ,
+.Fl -no-input
+.Xc
+Direct input from 
+.Pa /dev/null
+(see the
+.Sx BUGS
+section).
+.It Xo
+.Fl p Ar number-or-service ,
+.Fl -port= Ns Ar number-or-service
+.Xc
+Connect to this port instead of the default (which is 514 when using
+old port based authentication, 544 for Kerberos 5 and non-encrypted
+Kerberos 4, and 545 for encrytpted Kerberos 4; subject of course to
+the contents of
+.Pa /etc/services ) .
+.It Xo
+.Fl P Ar N|O|1|2 ,
+.Fl -protocol= Ns Ar N|O|1|2
+.Xc
+Specifies the protocol version to use with Kerberos 5.
+.Ar N
+and
+.Ar 2
+select protocol version 2, while 
+.Ar O
+and
+.Ar 1
+select version 1. Version 2 is believed to be more secure, and is the
+default. Unless asked for a specific version,
+.Nm
+will try both.  This behaviour may change in the future.
+.It Xo
 .Fl u ,
 .Fl -unique
 .Xc
@@ -167,39 +205,23 @@ any existing cache. Mutually exclusive to
 Name of the remote credentials cache. Mutually exclusive to
 .Fl u .
 .It Xo
-.Fl p Ar number-or-service ,
-.Fl -port= Ns Ar number-or-service
+.Fl x ,
+.Fl -encrypt
 .Xc
-Connect to this port instead of the default (which is 514 when using
-old port based authentication, 544 for Kerberos 5 and non-encrypted
-Kerberos 4, and 545 for encrytpted Kerberos 4; subject of course to
-the contents of
-.Pa /etc/services ) .
-.It Xo
-.Fl l Ar string ,
-.Fl -user= Ns Ar string
-.Xc
-By default the remote username is the same as the local. The
-.Fl l
-option or the
-.Pa username@host
-format allow the remote name to be specified.
-.It Xo
-.Fl P Ar N|O|1|2 ,
-.Fl -protocol= Ns Ar N|O|1|2
-.Xc
-Specifies which protocol version to use with Kerberos 5.
-.Ar N
-and
-.Ar 2
-selects protocol version 2, while 
-.Ar O
-and
-.Ar 1
-selects version 1. Version 2 is believed to be more secure, and is the
-default. Unless asked for a specific version,
-.Nm
-will try both.  This behaviour may change in the future.
+The
+.Fl x
+option enables encryption for all data exchange. This is only valid
+for Kerberos authenticated connections (see the
+.Sx BUGS
+section for limitations).
+.It Fl z
+The opposite of
+.Fl x .
+This is the default, but encryption can be enabled when using
+Kerberos 5, by setting the
+.Li libdefaults/encrypt
+option in
+.Xr krb5.conf 5 .
 .El
 .\".Pp
 .\"Without a