1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.365 2024/06/24 06:59:39 jmc Exp $ 37.Dd $Mdocdate: June 24 2024 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51Unless noted otherwise, for each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123This keyword may appear multiple times in 124.Nm 125with each instance appending to the list. 126.It Cm AllowStreamLocalForwarding 127Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 128The available options are 129.Cm yes 130(the default) 131or 132.Cm all 133to allow StreamLocal forwarding, 134.Cm no 135to prevent all StreamLocal forwarding, 136.Cm local 137to allow local (from the perspective of 138.Xr ssh 1 ) 139forwarding only or 140.Cm remote 141to allow remote forwarding only. 142Note that disabling StreamLocal forwarding does not improve security unless 143users are also denied shell access, as they can always install their 144own forwarders. 145.It Cm AllowTcpForwarding 146Specifies whether TCP forwarding is permitted. 147The available options are 148.Cm yes 149(the default) 150or 151.Cm all 152to allow TCP forwarding, 153.Cm no 154to prevent all TCP forwarding, 155.Cm local 156to allow local (from the perspective of 157.Xr ssh 1 ) 158forwarding only or 159.Cm remote 160to allow remote forwarding only. 161Note that disabling TCP forwarding does not improve security unless 162users are also denied shell access, as they can always install their 163own forwarders. 164.It Cm AllowUsers 165This keyword can be followed by a list of user name patterns, separated 166by spaces. 167If specified, login is allowed only for user names that 168match one of the patterns. 169Only user names are valid; a numerical user ID is not recognized. 170By default, login is allowed for all users. 171If the pattern takes the form USER@HOST then USER and HOST 172are separately checked, restricting logins to particular 173users from particular hosts. 174HOST criteria may additionally contain addresses to match in CIDR 175address/masklen format. 176The allow/deny users directives are processed in the following order: 177.Cm DenyUsers , 178.Cm AllowUsers . 179.Pp 180See PATTERNS in 181.Xr ssh_config 5 182for more information on patterns. 183This keyword may appear multiple times in 184.Nm 185with each instance appending to the list. 186.It Cm AuthenticationMethods 187Specifies the authentication methods that must be successfully completed 188for a user to be granted access. 189This option must be followed by one or more lists of comma-separated 190authentication method names, or by the single string 191.Cm any 192to indicate the default behaviour of accepting any single authentication 193method. 194If the default is overridden, then successful authentication requires 195completion of every method in at least one of these lists. 196.Pp 197For example, 198.Qq publickey,password publickey,keyboard-interactive 199would require the user to complete public key authentication, followed by 200either password or keyboard interactive authentication. 201Only methods that are next in one or more lists are offered at each stage, 202so for this example it would not be possible to attempt password or 203keyboard-interactive authentication before public key. 204.Pp 205For keyboard interactive authentication it is also possible to 206restrict authentication to a specific device by appending a 207colon followed by the device identifier 208.Cm bsdauth 209or 210.Cm pam . 211depending on the server configuration. 212For example, 213.Qq keyboard-interactive:bsdauth 214would restrict keyboard interactive authentication to the 215.Cm bsdauth 216device. 217.Pp 218If the publickey method is listed more than once, 219.Xr sshd 8 220verifies that keys that have been used successfully are not reused for 221subsequent authentications. 222For example, 223.Qq publickey,publickey 224requires successful authentication using two different public keys. 225.Pp 226Note that each authentication method listed should also be explicitly enabled 227in the configuration. 228.Pp 229The available authentication methods are: 230.Qq gssapi-with-mic , 231.Qq hostbased , 232.Qq keyboard-interactive , 233.Qq none 234(used for access to password-less accounts when 235.Cm PermitEmptyPasswords 236is enabled), 237.Qq password 238and 239.Qq publickey . 240.It Cm AuthorizedKeysCommand 241Specifies a program to be used to look up the user's public keys. 242The program must be owned by root, not writable by group or others and 243specified by an absolute path. 244Arguments to 245.Cm AuthorizedKeysCommand 246accept the tokens described in the 247.Sx TOKENS 248section. 249If no arguments are specified then the username of the target user is used. 250.Pp 251The program should produce on standard output zero or 252more lines of authorized_keys output (see 253.Sx AUTHORIZED_KEYS 254in 255.Xr sshd 8 ) . 256.Cm AuthorizedKeysCommand 257is tried after the usual 258.Cm AuthorizedKeysFile 259files and will not be executed if a matching key is found there. 260By default, no 261.Cm AuthorizedKeysCommand 262is run. 263.It Cm AuthorizedKeysCommandUser 264Specifies the user under whose account the 265.Cm AuthorizedKeysCommand 266is run. 267It is recommended to use a dedicated user that has no other role on the host 268than running authorized keys commands. 269If 270.Cm AuthorizedKeysCommand 271is specified but 272.Cm AuthorizedKeysCommandUser 273is not, then 274.Xr sshd 8 275will refuse to start. 276.It Cm AuthorizedKeysFile 277Specifies the file that contains the public keys used for user authentication. 278The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 279.Xr sshd 8 . 280Arguments to 281.Cm AuthorizedKeysFile 282accept the tokens described in the 283.Sx TOKENS 284section. 285After expansion, 286.Cm AuthorizedKeysFile 287is taken to be an absolute path or one relative to the user's home 288directory. 289Multiple files may be listed, separated by whitespace. 290Alternately this option may be set to 291.Cm none 292to skip checking for user keys in files. 293The default is 294.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 295.It Cm AuthorizedPrincipalsCommand 296Specifies a program to be used to generate the list of allowed 297certificate principals as per 298.Cm AuthorizedPrincipalsFile . 299The program must be owned by root, not writable by group or others and 300specified by an absolute path. 301Arguments to 302.Cm AuthorizedPrincipalsCommand 303accept the tokens described in the 304.Sx TOKENS 305section. 306If no arguments are specified then the username of the target user is used. 307.Pp 308The program should produce on standard output zero or 309more lines of 310.Cm AuthorizedPrincipalsFile 311output. 312If either 313.Cm AuthorizedPrincipalsCommand 314or 315.Cm AuthorizedPrincipalsFile 316is specified, then certificates offered by the client for authentication 317must contain a principal that is listed. 318By default, no 319.Cm AuthorizedPrincipalsCommand 320is run. 321.It Cm AuthorizedPrincipalsCommandUser 322Specifies the user under whose account the 323.Cm AuthorizedPrincipalsCommand 324is run. 325It is recommended to use a dedicated user that has no other role on the host 326than running authorized principals commands. 327If 328.Cm AuthorizedPrincipalsCommand 329is specified but 330.Cm AuthorizedPrincipalsCommandUser 331is not, then 332.Xr sshd 8 333will refuse to start. 334.It Cm AuthorizedPrincipalsFile 335Specifies a file that lists principal names that are accepted for 336certificate authentication. 337When using certificates signed by a key listed in 338.Cm TrustedUserCAKeys , 339this file lists names, one of which must appear in the certificate for it 340to be accepted for authentication. 341Names are listed one per line preceded by key options (as described in 342.Sx AUTHORIZED_KEYS FILE FORMAT 343in 344.Xr sshd 8 ) . 345Empty lines and comments starting with 346.Ql # 347are ignored. 348.Pp 349Arguments to 350.Cm AuthorizedPrincipalsFile 351accept the tokens described in the 352.Sx TOKENS 353section. 354After expansion, 355.Cm AuthorizedPrincipalsFile 356is taken to be an absolute path or one relative to the user's home directory. 357The default is 358.Cm none , 359i.e. not to use a principals file \(en in this case, the username 360of the user must appear in a certificate's principals list for it to be 361accepted. 362.Pp 363Note that 364.Cm AuthorizedPrincipalsFile 365is only used when authentication proceeds using a CA listed in 366.Cm TrustedUserCAKeys 367and is not consulted for certification authorities trusted via 368.Pa ~/.ssh/authorized_keys , 369though the 370.Cm principals= 371key option offers a similar facility (see 372.Xr sshd 8 373for details). 374.It Cm Banner 375The contents of the specified file are sent to the remote user before 376authentication is allowed. 377If the argument is 378.Cm none 379then no banner is displayed. 380By default, no banner is displayed. 381.It Cm CASignatureAlgorithms 382Specifies which algorithms are allowed for signing of certificates 383by certificate authorities (CAs). 384The default is: 385.Bd -literal -offset indent 386ssh-ed25519,ecdsa-sha2-nistp256, 387ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 388sk-ssh-ed25519@openssh.com, 389sk-ecdsa-sha2-nistp256@openssh.com, 390rsa-sha2-512,rsa-sha2-256 391.Ed 392.Pp 393If the specified list begins with a 394.Sq + 395character, then the specified algorithms will be appended to the default set 396instead of replacing them. 397If the specified list begins with a 398.Sq - 399character, then the specified algorithms (including wildcards) will be removed 400from the default set instead of replacing them. 401.Pp 402Certificates signed using other algorithms will not be accepted for 403public key or host-based authentication. 404.It Cm ChannelTimeout 405Specifies whether and how quickly 406.Xr sshd 8 407should close inactive channels. 408Timeouts are specified as one or more 409.Dq type=interval 410pairs separated by whitespace, where the 411.Dq type 412must be the special keyword 413.Dq global 414or a channel type name from the list below, optionally containing 415wildcard characters. 416.Pp 417The timeout value 418.Dq interval 419is specified in seconds or may use any of the units documented in the 420.Sx TIME FORMATS 421section. 422For example, 423.Dq session=5m 424would cause interactive sessions to terminate after five minutes of 425inactivity. 426Specifying a zero value disables the inactivity timeout. 427.Pp 428The special timeout 429.Dq global 430applies to all active channels, taken together. 431Traffic on any active channel will reset the timeout, but when the timeout 432expires then all open channels will be closed. 433Note that this global timeout is not matched by wildcards and must be 434specified explicitly. 435.Pp 436The available channel type names include: 437.Bl -tag -width Ds 438.It Cm agent-connection 439Open connections to 440.Xr ssh-agent 1 . 441.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com 442Open TCP or Unix socket (respectively) connections that have 443been established from a 444.Xr ssh 1 445local forwarding, i.e.\& 446.Cm LocalForward 447or 448.Cm DynamicForward . 449.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com 450Open TCP or Unix socket (respectively) connections that have been 451established to a 452.Xr sshd 8 453listening on behalf of a 454.Xr ssh 1 455remote forwarding, i.e.\& 456.Cm RemoteForward . 457.It Cm session 458The interactive main session, including shell session, command execution, 459.Xr scp 1 , 460.Xr sftp 1 , 461etc. 462.It Cm tun-connection 463Open 464.Cm TunnelForward 465connections. 466.It Cm x11-connection 467Open X11 forwarding sessions. 468.El 469.Pp 470Note that in all the above cases, terminating an inactive session does not 471guarantee to remove all resources associated with the session, e.g. shell 472processes or X11 clients relating to the session may continue to execute. 473.Pp 474Moreover, terminating an inactive channel or session does not necessarily 475close the SSH connection, nor does it prevent a client from 476requesting another channel of the same type. 477In particular, expiring an inactive forwarding session does not prevent 478another identical forwarding from being subsequently created. 479.Pp 480The default is not to expire channels of any type for inactivity. 481.It Cm ChrootDirectory 482Specifies the pathname of a directory to 483.Xr chroot 2 484to after authentication. 485At session startup 486.Xr sshd 8 487checks that all components of the pathname are root-owned directories 488which are not writable by group or others. 489After the chroot, 490.Xr sshd 8 491changes the working directory to the user's home directory. 492Arguments to 493.Cm ChrootDirectory 494accept the tokens described in the 495.Sx TOKENS 496section. 497.Pp 498The 499.Cm ChrootDirectory 500must contain the necessary files and directories to support the 501user's session. 502For an interactive session this requires at least a shell, typically 503.Xr sh 1 , 504and basic 505.Pa /dev 506nodes such as 507.Xr null 4 , 508.Xr zero 4 , 509.Xr stdin 4 , 510.Xr stdout 4 , 511.Xr stderr 4 , 512and 513.Xr tty 4 514devices. 515For file transfer sessions using SFTP 516no additional configuration of the environment is necessary if the in-process 517sftp-server is used, 518though sessions which use logging may require 519.Pa /dev/log 520inside the chroot directory on some operating systems (see 521.Xr sftp-server 8 522for details). 523.Pp 524For safety, it is very important that the directory hierarchy be 525prevented from modification by other processes on the system (especially 526those outside the jail). 527Misconfiguration can lead to unsafe environments which 528.Xr sshd 8 529cannot detect. 530.Pp 531The default is 532.Cm none , 533indicating not to 534.Xr chroot 2 . 535.It Cm Ciphers 536Specifies the ciphers allowed. 537Multiple ciphers must be comma-separated. 538If the specified list begins with a 539.Sq + 540character, then the specified ciphers will be appended to the default set 541instead of replacing them. 542If the specified list begins with a 543.Sq - 544character, then the specified ciphers (including wildcards) will be removed 545from the default set instead of replacing them. 546If the specified list begins with a 547.Sq ^ 548character, then the specified ciphers will be placed at the head of the 549default set. 550.Pp 551The supported ciphers are: 552.Pp 553.Bl -item -compact -offset indent 554.It 5553des-cbc 556.It 557aes128-cbc 558.It 559aes192-cbc 560.It 561aes256-cbc 562.It 563aes128-ctr 564.It 565aes192-ctr 566.It 567aes256-ctr 568.It 569aes128-gcm@openssh.com 570.It 571aes256-gcm@openssh.com 572.It 573chacha20-poly1305@openssh.com 574.El 575.Pp 576The default is: 577.Bd -literal -offset indent 578chacha20-poly1305@openssh.com, 579aes128-ctr,aes192-ctr,aes256-ctr, 580aes128-gcm@openssh.com,aes256-gcm@openssh.com 581.Ed 582.Pp 583The list of available ciphers may also be obtained using 584.Qq ssh -Q cipher . 585.It Cm ClientAliveCountMax 586Sets the number of client alive messages which may be sent without 587.Xr sshd 8 588receiving any messages back from the client. 589If this threshold is reached while client alive messages are being sent, 590sshd will disconnect the client, terminating the session. 591It is important to note that the use of client alive messages is very 592different from 593.Cm TCPKeepAlive . 594The client alive messages are sent through the encrypted channel 595and therefore will not be spoofable. 596The TCP keepalive option enabled by 597.Cm TCPKeepAlive 598is spoofable. 599The client alive mechanism is valuable when the client or 600server depend on knowing when a connection has become unresponsive. 601.Pp 602The default value is 3. 603If 604.Cm ClientAliveInterval 605is set to 15, and 606.Cm ClientAliveCountMax 607is left at the default, unresponsive SSH clients 608will be disconnected after approximately 45 seconds. 609Setting a zero 610.Cm ClientAliveCountMax 611disables connection termination. 612.It Cm ClientAliveInterval 613Sets a timeout interval in seconds after which if no data has been received 614from the client, 615.Xr sshd 8 616will send a message through the encrypted 617channel to request a response from the client. 618The default 619is 0, indicating that these messages will not be sent to the client. 620.It Cm Compression 621Specifies whether compression is enabled after 622the user has authenticated successfully. 623The argument must be 624.Cm yes , 625.Cm delayed 626(a legacy synonym for 627.Cm yes ) 628or 629.Cm no . 630The default is 631.Cm yes . 632.It Cm DenyGroups 633This keyword can be followed by a list of group name patterns, separated 634by spaces. 635Login is disallowed for users whose primary group or supplementary 636group list matches one of the patterns. 637Only group names are valid; a numerical group ID is not recognized. 638By default, login is allowed for all groups. 639The allow/deny groups directives are processed in the following order: 640.Cm DenyGroups , 641.Cm AllowGroups . 642.Pp 643See PATTERNS in 644.Xr ssh_config 5 645for more information on patterns. 646This keyword may appear multiple times in 647.Nm 648with each instance appending to the list. 649.It Cm DenyUsers 650This keyword can be followed by a list of user name patterns, separated 651by spaces. 652Login is disallowed for user names that match one of the patterns. 653Only user names are valid; a numerical user ID is not recognized. 654By default, login is allowed for all users. 655If the pattern takes the form USER@HOST then USER and HOST 656are separately checked, restricting logins to particular 657users from particular hosts. 658HOST criteria may additionally contain addresses to match in CIDR 659address/masklen format. 660The allow/deny users directives are processed in the following order: 661.Cm DenyUsers , 662.Cm AllowUsers . 663.Pp 664See PATTERNS in 665.Xr ssh_config 5 666for more information on patterns. 667This keyword may appear multiple times in 668.Nm 669with each instance appending to the list. 670.It Cm DisableForwarding 671Disables all forwarding features, including X11, 672.Xr ssh-agent 1 , 673TCP and StreamLocal. 674This option overrides all other forwarding-related options and may 675simplify restricted configurations. 676.It Cm ExposeAuthInfo 677Writes a temporary file containing a list of authentication methods and 678public credentials (e.g. keys) used to authenticate the user. 679The location of the file is exposed to the user session through the 680.Ev SSH_USER_AUTH 681environment variable. 682The default is 683.Cm no . 684.It Cm FingerprintHash 685Specifies the hash algorithm used when logging key fingerprints. 686Valid options are: 687.Cm md5 688and 689.Cm sha256 . 690The default is 691.Cm sha256 . 692.It Cm ForceCommand 693Forces the execution of the command specified by 694.Cm ForceCommand , 695ignoring any command supplied by the client and 696.Pa ~/.ssh/rc 697if present. 698The command is invoked by using the user's login shell with the -c option. 699This applies to shell, command, or subsystem execution. 700It is most useful inside a 701.Cm Match 702block. 703The command originally supplied by the client is available in the 704.Ev SSH_ORIGINAL_COMMAND 705environment variable. 706Specifying a command of 707.Cm internal-sftp 708will force the use of an in-process SFTP server that requires no support 709files when used with 710.Cm ChrootDirectory . 711The default is 712.Cm none . 713.It Cm GatewayPorts 714Specifies whether remote hosts are allowed to connect to ports 715forwarded for the client. 716By default, 717.Xr sshd 8 718binds remote port forwardings to the loopback address. 719This prevents other remote hosts from connecting to forwarded ports. 720.Cm GatewayPorts 721can be used to specify that sshd 722should allow remote port forwardings to bind to non-loopback addresses, thus 723allowing other hosts to connect. 724The argument may be 725.Cm no 726to force remote port forwardings to be available to the local host only, 727.Cm yes 728to force remote port forwardings to bind to the wildcard address, or 729.Cm clientspecified 730to allow the client to select the address to which the forwarding is bound. 731The default is 732.Cm no . 733.It Cm GSSAPIAuthentication 734Specifies whether user authentication based on GSSAPI is allowed. 735The default is 736.Cm no . 737.It Cm GSSAPICleanupCredentials 738Specifies whether to automatically destroy the user's credentials cache 739on logout. 740The default is 741.Cm yes . 742.It Cm GSSAPIStrictAcceptorCheck 743Determines whether to be strict about the identity of the GSSAPI acceptor 744a client authenticates against. 745If set to 746.Cm yes 747then the client must authenticate against the host 748service on the current hostname. 749If set to 750.Cm no 751then the client may authenticate against any service key stored in the 752machine's default store. 753This facility is provided to assist with operation on multi homed machines. 754The default is 755.Cm yes . 756.It Cm HostbasedAcceptedAlgorithms 757Specifies the signature algorithms that will be accepted for hostbased 758authentication as a list of comma-separated patterns. 759Alternately if the specified list begins with a 760.Sq + 761character, then the specified signature algorithms will be appended to 762the default set instead of replacing them. 763If the specified list begins with a 764.Sq - 765character, then the specified signature algorithms (including wildcards) 766will be removed from the default set instead of replacing them. 767If the specified list begins with a 768.Sq ^ 769character, then the specified signature algorithms will be placed at 770the head of the default set. 771The default for this option is: 772.Bd -literal -offset 3n 773ssh-ed25519-cert-v01@openssh.com, 774ecdsa-sha2-nistp256-cert-v01@openssh.com, 775ecdsa-sha2-nistp384-cert-v01@openssh.com, 776ecdsa-sha2-nistp521-cert-v01@openssh.com, 777sk-ssh-ed25519-cert-v01@openssh.com, 778sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 779rsa-sha2-512-cert-v01@openssh.com, 780rsa-sha2-256-cert-v01@openssh.com, 781ssh-ed25519, 782ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 783sk-ssh-ed25519@openssh.com, 784sk-ecdsa-sha2-nistp256@openssh.com, 785rsa-sha2-512,rsa-sha2-256 786.Ed 787.Pp 788The list of available signature algorithms may also be obtained using 789.Qq ssh -Q HostbasedAcceptedAlgorithms . 790This was formerly named HostbasedAcceptedKeyTypes. 791.It Cm HostbasedAuthentication 792Specifies whether rhosts or /etc/hosts.equiv authentication together 793with successful public key client host authentication is allowed 794(host-based authentication). 795The default is 796.Cm no . 797.It Cm HostbasedUsesNameFromPacketOnly 798Specifies whether or not the server will attempt to perform a reverse 799name lookup when matching the name in the 800.Pa ~/.shosts , 801.Pa ~/.rhosts , 802and 803.Pa /etc/hosts.equiv 804files during 805.Cm HostbasedAuthentication . 806A setting of 807.Cm yes 808means that 809.Xr sshd 8 810uses the name supplied by the client rather than 811attempting to resolve the name from the TCP connection itself. 812The default is 813.Cm no . 814.It Cm HostCertificate 815Specifies a file containing a public host certificate. 816The certificate's public key must match a private host key already specified 817by 818.Cm HostKey . 819The default behaviour of 820.Xr sshd 8 821is not to load any certificates. 822.It Cm HostKey 823Specifies a file containing a private host key 824used by SSH. 825The defaults are 826.Pa /etc/ssh/ssh_host_ecdsa_key , 827.Pa /etc/ssh/ssh_host_ed25519_key 828and 829.Pa /etc/ssh/ssh_host_rsa_key . 830.Pp 831Note that 832.Xr sshd 8 833will refuse to use a file if it is group/world-accessible 834and that the 835.Cm HostKeyAlgorithms 836option restricts which of the keys are actually used by 837.Xr sshd 8 . 838.Pp 839It is possible to have multiple host key files. 840It is also possible to specify public host key files instead. 841In this case operations on the private key will be delegated 842to an 843.Xr ssh-agent 1 . 844.It Cm HostKeyAgent 845Identifies the UNIX-domain socket used to communicate 846with an agent that has access to the private host keys. 847If the string 848.Qq SSH_AUTH_SOCK 849is specified, the location of the socket will be read from the 850.Ev SSH_AUTH_SOCK 851environment variable. 852.It Cm HostKeyAlgorithms 853Specifies the host key signature algorithms 854that the server offers. 855The default for this option is: 856.Bd -literal -offset 3n 857ssh-ed25519-cert-v01@openssh.com, 858ecdsa-sha2-nistp256-cert-v01@openssh.com, 859ecdsa-sha2-nistp384-cert-v01@openssh.com, 860ecdsa-sha2-nistp521-cert-v01@openssh.com, 861sk-ssh-ed25519-cert-v01@openssh.com, 862sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 863rsa-sha2-512-cert-v01@openssh.com, 864rsa-sha2-256-cert-v01@openssh.com, 865ssh-ed25519, 866ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 867sk-ssh-ed25519@openssh.com, 868sk-ecdsa-sha2-nistp256@openssh.com, 869rsa-sha2-512,rsa-sha2-256 870.Ed 871.Pp 872The list of available signature algorithms may also be obtained using 873.Qq ssh -Q HostKeyAlgorithms . 874.It Cm IgnoreRhosts 875Specifies whether to ignore per-user 876.Pa .rhosts 877and 878.Pa .shosts 879files during 880.Cm HostbasedAuthentication . 881The system-wide 882.Pa /etc/hosts.equiv 883and 884.Pa /etc/shosts.equiv 885are still used regardless of this setting. 886.Pp 887Accepted values are 888.Cm yes 889(the default) to ignore all per-user files, 890.Cm shosts-only 891to allow the use of 892.Pa .shosts 893but to ignore 894.Pa .rhosts 895or 896.Cm no 897to allow both 898.Pa .shosts 899and 900.Pa rhosts . 901.It Cm IgnoreUserKnownHosts 902Specifies whether 903.Xr sshd 8 904should ignore the user's 905.Pa ~/.ssh/known_hosts 906during 907.Cm HostbasedAuthentication 908and use only the system-wide known hosts file 909.Pa /etc/ssh/ssh_known_hosts . 910The default is 911.Dq no . 912.It Cm Include 913Include the specified configuration file(s). 914Multiple pathnames may be specified and each pathname may contain 915.Xr glob 7 916wildcards that will be expanded and processed in lexical order. 917Files without absolute paths are assumed to be in 918.Pa /etc/ssh . 919An 920.Cm Include 921directive may appear inside a 922.Cm Match 923block 924to perform conditional inclusion. 925.It Cm IPQoS 926Specifies the IPv4 type-of-service or DSCP class for the connection. 927Accepted values are 928.Cm af11 , 929.Cm af12 , 930.Cm af13 , 931.Cm af21 , 932.Cm af22 , 933.Cm af23 , 934.Cm af31 , 935.Cm af32 , 936.Cm af33 , 937.Cm af41 , 938.Cm af42 , 939.Cm af43 , 940.Cm cs0 , 941.Cm cs1 , 942.Cm cs2 , 943.Cm cs3 , 944.Cm cs4 , 945.Cm cs5 , 946.Cm cs6 , 947.Cm cs7 , 948.Cm ef , 949.Cm le , 950.Cm lowdelay , 951.Cm throughput , 952.Cm reliability , 953a numeric value, or 954.Cm none 955to use the operating system default. 956This option may take one or two arguments, separated by whitespace. 957If one argument is specified, it is used as the packet class unconditionally. 958If two values are specified, the first is automatically selected for 959interactive sessions and the second for non-interactive sessions. 960The default is 961.Cm af21 962(Low-Latency Data) 963for interactive sessions and 964.Cm cs1 965(Lower Effort) 966for non-interactive sessions. 967.It Cm KbdInteractiveAuthentication 968Specifies whether to allow keyboard-interactive authentication. 969All authentication styles from 970.Xr login.conf 5 971are supported. 972The default is 973.Cm yes . 974The argument to this keyword must be 975.Cm yes 976or 977.Cm no . 978.Cm ChallengeResponseAuthentication 979is a deprecated alias for this. 980.It Cm KerberosAuthentication 981Specifies whether the password provided by the user for 982.Cm PasswordAuthentication 983will be validated through the Kerberos KDC. 984To use this option, the server needs a 985Kerberos servtab which allows the verification of the KDC's identity. 986The default is 987.Cm no . 988.It Cm KerberosGetAFSToken 989If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 990an AFS token before accessing the user's home directory. 991The default is 992.Cm no . 993.It Cm KerberosOrLocalPasswd 994If password authentication through Kerberos fails then 995the password will be validated via any additional local mechanism 996such as 997.Pa /etc/passwd . 998The default is 999.Cm yes . 1000.It Cm KerberosTicketCleanup 1001Specifies whether to automatically destroy the user's ticket cache 1002file on logout. 1003The default is 1004.Cm yes . 1005.It Cm KexAlgorithms 1006Specifies the permitted KEX (Key Exchange) algorithms that the server will 1007offer to clients. 1008The ordering of this list is not important, as the client specifies the 1009preference order. 1010Multiple algorithms must be comma-separated. 1011.Pp 1012If the specified list begins with a 1013.Sq + 1014character, then the specified algorithms will be appended to the default set 1015instead of replacing them. 1016If the specified list begins with a 1017.Sq - 1018character, then the specified algorithms (including wildcards) will be removed 1019from the default set instead of replacing them. 1020If the specified list begins with a 1021.Sq ^ 1022character, then the specified algorithms will be placed at the head of the 1023default set. 1024.Pp 1025The supported algorithms are: 1026.Pp 1027.Bl -item -compact -offset indent 1028.It 1029curve25519-sha256 1030.It 1031curve25519-sha256@libssh.org 1032.It 1033diffie-hellman-group1-sha1 1034.It 1035diffie-hellman-group14-sha1 1036.It 1037diffie-hellman-group14-sha256 1038.It 1039diffie-hellman-group16-sha512 1040.It 1041diffie-hellman-group18-sha512 1042.It 1043diffie-hellman-group-exchange-sha1 1044.It 1045diffie-hellman-group-exchange-sha256 1046.It 1047ecdh-sha2-nistp256 1048.It 1049ecdh-sha2-nistp384 1050.It 1051ecdh-sha2-nistp521 1052.It 1053sntrup761x25519-sha512@openssh.com 1054.El 1055.Pp 1056The default is: 1057.Bd -literal -offset indent 1058sntrup761x25519-sha512@openssh.com, 1059curve25519-sha256,curve25519-sha256@libssh.org, 1060ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 1061diffie-hellman-group-exchange-sha256, 1062diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 1063diffie-hellman-group14-sha256 1064.Ed 1065.Pp 1066The list of supported key exchange algorithms may also be obtained using 1067.Qq ssh -Q KexAlgorithms . 1068.It Cm ListenAddress 1069Specifies the local addresses 1070.Xr sshd 8 1071should listen on. 1072The following forms may be used: 1073.Pp 1074.Bl -item -offset indent -compact 1075.It 1076.Cm ListenAddress 1077.Sm off 1078.Ar hostname | address 1079.Sm on 1080.Op Cm rdomain Ar domain 1081.It 1082.Cm ListenAddress 1083.Sm off 1084.Ar hostname : port 1085.Sm on 1086.Op Cm rdomain Ar domain 1087.It 1088.Cm ListenAddress 1089.Sm off 1090.Ar IPv4_address : port 1091.Sm on 1092.Op Cm rdomain Ar domain 1093.It 1094.Cm ListenAddress 1095.Sm off 1096.Oo Ar hostname | address Oc : Ar port 1097.Sm on 1098.Op Cm rdomain Ar domain 1099.El 1100.Pp 1101The optional 1102.Cm rdomain 1103qualifier requests 1104.Xr sshd 8 1105listen in an explicit routing domain. 1106If 1107.Ar port 1108is not specified, 1109sshd will listen on the address and all 1110.Cm Port 1111options specified. 1112The default is to listen on all local addresses on the current default 1113routing domain. 1114Multiple 1115.Cm ListenAddress 1116options are permitted. 1117For more information on routing domains, see 1118.Xr rdomain 4 . 1119.It Cm LoginGraceTime 1120The server disconnects after this time if the user has not 1121successfully logged in. 1122If the value is 0, there is no time limit. 1123The default is 120 seconds. 1124.It Cm LogLevel 1125Gives the verbosity level that is used when logging messages from 1126.Xr sshd 8 . 1127The possible values are: 1128QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1129The default is INFO. 1130DEBUG and DEBUG1 are equivalent. 1131DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1132Logging with a DEBUG level violates the privacy of users and is not recommended. 1133.It Cm LogVerbose 1134Specify one or more overrides to 1135.Cm LogLevel . 1136An override consists of a pattern lists that matches the source file, function 1137and line number to force detailed logging for. 1138For example, an override pattern of: 1139.Bd -literal -offset indent 1140kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1141.Ed 1142.Pp 1143would enable detailed logging for line 1000 of 1144.Pa kex.c , 1145everything in the 1146.Fn kex_exchange_identification 1147function, and all code in the 1148.Pa packet.c 1149file. 1150This option is intended for debugging and no overrides are enabled by default. 1151.It Cm MACs 1152Specifies the available MAC (message authentication code) algorithms. 1153The MAC algorithm is used for data integrity protection. 1154Multiple algorithms must be comma-separated. 1155If the specified list begins with a 1156.Sq + 1157character, then the specified algorithms will be appended to the default set 1158instead of replacing them. 1159If the specified list begins with a 1160.Sq - 1161character, then the specified algorithms (including wildcards) will be removed 1162from the default set instead of replacing them. 1163If the specified list begins with a 1164.Sq ^ 1165character, then the specified algorithms will be placed at the head of the 1166default set. 1167.Pp 1168The algorithms that contain 1169.Qq -etm 1170calculate the MAC after encryption (encrypt-then-mac). 1171These are considered safer and their use recommended. 1172The supported MACs are: 1173.Pp 1174.Bl -item -compact -offset indent 1175.It 1176hmac-md5 1177.It 1178hmac-md5-96 1179.It 1180hmac-sha1 1181.It 1182hmac-sha1-96 1183.It 1184hmac-sha2-256 1185.It 1186hmac-sha2-512 1187.It 1188umac-64@openssh.com 1189.It 1190umac-128@openssh.com 1191.It 1192hmac-md5-etm@openssh.com 1193.It 1194hmac-md5-96-etm@openssh.com 1195.It 1196hmac-sha1-etm@openssh.com 1197.It 1198hmac-sha1-96-etm@openssh.com 1199.It 1200hmac-sha2-256-etm@openssh.com 1201.It 1202hmac-sha2-512-etm@openssh.com 1203.It 1204umac-64-etm@openssh.com 1205.It 1206umac-128-etm@openssh.com 1207.El 1208.Pp 1209The default is: 1210.Bd -literal -offset indent 1211umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1212hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1213hmac-sha1-etm@openssh.com, 1214umac-64@openssh.com,umac-128@openssh.com, 1215hmac-sha2-256,hmac-sha2-512,hmac-sha1 1216.Ed 1217.Pp 1218The list of available MAC algorithms may also be obtained using 1219.Qq ssh -Q mac . 1220.It Cm Match 1221Introduces a conditional block. 1222If all of the criteria on the 1223.Cm Match 1224line are satisfied, the keywords on the following lines override those 1225set in the global section of the config file, until either another 1226.Cm Match 1227line or the end of the file. 1228If a keyword appears in multiple 1229.Cm Match 1230blocks that are satisfied, only the first instance of the keyword is 1231applied. 1232.Pp 1233The arguments to 1234.Cm Match 1235are one or more criteria-pattern pairs or the single token 1236.Cm All 1237which matches all criteria. 1238The available criteria are 1239.Cm User , 1240.Cm Group , 1241.Cm Host , 1242.Cm LocalAddress , 1243.Cm LocalPort , 1244.Cm RDomain , 1245and 1246.Cm Address 1247(with 1248.Cm RDomain 1249representing the 1250.Xr rdomain 4 1251on which the connection was received). 1252.Pp 1253The match patterns may consist of single entries or comma-separated 1254lists and may use the wildcard and negation operators described in the 1255.Sx PATTERNS 1256section of 1257.Xr ssh_config 5 . 1258.Pp 1259The patterns in an 1260.Cm Address 1261criteria may additionally contain addresses to match in CIDR 1262address/masklen format, 1263such as 192.0.2.0/24 or 2001:db8::/32. 1264Note that the mask length provided must be consistent with the address - 1265it is an error to specify a mask length that is too long for the address 1266or one with bits set in this host portion of the address. 1267For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1268.Pp 1269Only a subset of keywords may be used on the lines following a 1270.Cm Match 1271keyword. 1272Available keywords are 1273.Cm AcceptEnv , 1274.Cm AllowAgentForwarding , 1275.Cm AllowGroups , 1276.Cm AllowStreamLocalForwarding , 1277.Cm AllowTcpForwarding , 1278.Cm AllowUsers , 1279.Cm AuthenticationMethods , 1280.Cm AuthorizedKeysCommand , 1281.Cm AuthorizedKeysCommandUser , 1282.Cm AuthorizedKeysFile , 1283.Cm AuthorizedPrincipalsCommand , 1284.Cm AuthorizedPrincipalsCommandUser , 1285.Cm AuthorizedPrincipalsFile , 1286.Cm Banner , 1287.Cm CASignatureAlgorithms , 1288.Cm ChannelTimeout , 1289.Cm ChrootDirectory , 1290.Cm ClientAliveCountMax , 1291.Cm ClientAliveInterval , 1292.Cm DenyGroups , 1293.Cm DenyUsers , 1294.Cm DisableForwarding , 1295.Cm ExposeAuthInfo , 1296.Cm ForceCommand , 1297.Cm GatewayPorts , 1298.Cm GSSAPIAuthentication , 1299.Cm HostbasedAcceptedAlgorithms , 1300.Cm HostbasedAuthentication , 1301.Cm HostbasedUsesNameFromPacketOnly , 1302.Cm IgnoreRhosts , 1303.Cm Include , 1304.Cm IPQoS , 1305.Cm KbdInteractiveAuthentication , 1306.Cm KerberosAuthentication , 1307.Cm LogLevel , 1308.Cm MaxAuthTries , 1309.Cm MaxSessions , 1310.Cm PAMServiceName , 1311.Cm PasswordAuthentication , 1312.Cm PermitEmptyPasswords , 1313.Cm PermitListen , 1314.Cm PermitOpen , 1315.Cm PermitRootLogin , 1316.Cm PermitTTY , 1317.Cm PermitTunnel , 1318.Cm PermitUserRC , 1319.Cm PubkeyAcceptedAlgorithms , 1320.Cm PubkeyAuthentication , 1321.Cm PubkeyAuthOptions , 1322.Cm RekeyLimit , 1323.Cm RevokedKeys , 1324.Cm RDomain , 1325.Cm SetEnv , 1326.Cm StreamLocalBindMask , 1327.Cm StreamLocalBindUnlink , 1328.Cm TrustedUserCAKeys , 1329.Cm UnusedConnectionTimeout , 1330.Cm X11DisplayOffset , 1331.Cm X11Forwarding 1332and 1333.Cm X11UseLocalhost . 1334.It Cm MaxAuthTries 1335Specifies the maximum number of authentication attempts permitted per 1336connection. 1337Once the number of failures reaches half this value, 1338additional failures are logged. 1339The default is 6. 1340.It Cm MaxSessions 1341Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1342sessions permitted per network connection. 1343Multiple sessions may be established by clients that support connection 1344multiplexing. 1345Setting 1346.Cm MaxSessions 1347to 1 will effectively disable session multiplexing, whereas setting it to 0 1348will prevent all shell, login and subsystem sessions while still permitting 1349forwarding. 1350The default is 10. 1351.It Cm MaxStartups 1352Specifies the maximum number of concurrent unauthenticated connections to the 1353SSH daemon. 1354Additional connections will be dropped until authentication succeeds or the 1355.Cm LoginGraceTime 1356expires for a connection. 1357The default is 10:30:100. 1358.Pp 1359Alternatively, random early drop can be enabled by specifying 1360the three colon separated values 1361start:rate:full (e.g. "10:30:60"). 1362.Xr sshd 8 1363will refuse connection attempts with a probability of rate/100 (30%) 1364if there are currently start (10) unauthenticated connections. 1365The probability increases linearly and all connection attempts 1366are refused if the number of unauthenticated connections reaches full (60). 1367.It Cm ModuliFile 1368Specifies the 1369.Xr moduli 5 1370file that contains the Diffie-Hellman groups used for the 1371.Dq diffie-hellman-group-exchange-sha1 1372and 1373.Dq diffie-hellman-group-exchange-sha256 1374key exchange methods. 1375The default is 1376.Pa /etc/moduli . 1377.It Cm PAMServiceName 1378Specifies the service name used for Pluggable Authentication Modules (PAM) 1379authentication, authorisation and session controls when 1380.Cm UsePAM 1381is enabled. 1382The default is 1383.Cm sshd . 1384.It Cm PasswordAuthentication 1385Specifies whether password authentication is allowed. 1386The default is 1387.Cm sshd . 1388.It Cm PermitEmptyPasswords 1389When password authentication is allowed, it specifies whether the 1390server allows login to accounts with empty password strings. 1391The default is 1392.Cm no . 1393.It Cm PermitListen 1394Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1395The listen specification must be one of the following forms: 1396.Pp 1397.Bl -item -offset indent -compact 1398.It 1399.Cm PermitListen 1400.Sm off 1401.Ar port 1402.Sm on 1403.It 1404.Cm PermitListen 1405.Sm off 1406.Ar host : port 1407.Sm on 1408.El 1409.Pp 1410Multiple permissions may be specified by separating them with whitespace. 1411An argument of 1412.Cm any 1413can be used to remove all restrictions and permit any listen requests. 1414An argument of 1415.Cm none 1416can be used to prohibit all listen requests. 1417The host name may contain wildcards as described in the PATTERNS section in 1418.Xr ssh_config 5 . 1419The wildcard 1420.Sq * 1421can also be used in place of a port number to allow all ports. 1422By default all port forwarding listen requests are permitted. 1423Note that the 1424.Cm GatewayPorts 1425option may further restrict which addresses may be listened on. 1426Note also that 1427.Xr ssh 1 1428will request a listen host of 1429.Dq localhost 1430if no listen host was specifically requested, and this name is 1431treated differently to explicit localhost addresses of 1432.Dq 127.0.0.1 1433and 1434.Dq ::1 . 1435.It Cm PermitOpen 1436Specifies the destinations to which TCP port forwarding is permitted. 1437The forwarding specification must be one of the following forms: 1438.Pp 1439.Bl -item -offset indent -compact 1440.It 1441.Cm PermitOpen 1442.Sm off 1443.Ar host : port 1444.Sm on 1445.It 1446.Cm PermitOpen 1447.Sm off 1448.Ar IPv4_addr : port 1449.Sm on 1450.It 1451.Cm PermitOpen 1452.Sm off 1453.Ar \&[ IPv6_addr \&] : port 1454.Sm on 1455.El 1456.Pp 1457Multiple forwards may be specified by separating them with whitespace. 1458An argument of 1459.Cm any 1460can be used to remove all restrictions and permit any forwarding requests. 1461An argument of 1462.Cm none 1463can be used to prohibit all forwarding requests. 1464The wildcard 1465.Sq * 1466can be used for host or port to allow all hosts or ports respectively. 1467Otherwise, no pattern matching or address lookups are performed on supplied 1468names. 1469By default all port forwarding requests are permitted. 1470.It Cm PermitRootLogin 1471Specifies whether root can log in using 1472.Xr ssh 1 . 1473The argument must be 1474.Cm yes , 1475.Cm prohibit-password , 1476.Cm forced-commands-only , 1477or 1478.Cm no . 1479The default is 1480.Cm prohibit-password . 1481.Pp 1482If this option is set to 1483.Cm prohibit-password 1484(or its deprecated alias, 1485.Cm without-password ) , 1486password and keyboard-interactive authentication are disabled for root. 1487.Pp 1488If this option is set to 1489.Cm forced-commands-only , 1490root login with public key authentication will be allowed, 1491but only if the 1492.Ar command 1493option has been specified 1494(which may be useful for taking remote backups even if root login is 1495normally not allowed). 1496All other authentication methods are disabled for root. 1497.Pp 1498If this option is set to 1499.Cm no , 1500root is not allowed to log in. 1501.It Cm PermitTTY 1502Specifies whether 1503.Xr pty 4 1504allocation is permitted. 1505The default is 1506.Cm yes . 1507.It Cm PermitTunnel 1508Specifies whether 1509.Xr tun 4 1510device forwarding is allowed. 1511The argument must be 1512.Cm yes , 1513.Cm point-to-point 1514(layer 3), 1515.Cm ethernet 1516(layer 2), or 1517.Cm no . 1518Specifying 1519.Cm yes 1520permits both 1521.Cm point-to-point 1522and 1523.Cm ethernet . 1524The default is 1525.Cm no . 1526.Pp 1527Independent of this setting, the permissions of the selected 1528.Xr tun 4 1529device must allow access to the user. 1530.It Cm PermitUserEnvironment 1531Specifies whether 1532.Pa ~/.ssh/environment 1533and 1534.Cm environment= 1535options in 1536.Pa ~/.ssh/authorized_keys 1537are processed by 1538.Xr sshd 8 . 1539Valid options are 1540.Cm yes , 1541.Cm no 1542or a pattern-list specifying which environment variable names to accept 1543(for example 1544.Qq LANG,LC_* ) . 1545The default is 1546.Cm no . 1547Enabling environment processing may enable users to bypass access 1548restrictions in some configurations using mechanisms such as 1549.Ev LD_PRELOAD . 1550.It Cm PermitUserRC 1551Specifies whether any 1552.Pa ~/.ssh/rc 1553file is executed. 1554The default is 1555.Cm yes . 1556.It Cm PerSourceMaxStartups 1557Specifies the number of unauthenticated connections allowed from a 1558given source address, or 1559.Dq none 1560if there is no limit. 1561This limit is applied in addition to 1562.Cm MaxStartups , 1563whichever is lower. 1564The default is 1565.Cm none . 1566.It Cm PerSourceNetBlockSize 1567Specifies the number of bits of source address that are grouped together 1568for the purposes of applying PerSourceMaxStartups limits. 1569Values for IPv4 and optionally IPv6 may be specified, separated by a colon. 1570The default is 1571.Cm 32:128 , 1572which means each address is considered individually. 1573.It Cm PerSourcePenalties 1574Controls penalties for various conditions that may represent attacks on 1575.Xr sshd 8 . 1576If a penalty is enforced against a client then its source address and any 1577others in the same network, as defined by 1578.Cm PerSourceNetBlockSize , 1579will be refused connection for a period. 1580.Pp 1581A penalty doesn't affect concurrent connections in progress, but multiple 1582penalties from the same source from concurrent connections will accumulate 1583up to a maximum. 1584Conversely, penalties are not applied until a minimum threshold time has been 1585accumulated. 1586.Pp 1587Penalties are enabled by default with the default settings listed below 1588but may disabled using the 1589.Cm off 1590keyword. 1591The defaults may be overridden by specifying one or more of the keywords below, 1592separated by whitespace. 1593All keywords accept arguments, e.g.\& 1594.Qq crash:2m . 1595.Bl -tag -width Ds 1596.It Cm crash:duration 1597Specifies how long to refuse clients that cause a crash of 1598.Xr sshd 8 (default: 90s). 1599.It Cm authfail:duration 1600Specifies how long to refuse clients that disconnect after making one or more 1601unsuccessful authentication attempts (default: 5s). 1602.It Cm noauth:duration 1603Specifies how long to refuse clients that disconnect without attempting 1604authentication (default: 1s). 1605This timeout should be used cautiously otherwise it may penalise legitimate 1606scanning tools such as 1607.Xr ssh-keyscan 1 . 1608.It Cm grace-exceeded:duration 1609Specifies how long to refuse clients that fail to authenticate after 1610.Cm LoginGraceTime 1611(default: 20s). 1612.It Cm max:duration 1613Specifies the maximum time a particular source address range will be refused 1614access for (default: 10m). 1615Repeated penalties will accumulate up to this maximum. 1616.It Cm min:duration 1617Specifies the minimum penalty that must accrue before enforcement begins 1618(default: 15s). 1619.It Cm max-sources4:number , max-sources6:number 1620Specifies the maximum number of client IPv4 and IPv6 address ranges to 1621track for penalties (default: 65536 for both). 1622.It Cm overflow:mode 1623Controls how the server behaves when 1624.Cm max-sources4 1625or 1626.Cm max-sources6 1627is exceeded. 1628There are two operating modes: 1629.Cm deny-all , 1630which denies all incoming connections other than those exempted via 1631.Cm PerSourcePenaltyExemptList 1632until a penalty expires, and 1633.Cm permissive , 1634which allows new connections by removing existing penalties early 1635(default: permissive). 1636Note that client penalties below the 1637.Cm min 1638threshold count against the total number of tracked penalties. 1639IPv4 and IPv6 addresses are tracked separately, so an overflow in one will 1640not affect the other. 1641.It Cm overflow6:mode 1642Allows specifying a different overflow mode for IPv6 addresses. 1643The default it to use the same overflow mode as was specified for IPv4. 1644.El 1645.It Cm PerSourcePenaltyExemptList 1646Specifies a comma-separated list of addresses to exempt from penalties. 1647This list may contain wildcards and CIDR address/masklen ranges. 1648Note that the mask length provided must be consistent with the address - 1649it is an error to specify a mask length that is too long for the address 1650or one with bits set in this host portion of the address. 1651For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1652The default is not to exempt any addresses. 1653.It Cm PidFile 1654Specifies the file that contains the process ID of the 1655SSH daemon, or 1656.Cm none 1657to not write one. 1658The default is 1659.Pa /var/run/sshd.pid . 1660.It Cm Port 1661Specifies the port number that 1662.Xr sshd 8 1663listens on. 1664The default is 22. 1665Multiple options of this type are permitted. 1666See also 1667.Cm ListenAddress . 1668.It Cm PrintLastLog 1669Specifies whether 1670.Xr sshd 8 1671should print the date and time of the last user login when a user logs 1672in interactively. 1673The default is 1674.Cm yes . 1675.It Cm PrintMotd 1676Specifies whether 1677.Xr sshd 8 1678should print 1679.Pa /etc/motd 1680when a user logs in interactively. 1681(On some systems it is also printed by the shell, 1682.Pa /etc/profile , 1683or equivalent.) 1684The default is 1685.Cm yes . 1686.It Cm PubkeyAcceptedAlgorithms 1687Specifies the signature algorithms that will be accepted for public key 1688authentication as a list of comma-separated patterns. 1689Alternately if the specified list begins with a 1690.Sq + 1691character, then the specified algorithms will be appended to the default set 1692instead of replacing them. 1693If the specified list begins with a 1694.Sq - 1695character, then the specified algorithms (including wildcards) will be removed 1696from the default set instead of replacing them. 1697If the specified list begins with a 1698.Sq ^ 1699character, then the specified algorithms will be placed at the head of the 1700default set. 1701The default for this option is: 1702.Bd -literal -offset 3n 1703ssh-ed25519-cert-v01@openssh.com, 1704ecdsa-sha2-nistp256-cert-v01@openssh.com, 1705ecdsa-sha2-nistp384-cert-v01@openssh.com, 1706ecdsa-sha2-nistp521-cert-v01@openssh.com, 1707sk-ssh-ed25519-cert-v01@openssh.com, 1708sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1709rsa-sha2-512-cert-v01@openssh.com, 1710rsa-sha2-256-cert-v01@openssh.com, 1711ssh-ed25519, 1712ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1713sk-ssh-ed25519@openssh.com, 1714sk-ecdsa-sha2-nistp256@openssh.com, 1715rsa-sha2-512,rsa-sha2-256 1716.Ed 1717.Pp 1718The list of available signature algorithms may also be obtained using 1719.Qq ssh -Q PubkeyAcceptedAlgorithms . 1720.It Cm PubkeyAuthOptions 1721Sets one or more public key authentication options. 1722The supported keywords are: 1723.Cm none 1724(the default; indicating no additional options are enabled), 1725.Cm touch-required 1726and 1727.Cm verify-required . 1728.Pp 1729The 1730.Cm touch-required 1731option causes public key authentication using a FIDO authenticator algorithm 1732(i.e.\& 1733.Cm ecdsa-sk 1734or 1735.Cm ed25519-sk ) 1736to always require the signature to attest that a physically present user 1737explicitly confirmed the authentication (usually by touching the authenticator). 1738By default, 1739.Xr sshd 8 1740requires user presence unless overridden with an authorized_keys option. 1741The 1742.Cm touch-required 1743flag disables this override. 1744.Pp 1745The 1746.Cm verify-required 1747option requires a FIDO key signature attest that the user was verified, 1748e.g. via a PIN. 1749.Pp 1750Neither the 1751.Cm touch-required 1752or 1753.Cm verify-required 1754options have any effect for other, non-FIDO, public key types. 1755.It Cm PubkeyAuthentication 1756Specifies whether public key authentication is allowed. 1757The default is 1758.Cm yes . 1759.It Cm RekeyLimit 1760Specifies the maximum amount of data that may be transmitted or received 1761before the session key is renegotiated, optionally followed by a maximum 1762amount of time that may pass before the session key is renegotiated. 1763The first argument is specified in bytes and may have a suffix of 1764.Sq K , 1765.Sq M , 1766or 1767.Sq G 1768to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1769The default is between 1770.Sq 1G 1771and 1772.Sq 4G , 1773depending on the cipher. 1774The optional second value is specified in seconds and may use any of the 1775units documented in the 1776.Sx TIME FORMATS 1777section. 1778The default value for 1779.Cm RekeyLimit 1780is 1781.Cm default none , 1782which means that rekeying is performed after the cipher's default amount 1783of data has been sent or received and no time based rekeying is done. 1784.It Cm RequiredRSASize 1785Specifies the minimum RSA key size (in bits) that 1786.Xr sshd 8 1787will accept. 1788User and host-based authentication keys smaller than this limit will be 1789refused. 1790The default is 1791.Cm 1024 1792bits. 1793Note that this limit may only be raised from the default. 1794.It Cm RevokedKeys 1795Specifies revoked public keys file, or 1796.Cm none 1797to not use one. 1798Keys listed in this file will be refused for public key authentication. 1799Note that if this file is not readable, then public key authentication will 1800be refused for all users. 1801Keys may be specified as a text file, listing one public key per line, or as 1802an OpenSSH Key Revocation List (KRL) as generated by 1803.Xr ssh-keygen 1 . 1804For more information on KRLs, see the KEY REVOCATION LISTS section in 1805.Xr ssh-keygen 1 . 1806.It Cm RDomain 1807Specifies an explicit routing domain that is applied after authentication 1808has completed. 1809The user session, as well as any forwarded or listening IP sockets, 1810will be bound to this 1811.Xr rdomain 4 . 1812If the routing domain is set to 1813.Cm \&%D , 1814then the domain in which the incoming connection was received will be applied. 1815.It Cm SecurityKeyProvider 1816Specifies a path to a library that will be used when loading 1817FIDO authenticator-hosted keys, overriding the default of using 1818the built-in USB HID support. 1819.It Cm SetEnv 1820Specifies one or more environment variables to set in child sessions started 1821by 1822.Xr sshd 8 1823as 1824.Dq NAME=VALUE . 1825The environment value may be quoted (e.g. if it contains whitespace 1826characters). 1827Environment variables set by 1828.Cm SetEnv 1829override the default environment and any variables specified by the user 1830via 1831.Cm AcceptEnv 1832or 1833.Cm PermitUserEnvironment . 1834.It Cm SshdSessionPath 1835Overrides the default path to the 1836.Cm sshd-session 1837binary that is invoked to handle each connection. 1838The default is 1839.Pa /usr/libexec/sshd-session . 1840This option is intended for use by tests. 1841.It Cm StreamLocalBindMask 1842Sets the octal file creation mode mask 1843.Pq umask 1844used when creating a Unix-domain socket file for local or remote 1845port forwarding. 1846This option is only used for port forwarding to a Unix-domain socket file. 1847.Pp 1848The default value is 0177, which creates a Unix-domain socket file that is 1849readable and writable only by the owner. 1850Note that not all operating systems honor the file mode on Unix-domain 1851socket files. 1852.It Cm StreamLocalBindUnlink 1853Specifies whether to remove an existing Unix-domain socket file for local 1854or remote port forwarding before creating a new one. 1855If the socket file already exists and 1856.Cm StreamLocalBindUnlink 1857is not enabled, 1858.Nm sshd 1859will be unable to forward the port to the Unix-domain socket file. 1860This option is only used for port forwarding to a Unix-domain socket file. 1861.Pp 1862The argument must be 1863.Cm yes 1864or 1865.Cm no . 1866The default is 1867.Cm no . 1868.It Cm StrictModes 1869Specifies whether 1870.Xr sshd 8 1871should check file modes and ownership of the 1872user's files and home directory before accepting login. 1873This is normally desirable because novices sometimes accidentally leave their 1874directory or files world-writable. 1875The default is 1876.Cm yes . 1877Note that this does not apply to 1878.Cm ChrootDirectory , 1879whose permissions and ownership are checked unconditionally. 1880.It Cm Subsystem 1881Configures an external subsystem (e.g. file transfer daemon). 1882Arguments should be a subsystem name and a command (with optional arguments) 1883to execute upon subsystem request. 1884.Pp 1885The command 1886.Cm sftp-server 1887implements the SFTP file transfer subsystem. 1888.Pp 1889Alternately the name 1890.Cm internal-sftp 1891implements an in-process SFTP server. 1892This may simplify configurations using 1893.Cm ChrootDirectory 1894to force a different filesystem root on clients. 1895It accepts the same command line arguments as 1896.Cm sftp-server 1897and even though it is in-process, settings such as 1898.Cm LogLevel 1899or 1900.Cm SyslogFacility 1901do not apply to it and must be set explicitly via 1902command line arguments. 1903.Pp 1904By default no subsystems are defined. 1905.It Cm SyslogFacility 1906Gives the facility code that is used when logging messages from 1907.Xr sshd 8 . 1908The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1909LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1910The default is AUTH. 1911.It Cm TCPKeepAlive 1912Specifies whether the system should send TCP keepalive messages to the 1913other side. 1914If they are sent, death of the connection or crash of one 1915of the machines will be properly noticed. 1916However, this means that 1917connections will die if the route is down temporarily, and some people 1918find it annoying. 1919On the other hand, if TCP keepalives are not sent, 1920sessions may hang indefinitely on the server, leaving 1921.Qq ghost 1922users and consuming server resources. 1923.Pp 1924The default is 1925.Cm yes 1926(to send TCP keepalive messages), and the server will notice 1927if the network goes down or the client host crashes. 1928This avoids infinitely hanging sessions. 1929.Pp 1930To disable TCP keepalive messages, the value should be set to 1931.Cm no . 1932.It Cm TrustedUserCAKeys 1933Specifies a file containing public keys of certificate authorities that are 1934trusted to sign user certificates for authentication, or 1935.Cm none 1936to not use one. 1937Keys are listed one per line; empty lines and comments starting with 1938.Ql # 1939are allowed. 1940If a certificate is presented for authentication and has its signing CA key 1941listed in this file, then it may be used for authentication for any user 1942listed in the certificate's principals list. 1943Note that certificates that lack a list of principals will not be permitted 1944for authentication using 1945.Cm TrustedUserCAKeys . 1946For more details on certificates, see the CERTIFICATES section in 1947.Xr ssh-keygen 1 . 1948.It Cm UnusedConnectionTimeout 1949Specifies whether and how quickly 1950.Xr sshd 8 1951should close client connections with no open channels. 1952Open channels include active shell, command execution or subsystem 1953sessions, connected network, socket, agent or X11 forwardings. 1954Forwarding listeners, such as those from the 1955.Xr ssh 1 1956.Fl R 1957flag, are not considered as open channels and do not prevent the timeout. 1958The timeout value 1959is specified in seconds or may use any of the units documented in the 1960.Sx TIME FORMATS 1961section. 1962.Pp 1963Note that this timeout starts when the client connection completes 1964user authentication but before the client has an opportunity to open any 1965channels. 1966Caution should be used when using short timeout values, as they may not 1967provide sufficient time for the client to request and open its channels 1968before terminating the connection. 1969.Pp 1970The default 1971.Cm none 1972is to never expire connections for having no open channels. 1973This option may be useful in conjunction with 1974.Cm ChannelTimeout . 1975.It Cm UseDNS 1976Specifies whether 1977.Xr sshd 8 1978should look up the remote host name, and to check that 1979the resolved host name for the remote IP address maps back to the 1980very same IP address. 1981.Pp 1982If this option is set to 1983.Cm no 1984(the default) then only addresses and not host names may be used in 1985.Pa ~/.ssh/authorized_keys 1986.Cm from 1987and 1988.Nm 1989.Cm Match 1990.Cm Host 1991directives. 1992.It Cm UsePAM 1993Enables the Pluggable Authentication Module interface. 1994If set to 1995.Cm yes 1996this will enable PAM authentication using 1997.Cm KbdInteractiveAuthentication 1998and 1999.Cm PasswordAuthentication 2000in addition to PAM account and session module processing for all 2001authentication types. 2002.Pp 2003Because PAM keyboard-interactive authentication usually serves an equivalent 2004role to password authentication, you should disable either 2005.Cm PasswordAuthentication 2006or 2007.Cm KbdInteractiveAuthentication . 2008.Pp 2009If 2010.Cm UsePAM 2011is enabled, you will not be able to run 2012.Xr sshd 8 2013as a non-root user. 2014The default is 2015.Cm no . 2016.It Cm VersionAddendum 2017Optionally specifies additional text to append to the SSH protocol banner 2018sent by the server upon connection. 2019The default is 2020.Cm none . 2021.It Cm X11DisplayOffset 2022Specifies the first display number available for 2023.Xr sshd 8 Ns 's 2024X11 forwarding. 2025This prevents sshd from interfering with real X11 servers. 2026The default is 10. 2027.It Cm X11Forwarding 2028Specifies whether X11 forwarding is permitted. 2029The argument must be 2030.Cm yes 2031or 2032.Cm no . 2033The default is 2034.Cm no . 2035.Pp 2036When X11 forwarding is enabled, there may be additional exposure to 2037the server and to client displays if the 2038.Xr sshd 8 2039proxy display is configured to listen on the wildcard address (see 2040.Cm X11UseLocalhost ) , 2041though this is not the default. 2042Additionally, the authentication spoofing and authentication data 2043verification and substitution occur on the client side. 2044The security risk of using X11 forwarding is that the client's X11 2045display server may be exposed to attack when the SSH client requests 2046forwarding (see the warnings for 2047.Cm ForwardX11 2048in 2049.Xr ssh_config 5 ) . 2050A system administrator may have a stance in which they want to 2051protect clients that may expose themselves to attack by unwittingly 2052requesting X11 forwarding, which can warrant a 2053.Cm no 2054setting. 2055.Pp 2056Note that disabling X11 forwarding does not prevent users from 2057forwarding X11 traffic, as users can always install their own forwarders. 2058.It Cm X11UseLocalhost 2059Specifies whether 2060.Xr sshd 8 2061should bind the X11 forwarding server to the loopback address or to 2062the wildcard address. 2063By default, 2064sshd binds the forwarding server to the loopback address and sets the 2065hostname part of the 2066.Ev DISPLAY 2067environment variable to 2068.Cm localhost . 2069This prevents remote hosts from connecting to the proxy display. 2070However, some older X11 clients may not function with this 2071configuration. 2072.Cm X11UseLocalhost 2073may be set to 2074.Cm no 2075to specify that the forwarding server should be bound to the wildcard 2076address. 2077The argument must be 2078.Cm yes 2079or 2080.Cm no . 2081The default is 2082.Cm yes . 2083.It Cm XAuthLocation 2084Specifies the full pathname of the 2085.Xr xauth 1 2086program, or 2087.Cm none 2088to not use one. 2089The default is 2090.Pa /usr/X11R6/bin/xauth . 2091.El 2092.Sh TIME FORMATS 2093.Xr sshd 8 2094command-line arguments and configuration file options that specify time 2095may be expressed using a sequence of the form: 2096.Sm off 2097.Ar time Op Ar qualifier , 2098.Sm on 2099where 2100.Ar time 2101is a positive integer value and 2102.Ar qualifier 2103is one of the following: 2104.Pp 2105.Bl -tag -width Ds -compact -offset indent 2106.It Aq Cm none 2107seconds 2108.It Cm s | Cm S 2109seconds 2110.It Cm m | Cm M 2111minutes 2112.It Cm h | Cm H 2113hours 2114.It Cm d | Cm D 2115days 2116.It Cm w | Cm W 2117weeks 2118.El 2119.Pp 2120Each member of the sequence is added together to calculate 2121the total time value. 2122.Pp 2123Time format examples: 2124.Pp 2125.Bl -tag -width Ds -compact -offset indent 2126.It 600 2127600 seconds (10 minutes) 2128.It 10m 212910 minutes 2130.It 1h30m 21311 hour 30 minutes (90 minutes) 2132.El 2133.Sh TOKENS 2134Arguments to some keywords can make use of tokens, 2135which are expanded at runtime: 2136.Pp 2137.Bl -tag -width XXXX -offset indent -compact 2138.It %% 2139A literal 2140.Sq % . 2141.It \&%C 2142Identifies the connection endpoints, containing 2143four space-separated values: client address, client port number, 2144server address, and server port number. 2145.It \&%D 2146The routing domain in which the incoming connection was received. 2147.It %F 2148The fingerprint of the CA key. 2149.It %f 2150The fingerprint of the key or certificate. 2151.It %h 2152The home directory of the user. 2153.It %i 2154The key ID in the certificate. 2155.It %K 2156The base64-encoded CA key. 2157.It %k 2158The base64-encoded key or certificate for authentication. 2159.It %s 2160The serial number of the certificate. 2161.It \&%T 2162The type of the CA key. 2163.It %t 2164The key or certificate type. 2165.It \&%U 2166The numeric user ID of the target user. 2167.It %u 2168The username. 2169.El 2170.Pp 2171.Cm AuthorizedKeysCommand 2172accepts the tokens %%, %C, %D, %f, %h, %k, %t, %U, and %u. 2173.Pp 2174.Cm AuthorizedKeysFile 2175accepts the tokens %%, %h, %U, and %u. 2176.Pp 2177.Cm AuthorizedPrincipalsCommand 2178accepts the tokens %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 2179.Pp 2180.Cm AuthorizedPrincipalsFile 2181accepts the tokens %%, %h, %U, and %u. 2182.Pp 2183.Cm ChrootDirectory 2184accepts the tokens %%, %h, %U, and %u. 2185.Pp 2186.Cm RoutingDomain 2187accepts the token %D. 2188.Sh FILES 2189.Bl -tag -width Ds 2190.It Pa /etc/ssh/sshd_config 2191Contains configuration data for 2192.Xr sshd 8 . 2193This file should be writable by root only, but it is recommended 2194(though not necessary) that it be world-readable. 2195.El 2196.Sh SEE ALSO 2197.Xr sftp-server 8 , 2198.Xr sshd 8 2199.Sh AUTHORS 2200.An -nosplit 2201OpenSSH is a derivative of the original and free 2202ssh 1.2.12 release by 2203.An Tatu Ylonen . 2204.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 2205.An Theo de Raadt 2206and 2207.An Dug Song 2208removed many bugs, re-added newer features and 2209created OpenSSH. 2210.An Markus Friedl 2211contributed the support for SSH protocol versions 1.5 and 2.0. 2212.An Niels Provos 2213and 2214.An Markus Friedl 2215contributed support for privilege separation. 2216