1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.345 2023/01/06 08:44:11 jmc Exp $ 37.Dd $Mdocdate: January 6 2023 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51For each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123.It Cm AllowStreamLocalForwarding 124Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 125The available options are 126.Cm yes 127(the default) 128or 129.Cm all 130to allow StreamLocal forwarding, 131.Cm no 132to prevent all StreamLocal forwarding, 133.Cm local 134to allow local (from the perspective of 135.Xr ssh 1 ) 136forwarding only or 137.Cm remote 138to allow remote forwarding only. 139Note that disabling StreamLocal forwarding does not improve security unless 140users are also denied shell access, as they can always install their 141own forwarders. 142.It Cm AllowTcpForwarding 143Specifies whether TCP forwarding is permitted. 144The available options are 145.Cm yes 146(the default) 147or 148.Cm all 149to allow TCP forwarding, 150.Cm no 151to prevent all TCP forwarding, 152.Cm local 153to allow local (from the perspective of 154.Xr ssh 1 ) 155forwarding only or 156.Cm remote 157to allow remote forwarding only. 158Note that disabling TCP forwarding does not improve security unless 159users are also denied shell access, as they can always install their 160own forwarders. 161.It Cm AllowUsers 162This keyword can be followed by a list of user name patterns, separated 163by spaces. 164If specified, login is allowed only for user names that 165match one of the patterns. 166Only user names are valid; a numerical user ID is not recognized. 167By default, login is allowed for all users. 168If the pattern takes the form USER@HOST then USER and HOST 169are separately checked, restricting logins to particular 170users from particular hosts. 171HOST criteria may additionally contain addresses to match in CIDR 172address/masklen format. 173The allow/deny users directives are processed in the following order: 174.Cm DenyUsers , 175.Cm AllowUsers . 176.Pp 177See PATTERNS in 178.Xr ssh_config 5 179for more information on patterns. 180.It Cm AuthenticationMethods 181Specifies the authentication methods that must be successfully completed 182for a user to be granted access. 183This option must be followed by one or more lists of comma-separated 184authentication method names, or by the single string 185.Cm any 186to indicate the default behaviour of accepting any single authentication 187method. 188If the default is overridden, then successful authentication requires 189completion of every method in at least one of these lists. 190.Pp 191For example, 192.Qq publickey,password publickey,keyboard-interactive 193would require the user to complete public key authentication, followed by 194either password or keyboard interactive authentication. 195Only methods that are next in one or more lists are offered at each stage, 196so for this example it would not be possible to attempt password or 197keyboard-interactive authentication before public key. 198.Pp 199For keyboard interactive authentication it is also possible to 200restrict authentication to a specific device by appending a 201colon followed by the device identifier 202.Cm bsdauth , 203.Cm pam , 204or 205.Cm skey , 206depending on the server configuration. 207For example, 208.Qq keyboard-interactive:bsdauth 209would restrict keyboard interactive authentication to the 210.Cm bsdauth 211device. 212.Pp 213If the publickey method is listed more than once, 214.Xr sshd 8 215verifies that keys that have been used successfully are not reused for 216subsequent authentications. 217For example, 218.Qq publickey,publickey 219requires successful authentication using two different public keys. 220.Pp 221Note that each authentication method listed should also be explicitly enabled 222in the configuration. 223.Pp 224The available authentication methods are: 225.Qq gssapi-with-mic , 226.Qq hostbased , 227.Qq keyboard-interactive , 228.Qq none 229(used for access to password-less accounts when 230.Cm PermitEmptyPasswords 231is enabled), 232.Qq password 233and 234.Qq publickey . 235.It Cm AuthorizedKeysCommand 236Specifies a program to be used to look up the user's public keys. 237The program must be owned by root, not writable by group or others and 238specified by an absolute path. 239Arguments to 240.Cm AuthorizedKeysCommand 241accept the tokens described in the 242.Sx TOKENS 243section. 244If no arguments are specified then the username of the target user is used. 245.Pp 246The program should produce on standard output zero or 247more lines of authorized_keys output (see 248.Sx AUTHORIZED_KEYS 249in 250.Xr sshd 8 ) . 251.Cm AuthorizedKeysCommand 252is tried after the usual 253.Cm AuthorizedKeysFile 254files and will not be executed if a matching key is found there. 255By default, no 256.Cm AuthorizedKeysCommand 257is run. 258.It Cm AuthorizedKeysCommandUser 259Specifies the user under whose account the 260.Cm AuthorizedKeysCommand 261is run. 262It is recommended to use a dedicated user that has no other role on the host 263than running authorized keys commands. 264If 265.Cm AuthorizedKeysCommand 266is specified but 267.Cm AuthorizedKeysCommandUser 268is not, then 269.Xr sshd 8 270will refuse to start. 271.It Cm AuthorizedKeysFile 272Specifies the file that contains the public keys used for user authentication. 273The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 274.Xr sshd 8 . 275Arguments to 276.Cm AuthorizedKeysFile 277accept the tokens described in the 278.Sx TOKENS 279section. 280After expansion, 281.Cm AuthorizedKeysFile 282is taken to be an absolute path or one relative to the user's home 283directory. 284Multiple files may be listed, separated by whitespace. 285Alternately this option may be set to 286.Cm none 287to skip checking for user keys in files. 288The default is 289.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 290.It Cm AuthorizedPrincipalsCommand 291Specifies a program to be used to generate the list of allowed 292certificate principals as per 293.Cm AuthorizedPrincipalsFile . 294The program must be owned by root, not writable by group or others and 295specified by an absolute path. 296Arguments to 297.Cm AuthorizedPrincipalsCommand 298accept the tokens described in the 299.Sx TOKENS 300section. 301If no arguments are specified then the username of the target user is used. 302.Pp 303The program should produce on standard output zero or 304more lines of 305.Cm AuthorizedPrincipalsFile 306output. 307If either 308.Cm AuthorizedPrincipalsCommand 309or 310.Cm AuthorizedPrincipalsFile 311is specified, then certificates offered by the client for authentication 312must contain a principal that is listed. 313By default, no 314.Cm AuthorizedPrincipalsCommand 315is run. 316.It Cm AuthorizedPrincipalsCommandUser 317Specifies the user under whose account the 318.Cm AuthorizedPrincipalsCommand 319is run. 320It is recommended to use a dedicated user that has no other role on the host 321than running authorized principals commands. 322If 323.Cm AuthorizedPrincipalsCommand 324is specified but 325.Cm AuthorizedPrincipalsCommandUser 326is not, then 327.Xr sshd 8 328will refuse to start. 329.It Cm AuthorizedPrincipalsFile 330Specifies a file that lists principal names that are accepted for 331certificate authentication. 332When using certificates signed by a key listed in 333.Cm TrustedUserCAKeys , 334this file lists names, one of which must appear in the certificate for it 335to be accepted for authentication. 336Names are listed one per line preceded by key options (as described in 337.Sx AUTHORIZED_KEYS FILE FORMAT 338in 339.Xr sshd 8 ) . 340Empty lines and comments starting with 341.Ql # 342are ignored. 343.Pp 344Arguments to 345.Cm AuthorizedPrincipalsFile 346accept the tokens described in the 347.Sx TOKENS 348section. 349After expansion, 350.Cm AuthorizedPrincipalsFile 351is taken to be an absolute path or one relative to the user's home directory. 352The default is 353.Cm none , 354i.e. not to use a principals file \(en in this case, the username 355of the user must appear in a certificate's principals list for it to be 356accepted. 357.Pp 358Note that 359.Cm AuthorizedPrincipalsFile 360is only used when authentication proceeds using a CA listed in 361.Cm TrustedUserCAKeys 362and is not consulted for certification authorities trusted via 363.Pa ~/.ssh/authorized_keys , 364though the 365.Cm principals= 366key option offers a similar facility (see 367.Xr sshd 8 368for details). 369.It Cm Banner 370The contents of the specified file are sent to the remote user before 371authentication is allowed. 372If the argument is 373.Cm none 374then no banner is displayed. 375By default, no banner is displayed. 376.It Cm CASignatureAlgorithms 377Specifies which algorithms are allowed for signing of certificates 378by certificate authorities (CAs). 379The default is: 380.Bd -literal -offset indent 381ssh-ed25519,ecdsa-sha2-nistp256, 382ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 383sk-ssh-ed25519@openssh.com, 384sk-ecdsa-sha2-nistp256@openssh.com, 385rsa-sha2-512,rsa-sha2-256 386.Ed 387.Pp 388If the specified list begins with a 389.Sq + 390character, then the specified algorithms will be appended to the default set 391instead of replacing them. 392If the specified list begins with a 393.Sq - 394character, then the specified algorithms (including wildcards) will be removed 395from the default set instead of replacing them. 396.Pp 397Certificates signed using other algorithms will not be accepted for 398public key or host-based authentication. 399.It Cm ChannelTimeout 400Specifies whether and how quickly 401.Xr sshd 8 402should close inactive channels. 403Timeouts are specified as one or more 404.Dq type=interval 405pairs separated by whitespace, where the 406.Dq type 407must be a channel type name (as described in the table below), optionally 408containing wildcard characters. 409.Pp 410The timeout value 411.Dq interval 412is specified in seconds or may use any of the units documented in the 413.Sx TIME FORMATS 414section. 415For example, 416.Dq session:*=5m 417would cause all sessions to terminate after five minutes of inactivity. 418Specifying a zero value disables the inactivity timeout. 419.Pp 420The available channel types include: 421.Bl -tag -width Ds 422.It Cm agent-connection 423Open connections to 424.Xr ssh-agent 1 . 425.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com 426Open TCP or Unix socket (respectively) connections that have 427been established from a 428.Xr ssh 1 429local forwarding, i.e.\& 430.Cm LocalForward 431or 432.Cm DynamicForward . 433.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com 434Open TCP or Unix socket (respectively) connections that have been 435established to a 436.Xr sshd 8 437listening on behalf of a 438.Xr ssh 1 439remote forwarding, i.e.\& 440.Cm RemoteForward . 441.It Cm session:command 442Command execution sessions. 443.It Cm session:shell 444Interactive shell sessions. 445.It Cm session:subsystem:... 446Subsystem sessions, e.g. for 447.Xr sftp 1 , 448which could be identified as 449.Cm session:subsystem:sftp . 450.It Cm x11-connection 451Open X11 forwarding sessions. 452.El 453.Pp 454Note that in all the above cases, terminating an inactive session does not 455guarantee to remove all resources associated with the session, e.g. shell 456processes or X11 clients relating to the session may continue to execute. 457.Pp 458Moreover, terminating an inactive channel or session does not necessarily 459close the SSH connection, nor does it prevent a client from 460requesting another channel of the same type. 461In particular, expiring an inactive forwarding session does not prevent 462another identical forwarding from being subsequently created. 463.Pp 464The default is not to expire channels of any type for inactivity. 465.It Cm ChrootDirectory 466Specifies the pathname of a directory to 467.Xr chroot 2 468to after authentication. 469At session startup 470.Xr sshd 8 471checks that all components of the pathname are root-owned directories 472which are not writable by any other user or group. 473After the chroot, 474.Xr sshd 8 475changes the working directory to the user's home directory. 476Arguments to 477.Cm ChrootDirectory 478accept the tokens described in the 479.Sx TOKENS 480section. 481.Pp 482The 483.Cm ChrootDirectory 484must contain the necessary files and directories to support the 485user's session. 486For an interactive session this requires at least a shell, typically 487.Xr sh 1 , 488and basic 489.Pa /dev 490nodes such as 491.Xr null 4 , 492.Xr zero 4 , 493.Xr stdin 4 , 494.Xr stdout 4 , 495.Xr stderr 4 , 496and 497.Xr tty 4 498devices. 499For file transfer sessions using SFTP 500no additional configuration of the environment is necessary if the in-process 501sftp-server is used, 502though sessions which use logging may require 503.Pa /dev/log 504inside the chroot directory on some operating systems (see 505.Xr sftp-server 8 506for details). 507.Pp 508For safety, it is very important that the directory hierarchy be 509prevented from modification by other processes on the system (especially 510those outside the jail). 511Misconfiguration can lead to unsafe environments which 512.Xr sshd 8 513cannot detect. 514.Pp 515The default is 516.Cm none , 517indicating not to 518.Xr chroot 2 . 519.It Cm Ciphers 520Specifies the ciphers allowed. 521Multiple ciphers must be comma-separated. 522If the specified list begins with a 523.Sq + 524character, then the specified ciphers will be appended to the default set 525instead of replacing them. 526If the specified list begins with a 527.Sq - 528character, then the specified ciphers (including wildcards) will be removed 529from the default set instead of replacing them. 530If the specified list begins with a 531.Sq ^ 532character, then the specified ciphers will be placed at the head of the 533default set. 534.Pp 535The supported ciphers are: 536.Pp 537.Bl -item -compact -offset indent 538.It 5393des-cbc 540.It 541aes128-cbc 542.It 543aes192-cbc 544.It 545aes256-cbc 546.It 547aes128-ctr 548.It 549aes192-ctr 550.It 551aes256-ctr 552.It 553aes128-gcm@openssh.com 554.It 555aes256-gcm@openssh.com 556.It 557chacha20-poly1305@openssh.com 558.El 559.Pp 560The default is: 561.Bd -literal -offset indent 562chacha20-poly1305@openssh.com, 563aes128-ctr,aes192-ctr,aes256-ctr, 564aes128-gcm@openssh.com,aes256-gcm@openssh.com 565.Ed 566.Pp 567The list of available ciphers may also be obtained using 568.Qq ssh -Q cipher . 569.It Cm ClientAliveCountMax 570Sets the number of client alive messages which may be sent without 571.Xr sshd 8 572receiving any messages back from the client. 573If this threshold is reached while client alive messages are being sent, 574sshd will disconnect the client, terminating the session. 575It is important to note that the use of client alive messages is very 576different from 577.Cm TCPKeepAlive . 578The client alive messages are sent through the encrypted channel 579and therefore will not be spoofable. 580The TCP keepalive option enabled by 581.Cm TCPKeepAlive 582is spoofable. 583The client alive mechanism is valuable when the client or 584server depend on knowing when a connection has become unresponsive. 585.Pp 586The default value is 3. 587If 588.Cm ClientAliveInterval 589is set to 15, and 590.Cm ClientAliveCountMax 591is left at the default, unresponsive SSH clients 592will be disconnected after approximately 45 seconds. 593Setting a zero 594.Cm ClientAliveCountMax 595disables connection termination. 596.It Cm ClientAliveInterval 597Sets a timeout interval in seconds after which if no data has been received 598from the client, 599.Xr sshd 8 600will send a message through the encrypted 601channel to request a response from the client. 602The default 603is 0, indicating that these messages will not be sent to the client. 604.It Cm Compression 605Specifies whether compression is enabled after 606the user has authenticated successfully. 607The argument must be 608.Cm yes , 609.Cm delayed 610(a legacy synonym for 611.Cm yes ) 612or 613.Cm no . 614The default is 615.Cm yes . 616.It Cm DenyGroups 617This keyword can be followed by a list of group name patterns, separated 618by spaces. 619Login is disallowed for users whose primary group or supplementary 620group list matches one of the patterns. 621Only group names are valid; a numerical group ID is not recognized. 622By default, login is allowed for all groups. 623The allow/deny groups directives are processed in the following order: 624.Cm DenyGroups , 625.Cm AllowGroups . 626.Pp 627See PATTERNS in 628.Xr ssh_config 5 629for more information on patterns. 630.It Cm DenyUsers 631This keyword can be followed by a list of user name patterns, separated 632by spaces. 633Login is disallowed for user names that match one of the patterns. 634Only user names are valid; a numerical user ID is not recognized. 635By default, login is allowed for all users. 636If the pattern takes the form USER@HOST then USER and HOST 637are separately checked, restricting logins to particular 638users from particular hosts. 639HOST criteria may additionally contain addresses to match in CIDR 640address/masklen format. 641The allow/deny users directives are processed in the following order: 642.Cm DenyUsers , 643.Cm AllowUsers . 644.Pp 645See PATTERNS in 646.Xr ssh_config 5 647for more information on patterns. 648.It Cm DisableForwarding 649Disables all forwarding features, including X11, 650.Xr ssh-agent 1 , 651TCP and StreamLocal. 652This option overrides all other forwarding-related options and may 653simplify restricted configurations. 654.It Cm ExposeAuthInfo 655Writes a temporary file containing a list of authentication methods and 656public credentials (e.g. keys) used to authenticate the user. 657The location of the file is exposed to the user session through the 658.Ev SSH_USER_AUTH 659environment variable. 660The default is 661.Cm no . 662.It Cm FingerprintHash 663Specifies the hash algorithm used when logging key fingerprints. 664Valid options are: 665.Cm md5 666and 667.Cm sha256 . 668The default is 669.Cm sha256 . 670.It Cm ForceCommand 671Forces the execution of the command specified by 672.Cm ForceCommand , 673ignoring any command supplied by the client and 674.Pa ~/.ssh/rc 675if present. 676The command is invoked by using the user's login shell with the -c option. 677This applies to shell, command, or subsystem execution. 678It is most useful inside a 679.Cm Match 680block. 681The command originally supplied by the client is available in the 682.Ev SSH_ORIGINAL_COMMAND 683environment variable. 684Specifying a command of 685.Cm internal-sftp 686will force the use of an in-process SFTP server that requires no support 687files when used with 688.Cm ChrootDirectory . 689The default is 690.Cm none . 691.It Cm GatewayPorts 692Specifies whether remote hosts are allowed to connect to ports 693forwarded for the client. 694By default, 695.Xr sshd 8 696binds remote port forwardings to the loopback address. 697This prevents other remote hosts from connecting to forwarded ports. 698.Cm GatewayPorts 699can be used to specify that sshd 700should allow remote port forwardings to bind to non-loopback addresses, thus 701allowing other hosts to connect. 702The argument may be 703.Cm no 704to force remote port forwardings to be available to the local host only, 705.Cm yes 706to force remote port forwardings to bind to the wildcard address, or 707.Cm clientspecified 708to allow the client to select the address to which the forwarding is bound. 709The default is 710.Cm no . 711.It Cm GSSAPIAuthentication 712Specifies whether user authentication based on GSSAPI is allowed. 713The default is 714.Cm no . 715.It Cm GSSAPICleanupCredentials 716Specifies whether to automatically destroy the user's credentials cache 717on logout. 718The default is 719.Cm yes . 720.It Cm GSSAPIStrictAcceptorCheck 721Determines whether to be strict about the identity of the GSSAPI acceptor 722a client authenticates against. 723If set to 724.Cm yes 725then the client must authenticate against the host 726service on the current hostname. 727If set to 728.Cm no 729then the client may authenticate against any service key stored in the 730machine's default store. 731This facility is provided to assist with operation on multi homed machines. 732The default is 733.Cm yes . 734.It Cm HostbasedAcceptedAlgorithms 735Specifies the signature algorithms that will be accepted for hostbased 736authentication as a list of comma-separated patterns. 737Alternately if the specified list begins with a 738.Sq + 739character, then the specified signature algorithms will be appended to 740the default set instead of replacing them. 741If the specified list begins with a 742.Sq - 743character, then the specified signature algorithms (including wildcards) 744will be removed from the default set instead of replacing them. 745If the specified list begins with a 746.Sq ^ 747character, then the specified signature algorithms will be placed at 748the head of the default set. 749The default for this option is: 750.Bd -literal -offset 3n 751ssh-ed25519-cert-v01@openssh.com, 752ecdsa-sha2-nistp256-cert-v01@openssh.com, 753ecdsa-sha2-nistp384-cert-v01@openssh.com, 754ecdsa-sha2-nistp521-cert-v01@openssh.com, 755sk-ssh-ed25519-cert-v01@openssh.com, 756sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 757rsa-sha2-512-cert-v01@openssh.com, 758rsa-sha2-256-cert-v01@openssh.com, 759ssh-ed25519, 760ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 761sk-ssh-ed25519@openssh.com, 762sk-ecdsa-sha2-nistp256@openssh.com, 763rsa-sha2-512,rsa-sha2-256 764.Ed 765.Pp 766The list of available signature algorithms may also be obtained using 767.Qq ssh -Q HostbasedAcceptedAlgorithms . 768This was formerly named HostbasedAcceptedKeyTypes. 769.It Cm HostbasedAuthentication 770Specifies whether rhosts or /etc/hosts.equiv authentication together 771with successful public key client host authentication is allowed 772(host-based authentication). 773The default is 774.Cm no . 775.It Cm HostbasedUsesNameFromPacketOnly 776Specifies whether or not the server will attempt to perform a reverse 777name lookup when matching the name in the 778.Pa ~/.shosts , 779.Pa ~/.rhosts , 780and 781.Pa /etc/hosts.equiv 782files during 783.Cm HostbasedAuthentication . 784A setting of 785.Cm yes 786means that 787.Xr sshd 8 788uses the name supplied by the client rather than 789attempting to resolve the name from the TCP connection itself. 790The default is 791.Cm no . 792.It Cm HostCertificate 793Specifies a file containing a public host certificate. 794The certificate's public key must match a private host key already specified 795by 796.Cm HostKey . 797The default behaviour of 798.Xr sshd 8 799is not to load any certificates. 800.It Cm HostKey 801Specifies a file containing a private host key 802used by SSH. 803The defaults are 804.Pa /etc/ssh/ssh_host_ecdsa_key , 805.Pa /etc/ssh/ssh_host_ed25519_key 806and 807.Pa /etc/ssh/ssh_host_rsa_key . 808.Pp 809Note that 810.Xr sshd 8 811will refuse to use a file if it is group/world-accessible 812and that the 813.Cm HostKeyAlgorithms 814option restricts which of the keys are actually used by 815.Xr sshd 8 . 816.Pp 817It is possible to have multiple host key files. 818It is also possible to specify public host key files instead. 819In this case operations on the private key will be delegated 820to an 821.Xr ssh-agent 1 . 822.It Cm HostKeyAgent 823Identifies the UNIX-domain socket used to communicate 824with an agent that has access to the private host keys. 825If the string 826.Qq SSH_AUTH_SOCK 827is specified, the location of the socket will be read from the 828.Ev SSH_AUTH_SOCK 829environment variable. 830.It Cm HostKeyAlgorithms 831Specifies the host key signature algorithms 832that the server offers. 833The default for this option is: 834.Bd -literal -offset 3n 835ssh-ed25519-cert-v01@openssh.com, 836ecdsa-sha2-nistp256-cert-v01@openssh.com, 837ecdsa-sha2-nistp384-cert-v01@openssh.com, 838ecdsa-sha2-nistp521-cert-v01@openssh.com, 839sk-ssh-ed25519-cert-v01@openssh.com, 840sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 841rsa-sha2-512-cert-v01@openssh.com, 842rsa-sha2-256-cert-v01@openssh.com, 843ssh-ed25519, 844ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 845sk-ssh-ed25519@openssh.com, 846sk-ecdsa-sha2-nistp256@openssh.com, 847rsa-sha2-512,rsa-sha2-256 848.Ed 849.Pp 850The list of available signature algorithms may also be obtained using 851.Qq ssh -Q HostKeyAlgorithms . 852.It Cm IgnoreRhosts 853Specifies whether to ignore per-user 854.Pa .rhosts 855and 856.Pa .shosts 857files during 858.Cm HostbasedAuthentication . 859The system-wide 860.Pa /etc/hosts.equiv 861and 862.Pa /etc/shosts.equiv 863are still used regardless of this setting. 864.Pp 865Accepted values are 866.Cm yes 867(the default) to ignore all per-user files, 868.Cm shosts-only 869to allow the use of 870.Pa .shosts 871but to ignore 872.Pa .rhosts 873or 874.Cm no 875to allow both 876.Pa .shosts 877and 878.Pa rhosts . 879.It Cm IgnoreUserKnownHosts 880Specifies whether 881.Xr sshd 8 882should ignore the user's 883.Pa ~/.ssh/known_hosts 884during 885.Cm HostbasedAuthentication 886and use only the system-wide known hosts file 887.Pa /etc/ssh/ssh_known_hosts . 888The default is 889.Dq no . 890.It Cm Include 891Include the specified configuration file(s). 892Multiple pathnames may be specified and each pathname may contain 893.Xr glob 7 894wildcards that will be expanded and processed in lexical order. 895Files without absolute paths are assumed to be in 896.Pa /etc/ssh . 897An 898.Cm Include 899directive may appear inside a 900.Cm Match 901block 902to perform conditional inclusion. 903.It Cm IPQoS 904Specifies the IPv4 type-of-service or DSCP class for the connection. 905Accepted values are 906.Cm af11 , 907.Cm af12 , 908.Cm af13 , 909.Cm af21 , 910.Cm af22 , 911.Cm af23 , 912.Cm af31 , 913.Cm af32 , 914.Cm af33 , 915.Cm af41 , 916.Cm af42 , 917.Cm af43 , 918.Cm cs0 , 919.Cm cs1 , 920.Cm cs2 , 921.Cm cs3 , 922.Cm cs4 , 923.Cm cs5 , 924.Cm cs6 , 925.Cm cs7 , 926.Cm ef , 927.Cm le , 928.Cm lowdelay , 929.Cm throughput , 930.Cm reliability , 931a numeric value, or 932.Cm none 933to use the operating system default. 934This option may take one or two arguments, separated by whitespace. 935If one argument is specified, it is used as the packet class unconditionally. 936If two values are specified, the first is automatically selected for 937interactive sessions and the second for non-interactive sessions. 938The default is 939.Cm af21 940(Low-Latency Data) 941for interactive sessions and 942.Cm cs1 943(Lower Effort) 944for non-interactive sessions. 945.It Cm KbdInteractiveAuthentication 946Specifies whether to allow keyboard-interactive authentication. 947All authentication styles from 948.Xr login.conf 5 949are supported. 950The default is 951.Cm yes . 952The argument to this keyword must be 953.Cm yes 954or 955.Cm no . 956.Cm ChallengeResponseAuthentication 957is a deprecated alias for this. 958.It Cm KerberosAuthentication 959Specifies whether the password provided by the user for 960.Cm PasswordAuthentication 961will be validated through the Kerberos KDC. 962To use this option, the server needs a 963Kerberos servtab which allows the verification of the KDC's identity. 964The default is 965.Cm no . 966.It Cm KerberosGetAFSToken 967If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 968an AFS token before accessing the user's home directory. 969The default is 970.Cm no . 971.It Cm KerberosOrLocalPasswd 972If password authentication through Kerberos fails then 973the password will be validated via any additional local mechanism 974such as 975.Pa /etc/passwd . 976The default is 977.Cm yes . 978.It Cm KerberosTicketCleanup 979Specifies whether to automatically destroy the user's ticket cache 980file on logout. 981The default is 982.Cm yes . 983.It Cm KexAlgorithms 984Specifies the available KEX (Key Exchange) algorithms. 985Multiple algorithms must be comma-separated. 986Alternately if the specified list begins with a 987.Sq + 988character, then the specified algorithms will be appended to the default set 989instead of replacing them. 990If the specified list begins with a 991.Sq - 992character, then the specified algorithms (including wildcards) will be removed 993from the default set instead of replacing them. 994If the specified list begins with a 995.Sq ^ 996character, then the specified algorithms will be placed at the head of the 997default set. 998The supported algorithms are: 999.Pp 1000.Bl -item -compact -offset indent 1001.It 1002curve25519-sha256 1003.It 1004curve25519-sha256@libssh.org 1005.It 1006diffie-hellman-group1-sha1 1007.It 1008diffie-hellman-group14-sha1 1009.It 1010diffie-hellman-group14-sha256 1011.It 1012diffie-hellman-group16-sha512 1013.It 1014diffie-hellman-group18-sha512 1015.It 1016diffie-hellman-group-exchange-sha1 1017.It 1018diffie-hellman-group-exchange-sha256 1019.It 1020ecdh-sha2-nistp256 1021.It 1022ecdh-sha2-nistp384 1023.It 1024ecdh-sha2-nistp521 1025.It 1026sntrup761x25519-sha512@openssh.com 1027.El 1028.Pp 1029The default is: 1030.Bd -literal -offset indent 1031sntrup761x25519-sha512@openssh.com, 1032curve25519-sha256,curve25519-sha256@libssh.org, 1033ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 1034diffie-hellman-group-exchange-sha256, 1035diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 1036diffie-hellman-group14-sha256 1037.Ed 1038.Pp 1039The list of available key exchange algorithms may also be obtained using 1040.Qq ssh -Q KexAlgorithms . 1041.It Cm ListenAddress 1042Specifies the local addresses 1043.Xr sshd 8 1044should listen on. 1045The following forms may be used: 1046.Pp 1047.Bl -item -offset indent -compact 1048.It 1049.Cm ListenAddress 1050.Sm off 1051.Ar hostname | address 1052.Sm on 1053.Op Cm rdomain Ar domain 1054.It 1055.Cm ListenAddress 1056.Sm off 1057.Ar hostname : port 1058.Sm on 1059.Op Cm rdomain Ar domain 1060.It 1061.Cm ListenAddress 1062.Sm off 1063.Ar IPv4_address : port 1064.Sm on 1065.Op Cm rdomain Ar domain 1066.It 1067.Cm ListenAddress 1068.Sm off 1069.Oo Ar hostname | address Oc : Ar port 1070.Sm on 1071.Op Cm rdomain Ar domain 1072.El 1073.Pp 1074The optional 1075.Cm rdomain 1076qualifier requests 1077.Xr sshd 8 1078listen in an explicit routing domain. 1079If 1080.Ar port 1081is not specified, 1082sshd will listen on the address and all 1083.Cm Port 1084options specified. 1085The default is to listen on all local addresses on the current default 1086routing domain. 1087Multiple 1088.Cm ListenAddress 1089options are permitted. 1090For more information on routing domains, see 1091.Xr rdomain 4 . 1092.It Cm LoginGraceTime 1093The server disconnects after this time if the user has not 1094successfully logged in. 1095If the value is 0, there is no time limit. 1096The default is 120 seconds. 1097.It Cm LogLevel 1098Gives the verbosity level that is used when logging messages from 1099.Xr sshd 8 . 1100The possible values are: 1101QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1102The default is INFO. 1103DEBUG and DEBUG1 are equivalent. 1104DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1105Logging with a DEBUG level violates the privacy of users and is not recommended. 1106.It Cm LogVerbose 1107Specify one or more overrides to LogLevel. 1108An override consists of a pattern lists that matches the source file, function 1109and line number to force detailed logging for. 1110For example, an override pattern of: 1111.Bd -literal -offset indent 1112kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1113.Ed 1114.Pp 1115would enable detailed logging for line 1000 of 1116.Pa kex.c , 1117everything in the 1118.Fn kex_exchange_identification 1119function, and all code in the 1120.Pa packet.c 1121file. 1122This option is intended for debugging and no overrides are enabled by default. 1123.It Cm MACs 1124Specifies the available MAC (message authentication code) algorithms. 1125The MAC algorithm is used for data integrity protection. 1126Multiple algorithms must be comma-separated. 1127If the specified list begins with a 1128.Sq + 1129character, then the specified algorithms will be appended to the default set 1130instead of replacing them. 1131If the specified list begins with a 1132.Sq - 1133character, then the specified algorithms (including wildcards) will be removed 1134from the default set instead of replacing them. 1135If the specified list begins with a 1136.Sq ^ 1137character, then the specified algorithms will be placed at the head of the 1138default set. 1139.Pp 1140The algorithms that contain 1141.Qq -etm 1142calculate the MAC after encryption (encrypt-then-mac). 1143These are considered safer and their use recommended. 1144The supported MACs are: 1145.Pp 1146.Bl -item -compact -offset indent 1147.It 1148hmac-md5 1149.It 1150hmac-md5-96 1151.It 1152hmac-sha1 1153.It 1154hmac-sha1-96 1155.It 1156hmac-sha2-256 1157.It 1158hmac-sha2-512 1159.It 1160umac-64@openssh.com 1161.It 1162umac-128@openssh.com 1163.It 1164hmac-md5-etm@openssh.com 1165.It 1166hmac-md5-96-etm@openssh.com 1167.It 1168hmac-sha1-etm@openssh.com 1169.It 1170hmac-sha1-96-etm@openssh.com 1171.It 1172hmac-sha2-256-etm@openssh.com 1173.It 1174hmac-sha2-512-etm@openssh.com 1175.It 1176umac-64-etm@openssh.com 1177.It 1178umac-128-etm@openssh.com 1179.El 1180.Pp 1181The default is: 1182.Bd -literal -offset indent 1183umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1184hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1185hmac-sha1-etm@openssh.com, 1186umac-64@openssh.com,umac-128@openssh.com, 1187hmac-sha2-256,hmac-sha2-512,hmac-sha1 1188.Ed 1189.Pp 1190The list of available MAC algorithms may also be obtained using 1191.Qq ssh -Q mac . 1192.It Cm Match 1193Introduces a conditional block. 1194If all of the criteria on the 1195.Cm Match 1196line are satisfied, the keywords on the following lines override those 1197set in the global section of the config file, until either another 1198.Cm Match 1199line or the end of the file. 1200If a keyword appears in multiple 1201.Cm Match 1202blocks that are satisfied, only the first instance of the keyword is 1203applied. 1204.Pp 1205The arguments to 1206.Cm Match 1207are one or more criteria-pattern pairs or the single token 1208.Cm All 1209which matches all criteria. 1210The available criteria are 1211.Cm User , 1212.Cm Group , 1213.Cm Host , 1214.Cm LocalAddress , 1215.Cm LocalPort , 1216.Cm RDomain , 1217and 1218.Cm Address 1219(with 1220.Cm RDomain 1221representing the 1222.Xr rdomain 4 1223on which the connection was received). 1224.Pp 1225The match patterns may consist of single entries or comma-separated 1226lists and may use the wildcard and negation operators described in the 1227.Sx PATTERNS 1228section of 1229.Xr ssh_config 5 . 1230.Pp 1231The patterns in an 1232.Cm Address 1233criteria may additionally contain addresses to match in CIDR 1234address/masklen format, 1235such as 192.0.2.0/24 or 2001:db8::/32. 1236Note that the mask length provided must be consistent with the address - 1237it is an error to specify a mask length that is too long for the address 1238or one with bits set in this host portion of the address. 1239For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1240.Pp 1241Only a subset of keywords may be used on the lines following a 1242.Cm Match 1243keyword. 1244Available keywords are 1245.Cm AcceptEnv , 1246.Cm AllowAgentForwarding , 1247.Cm AllowGroups , 1248.Cm AllowStreamLocalForwarding , 1249.Cm AllowTcpForwarding , 1250.Cm AllowUsers , 1251.Cm AuthenticationMethods , 1252.Cm AuthorizedKeysCommand , 1253.Cm AuthorizedKeysCommandUser , 1254.Cm AuthorizedKeysFile , 1255.Cm AuthorizedPrincipalsCommand , 1256.Cm AuthorizedPrincipalsCommandUser , 1257.Cm AuthorizedPrincipalsFile , 1258.Cm Banner , 1259.Cm CASignatureAlgorithms , 1260.Cm ChrootDirectory , 1261.Cm ClientAliveCountMax , 1262.Cm ClientAliveInterval , 1263.Cm DenyGroups , 1264.Cm DenyUsers , 1265.Cm DisableForwarding , 1266.Cm ExposeAuthInfo , 1267.Cm ForceCommand , 1268.Cm GatewayPorts , 1269.Cm GSSAPIAuthentication , 1270.Cm HostbasedAcceptedAlgorithms , 1271.Cm HostbasedAuthentication , 1272.Cm HostbasedUsesNameFromPacketOnly , 1273.Cm IgnoreRhosts , 1274.Cm Include , 1275.Cm IPQoS , 1276.Cm KbdInteractiveAuthentication , 1277.Cm KerberosAuthentication , 1278.Cm LogLevel , 1279.Cm MaxAuthTries , 1280.Cm MaxSessions , 1281.Cm PasswordAuthentication , 1282.Cm PermitEmptyPasswords , 1283.Cm PermitListen , 1284.Cm PermitOpen , 1285.Cm PermitRootLogin , 1286.Cm PermitTTY , 1287.Cm PermitTunnel , 1288.Cm PermitUserRC , 1289.Cm PubkeyAcceptedAlgorithms , 1290.Cm PubkeyAuthentication , 1291.Cm PubkeyAuthOptions , 1292.Cm RekeyLimit , 1293.Cm RevokedKeys , 1294.Cm RDomain , 1295.Cm SetEnv , 1296.Cm StreamLocalBindMask , 1297.Cm StreamLocalBindUnlink , 1298.Cm TrustedUserCAKeys , 1299.Cm X11DisplayOffset , 1300.Cm X11Forwarding 1301and 1302.Cm X11UseLocalhost . 1303.It Cm MaxAuthTries 1304Specifies the maximum number of authentication attempts permitted per 1305connection. 1306Once the number of failures reaches half this value, 1307additional failures are logged. 1308The default is 6. 1309.It Cm MaxSessions 1310Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1311sessions permitted per network connection. 1312Multiple sessions may be established by clients that support connection 1313multiplexing. 1314Setting 1315.Cm MaxSessions 1316to 1 will effectively disable session multiplexing, whereas setting it to 0 1317will prevent all shell, login and subsystem sessions while still permitting 1318forwarding. 1319The default is 10. 1320.It Cm MaxStartups 1321Specifies the maximum number of concurrent unauthenticated connections to the 1322SSH daemon. 1323Additional connections will be dropped until authentication succeeds or the 1324.Cm LoginGraceTime 1325expires for a connection. 1326The default is 10:30:100. 1327.Pp 1328Alternatively, random early drop can be enabled by specifying 1329the three colon separated values 1330start:rate:full (e.g. "10:30:60"). 1331.Xr sshd 8 1332will refuse connection attempts with a probability of rate/100 (30%) 1333if there are currently start (10) unauthenticated connections. 1334The probability increases linearly and all connection attempts 1335are refused if the number of unauthenticated connections reaches full (60). 1336.It Cm ModuliFile 1337Specifies the 1338.Xr moduli 5 1339file that contains the Diffie-Hellman groups used for the 1340.Dq diffie-hellman-group-exchange-sha1 1341and 1342.Dq diffie-hellman-group-exchange-sha256 1343key exchange methods. 1344The default is 1345.Pa /etc/moduli . 1346.It Cm PasswordAuthentication 1347Specifies whether password authentication is allowed. 1348The default is 1349.Cm yes . 1350.It Cm PermitEmptyPasswords 1351When password authentication is allowed, it specifies whether the 1352server allows login to accounts with empty password strings. 1353The default is 1354.Cm no . 1355.It Cm PermitListen 1356Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1357The listen specification must be one of the following forms: 1358.Pp 1359.Bl -item -offset indent -compact 1360.It 1361.Cm PermitListen 1362.Sm off 1363.Ar port 1364.Sm on 1365.It 1366.Cm PermitListen 1367.Sm off 1368.Ar host : port 1369.Sm on 1370.El 1371.Pp 1372Multiple permissions may be specified by separating them with whitespace. 1373An argument of 1374.Cm any 1375can be used to remove all restrictions and permit any listen requests. 1376An argument of 1377.Cm none 1378can be used to prohibit all listen requests. 1379The host name may contain wildcards as described in the PATTERNS section in 1380.Xr ssh_config 5 . 1381The wildcard 1382.Sq * 1383can also be used in place of a port number to allow all ports. 1384By default all port forwarding listen requests are permitted. 1385Note that the 1386.Cm GatewayPorts 1387option may further restrict which addresses may be listened on. 1388Note also that 1389.Xr ssh 1 1390will request a listen host of 1391.Dq localhost 1392if no listen host was specifically requested, and this name is 1393treated differently to explicit localhost addresses of 1394.Dq 127.0.0.1 1395and 1396.Dq ::1 . 1397.It Cm PermitOpen 1398Specifies the destinations to which TCP port forwarding is permitted. 1399The forwarding specification must be one of the following forms: 1400.Pp 1401.Bl -item -offset indent -compact 1402.It 1403.Cm PermitOpen 1404.Sm off 1405.Ar host : port 1406.Sm on 1407.It 1408.Cm PermitOpen 1409.Sm off 1410.Ar IPv4_addr : port 1411.Sm on 1412.It 1413.Cm PermitOpen 1414.Sm off 1415.Ar \&[ IPv6_addr \&] : port 1416.Sm on 1417.El 1418.Pp 1419Multiple forwards may be specified by separating them with whitespace. 1420An argument of 1421.Cm any 1422can be used to remove all restrictions and permit any forwarding requests. 1423An argument of 1424.Cm none 1425can be used to prohibit all forwarding requests. 1426The wildcard 1427.Sq * 1428can be used for host or port to allow all hosts or ports respectively. 1429Otherwise, no pattern matching or address lookups are performed on supplied 1430names. 1431By default all port forwarding requests are permitted. 1432.It Cm PermitRootLogin 1433Specifies whether root can log in using 1434.Xr ssh 1 . 1435The argument must be 1436.Cm yes , 1437.Cm prohibit-password , 1438.Cm forced-commands-only , 1439or 1440.Cm no . 1441The default is 1442.Cm prohibit-password . 1443.Pp 1444If this option is set to 1445.Cm prohibit-password 1446(or its deprecated alias, 1447.Cm without-password ) , 1448password and keyboard-interactive authentication are disabled for root. 1449.Pp 1450If this option is set to 1451.Cm forced-commands-only , 1452root login with public key authentication will be allowed, 1453but only if the 1454.Ar command 1455option has been specified 1456(which may be useful for taking remote backups even if root login is 1457normally not allowed). 1458All other authentication methods are disabled for root. 1459.Pp 1460If this option is set to 1461.Cm no , 1462root is not allowed to log in. 1463.It Cm PermitTTY 1464Specifies whether 1465.Xr pty 4 1466allocation is permitted. 1467The default is 1468.Cm yes . 1469.It Cm PermitTunnel 1470Specifies whether 1471.Xr tun 4 1472device forwarding is allowed. 1473The argument must be 1474.Cm yes , 1475.Cm point-to-point 1476(layer 3), 1477.Cm ethernet 1478(layer 2), or 1479.Cm no . 1480Specifying 1481.Cm yes 1482permits both 1483.Cm point-to-point 1484and 1485.Cm ethernet . 1486The default is 1487.Cm no . 1488.Pp 1489Independent of this setting, the permissions of the selected 1490.Xr tun 4 1491device must allow access to the user. 1492.It Cm PermitUserEnvironment 1493Specifies whether 1494.Pa ~/.ssh/environment 1495and 1496.Cm environment= 1497options in 1498.Pa ~/.ssh/authorized_keys 1499are processed by 1500.Xr sshd 8 . 1501Valid options are 1502.Cm yes , 1503.Cm no 1504or a pattern-list specifying which environment variable names to accept 1505(for example 1506.Qq LANG,LC_* ) . 1507The default is 1508.Cm no . 1509Enabling environment processing may enable users to bypass access 1510restrictions in some configurations using mechanisms such as 1511.Ev LD_PRELOAD . 1512.It Cm PermitUserRC 1513Specifies whether any 1514.Pa ~/.ssh/rc 1515file is executed. 1516The default is 1517.Cm yes . 1518.It Cm PerSourceMaxStartups 1519Specifies the number of unauthenticated connections allowed from a 1520given source address, or 1521.Dq none 1522if there is no limit. 1523This limit is applied in addition to 1524.Cm MaxStartups , 1525whichever is lower. 1526The default is 1527.Cm none . 1528.It Cm PerSourceNetBlockSize 1529Specifies the number of bits of source address that are grouped together 1530for the purposes of applying PerSourceMaxStartups limits. 1531Values for IPv4 and optionally IPv6 may be specified, separated by a colon. 1532The default is 1533.Cm 32:128 , 1534which means each address is considered individually. 1535.It Cm PidFile 1536Specifies the file that contains the process ID of the 1537SSH daemon, or 1538.Cm none 1539to not write one. 1540The default is 1541.Pa /var/run/sshd.pid . 1542.It Cm Port 1543Specifies the port number that 1544.Xr sshd 8 1545listens on. 1546The default is 22. 1547Multiple options of this type are permitted. 1548See also 1549.Cm ListenAddress . 1550.It Cm PrintLastLog 1551Specifies whether 1552.Xr sshd 8 1553should print the date and time of the last user login when a user logs 1554in interactively. 1555The default is 1556.Cm yes . 1557.It Cm PrintMotd 1558Specifies whether 1559.Xr sshd 8 1560should print 1561.Pa /etc/motd 1562when a user logs in interactively. 1563(On some systems it is also printed by the shell, 1564.Pa /etc/profile , 1565or equivalent.) 1566The default is 1567.Cm yes . 1568.It Cm PubkeyAcceptedAlgorithms 1569Specifies the signature algorithms that will be accepted for public key 1570authentication as a list of comma-separated patterns. 1571Alternately if the specified list begins with a 1572.Sq + 1573character, then the specified algorithms will be appended to the default set 1574instead of replacing them. 1575If the specified list begins with a 1576.Sq - 1577character, then the specified algorithms (including wildcards) will be removed 1578from the default set instead of replacing them. 1579If the specified list begins with a 1580.Sq ^ 1581character, then the specified algorithms will be placed at the head of the 1582default set. 1583The default for this option is: 1584.Bd -literal -offset 3n 1585ssh-ed25519-cert-v01@openssh.com, 1586ecdsa-sha2-nistp256-cert-v01@openssh.com, 1587ecdsa-sha2-nistp384-cert-v01@openssh.com, 1588ecdsa-sha2-nistp521-cert-v01@openssh.com, 1589sk-ssh-ed25519-cert-v01@openssh.com, 1590sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1591rsa-sha2-512-cert-v01@openssh.com, 1592rsa-sha2-256-cert-v01@openssh.com, 1593ssh-ed25519, 1594ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1595sk-ssh-ed25519@openssh.com, 1596sk-ecdsa-sha2-nistp256@openssh.com, 1597rsa-sha2-512,rsa-sha2-256 1598.Ed 1599.Pp 1600The list of available signature algorithms may also be obtained using 1601.Qq ssh -Q PubkeyAcceptedAlgorithms . 1602.It Cm PubkeyAuthOptions 1603Sets one or more public key authentication options. 1604The supported keywords are: 1605.Cm none 1606(the default; indicating no additional options are enabled), 1607.Cm touch-required 1608and 1609.Cm verify-required . 1610.Pp 1611The 1612.Cm touch-required 1613option causes public key authentication using a FIDO authenticator algorithm 1614(i.e.\& 1615.Cm ecdsa-sk 1616or 1617.Cm ed25519-sk ) 1618to always require the signature to attest that a physically present user 1619explicitly confirmed the authentication (usually by touching the authenticator). 1620By default, 1621.Xr sshd 8 1622requires user presence unless overridden with an authorized_keys option. 1623The 1624.Cm touch-required 1625flag disables this override. 1626.Pp 1627The 1628.Cm verify-required 1629option requires a FIDO key signature attest that the user was verified, 1630e.g. via a PIN. 1631.Pp 1632Neither the 1633.Cm touch-required 1634or 1635.Cm verify-required 1636options have any effect for other, non-FIDO, public key types. 1637.It Cm PubkeyAuthentication 1638Specifies whether public key authentication is allowed. 1639The default is 1640.Cm yes . 1641.It Cm RekeyLimit 1642Specifies the maximum amount of data that may be transmitted or received 1643before the session key is renegotiated, optionally followed by a maximum 1644amount of time that may pass before the session key is renegotiated. 1645The first argument is specified in bytes and may have a suffix of 1646.Sq K , 1647.Sq M , 1648or 1649.Sq G 1650to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1651The default is between 1652.Sq 1G 1653and 1654.Sq 4G , 1655depending on the cipher. 1656The optional second value is specified in seconds and may use any of the 1657units documented in the 1658.Sx TIME FORMATS 1659section. 1660The default value for 1661.Cm RekeyLimit 1662is 1663.Cm default none , 1664which means that rekeying is performed after the cipher's default amount 1665of data has been sent or received and no time based rekeying is done. 1666.It Cm RequiredRSASize 1667Specifies the minimum RSA key size (in bits) that 1668.Xr sshd 8 1669will accept. 1670User and host-based authentication keys smaller than this limit will be 1671refused. 1672The default is 1673.Cm 1024 1674bits. 1675Note that this limit may only be raised from the default. 1676.It Cm RevokedKeys 1677Specifies revoked public keys file, or 1678.Cm none 1679to not use one. 1680Keys listed in this file will be refused for public key authentication. 1681Note that if this file is not readable, then public key authentication will 1682be refused for all users. 1683Keys may be specified as a text file, listing one public key per line, or as 1684an OpenSSH Key Revocation List (KRL) as generated by 1685.Xr ssh-keygen 1 . 1686For more information on KRLs, see the KEY REVOCATION LISTS section in 1687.Xr ssh-keygen 1 . 1688.It Cm RDomain 1689Specifies an explicit routing domain that is applied after authentication 1690has completed. 1691The user session, as well as any forwarded or listening IP sockets, 1692will be bound to this 1693.Xr rdomain 4 . 1694If the routing domain is set to 1695.Cm \&%D , 1696then the domain in which the incoming connection was received will be applied. 1697.It Cm SecurityKeyProvider 1698Specifies a path to a library that will be used when loading 1699FIDO authenticator-hosted keys, overriding the default of using 1700the built-in USB HID support. 1701.It Cm SetEnv 1702Specifies one or more environment variables to set in child sessions started 1703by 1704.Xr sshd 8 1705as 1706.Dq NAME=VALUE . 1707The environment value may be quoted (e.g. if it contains whitespace 1708characters). 1709Environment variables set by 1710.Cm SetEnv 1711override the default environment and any variables specified by the user 1712via 1713.Cm AcceptEnv 1714or 1715.Cm PermitUserEnvironment . 1716.It Cm StreamLocalBindMask 1717Sets the octal file creation mode mask 1718.Pq umask 1719used when creating a Unix-domain socket file for local or remote 1720port forwarding. 1721This option is only used for port forwarding to a Unix-domain socket file. 1722.Pp 1723The default value is 0177, which creates a Unix-domain socket file that is 1724readable and writable only by the owner. 1725Note that not all operating systems honor the file mode on Unix-domain 1726socket files. 1727.It Cm StreamLocalBindUnlink 1728Specifies whether to remove an existing Unix-domain socket file for local 1729or remote port forwarding before creating a new one. 1730If the socket file already exists and 1731.Cm StreamLocalBindUnlink 1732is not enabled, 1733.Nm sshd 1734will be unable to forward the port to the Unix-domain socket file. 1735This option is only used for port forwarding to a Unix-domain socket file. 1736.Pp 1737The argument must be 1738.Cm yes 1739or 1740.Cm no . 1741The default is 1742.Cm no . 1743.It Cm StrictModes 1744Specifies whether 1745.Xr sshd 8 1746should check file modes and ownership of the 1747user's files and home directory before accepting login. 1748This is normally desirable because novices sometimes accidentally leave their 1749directory or files world-writable. 1750The default is 1751.Cm yes . 1752Note that this does not apply to 1753.Cm ChrootDirectory , 1754whose permissions and ownership are checked unconditionally. 1755.It Cm Subsystem 1756Configures an external subsystem (e.g. file transfer daemon). 1757Arguments should be a subsystem name and a command (with optional arguments) 1758to execute upon subsystem request. 1759.Pp 1760The command 1761.Cm sftp-server 1762implements the SFTP file transfer subsystem. 1763.Pp 1764Alternately the name 1765.Cm internal-sftp 1766implements an in-process SFTP server. 1767This may simplify configurations using 1768.Cm ChrootDirectory 1769to force a different filesystem root on clients. 1770.Pp 1771By default no subsystems are defined. 1772.It Cm SyslogFacility 1773Gives the facility code that is used when logging messages from 1774.Xr sshd 8 . 1775The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1776LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1777The default is AUTH. 1778.It Cm TCPKeepAlive 1779Specifies whether the system should send TCP keepalive messages to the 1780other side. 1781If they are sent, death of the connection or crash of one 1782of the machines will be properly noticed. 1783However, this means that 1784connections will die if the route is down temporarily, and some people 1785find it annoying. 1786On the other hand, if TCP keepalives are not sent, 1787sessions may hang indefinitely on the server, leaving 1788.Qq ghost 1789users and consuming server resources. 1790.Pp 1791The default is 1792.Cm yes 1793(to send TCP keepalive messages), and the server will notice 1794if the network goes down or the client host crashes. 1795This avoids infinitely hanging sessions. 1796.Pp 1797To disable TCP keepalive messages, the value should be set to 1798.Cm no . 1799.It Cm TrustedUserCAKeys 1800Specifies a file containing public keys of certificate authorities that are 1801trusted to sign user certificates for authentication, or 1802.Cm none 1803to not use one. 1804Keys are listed one per line; empty lines and comments starting with 1805.Ql # 1806are allowed. 1807If a certificate is presented for authentication and has its signing CA key 1808listed in this file, then it may be used for authentication for any user 1809listed in the certificate's principals list. 1810Note that certificates that lack a list of principals will not be permitted 1811for authentication using 1812.Cm TrustedUserCAKeys . 1813For more details on certificates, see the CERTIFICATES section in 1814.Xr ssh-keygen 1 . 1815.It Cm UseDNS 1816Specifies whether 1817.Xr sshd 8 1818should look up the remote host name, and to check that 1819the resolved host name for the remote IP address maps back to the 1820very same IP address. 1821.Pp 1822If this option is set to 1823.Cm no 1824(the default) then only addresses and not host names may be used in 1825.Pa ~/.ssh/authorized_keys 1826.Cm from 1827and 1828.Nm 1829.Cm Match 1830.Cm Host 1831directives. 1832.It Cm VersionAddendum 1833Optionally specifies additional text to append to the SSH protocol banner 1834sent by the server upon connection. 1835The default is 1836.Cm none . 1837.It Cm X11DisplayOffset 1838Specifies the first display number available for 1839.Xr sshd 8 Ns 's 1840X11 forwarding. 1841This prevents sshd from interfering with real X11 servers. 1842The default is 10. 1843.It Cm X11Forwarding 1844Specifies whether X11 forwarding is permitted. 1845The argument must be 1846.Cm yes 1847or 1848.Cm no . 1849The default is 1850.Cm no . 1851.Pp 1852When X11 forwarding is enabled, there may be additional exposure to 1853the server and to client displays if the 1854.Xr sshd 8 1855proxy display is configured to listen on the wildcard address (see 1856.Cm X11UseLocalhost ) , 1857though this is not the default. 1858Additionally, the authentication spoofing and authentication data 1859verification and substitution occur on the client side. 1860The security risk of using X11 forwarding is that the client's X11 1861display server may be exposed to attack when the SSH client requests 1862forwarding (see the warnings for 1863.Cm ForwardX11 1864in 1865.Xr ssh_config 5 ) . 1866A system administrator may have a stance in which they want to 1867protect clients that may expose themselves to attack by unwittingly 1868requesting X11 forwarding, which can warrant a 1869.Cm no 1870setting. 1871.Pp 1872Note that disabling X11 forwarding does not prevent users from 1873forwarding X11 traffic, as users can always install their own forwarders. 1874.It Cm X11UseLocalhost 1875Specifies whether 1876.Xr sshd 8 1877should bind the X11 forwarding server to the loopback address or to 1878the wildcard address. 1879By default, 1880sshd binds the forwarding server to the loopback address and sets the 1881hostname part of the 1882.Ev DISPLAY 1883environment variable to 1884.Cm localhost . 1885This prevents remote hosts from connecting to the proxy display. 1886However, some older X11 clients may not function with this 1887configuration. 1888.Cm X11UseLocalhost 1889may be set to 1890.Cm no 1891to specify that the forwarding server should be bound to the wildcard 1892address. 1893The argument must be 1894.Cm yes 1895or 1896.Cm no . 1897The default is 1898.Cm yes . 1899.It Cm XAuthLocation 1900Specifies the full pathname of the 1901.Xr xauth 1 1902program, or 1903.Cm none 1904to not use one. 1905The default is 1906.Pa /usr/X11R6/bin/xauth . 1907.El 1908.Sh TIME FORMATS 1909.Xr sshd 8 1910command-line arguments and configuration file options that specify time 1911may be expressed using a sequence of the form: 1912.Sm off 1913.Ar time Op Ar qualifier , 1914.Sm on 1915where 1916.Ar time 1917is a positive integer value and 1918.Ar qualifier 1919is one of the following: 1920.Pp 1921.Bl -tag -width Ds -compact -offset indent 1922.It Aq Cm none 1923seconds 1924.It Cm s | Cm S 1925seconds 1926.It Cm m | Cm M 1927minutes 1928.It Cm h | Cm H 1929hours 1930.It Cm d | Cm D 1931days 1932.It Cm w | Cm W 1933weeks 1934.El 1935.Pp 1936Each member of the sequence is added together to calculate 1937the total time value. 1938.Pp 1939Time format examples: 1940.Pp 1941.Bl -tag -width Ds -compact -offset indent 1942.It 600 1943600 seconds (10 minutes) 1944.It 10m 194510 minutes 1946.It 1h30m 19471 hour 30 minutes (90 minutes) 1948.El 1949.Sh TOKENS 1950Arguments to some keywords can make use of tokens, 1951which are expanded at runtime: 1952.Pp 1953.Bl -tag -width XXXX -offset indent -compact 1954.It %% 1955A literal 1956.Sq % . 1957.It \&%D 1958The routing domain in which the incoming connection was received. 1959.It %F 1960The fingerprint of the CA key. 1961.It %f 1962The fingerprint of the key or certificate. 1963.It %h 1964The home directory of the user. 1965.It %i 1966The key ID in the certificate. 1967.It %K 1968The base64-encoded CA key. 1969.It %k 1970The base64-encoded key or certificate for authentication. 1971.It %s 1972The serial number of the certificate. 1973.It \&%T 1974The type of the CA key. 1975.It %t 1976The key or certificate type. 1977.It \&%U 1978The numeric user ID of the target user. 1979.It %u 1980The username. 1981.El 1982.Pp 1983.Cm AuthorizedKeysCommand 1984accepts the tokens %%, %f, %h, %k, %t, %U, and %u. 1985.Pp 1986.Cm AuthorizedKeysFile 1987accepts the tokens %%, %h, %U, and %u. 1988.Pp 1989.Cm AuthorizedPrincipalsCommand 1990accepts the tokens %%, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 1991.Pp 1992.Cm AuthorizedPrincipalsFile 1993accepts the tokens %%, %h, %U, and %u. 1994.Pp 1995.Cm ChrootDirectory 1996accepts the tokens %%, %h, %U, and %u. 1997.Pp 1998.Cm RoutingDomain 1999accepts the token %D. 2000.Sh FILES 2001.Bl -tag -width Ds 2002.It Pa /etc/ssh/sshd_config 2003Contains configuration data for 2004.Xr sshd 8 . 2005This file should be writable by root only, but it is recommended 2006(though not necessary) that it be world-readable. 2007.El 2008.Sh SEE ALSO 2009.Xr sftp-server 8 , 2010.Xr sshd 8 2011.Sh AUTHORS 2012.An -nosplit 2013OpenSSH is a derivative of the original and free 2014ssh 1.2.12 release by 2015.An Tatu Ylonen . 2016.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 2017.An Theo de Raadt 2018and 2019.An Dug Song 2020removed many bugs, re-added newer features and 2021created OpenSSH. 2022.An Markus Friedl 2023contributed the support for SSH protocol versions 1.5 and 2.0. 2024.An Niels Provos 2025and 2026.An Markus Friedl 2027contributed support for privilege separation. 2028