1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.175 2014/07/15 15:54:14 millert Exp $ 37.Dd $Mdocdate: July 15 2014 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH SSH daemon configuration file 43.Sh SYNOPSIS 44.Nm /etc/ssh/sshd_config 45.Sh DESCRIPTION 46.Xr sshd 8 47reads configuration data from 48.Pa /etc/ssh/sshd_config 49(or the file specified with 50.Fl f 51on the command line). 52The file contains keyword-argument pairs, one per line. 53Lines starting with 54.Ql # 55and empty lines are interpreted as comments. 56Arguments may optionally be enclosed in double quotes 57.Pq \&" 58in order to represent arguments containing spaces. 59.Pp 60The possible 61keywords and their meanings are as follows (note that 62keywords are case-insensitive and arguments are case-sensitive): 63.Bl -tag -width Ds 64.It Cm AcceptEnv 65Specifies what environment variables sent by the client will be copied into 66the session's 67.Xr environ 7 . 68See 69.Cm SendEnv 70in 71.Xr ssh_config 5 72for how to configure the client. 73Note that environment passing is only supported for protocol 2. 74Variables are specified by name, which may contain the wildcard characters 75.Ql * 76and 77.Ql \&? . 78Multiple environment variables may be separated by whitespace or spread 79across multiple 80.Cm AcceptEnv 81directives. 82Be warned that some environment variables could be used to bypass restricted 83user environments. 84For this reason, care should be taken in the use of this directive. 85The default is not to accept any environment variables. 86.It Cm AddressFamily 87Specifies which address family should be used by 88.Xr sshd 8 . 89Valid arguments are 90.Dq any , 91.Dq inet 92(use IPv4 only), or 93.Dq inet6 94(use IPv6 only). 95The default is 96.Dq any . 97.It Cm AllowAgentForwarding 98Specifies whether 99.Xr ssh-agent 1 100forwarding is permitted. 101The default is 102.Dq yes . 103Note that disabling agent forwarding does not improve security 104unless users are also denied shell access, as they can always install 105their own forwarders. 106.It Cm AllowGroups 107This keyword can be followed by a list of group name patterns, separated 108by spaces. 109If specified, login is allowed only for users whose primary 110group or supplementary group list matches one of the patterns. 111Only group names are valid; a numerical group ID is not recognized. 112By default, login is allowed for all groups. 113The allow/deny directives are processed in the following order: 114.Cm DenyUsers , 115.Cm AllowUsers , 116.Cm DenyGroups , 117and finally 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123.It Cm AllowTcpForwarding 124Specifies whether TCP forwarding is permitted. 125The available options are 126.Dq yes 127or 128.Dq all 129to allow TCP forwarding, 130.Dq no 131to prevent all TCP forwarding, 132.Dq local 133to allow local (from the perspective of 134.Xr ssh 1 ) 135forwarding only or 136.Dq remote 137to allow remote forwarding only. 138The default is 139.Dq yes . 140Note that disabling TCP forwarding does not improve security unless 141users are also denied shell access, as they can always install their 142own forwarders. 143.It Cm AllowStreamLocalForwarding 144Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 145The available options are 146.Dq yes 147or 148.Dq all 149to allow StreamLocal forwarding, 150.Dq no 151to prevent all StreamLocal forwarding, 152.Dq local 153to allow local (from the perspective of 154.Xr ssh 1 ) 155forwarding only or 156.Dq remote 157to allow remote forwarding only. 158The default is 159.Dq yes . 160Note that disabling StreamLocal forwarding does not improve security unless 161users are also denied shell access, as they can always install their 162own forwarders. 163.It Cm AllowUsers 164This keyword can be followed by a list of user name patterns, separated 165by spaces. 166If specified, login is allowed only for user names that 167match one of the patterns. 168Only user names are valid; a numerical user ID is not recognized. 169By default, login is allowed for all users. 170If the pattern takes the form USER@HOST then USER and HOST 171are separately checked, restricting logins to particular 172users from particular hosts. 173The allow/deny directives are processed in the following order: 174.Cm DenyUsers , 175.Cm AllowUsers , 176.Cm DenyGroups , 177and finally 178.Cm AllowGroups . 179.Pp 180See PATTERNS in 181.Xr ssh_config 5 182for more information on patterns. 183.It Cm AuthenticationMethods 184Specifies the authentication methods that must be successfully completed 185for a user to be granted access. 186This option must be followed by one or more comma-separated lists of 187authentication method names. 188Successful authentication requires completion of every method in at least 189one of these lists. 190.Pp 191For example, an argument of 192.Dq publickey,password publickey,keyboard-interactive 193would require the user to complete public key authentication, followed by 194either password or keyboard interactive authentication. 195Only methods that are next in one or more lists are offered at each stage, 196so for this example, it would not be possible to attempt password or 197keyboard-interactive authentication before public key. 198.Pp 199For keyboard interactive authentication it is also possible to 200restrict authentication to a specific device by appending a 201colon followed by the device identifier 202.Dq bsdauth , 203.Dq pam , 204or 205.Dq skey , 206depending on the server configuration. 207For example, 208.Dq keyboard-interactive:bsdauth 209would restrict keyboard interactive authentication to the 210.Dq bsdauth 211device. 212.Pp 213This option is only available for SSH protocol 2 and will yield a fatal 214error if enabled if protocol 1 is also enabled. 215Note that each authentication method listed should also be explicitly enabled 216in the configuration. 217The default is not to require multiple authentication; successful completion 218of a single authentication method is sufficient. 219.It Cm AuthorizedKeysCommand 220Specifies a program to be used to look up the user's public keys. 221The program must be owned by root and not writable by group or others. 222It will be invoked with a single argument of the username 223being authenticated, and should produce on standard output zero or 224more lines of authorized_keys output (see AUTHORIZED_KEYS in 225.Xr sshd 8 ) . 226If a key supplied by AuthorizedKeysCommand does not successfully authenticate 227and authorize the user then public key authentication continues using the usual 228.Cm AuthorizedKeysFile 229files. 230By default, no AuthorizedKeysCommand is run. 231.It Cm AuthorizedKeysCommandUser 232Specifies the user under whose account the AuthorizedKeysCommand is run. 233It is recommended to use a dedicated user that has no other role on the host 234than running authorized keys commands. 235.It Cm AuthorizedKeysFile 236Specifies the file that contains the public keys that can be used 237for user authentication. 238The format is described in the 239AUTHORIZED_KEYS FILE FORMAT 240section of 241.Xr sshd 8 . 242.Cm AuthorizedKeysFile 243may contain tokens of the form %T which are substituted during connection 244setup. 245The following tokens are defined: %% is replaced by a literal '%', 246%h is replaced by the home directory of the user being authenticated, and 247%u is replaced by the username of that user. 248After expansion, 249.Cm AuthorizedKeysFile 250is taken to be an absolute path or one relative to the user's home 251directory. 252Multiple files may be listed, separated by whitespace. 253The default is 254.Dq .ssh/authorized_keys .ssh/authorized_keys2 . 255.It Cm AuthorizedPrincipalsFile 256Specifies a file that lists principal names that are accepted for 257certificate authentication. 258When using certificates signed by a key listed in 259.Cm TrustedUserCAKeys , 260this file lists names, one of which must appear in the certificate for it 261to be accepted for authentication. 262Names are listed one per line preceded by key options (as described 263in AUTHORIZED_KEYS FILE FORMAT in 264.Xr sshd 8 ) . 265Empty lines and comments starting with 266.Ql # 267are ignored. 268.Pp 269.Cm AuthorizedPrincipalsFile 270may contain tokens of the form %T which are substituted during connection 271setup. 272The following tokens are defined: %% is replaced by a literal '%', 273%h is replaced by the home directory of the user being authenticated, and 274%u is replaced by the username of that user. 275After expansion, 276.Cm AuthorizedPrincipalsFile 277is taken to be an absolute path or one relative to the user's home 278directory. 279.Pp 280The default is 281.Dq none , 282i.e. not to use a principals file \(en in this case, the username 283of the user must appear in a certificate's principals list for it to be 284accepted. 285Note that 286.Cm AuthorizedPrincipalsFile 287is only used when authentication proceeds using a CA listed in 288.Cm TrustedUserCAKeys 289and is not consulted for certification authorities trusted via 290.Pa ~/.ssh/authorized_keys , 291though the 292.Cm principals= 293key option offers a similar facility (see 294.Xr sshd 8 295for details). 296.It Cm Banner 297The contents of the specified file are sent to the remote user before 298authentication is allowed. 299If the argument is 300.Dq none 301then no banner is displayed. 302This option is only available for protocol version 2. 303By default, no banner is displayed. 304.It Cm ChallengeResponseAuthentication 305Specifies whether challenge-response authentication is allowed. 306All authentication styles from 307.Xr login.conf 5 308are supported. 309The default is 310.Dq yes . 311.It Cm ChrootDirectory 312Specifies the pathname of a directory to 313.Xr chroot 2 314to after authentication. 315All components of the pathname must be root-owned directories that are 316not writable by any other user or group. 317After the chroot, 318.Xr sshd 8 319changes the working directory to the user's home directory. 320.Pp 321The pathname may contain the following tokens that are expanded at runtime once 322the connecting user has been authenticated: %% is replaced by a literal '%', 323%h is replaced by the home directory of the user being authenticated, and 324%u is replaced by the username of that user. 325.Pp 326The 327.Cm ChrootDirectory 328must contain the necessary files and directories to support the 329user's session. 330For an interactive session this requires at least a shell, typically 331.Xr sh 1 , 332and basic 333.Pa /dev 334nodes such as 335.Xr null 4 , 336.Xr zero 4 , 337.Xr stdin 4 , 338.Xr stdout 4 , 339.Xr stderr 4 , 340.Xr arandom 4 341and 342.Xr tty 4 343devices. 344For file transfer sessions using 345.Dq sftp , 346no additional configuration of the environment is necessary if the 347in-process sftp server is used, 348though sessions which use logging do require 349.Pa /dev/log 350inside the chroot directory (see 351.Xr sftp-server 8 352for details). 353.Pp 354The default is not to 355.Xr chroot 2 . 356.It Cm Ciphers 357Specifies the ciphers allowed for protocol version 2. 358Multiple ciphers must be comma-separated. 359The supported ciphers are: 360.Pp 361.Bl -item -compact -offset indent 362.It 3633des-cbc 364.It 365aes128-cbc 366.It 367aes192-cbc 368.It 369aes256-cbc 370.It 371aes128-ctr 372.It 373aes192-ctr 374.It 375aes256-ctr 376.It 377aes128-gcm@openssh.com 378.It 379aes256-gcm@openssh.com 380.It 381arcfour 382.It 383arcfour128 384.It 385arcfour256 386.It 387blowfish-cbc 388.It 389cast128-cbc 390.It 391chacha20-poly1305@openssh.com 392.El 393.Pp 394The default is: 395.Bd -literal -offset indent 396aes128-ctr,aes192-ctr,aes256-ctr, 397aes128-gcm@openssh.com,aes256-gcm@openssh.com, 398chacha20-poly1305@openssh.com 399.Ed 400.Pp 401The list of available ciphers may also be obtained using the 402.Fl Q 403option of 404.Xr ssh 1 . 405.It Cm ClientAliveCountMax 406Sets the number of client alive messages (see below) which may be 407sent without 408.Xr sshd 8 409receiving any messages back from the client. 410If this threshold is reached while client alive messages are being sent, 411sshd will disconnect the client, terminating the session. 412It is important to note that the use of client alive messages is very 413different from 414.Cm TCPKeepAlive 415(below). 416The client alive messages are sent through the encrypted channel 417and therefore will not be spoofable. 418The TCP keepalive option enabled by 419.Cm TCPKeepAlive 420is spoofable. 421The client alive mechanism is valuable when the client or 422server depend on knowing when a connection has become inactive. 423.Pp 424The default value is 3. 425If 426.Cm ClientAliveInterval 427(see below) is set to 15, and 428.Cm ClientAliveCountMax 429is left at the default, unresponsive SSH clients 430will be disconnected after approximately 45 seconds. 431This option applies to protocol version 2 only. 432.It Cm ClientAliveInterval 433Sets a timeout interval in seconds after which if no data has been received 434from the client, 435.Xr sshd 8 436will send a message through the encrypted 437channel to request a response from the client. 438The default 439is 0, indicating that these messages will not be sent to the client. 440This option applies to protocol version 2 only. 441.It Cm Compression 442Specifies whether compression is allowed, or delayed until 443the user has authenticated successfully. 444The argument must be 445.Dq yes , 446.Dq delayed , 447or 448.Dq no . 449The default is 450.Dq delayed . 451.It Cm DenyGroups 452This keyword can be followed by a list of group name patterns, separated 453by spaces. 454Login is disallowed for users whose primary group or supplementary 455group list matches one of the patterns. 456Only group names are valid; a numerical group ID is not recognized. 457By default, login is allowed for all groups. 458The allow/deny directives are processed in the following order: 459.Cm DenyUsers , 460.Cm AllowUsers , 461.Cm DenyGroups , 462and finally 463.Cm AllowGroups . 464.Pp 465See PATTERNS in 466.Xr ssh_config 5 467for more information on patterns. 468.It Cm DenyUsers 469This keyword can be followed by a list of user name patterns, separated 470by spaces. 471Login is disallowed for user names that match one of the patterns. 472Only user names are valid; a numerical user ID is not recognized. 473By default, login is allowed for all users. 474If the pattern takes the form USER@HOST then USER and HOST 475are separately checked, restricting logins to particular 476users from particular hosts. 477The allow/deny directives are processed in the following order: 478.Cm DenyUsers , 479.Cm AllowUsers , 480.Cm DenyGroups , 481and finally 482.Cm AllowGroups . 483.Pp 484See PATTERNS in 485.Xr ssh_config 5 486for more information on patterns. 487.It Cm ForceCommand 488Forces the execution of the command specified by 489.Cm ForceCommand , 490ignoring any command supplied by the client and 491.Pa ~/.ssh/rc 492if present. 493The command is invoked by using the user's login shell with the -c option. 494This applies to shell, command, or subsystem execution. 495It is most useful inside a 496.Cm Match 497block. 498The command originally supplied by the client is available in the 499.Ev SSH_ORIGINAL_COMMAND 500environment variable. 501Specifying a command of 502.Dq internal-sftp 503will force the use of an in-process sftp server that requires no support 504files when used with 505.Cm ChrootDirectory . 506.It Cm GatewayPorts 507Specifies whether remote hosts are allowed to connect to ports 508forwarded for the client. 509By default, 510.Xr sshd 8 511binds remote port forwardings to the loopback address. 512This prevents other remote hosts from connecting to forwarded ports. 513.Cm GatewayPorts 514can be used to specify that sshd 515should allow remote port forwardings to bind to non-loopback addresses, thus 516allowing other hosts to connect. 517The argument may be 518.Dq no 519to force remote port forwardings to be available to the local host only, 520.Dq yes 521to force remote port forwardings to bind to the wildcard address, or 522.Dq clientspecified 523to allow the client to select the address to which the forwarding is bound. 524The default is 525.Dq no . 526.It Cm GSSAPIAuthentication 527Specifies whether user authentication based on GSSAPI is allowed. 528The default is 529.Dq no . 530Note that this option applies to protocol version 2 only. 531.It Cm GSSAPICleanupCredentials 532Specifies whether to automatically destroy the user's credentials cache 533on logout. 534The default is 535.Dq yes . 536Note that this option applies to protocol version 2 only. 537.It Cm HostbasedAuthentication 538Specifies whether rhosts or /etc/hosts.equiv authentication together 539with successful public key client host authentication is allowed 540(host-based authentication). 541This option is similar to 542.Cm RhostsRSAAuthentication 543and applies to protocol version 2 only. 544The default is 545.Dq no . 546.It Cm HostbasedUsesNameFromPacketOnly 547Specifies whether or not the server will attempt to perform a reverse 548name lookup when matching the name in the 549.Pa ~/.shosts , 550.Pa ~/.rhosts , 551and 552.Pa /etc/hosts.equiv 553files during 554.Cm HostbasedAuthentication . 555A setting of 556.Dq yes 557means that 558.Xr sshd 8 559uses the name supplied by the client rather than 560attempting to resolve the name from the TCP connection itself. 561The default is 562.Dq no . 563.It Cm HostCertificate 564Specifies a file containing a public host certificate. 565The certificate's public key must match a private host key already specified 566by 567.Cm HostKey . 568The default behaviour of 569.Xr sshd 8 570is not to load any certificates. 571.It Cm HostKey 572Specifies a file containing a private host key 573used by SSH. 574The default is 575.Pa /etc/ssh/ssh_host_key 576for protocol version 1, and 577.Pa /etc/ssh/ssh_host_dsa_key , 578.Pa /etc/ssh/ssh_host_ecdsa_key , 579.Pa /etc/ssh/ssh_host_ed25519_key 580and 581.Pa /etc/ssh/ssh_host_rsa_key 582for protocol version 2. 583Note that 584.Xr sshd 8 585will refuse to use a file if it is group/world-accessible. 586It is possible to have multiple host key files. 587.Dq rsa1 588keys are used for version 1 and 589.Dq dsa , 590.Dq ecdsa , 591.Dq ed25519 592or 593.Dq rsa 594are used for version 2 of the SSH protocol. 595It is also possible to specify public host key files instead. 596In this case operations on the private key will be delegated 597to an 598.Xr ssh-agent 1 . 599.It Cm HostKeyAgent 600Identifies the UNIX-domain socket used to communicate 601with an agent that has access to the private host keys. 602If 603.Dq SSH_AUTH_SOCK 604is specified, the location of the socket will be read from the 605.Ev SSH_AUTH_SOCK 606environment variable. 607.It Cm IgnoreRhosts 608Specifies that 609.Pa .rhosts 610and 611.Pa .shosts 612files will not be used in 613.Cm RhostsRSAAuthentication 614or 615.Cm HostbasedAuthentication . 616.Pp 617.Pa /etc/hosts.equiv 618and 619.Pa /etc/shosts.equiv 620are still used. 621The default is 622.Dq yes . 623.It Cm IgnoreUserKnownHosts 624Specifies whether 625.Xr sshd 8 626should ignore the user's 627.Pa ~/.ssh/known_hosts 628during 629.Cm RhostsRSAAuthentication 630or 631.Cm HostbasedAuthentication . 632The default is 633.Dq no . 634.It Cm IPQoS 635Specifies the IPv4 type-of-service or DSCP class for the connection. 636Accepted values are 637.Dq af11 , 638.Dq af12 , 639.Dq af13 , 640.Dq af21 , 641.Dq af22 , 642.Dq af23 , 643.Dq af31 , 644.Dq af32 , 645.Dq af33 , 646.Dq af41 , 647.Dq af42 , 648.Dq af43 , 649.Dq cs0 , 650.Dq cs1 , 651.Dq cs2 , 652.Dq cs3 , 653.Dq cs4 , 654.Dq cs5 , 655.Dq cs6 , 656.Dq cs7 , 657.Dq ef , 658.Dq lowdelay , 659.Dq throughput , 660.Dq reliability , 661or a numeric value. 662This option may take one or two arguments, separated by whitespace. 663If one argument is specified, it is used as the packet class unconditionally. 664If two values are specified, the first is automatically selected for 665interactive sessions and the second for non-interactive sessions. 666The default is 667.Dq lowdelay 668for interactive sessions and 669.Dq throughput 670for non-interactive sessions. 671.It Cm KbdInteractiveAuthentication 672Specifies whether to allow keyboard-interactive authentication. 673The argument to this keyword must be 674.Dq yes 675or 676.Dq no . 677The default is to use whatever value 678.Cm ChallengeResponseAuthentication 679is set to 680(by default 681.Dq yes ) . 682.It Cm KerberosAuthentication 683Specifies whether the password provided by the user for 684.Cm PasswordAuthentication 685will be validated through the Kerberos KDC. 686To use this option, the server needs a 687Kerberos servtab which allows the verification of the KDC's identity. 688The default is 689.Dq no . 690.It Cm KerberosGetAFSToken 691If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 692an AFS token before accessing the user's home directory. 693The default is 694.Dq no . 695.It Cm KerberosOrLocalPasswd 696If password authentication through Kerberos fails then 697the password will be validated via any additional local mechanism 698such as 699.Pa /etc/passwd . 700The default is 701.Dq yes . 702.It Cm KerberosTicketCleanup 703Specifies whether to automatically destroy the user's ticket cache 704file on logout. 705The default is 706.Dq yes . 707.It Cm KexAlgorithms 708Specifies the available KEX (Key Exchange) algorithms. 709Multiple algorithms must be comma-separated. 710The supported algorithms are: 711.Pp 712.Bl -item -compact -offset indent 713.It 714curve25519-sha256@libssh.org 715.It 716diffie-hellman-group1-sha1 717.It 718diffie-hellman-group14-sha1 719.It 720diffie-hellman-group-exchange-sha1 721.It 722diffie-hellman-group-exchange-sha256 723.It 724ecdh-sha2-nistp256 725.It 726ecdh-sha2-nistp384 727.It 728ecdh-sha2-nistp521 729.El 730.Pp 731The default is: 732.Bd -literal -offset indent 733curve25519-sha256@libssh.org, 734ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 735diffie-hellman-group-exchange-sha256, 736diffie-hellman-group14-sha1 737.Ed 738.It Cm KeyRegenerationInterval 739In protocol version 1, the ephemeral server key is automatically regenerated 740after this many seconds (if it has been used). 741The purpose of regeneration is to prevent 742decrypting captured sessions by later breaking into the machine and 743stealing the keys. 744The key is never stored anywhere. 745If the value is 0, the key is never regenerated. 746The default is 3600 (seconds). 747.It Cm ListenAddress 748Specifies the local addresses 749.Xr sshd 8 750should listen on. 751The following forms may be used: 752.Pp 753.Bl -item -offset indent -compact 754.It 755.Cm ListenAddress 756.Sm off 757.Ar host No | Ar IPv4_addr No | Ar IPv6_addr 758.Sm on 759.It 760.Cm ListenAddress 761.Sm off 762.Ar host No | Ar IPv4_addr No : Ar port 763.Sm on 764.It 765.Cm ListenAddress 766.Sm off 767.Oo 768.Ar host No | Ar IPv6_addr Oc : Ar port 769.Sm on 770.El 771.Pp 772If 773.Ar port 774is not specified, 775sshd will listen on the address and all prior 776.Cm Port 777options specified. 778The default is to listen on all local addresses. 779Multiple 780.Cm ListenAddress 781options are permitted. 782Additionally, any 783.Cm Port 784options must precede this option for non-port qualified addresses. 785.It Cm LoginGraceTime 786The server disconnects after this time if the user has not 787successfully logged in. 788If the value is 0, there is no time limit. 789The default is 120 seconds. 790.It Cm LogLevel 791Gives the verbosity level that is used when logging messages from 792.Xr sshd 8 . 793The possible values are: 794QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 795The default is INFO. 796DEBUG and DEBUG1 are equivalent. 797DEBUG2 and DEBUG3 each specify higher levels of debugging output. 798Logging with a DEBUG level violates the privacy of users and is not recommended. 799.It Cm MACs 800Specifies the available MAC (message authentication code) algorithms. 801The MAC algorithm is used in protocol version 2 802for data integrity protection. 803Multiple algorithms must be comma-separated. 804The algorithms that contain 805.Dq -etm 806calculate the MAC after encryption (encrypt-then-mac). 807These are considered safer and their use recommended. 808The supported MACs are: 809.Pp 810.Bl -item -compact -offset indent 811.It 812hmac-md5 813.It 814hmac-md5-96 815.It 816hmac-ripemd160 817.It 818hmac-sha1 819.It 820hmac-sha1-96 821.It 822hmac-sha2-256 823.It 824hmac-sha2-512 825.It 826umac-64@openssh.com 827.It 828umac-128@openssh.com 829.It 830hmac-md5-etm@openssh.com 831.It 832hmac-md5-96-etm@openssh.com 833.It 834hmac-ripemd160-etm@openssh.com 835.It 836hmac-sha1-etm@openssh.com 837.It 838hmac-sha1-96-etm@openssh.com 839.It 840hmac-sha2-256-etm@openssh.com 841.It 842hmac-sha2-512-etm@openssh.com 843.It 844umac-64-etm@openssh.com 845.It 846umac-128-etm@openssh.com 847.El 848.Pp 849The default is: 850.Bd -literal -offset indent 851umac-64-etm@openssh.com,umac-128-etm@openssh.com, 852hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 853umac-64@openssh.com,umac-128@openssh.com, 854hmac-sha2-256,hmac-sha2-512 855.Ed 856.It Cm Match 857Introduces a conditional block. 858If all of the criteria on the 859.Cm Match 860line are satisfied, the keywords on the following lines override those 861set in the global section of the config file, until either another 862.Cm Match 863line or the end of the file. 864If a keyword appears in multiple 865.Cm Match 866blocks that are satisified, only the first instance of the keyword is 867applied. 868.Pp 869The arguments to 870.Cm Match 871are one or more criteria-pattern pairs or the single token 872.Cm All 873which matches all criteria. 874The available criteria are 875.Cm User , 876.Cm Group , 877.Cm Host , 878.Cm LocalAddress , 879.Cm LocalPort , 880and 881.Cm Address . 882The match patterns may consist of single entries or comma-separated 883lists and may use the wildcard and negation operators described in the 884PATTERNS section of 885.Xr ssh_config 5 . 886.Pp 887The patterns in an 888.Cm Address 889criteria may additionally contain addresses to match in CIDR 890address/masklen format, e.g.\& 891.Dq 192.0.2.0/24 892or 893.Dq 3ffe:ffff::/32 . 894Note that the mask length provided must be consistent with the address - 895it is an error to specify a mask length that is too long for the address 896or one with bits set in this host portion of the address. 897For example, 898.Dq 192.0.2.0/33 899and 900.Dq 192.0.2.0/8 901respectively. 902.Pp 903Only a subset of keywords may be used on the lines following a 904.Cm Match 905keyword. 906Available keywords are 907.Cm AcceptEnv , 908.Cm AllowAgentForwarding , 909.Cm AllowGroups , 910.Cm AllowTcpForwarding , 911.Cm AllowUsers , 912.Cm AuthenticationMethods , 913.Cm AuthorizedKeysCommand , 914.Cm AuthorizedKeysCommandUser , 915.Cm AuthorizedKeysFile , 916.Cm AuthorizedPrincipalsFile , 917.Cm Banner , 918.Cm ChrootDirectory , 919.Cm DenyGroups , 920.Cm DenyUsers , 921.Cm ForceCommand , 922.Cm GatewayPorts , 923.Cm GSSAPIAuthentication , 924.Cm HostbasedAuthentication , 925.Cm HostbasedUsesNameFromPacketOnly , 926.Cm KbdInteractiveAuthentication , 927.Cm KerberosAuthentication , 928.Cm MaxAuthTries , 929.Cm MaxSessions , 930.Cm PasswordAuthentication , 931.Cm PermitEmptyPasswords , 932.Cm PermitOpen , 933.Cm PermitRootLogin , 934.Cm PermitTTY , 935.Cm PermitTunnel , 936.Cm PermitUserRC , 937.Cm PubkeyAuthentication , 938.Cm RekeyLimit , 939.Cm RhostsRSAAuthentication , 940.Cm RSAAuthentication , 941.Cm X11DisplayOffset , 942.Cm X11Forwarding 943and 944.Cm X11UseLocalHost . 945.It Cm MaxAuthTries 946Specifies the maximum number of authentication attempts permitted per 947connection. 948Once the number of failures reaches half this value, 949additional failures are logged. 950The default is 6. 951.It Cm MaxSessions 952Specifies the maximum number of open sessions permitted per network connection. 953The default is 10. 954.It Cm MaxStartups 955Specifies the maximum number of concurrent unauthenticated connections to the 956SSH daemon. 957Additional connections will be dropped until authentication succeeds or the 958.Cm LoginGraceTime 959expires for a connection. 960The default is 10:30:100. 961.Pp 962Alternatively, random early drop can be enabled by specifying 963the three colon separated values 964.Dq start:rate:full 965(e.g. "10:30:60"). 966.Xr sshd 8 967will refuse connection attempts with a probability of 968.Dq rate/100 969(30%) 970if there are currently 971.Dq start 972(10) 973unauthenticated connections. 974The probability increases linearly and all connection attempts 975are refused if the number of unauthenticated connections reaches 976.Dq full 977(60). 978.It Cm PasswordAuthentication 979Specifies whether password authentication is allowed. 980The default is 981.Dq yes . 982.It Cm PermitEmptyPasswords 983When password authentication is allowed, it specifies whether the 984server allows login to accounts with empty password strings. 985The default is 986.Dq no . 987.It Cm PermitOpen 988Specifies the destinations to which TCP port forwarding is permitted. 989The forwarding specification must be one of the following forms: 990.Pp 991.Bl -item -offset indent -compact 992.It 993.Cm PermitOpen 994.Sm off 995.Ar host : port 996.Sm on 997.It 998.Cm PermitOpen 999.Sm off 1000.Ar IPv4_addr : port 1001.Sm on 1002.It 1003.Cm PermitOpen 1004.Sm off 1005.Ar \&[ IPv6_addr \&] : port 1006.Sm on 1007.El 1008.Pp 1009Multiple forwards may be specified by separating them with whitespace. 1010An argument of 1011.Dq any 1012can be used to remove all restrictions and permit any forwarding requests. 1013An argument of 1014.Dq none 1015can be used to prohibit all forwarding requests. 1016By default all port forwarding requests are permitted. 1017.It Cm PermitRootLogin 1018Specifies whether root can log in using 1019.Xr ssh 1 . 1020The argument must be 1021.Dq yes , 1022.Dq without-password , 1023.Dq forced-commands-only , 1024or 1025.Dq no . 1026The default is 1027.Dq yes . 1028.Pp 1029If this option is set to 1030.Dq without-password , 1031password authentication is disabled for root. 1032.Pp 1033If this option is set to 1034.Dq forced-commands-only , 1035root login with public key authentication will be allowed, 1036but only if the 1037.Ar command 1038option has been specified 1039(which may be useful for taking remote backups even if root login is 1040normally not allowed). 1041All other authentication methods are disabled for root. 1042.Pp 1043If this option is set to 1044.Dq no , 1045root is not allowed to log in. 1046.It Cm PermitTunnel 1047Specifies whether 1048.Xr tun 4 1049device forwarding is allowed. 1050The argument must be 1051.Dq yes , 1052.Dq point-to-point 1053(layer 3), 1054.Dq ethernet 1055(layer 2), or 1056.Dq no . 1057Specifying 1058.Dq yes 1059permits both 1060.Dq point-to-point 1061and 1062.Dq ethernet . 1063The default is 1064.Dq no . 1065.It Cm PermitTTY 1066Specifies whether 1067.Xr pty 4 1068allocation is permitted. 1069The default is 1070.Dq yes . 1071.It Cm PermitUserEnvironment 1072Specifies whether 1073.Pa ~/.ssh/environment 1074and 1075.Cm environment= 1076options in 1077.Pa ~/.ssh/authorized_keys 1078are processed by 1079.Xr sshd 8 . 1080The default is 1081.Dq no . 1082Enabling environment processing may enable users to bypass access 1083restrictions in some configurations using mechanisms such as 1084.Ev LD_PRELOAD . 1085.It Cm PermitUserRC 1086Specifies whether any 1087.Pa ~/.ssh/rc 1088file is executed. 1089The default is 1090.Dq yes . 1091.It Cm PidFile 1092Specifies the file that contains the process ID of the 1093SSH daemon. 1094The default is 1095.Pa /var/run/sshd.pid . 1096.It Cm Port 1097Specifies the port number that 1098.Xr sshd 8 1099listens on. 1100The default is 22. 1101Multiple options of this type are permitted. 1102See also 1103.Cm ListenAddress . 1104.It Cm PrintLastLog 1105Specifies whether 1106.Xr sshd 8 1107should print the date and time of the last user login when a user logs 1108in interactively. 1109The default is 1110.Dq yes . 1111.It Cm PrintMotd 1112Specifies whether 1113.Xr sshd 8 1114should print 1115.Pa /etc/motd 1116when a user logs in interactively. 1117(On some systems it is also printed by the shell, 1118.Pa /etc/profile , 1119or equivalent.) 1120The default is 1121.Dq yes . 1122.It Cm Protocol 1123Specifies the protocol versions 1124.Xr sshd 8 1125supports. 1126The possible values are 1127.Sq 1 1128and 1129.Sq 2 . 1130Multiple versions must be comma-separated. 1131The default is 1132.Sq 2 . 1133Note that the order of the protocol list does not indicate preference, 1134because the client selects among multiple protocol versions offered 1135by the server. 1136Specifying 1137.Dq 2,1 1138is identical to 1139.Dq 1,2 . 1140.It Cm PubkeyAuthentication 1141Specifies whether public key authentication is allowed. 1142The default is 1143.Dq yes . 1144Note that this option applies to protocol version 2 only. 1145.It Cm RekeyLimit 1146Specifies the maximum amount of data that may be transmitted before the 1147session key is renegotiated, optionally followed a maximum amount of 1148time that may pass before the session key is renegotiated. 1149The first argument is specified in bytes and may have a suffix of 1150.Sq K , 1151.Sq M , 1152or 1153.Sq G 1154to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1155The default is between 1156.Sq 1G 1157and 1158.Sq 4G , 1159depending on the cipher. 1160The optional second value is specified in seconds and may use any of the 1161units documented in the 1162.Sx TIME FORMATS 1163section. 1164The default value for 1165.Cm RekeyLimit 1166is 1167.Dq default none , 1168which means that rekeying is performed after the cipher's default amount 1169of data has been sent or received and no time based rekeying is done. 1170This option applies to protocol version 2 only. 1171.It Cm RevokedKeys 1172Specifies revoked public keys. 1173Keys listed in this file will be refused for public key authentication. 1174Note that if this file is not readable, then public key authentication will 1175be refused for all users. 1176Keys may be specified as a text file, listing one public key per line, or as 1177an OpenSSH Key Revocation List (KRL) as generated by 1178.Xr ssh-keygen 1 . 1179For more information on KRLs, see the KEY REVOCATION LISTS section in 1180.Xr ssh-keygen 1 . 1181.It Cm RhostsRSAAuthentication 1182Specifies whether rhosts or /etc/hosts.equiv authentication together 1183with successful RSA host authentication is allowed. 1184The default is 1185.Dq no . 1186This option applies to protocol version 1 only. 1187.It Cm RSAAuthentication 1188Specifies whether pure RSA authentication is allowed. 1189The default is 1190.Dq yes . 1191This option applies to protocol version 1 only. 1192.It Cm ServerKeyBits 1193Defines the number of bits in the ephemeral protocol version 1 server key. 1194The minimum value is 512, and the default is 1024. 1195.It Cm StreamLocalBindMask 1196Sets the octal file creation mode mask 1197.Pq umask 1198used when creating a Unix-domain socket file for local or remote 1199port forwarding. 1200This option is only used for port forwarding to a Unix-domain socket file. 1201.Pp 1202The default value is 0177, which creates a Unix-domain socket file that is 1203readable and writable only by the owner. 1204Note that not all operating systems honor the file mode on Unix-domain 1205socket files. 1206.It Cm StreamLocalBindUnlink 1207Specifies whether to remove an existing Unix-domain socket file for local 1208or remote port forwarding before creating a new one. 1209If the socket file already exists and 1210.Cm StreamLocalBindUnlink 1211is not enabled, 1212.Nm sshd 1213will be unable to forward the port to the Unix-domain socket file. 1214This option is only used for port forwarding to a Unix-domain socket file. 1215.Pp 1216The argument must be 1217.Dq yes 1218or 1219.Dq no . 1220The default is 1221.Dq no . 1222.It Cm StrictModes 1223Specifies whether 1224.Xr sshd 8 1225should check file modes and ownership of the 1226user's files and home directory before accepting login. 1227This is normally desirable because novices sometimes accidentally leave their 1228directory or files world-writable. 1229The default is 1230.Dq yes . 1231Note that this does not apply to 1232.Cm ChrootDirectory , 1233whose permissions and ownership are checked unconditionally. 1234.It Cm Subsystem 1235Configures an external subsystem (e.g. file transfer daemon). 1236Arguments should be a subsystem name and a command (with optional arguments) 1237to execute upon subsystem request. 1238.Pp 1239The command 1240.Xr sftp-server 8 1241implements the 1242.Dq sftp 1243file transfer subsystem. 1244.Pp 1245Alternately the name 1246.Dq internal-sftp 1247implements an in-process 1248.Dq sftp 1249server. 1250This may simplify configurations using 1251.Cm ChrootDirectory 1252to force a different filesystem root on clients. 1253.Pp 1254By default no subsystems are defined. 1255Note that this option applies to protocol version 2 only. 1256.It Cm SyslogFacility 1257Gives the facility code that is used when logging messages from 1258.Xr sshd 8 . 1259The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1260LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1261The default is AUTH. 1262.It Cm TCPKeepAlive 1263Specifies whether the system should send TCP keepalive messages to the 1264other side. 1265If they are sent, death of the connection or crash of one 1266of the machines will be properly noticed. 1267However, this means that 1268connections will die if the route is down temporarily, and some people 1269find it annoying. 1270On the other hand, if TCP keepalives are not sent, 1271sessions may hang indefinitely on the server, leaving 1272.Dq ghost 1273users and consuming server resources. 1274.Pp 1275The default is 1276.Dq yes 1277(to send TCP keepalive messages), and the server will notice 1278if the network goes down or the client host crashes. 1279This avoids infinitely hanging sessions. 1280.Pp 1281To disable TCP keepalive messages, the value should be set to 1282.Dq no . 1283.It Cm TrustedUserCAKeys 1284Specifies a file containing public keys of certificate authorities that are 1285trusted to sign user certificates for authentication. 1286Keys are listed one per line; empty lines and comments starting with 1287.Ql # 1288are allowed. 1289If a certificate is presented for authentication and has its signing CA key 1290listed in this file, then it may be used for authentication for any user 1291listed in the certificate's principals list. 1292Note that certificates that lack a list of principals will not be permitted 1293for authentication using 1294.Cm TrustedUserCAKeys . 1295For more details on certificates, see the CERTIFICATES section in 1296.Xr ssh-keygen 1 . 1297.It Cm UseDNS 1298Specifies whether 1299.Xr sshd 8 1300should look up the remote host name and check that 1301the resolved host name for the remote IP address maps back to the 1302very same IP address. 1303The default is 1304.Dq yes . 1305.It Cm UseLogin 1306Specifies whether 1307.Xr login 1 1308is used for interactive login sessions. 1309The default is 1310.Dq no . 1311Note that 1312.Xr login 1 1313is never used for remote command execution. 1314Note also, that if this is enabled, 1315.Cm X11Forwarding 1316will be disabled because 1317.Xr login 1 1318does not know how to handle 1319.Xr xauth 1 1320cookies. 1321If 1322.Cm UsePrivilegeSeparation 1323is specified, it will be disabled after authentication. 1324.It Cm UsePrivilegeSeparation 1325Specifies whether 1326.Xr sshd 8 1327separates privileges by creating an unprivileged child process 1328to deal with incoming network traffic. 1329After successful authentication, another process will be created that has 1330the privilege of the authenticated user. 1331The goal of privilege separation is to prevent privilege 1332escalation by containing any corruption within the unprivileged processes. 1333The default is 1334.Dq yes . 1335If 1336.Cm UsePrivilegeSeparation 1337is set to 1338.Dq sandbox 1339then the pre-authentication unprivileged process is subject to additional 1340restrictions. 1341.It Cm VersionAddendum 1342Optionally specifies additional text to append to the SSH protocol banner 1343sent by the server upon connection. 1344The default is 1345.Dq none . 1346.It Cm X11DisplayOffset 1347Specifies the first display number available for 1348.Xr sshd 8 Ns 's 1349X11 forwarding. 1350This prevents sshd from interfering with real X11 servers. 1351The default is 10. 1352.It Cm X11Forwarding 1353Specifies whether X11 forwarding is permitted. 1354The argument must be 1355.Dq yes 1356or 1357.Dq no . 1358The default is 1359.Dq no . 1360.Pp 1361When X11 forwarding is enabled, there may be additional exposure to 1362the server and to client displays if the 1363.Xr sshd 8 1364proxy display is configured to listen on the wildcard address (see 1365.Cm X11UseLocalhost 1366below), though this is not the default. 1367Additionally, the authentication spoofing and authentication data 1368verification and substitution occur on the client side. 1369The security risk of using X11 forwarding is that the client's X11 1370display server may be exposed to attack when the SSH client requests 1371forwarding (see the warnings for 1372.Cm ForwardX11 1373in 1374.Xr ssh_config 5 ) . 1375A system administrator may have a stance in which they want to 1376protect clients that may expose themselves to attack by unwittingly 1377requesting X11 forwarding, which can warrant a 1378.Dq no 1379setting. 1380.Pp 1381Note that disabling X11 forwarding does not prevent users from 1382forwarding X11 traffic, as users can always install their own forwarders. 1383X11 forwarding is automatically disabled if 1384.Cm UseLogin 1385is enabled. 1386.It Cm X11UseLocalhost 1387Specifies whether 1388.Xr sshd 8 1389should bind the X11 forwarding server to the loopback address or to 1390the wildcard address. 1391By default, 1392sshd binds the forwarding server to the loopback address and sets the 1393hostname part of the 1394.Ev DISPLAY 1395environment variable to 1396.Dq localhost . 1397This prevents remote hosts from connecting to the proxy display. 1398However, some older X11 clients may not function with this 1399configuration. 1400.Cm X11UseLocalhost 1401may be set to 1402.Dq no 1403to specify that the forwarding server should be bound to the wildcard 1404address. 1405The argument must be 1406.Dq yes 1407or 1408.Dq no . 1409The default is 1410.Dq yes . 1411.It Cm XAuthLocation 1412Specifies the full pathname of the 1413.Xr xauth 1 1414program. 1415The default is 1416.Pa /usr/X11R6/bin/xauth . 1417.El 1418.Sh TIME FORMATS 1419.Xr sshd 8 1420command-line arguments and configuration file options that specify time 1421may be expressed using a sequence of the form: 1422.Sm off 1423.Ar time Op Ar qualifier , 1424.Sm on 1425where 1426.Ar time 1427is a positive integer value and 1428.Ar qualifier 1429is one of the following: 1430.Pp 1431.Bl -tag -width Ds -compact -offset indent 1432.It Aq Cm none 1433seconds 1434.It Cm s | Cm S 1435seconds 1436.It Cm m | Cm M 1437minutes 1438.It Cm h | Cm H 1439hours 1440.It Cm d | Cm D 1441days 1442.It Cm w | Cm W 1443weeks 1444.El 1445.Pp 1446Each member of the sequence is added together to calculate 1447the total time value. 1448.Pp 1449Time format examples: 1450.Pp 1451.Bl -tag -width Ds -compact -offset indent 1452.It 600 1453600 seconds (10 minutes) 1454.It 10m 145510 minutes 1456.It 1h30m 14571 hour 30 minutes (90 minutes) 1458.El 1459.Sh FILES 1460.Bl -tag -width Ds 1461.It Pa /etc/ssh/sshd_config 1462Contains configuration data for 1463.Xr sshd 8 . 1464This file should be writable by root only, but it is recommended 1465(though not necessary) that it be world-readable. 1466.El 1467.Sh SEE ALSO 1468.Xr sshd 8 1469.Sh AUTHORS 1470OpenSSH is a derivative of the original and free 1471ssh 1.2.12 release by Tatu Ylonen. 1472Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 1473Theo de Raadt and Dug Song 1474removed many bugs, re-added newer features and 1475created OpenSSH. 1476Markus Friedl contributed the support for SSH 1477protocol versions 1.5 and 2.0. 1478Niels Provos and Markus Friedl contributed support 1479for privilege separation. 1480