1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.307 2020/02/07 03:54:44 dtucker Exp $ 37.Dd $Mdocdate: February 7 2020 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51For each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123.It Cm AllowStreamLocalForwarding 124Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 125The available options are 126.Cm yes 127(the default) 128or 129.Cm all 130to allow StreamLocal forwarding, 131.Cm no 132to prevent all StreamLocal forwarding, 133.Cm local 134to allow local (from the perspective of 135.Xr ssh 1 ) 136forwarding only or 137.Cm remote 138to allow remote forwarding only. 139Note that disabling StreamLocal forwarding does not improve security unless 140users are also denied shell access, as they can always install their 141own forwarders. 142.It Cm AllowTcpForwarding 143Specifies whether TCP forwarding is permitted. 144The available options are 145.Cm yes 146(the default) 147or 148.Cm all 149to allow TCP forwarding, 150.Cm no 151to prevent all TCP forwarding, 152.Cm local 153to allow local (from the perspective of 154.Xr ssh 1 ) 155forwarding only or 156.Cm remote 157to allow remote forwarding only. 158Note that disabling TCP forwarding does not improve security unless 159users are also denied shell access, as they can always install their 160own forwarders. 161.It Cm AllowUsers 162This keyword can be followed by a list of user name patterns, separated 163by spaces. 164If specified, login is allowed only for user names that 165match one of the patterns. 166Only user names are valid; a numerical user ID is not recognized. 167By default, login is allowed for all users. 168If the pattern takes the form USER@HOST then USER and HOST 169are separately checked, restricting logins to particular 170users from particular hosts. 171HOST criteria may additionally contain addresses to match in CIDR 172address/masklen format. 173The allow/deny users directives are processed in the following order: 174.Cm DenyUsers , 175.Cm AllowUsers . 176.Pp 177See PATTERNS in 178.Xr ssh_config 5 179for more information on patterns. 180.It Cm AuthenticationMethods 181Specifies the authentication methods that must be successfully completed 182for a user to be granted access. 183This option must be followed by one or more lists of comma-separated 184authentication method names, or by the single string 185.Cm any 186to indicate the default behaviour of accepting any single authentication 187method. 188If the default is overridden, then successful authentication requires 189completion of every method in at least one of these lists. 190.Pp 191For example, 192.Qq publickey,password publickey,keyboard-interactive 193would require the user to complete public key authentication, followed by 194either password or keyboard interactive authentication. 195Only methods that are next in one or more lists are offered at each stage, 196so for this example it would not be possible to attempt password or 197keyboard-interactive authentication before public key. 198.Pp 199For keyboard interactive authentication it is also possible to 200restrict authentication to a specific device by appending a 201colon followed by the device identifier 202.Cm bsdauth , 203.Cm pam , 204or 205.Cm skey , 206depending on the server configuration. 207For example, 208.Qq keyboard-interactive:bsdauth 209would restrict keyboard interactive authentication to the 210.Cm bsdauth 211device. 212.Pp 213If the publickey method is listed more than once, 214.Xr sshd 8 215verifies that keys that have been used successfully are not reused for 216subsequent authentications. 217For example, 218.Qq publickey,publickey 219requires successful authentication using two different public keys. 220.Pp 221Note that each authentication method listed should also be explicitly enabled 222in the configuration. 223.Pp 224The available authentication methods are: 225.Qq gssapi-with-mic , 226.Qq hostbased , 227.Qq keyboard-interactive , 228.Qq none 229(used for access to password-less accounts when 230.Cm PermitEmptyPasswords 231is enabled), 232.Qq password 233and 234.Qq publickey . 235.It Cm AuthorizedKeysCommand 236Specifies a program to be used to look up the user's public keys. 237The program must be owned by root, not writable by group or others and 238specified by an absolute path. 239Arguments to 240.Cm AuthorizedKeysCommand 241accept the tokens described in the 242.Sx TOKENS 243section. 244If no arguments are specified then the username of the target user is used. 245.Pp 246The program should produce on standard output zero or 247more lines of authorized_keys output (see 248.Sx AUTHORIZED_KEYS 249in 250.Xr sshd 8 ) . 251If a key supplied by 252.Cm AuthorizedKeysCommand 253does not successfully authenticate 254and authorize the user then public key authentication continues using the usual 255.Cm AuthorizedKeysFile 256files. 257By default, no 258.Cm AuthorizedKeysCommand 259is run. 260.It Cm AuthorizedKeysCommandUser 261Specifies the user under whose account the 262.Cm AuthorizedKeysCommand 263is run. 264It is recommended to use a dedicated user that has no other role on the host 265than running authorized keys commands. 266If 267.Cm AuthorizedKeysCommand 268is specified but 269.Cm AuthorizedKeysCommandUser 270is not, then 271.Xr sshd 8 272will refuse to start. 273.It Cm AuthorizedKeysFile 274Specifies the file that contains the public keys used for user authentication. 275The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 276.Xr sshd 8 . 277Arguments to 278.Cm AuthorizedKeysFile 279accept the tokens described in the 280.Sx TOKENS 281section. 282After expansion, 283.Cm AuthorizedKeysFile 284is taken to be an absolute path or one relative to the user's home 285directory. 286Multiple files may be listed, separated by whitespace. 287Alternately this option may be set to 288.Cm none 289to skip checking for user keys in files. 290The default is 291.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 292.It Cm AuthorizedPrincipalsCommand 293Specifies a program to be used to generate the list of allowed 294certificate principals as per 295.Cm AuthorizedPrincipalsFile . 296The program must be owned by root, not writable by group or others and 297specified by an absolute path. 298Arguments to 299.Cm AuthorizedPrincipalsCommand 300accept the tokens described in the 301.Sx TOKENS 302section. 303If no arguments are specified then the username of the target user is used. 304.Pp 305The program should produce on standard output zero or 306more lines of 307.Cm AuthorizedPrincipalsFile 308output. 309If either 310.Cm AuthorizedPrincipalsCommand 311or 312.Cm AuthorizedPrincipalsFile 313is specified, then certificates offered by the client for authentication 314must contain a principal that is listed. 315By default, no 316.Cm AuthorizedPrincipalsCommand 317is run. 318.It Cm AuthorizedPrincipalsCommandUser 319Specifies the user under whose account the 320.Cm AuthorizedPrincipalsCommand 321is run. 322It is recommended to use a dedicated user that has no other role on the host 323than running authorized principals commands. 324If 325.Cm AuthorizedPrincipalsCommand 326is specified but 327.Cm AuthorizedPrincipalsCommandUser 328is not, then 329.Xr sshd 8 330will refuse to start. 331.It Cm AuthorizedPrincipalsFile 332Specifies a file that lists principal names that are accepted for 333certificate authentication. 334When using certificates signed by a key listed in 335.Cm TrustedUserCAKeys , 336this file lists names, one of which must appear in the certificate for it 337to be accepted for authentication. 338Names are listed one per line preceded by key options (as described in 339.Sx AUTHORIZED_KEYS FILE FORMAT 340in 341.Xr sshd 8 ) . 342Empty lines and comments starting with 343.Ql # 344are ignored. 345.Pp 346Arguments to 347.Cm AuthorizedPrincipalsFile 348accept the tokens described in the 349.Sx TOKENS 350section. 351After expansion, 352.Cm AuthorizedPrincipalsFile 353is taken to be an absolute path or one relative to the user's home directory. 354The default is 355.Cm none , 356i.e. not to use a principals file \(en in this case, the username 357of the user must appear in a certificate's principals list for it to be 358accepted. 359.Pp 360Note that 361.Cm AuthorizedPrincipalsFile 362is only used when authentication proceeds using a CA listed in 363.Cm TrustedUserCAKeys 364and is not consulted for certification authorities trusted via 365.Pa ~/.ssh/authorized_keys , 366though the 367.Cm principals= 368key option offers a similar facility (see 369.Xr sshd 8 370for details). 371.It Cm Banner 372The contents of the specified file are sent to the remote user before 373authentication is allowed. 374If the argument is 375.Cm none 376then no banner is displayed. 377By default, no banner is displayed. 378.It Cm CASignatureAlgorithms 379Specifies which algorithms are allowed for signing of certificates 380by certificate authorities (CAs). 381The default is: 382.Bd -literal -offset indent 383ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 384ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa 385.Ed 386.Pp 387Certificates signed using other algorithms will not be accepted for 388public key or host-based authentication. 389.It Cm ChallengeResponseAuthentication 390Specifies whether challenge-response authentication is allowed. 391All authentication styles from 392.Xr login.conf 5 393are supported. 394The default is 395.Cm yes . 396.It Cm ChrootDirectory 397Specifies the pathname of a directory to 398.Xr chroot 2 399to after authentication. 400At session startup 401.Xr sshd 8 402checks that all components of the pathname are root-owned directories 403which are not writable by any other user or group. 404After the chroot, 405.Xr sshd 8 406changes the working directory to the user's home directory. 407Arguments to 408.Cm ChrootDirectory 409accept the tokens described in the 410.Sx TOKENS 411section. 412.Pp 413The 414.Cm ChrootDirectory 415must contain the necessary files and directories to support the 416user's session. 417For an interactive session this requires at least a shell, typically 418.Xr sh 1 , 419and basic 420.Pa /dev 421nodes such as 422.Xr null 4 , 423.Xr zero 4 , 424.Xr stdin 4 , 425.Xr stdout 4 , 426.Xr stderr 4 , 427and 428.Xr tty 4 429devices. 430For file transfer sessions using SFTP 431no additional configuration of the environment is necessary if the in-process 432sftp-server is used, 433though sessions which use logging may require 434.Pa /dev/log 435inside the chroot directory on some operating systems (see 436.Xr sftp-server 8 437for details). 438.Pp 439For safety, it is very important that the directory hierarchy be 440prevented from modification by other processes on the system (especially 441those outside the jail). 442Misconfiguration can lead to unsafe environments which 443.Xr sshd 8 444cannot detect. 445.Pp 446The default is 447.Cm none , 448indicating not to 449.Xr chroot 2 . 450.It Cm Ciphers 451Specifies the ciphers allowed. 452Multiple ciphers must be comma-separated. 453If the specified list begins with a 454.Sq + 455character, then the specified ciphers will be appended to the default set 456instead of replacing them. 457If the specified list begins with a 458.Sq - 459character, then the specified ciphers (including wildcards) will be removed 460from the default set instead of replacing them. 461If the specified list begins with a 462.Sq ^ 463character, then the specified ciphers will be placed at the head of the 464default set. 465.Pp 466The supported ciphers are: 467.Pp 468.Bl -item -compact -offset indent 469.It 4703des-cbc 471.It 472aes128-cbc 473.It 474aes192-cbc 475.It 476aes256-cbc 477.It 478aes128-ctr 479.It 480aes192-ctr 481.It 482aes256-ctr 483.It 484aes128-gcm@openssh.com 485.It 486aes256-gcm@openssh.com 487.It 488chacha20-poly1305@openssh.com 489.El 490.Pp 491The default is: 492.Bd -literal -offset indent 493chacha20-poly1305@openssh.com, 494aes128-ctr,aes192-ctr,aes256-ctr, 495aes128-gcm@openssh.com,aes256-gcm@openssh.com 496.Ed 497.Pp 498The list of available ciphers may also be obtained using 499.Qq ssh -Q cipher . 500.It Cm ClientAliveCountMax 501Sets the number of client alive messages which may be sent without 502.Xr sshd 8 503receiving any messages back from the client. 504If this threshold is reached while client alive messages are being sent, 505sshd will disconnect the client, terminating the session. 506It is important to note that the use of client alive messages is very 507different from 508.Cm TCPKeepAlive . 509The client alive messages are sent through the encrypted channel 510and therefore will not be spoofable. 511The TCP keepalive option enabled by 512.Cm TCPKeepAlive 513is spoofable. 514The client alive mechanism is valuable when the client or 515server depend on knowing when a connection has become unresponsive. 516.Pp 517The default value is 3. 518If 519.Cm ClientAliveInterval 520is set to 15, and 521.Cm ClientAliveCountMax 522is left at the default, unresponsive SSH clients 523will be disconnected after approximately 45 seconds. 524Setting a zero 525.Cm ClientAliveCountMax 526disables connection termination. 527.It Cm ClientAliveInterval 528Sets a timeout interval in seconds after which if no data has been received 529from the client, 530.Xr sshd 8 531will send a message through the encrypted 532channel to request a response from the client. 533The default 534is 0, indicating that these messages will not be sent to the client. 535.It Cm Compression 536Specifies whether compression is enabled after 537the user has authenticated successfully. 538The argument must be 539.Cm yes , 540.Cm delayed 541(a legacy synonym for 542.Cm yes ) 543or 544.Cm no . 545The default is 546.Cm yes . 547.It Cm DenyGroups 548This keyword can be followed by a list of group name patterns, separated 549by spaces. 550Login is disallowed for users whose primary group or supplementary 551group list matches one of the patterns. 552Only group names are valid; a numerical group ID is not recognized. 553By default, login is allowed for all groups. 554The allow/deny groups directives are processed in the following order: 555.Cm DenyGroups , 556.Cm AllowGroups . 557.Pp 558See PATTERNS in 559.Xr ssh_config 5 560for more information on patterns. 561.It Cm DenyUsers 562This keyword can be followed by a list of user name patterns, separated 563by spaces. 564Login is disallowed for user names that match one of the patterns. 565Only user names are valid; a numerical user ID is not recognized. 566By default, login is allowed for all users. 567If the pattern takes the form USER@HOST then USER and HOST 568are separately checked, restricting logins to particular 569users from particular hosts. 570HOST criteria may additionally contain addresses to match in CIDR 571address/masklen format. 572The allow/deny users directives are processed in the following order: 573.Cm DenyUsers , 574.Cm AllowUsers . 575.Pp 576See PATTERNS in 577.Xr ssh_config 5 578for more information on patterns. 579.It Cm DisableForwarding 580Disables all forwarding features, including X11, 581.Xr ssh-agent 1 , 582TCP and StreamLocal. 583This option overrides all other forwarding-related options and may 584simplify restricted configurations. 585.It Cm ExposeAuthInfo 586Writes a temporary file containing a list of authentication methods and 587public credentials (e.g. keys) used to authenticate the user. 588The location of the file is exposed to the user session through the 589.Ev SSH_USER_AUTH 590environment variable. 591The default is 592.Cm no . 593.It Cm FingerprintHash 594Specifies the hash algorithm used when logging key fingerprints. 595Valid options are: 596.Cm md5 597and 598.Cm sha256 . 599The default is 600.Cm sha256 . 601.It Cm ForceCommand 602Forces the execution of the command specified by 603.Cm ForceCommand , 604ignoring any command supplied by the client and 605.Pa ~/.ssh/rc 606if present. 607The command is invoked by using the user's login shell with the -c option. 608This applies to shell, command, or subsystem execution. 609It is most useful inside a 610.Cm Match 611block. 612The command originally supplied by the client is available in the 613.Ev SSH_ORIGINAL_COMMAND 614environment variable. 615Specifying a command of 616.Cm internal-sftp 617will force the use of an in-process SFTP server that requires no support 618files when used with 619.Cm ChrootDirectory . 620The default is 621.Cm none . 622.It Cm GatewayPorts 623Specifies whether remote hosts are allowed to connect to ports 624forwarded for the client. 625By default, 626.Xr sshd 8 627binds remote port forwardings to the loopback address. 628This prevents other remote hosts from connecting to forwarded ports. 629.Cm GatewayPorts 630can be used to specify that sshd 631should allow remote port forwardings to bind to non-loopback addresses, thus 632allowing other hosts to connect. 633The argument may be 634.Cm no 635to force remote port forwardings to be available to the local host only, 636.Cm yes 637to force remote port forwardings to bind to the wildcard address, or 638.Cm clientspecified 639to allow the client to select the address to which the forwarding is bound. 640The default is 641.Cm no . 642.It Cm GSSAPIAuthentication 643Specifies whether user authentication based on GSSAPI is allowed. 644The default is 645.Cm no . 646.It Cm GSSAPICleanupCredentials 647Specifies whether to automatically destroy the user's credentials cache 648on logout. 649The default is 650.Cm yes . 651.It Cm GSSAPIStrictAcceptorCheck 652Determines whether to be strict about the identity of the GSSAPI acceptor 653a client authenticates against. 654If set to 655.Cm yes 656then the client must authenticate against the host 657service on the current hostname. 658If set to 659.Cm no 660then the client may authenticate against any service key stored in the 661machine's default store. 662This facility is provided to assist with operation on multi homed machines. 663The default is 664.Cm yes . 665.It Cm HostbasedAcceptedKeyTypes 666Specifies the key types that will be accepted for hostbased authentication 667as a list of comma-separated patterns. 668Alternately if the specified list begins with a 669.Sq + 670character, then the specified key types will be appended to the default set 671instead of replacing them. 672If the specified list begins with a 673.Sq - 674character, then the specified key types (including wildcards) will be removed 675from the default set instead of replacing them. 676If the specified list begins with a 677.Sq ^ 678character, then the specified key types will be placed at the head of the 679default set. 680The default for this option is: 681.Bd -literal -offset 3n 682ecdsa-sha2-nistp256-cert-v01@openssh.com, 683ecdsa-sha2-nistp384-cert-v01@openssh.com, 684ecdsa-sha2-nistp521-cert-v01@openssh.com, 685sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 686ssh-ed25519-cert-v01@openssh.com, 687sk-ssh-ed25519-cert-v01@openssh.com, 688rsa-sha2-512-cert-v01@openssh.com, 689rsa-sha2-256-cert-v01@openssh.com, 690ssh-rsa-cert-v01@openssh.com, 691ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 692sk-ecdsa-sha2-nistp256@openssh.com, 693ssh-ed25519,sk-ssh-ed25519@openssh.com, 694rsa-sha2-512,rsa-sha2-256,ssh-rsa 695.Ed 696.Pp 697The list of available key types may also be obtained using 698.Qq ssh -Q HostbasedAcceptedKeyTypes . 699.It Cm HostbasedAuthentication 700Specifies whether rhosts or /etc/hosts.equiv authentication together 701with successful public key client host authentication is allowed 702(host-based authentication). 703The default is 704.Cm no . 705.It Cm HostbasedUsesNameFromPacketOnly 706Specifies whether or not the server will attempt to perform a reverse 707name lookup when matching the name in the 708.Pa ~/.shosts , 709.Pa ~/.rhosts , 710and 711.Pa /etc/hosts.equiv 712files during 713.Cm HostbasedAuthentication . 714A setting of 715.Cm yes 716means that 717.Xr sshd 8 718uses the name supplied by the client rather than 719attempting to resolve the name from the TCP connection itself. 720The default is 721.Cm no . 722.It Cm HostCertificate 723Specifies a file containing a public host certificate. 724The certificate's public key must match a private host key already specified 725by 726.Cm HostKey . 727The default behaviour of 728.Xr sshd 8 729is not to load any certificates. 730.It Cm HostKey 731Specifies a file containing a private host key 732used by SSH. 733The defaults are 734.Pa /etc/ssh/ssh_host_ecdsa_key , 735.Pa /etc/ssh/ssh_host_ed25519_key 736and 737.Pa /etc/ssh/ssh_host_rsa_key . 738.Pp 739Note that 740.Xr sshd 8 741will refuse to use a file if it is group/world-accessible 742and that the 743.Cm HostKeyAlgorithms 744option restricts which of the keys are actually used by 745.Xr sshd 8 . 746.Pp 747It is possible to have multiple host key files. 748It is also possible to specify public host key files instead. 749In this case operations on the private key will be delegated 750to an 751.Xr ssh-agent 1 . 752.It Cm HostKeyAgent 753Identifies the UNIX-domain socket used to communicate 754with an agent that has access to the private host keys. 755If the string 756.Qq SSH_AUTH_SOCK 757is specified, the location of the socket will be read from the 758.Ev SSH_AUTH_SOCK 759environment variable. 760.It Cm HostKeyAlgorithms 761Specifies the host key algorithms 762that the server offers. 763The default for this option is: 764.Bd -literal -offset 3n 765ecdsa-sha2-nistp256-cert-v01@openssh.com, 766ecdsa-sha2-nistp384-cert-v01@openssh.com, 767ecdsa-sha2-nistp521-cert-v01@openssh.com, 768sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 769ssh-ed25519-cert-v01@openssh.com, 770sk-ssh-ed25519-cert-v01@openssh.com, 771rsa-sha2-512-cert-v01@openssh.com, 772rsa-sha2-256-cert-v01@openssh.com, 773ssh-rsa-cert-v01@openssh.com, 774ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 775sk-ecdsa-sha2-nistp256@openssh.com, 776ssh-ed25519,sk-ssh-ed25519@openssh.com, 777rsa-sha2-512,rsa-sha2-256,ssh-rsa 778.Ed 779.Pp 780The list of available key types may also be obtained using 781.Qq ssh -Q HostKeyAlgorithms . 782.It Cm IgnoreRhosts 783Specifies that 784.Pa .rhosts 785and 786.Pa .shosts 787files will not be used in 788.Cm HostbasedAuthentication . 789.Pp 790.Pa /etc/hosts.equiv 791and 792.Pa /etc/shosts.equiv 793are still used. 794The default is 795.Cm yes . 796.It Cm IgnoreUserKnownHosts 797Specifies whether 798.Xr sshd 8 799should ignore the user's 800.Pa ~/.ssh/known_hosts 801during 802.Cm HostbasedAuthentication 803and use only the system-wide known hosts file 804.Pa /etc/ssh/known_hosts . 805The default is 806.Dq no . 807.It Cm Include 808Include the specified configuration file(s). 809Multiple pathnames may be specified and each pathname may contain 810.Xr glob 7 811wildcards. 812Files without absolute paths are assumed to be in 813.Pa /etc/ssh . 814An 815.Cm Include 816directive may appear inside a 817.Cm Match 818block 819to perform conditional inclusion. 820.It Cm IPQoS 821Specifies the IPv4 type-of-service or DSCP class for the connection. 822Accepted values are 823.Cm af11 , 824.Cm af12 , 825.Cm af13 , 826.Cm af21 , 827.Cm af22 , 828.Cm af23 , 829.Cm af31 , 830.Cm af32 , 831.Cm af33 , 832.Cm af41 , 833.Cm af42 , 834.Cm af43 , 835.Cm cs0 , 836.Cm cs1 , 837.Cm cs2 , 838.Cm cs3 , 839.Cm cs4 , 840.Cm cs5 , 841.Cm cs6 , 842.Cm cs7 , 843.Cm ef , 844.Cm le , 845.Cm lowdelay , 846.Cm throughput , 847.Cm reliability , 848a numeric value, or 849.Cm none 850to use the operating system default. 851This option may take one or two arguments, separated by whitespace. 852If one argument is specified, it is used as the packet class unconditionally. 853If two values are specified, the first is automatically selected for 854interactive sessions and the second for non-interactive sessions. 855The default is 856.Cm af21 857(Low-Latency Data) 858for interactive sessions and 859.Cm cs1 860(Lower Effort) 861for non-interactive sessions. 862.It Cm KbdInteractiveAuthentication 863Specifies whether to allow keyboard-interactive authentication. 864The argument to this keyword must be 865.Cm yes 866or 867.Cm no . 868The default is to use whatever value 869.Cm ChallengeResponseAuthentication 870is set to 871(by default 872.Cm yes ) . 873.It Cm KerberosAuthentication 874Specifies whether the password provided by the user for 875.Cm PasswordAuthentication 876will be validated through the Kerberos KDC. 877To use this option, the server needs a 878Kerberos servtab which allows the verification of the KDC's identity. 879The default is 880.Cm no . 881.It Cm KerberosGetAFSToken 882If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 883an AFS token before accessing the user's home directory. 884The default is 885.Cm no . 886.It Cm KerberosOrLocalPasswd 887If password authentication through Kerberos fails then 888the password will be validated via any additional local mechanism 889such as 890.Pa /etc/passwd . 891The default is 892.Cm yes . 893.It Cm KerberosTicketCleanup 894Specifies whether to automatically destroy the user's ticket cache 895file on logout. 896The default is 897.Cm yes . 898.It Cm KexAlgorithms 899Specifies the available KEX (Key Exchange) algorithms. 900Multiple algorithms must be comma-separated. 901Alternately if the specified list begins with a 902.Sq + 903character, then the specified methods will be appended to the default set 904instead of replacing them. 905If the specified list begins with a 906.Sq - 907character, then the specified methods (including wildcards) will be removed 908from the default set instead of replacing them. 909If the specified list begins with a 910.Sq ^ 911character, then the specified methods will be placed at the head of the 912default set. 913The supported algorithms are: 914.Pp 915.Bl -item -compact -offset indent 916.It 917curve25519-sha256 918.It 919curve25519-sha256@libssh.org 920.It 921diffie-hellman-group1-sha1 922.It 923diffie-hellman-group14-sha1 924.It 925diffie-hellman-group14-sha256 926.It 927diffie-hellman-group16-sha512 928.It 929diffie-hellman-group18-sha512 930.It 931diffie-hellman-group-exchange-sha1 932.It 933diffie-hellman-group-exchange-sha256 934.It 935ecdh-sha2-nistp256 936.It 937ecdh-sha2-nistp384 938.It 939ecdh-sha2-nistp521 940.It 941sntrup4591761x25519-sha512@tinyssh.org 942.El 943.Pp 944The default is: 945.Bd -literal -offset indent 946curve25519-sha256,curve25519-sha256@libssh.org, 947ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 948diffie-hellman-group-exchange-sha256, 949diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 950diffie-hellman-group14-sha256 951.Ed 952.Pp 953The list of available key exchange algorithms may also be obtained using 954.Qq ssh -Q KexAlgorithms . 955.It Cm ListenAddress 956Specifies the local addresses 957.Xr sshd 8 958should listen on. 959The following forms may be used: 960.Pp 961.Bl -item -offset indent -compact 962.It 963.Cm ListenAddress 964.Sm off 965.Ar hostname | address 966.Sm on 967.Op Cm rdomain Ar domain 968.It 969.Cm ListenAddress 970.Sm off 971.Ar hostname : port 972.Sm on 973.Op Cm rdomain Ar domain 974.It 975.Cm ListenAddress 976.Sm off 977.Ar IPv4_address : port 978.Sm on 979.Op Cm rdomain Ar domain 980.It 981.Cm ListenAddress 982.Sm off 983.Oo Ar hostname | address Oc : Ar port 984.Sm on 985.Op Cm rdomain Ar domain 986.El 987.Pp 988The optional 989.Cm rdomain 990qualifier requests 991.Xr sshd 8 992listen in an explicit routing domain. 993If 994.Ar port 995is not specified, 996sshd will listen on the address and all 997.Cm Port 998options specified. 999The default is to listen on all local addresses on the current default 1000routing domain. 1001Multiple 1002.Cm ListenAddress 1003options are permitted. 1004For more information on routing domains, see 1005.Xr rdomain 4 . 1006.It Cm LoginGraceTime 1007The server disconnects after this time if the user has not 1008successfully logged in. 1009If the value is 0, there is no time limit. 1010The default is 120 seconds. 1011.It Cm LogLevel 1012Gives the verbosity level that is used when logging messages from 1013.Xr sshd 8 . 1014The possible values are: 1015QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1016The default is INFO. 1017DEBUG and DEBUG1 are equivalent. 1018DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1019Logging with a DEBUG level violates the privacy of users and is not recommended. 1020.It Cm MACs 1021Specifies the available MAC (message authentication code) algorithms. 1022The MAC algorithm is used for data integrity protection. 1023Multiple algorithms must be comma-separated. 1024If the specified list begins with a 1025.Sq + 1026character, then the specified algorithms will be appended to the default set 1027instead of replacing them. 1028If the specified list begins with a 1029.Sq - 1030character, then the specified algorithms (including wildcards) will be removed 1031from the default set instead of replacing them. 1032If the specified list begins with a 1033.Sq ^ 1034character, then the specified algorithms will be placed at the head of the 1035default set. 1036.Pp 1037The algorithms that contain 1038.Qq -etm 1039calculate the MAC after encryption (encrypt-then-mac). 1040These are considered safer and their use recommended. 1041The supported MACs are: 1042.Pp 1043.Bl -item -compact -offset indent 1044.It 1045hmac-md5 1046.It 1047hmac-md5-96 1048.It 1049hmac-sha1 1050.It 1051hmac-sha1-96 1052.It 1053hmac-sha2-256 1054.It 1055hmac-sha2-512 1056.It 1057umac-64@openssh.com 1058.It 1059umac-128@openssh.com 1060.It 1061hmac-md5-etm@openssh.com 1062.It 1063hmac-md5-96-etm@openssh.com 1064.It 1065hmac-sha1-etm@openssh.com 1066.It 1067hmac-sha1-96-etm@openssh.com 1068.It 1069hmac-sha2-256-etm@openssh.com 1070.It 1071hmac-sha2-512-etm@openssh.com 1072.It 1073umac-64-etm@openssh.com 1074.It 1075umac-128-etm@openssh.com 1076.El 1077.Pp 1078The default is: 1079.Bd -literal -offset indent 1080umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1081hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1082hmac-sha1-etm@openssh.com, 1083umac-64@openssh.com,umac-128@openssh.com, 1084hmac-sha2-256,hmac-sha2-512,hmac-sha1 1085.Ed 1086.Pp 1087The list of available MAC algorithms may also be obtained using 1088.Qq ssh -Q mac . 1089.It Cm Match 1090Introduces a conditional block. 1091If all of the criteria on the 1092.Cm Match 1093line are satisfied, the keywords on the following lines override those 1094set in the global section of the config file, until either another 1095.Cm Match 1096line or the end of the file. 1097If a keyword appears in multiple 1098.Cm Match 1099blocks that are satisfied, only the first instance of the keyword is 1100applied. 1101.Pp 1102The arguments to 1103.Cm Match 1104are one or more criteria-pattern pairs or the single token 1105.Cm All 1106which matches all criteria. 1107The available criteria are 1108.Cm User , 1109.Cm Group , 1110.Cm Host , 1111.Cm LocalAddress , 1112.Cm LocalPort , 1113.Cm RDomain , 1114and 1115.Cm Address 1116(with 1117.Cm RDomain 1118representing the 1119.Xr rdomain 4 1120on which the connection was received). 1121.Pp 1122The match patterns may consist of single entries or comma-separated 1123lists and may use the wildcard and negation operators described in the 1124.Sx PATTERNS 1125section of 1126.Xr ssh_config 5 . 1127.Pp 1128The patterns in an 1129.Cm Address 1130criteria may additionally contain addresses to match in CIDR 1131address/masklen format, 1132such as 192.0.2.0/24 or 2001:db8::/32. 1133Note that the mask length provided must be consistent with the address - 1134it is an error to specify a mask length that is too long for the address 1135or one with bits set in this host portion of the address. 1136For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1137.Pp 1138Only a subset of keywords may be used on the lines following a 1139.Cm Match 1140keyword. 1141Available keywords are 1142.Cm AcceptEnv , 1143.Cm AllowAgentForwarding , 1144.Cm AllowGroups , 1145.Cm AllowStreamLocalForwarding , 1146.Cm AllowTcpForwarding , 1147.Cm AllowUsers , 1148.Cm AuthenticationMethods , 1149.Cm AuthorizedKeysCommand , 1150.Cm AuthorizedKeysCommandUser , 1151.Cm AuthorizedKeysFile , 1152.Cm AuthorizedPrincipalsCommand , 1153.Cm AuthorizedPrincipalsCommandUser , 1154.Cm AuthorizedPrincipalsFile , 1155.Cm Banner , 1156.Cm ChrootDirectory , 1157.Cm ClientAliveCountMax , 1158.Cm ClientAliveInterval , 1159.Cm DenyGroups , 1160.Cm DenyUsers , 1161.Cm ForceCommand , 1162.Cm GatewayPorts , 1163.Cm GSSAPIAuthentication , 1164.Cm HostbasedAcceptedKeyTypes , 1165.Cm HostbasedAuthentication , 1166.Cm HostbasedUsesNameFromPacketOnly , 1167.Cm Include , 1168.Cm IPQoS , 1169.Cm KbdInteractiveAuthentication , 1170.Cm KerberosAuthentication , 1171.Cm LogLevel , 1172.Cm MaxAuthTries , 1173.Cm MaxSessions , 1174.Cm PasswordAuthentication , 1175.Cm PermitEmptyPasswords , 1176.Cm PermitListen , 1177.Cm PermitOpen , 1178.Cm PermitRootLogin , 1179.Cm PermitTTY , 1180.Cm PermitTunnel , 1181.Cm PermitUserRC , 1182.Cm PubkeyAcceptedKeyTypes , 1183.Cm PubkeyAuthentication , 1184.Cm RekeyLimit , 1185.Cm RevokedKeys , 1186.Cm RDomain , 1187.Cm SetEnv , 1188.Cm StreamLocalBindMask , 1189.Cm StreamLocalBindUnlink , 1190.Cm TrustedUserCAKeys , 1191.Cm X11DisplayOffset , 1192.Cm X11Forwarding 1193and 1194.Cm X11UseLocalhost . 1195.It Cm MaxAuthTries 1196Specifies the maximum number of authentication attempts permitted per 1197connection. 1198Once the number of failures reaches half this value, 1199additional failures are logged. 1200The default is 6. 1201.It Cm MaxSessions 1202Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1203sessions permitted per network connection. 1204Multiple sessions may be established by clients that support connection 1205multiplexing. 1206Setting 1207.Cm MaxSessions 1208to 1 will effectively disable session multiplexing, whereas setting it to 0 1209will prevent all shell, login and subsystem sessions while still permitting 1210forwarding. 1211The default is 10. 1212.It Cm MaxStartups 1213Specifies the maximum number of concurrent unauthenticated connections to the 1214SSH daemon. 1215Additional connections will be dropped until authentication succeeds or the 1216.Cm LoginGraceTime 1217expires for a connection. 1218The default is 10:30:100. 1219.Pp 1220Alternatively, random early drop can be enabled by specifying 1221the three colon separated values 1222start:rate:full (e.g. "10:30:60"). 1223.Xr sshd 8 1224will refuse connection attempts with a probability of rate/100 (30%) 1225if there are currently start (10) unauthenticated connections. 1226The probability increases linearly and all connection attempts 1227are refused if the number of unauthenticated connections reaches full (60). 1228.It Cm PasswordAuthentication 1229Specifies whether password authentication is allowed. 1230The default is 1231.Cm yes . 1232.It Cm PermitEmptyPasswords 1233When password authentication is allowed, it specifies whether the 1234server allows login to accounts with empty password strings. 1235The default is 1236.Cm no . 1237.It Cm PermitListen 1238Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1239The listen specification must be one of the following forms: 1240.Pp 1241.Bl -item -offset indent -compact 1242.It 1243.Cm PermitListen 1244.Sm off 1245.Ar port 1246.Sm on 1247.It 1248.Cm PermitListen 1249.Sm off 1250.Ar host : port 1251.Sm on 1252.El 1253.Pp 1254Multiple permissions may be specified by separating them with whitespace. 1255An argument of 1256.Cm any 1257can be used to remove all restrictions and permit any listen requests. 1258An argument of 1259.Cm none 1260can be used to prohibit all listen requests. 1261The host name may contain wildcards as described in the PATTERNS section in 1262.Xr ssh_config 5 . 1263The wildcard 1264.Sq * 1265can also be used in place of a port number to allow all ports. 1266By default all port forwarding listen requests are permitted. 1267Note that the 1268.Cm GatewayPorts 1269option may further restrict which addresses may be listened on. 1270Note also that 1271.Xr ssh 1 1272will request a listen host of 1273.Dq localhost 1274if no listen host was specifically requested, and this name is 1275treated differently to explicit localhost addresses of 1276.Dq 127.0.0.1 1277and 1278.Dq ::1 . 1279.It Cm PermitOpen 1280Specifies the destinations to which TCP port forwarding is permitted. 1281The forwarding specification must be one of the following forms: 1282.Pp 1283.Bl -item -offset indent -compact 1284.It 1285.Cm PermitOpen 1286.Sm off 1287.Ar host : port 1288.Sm on 1289.It 1290.Cm PermitOpen 1291.Sm off 1292.Ar IPv4_addr : port 1293.Sm on 1294.It 1295.Cm PermitOpen 1296.Sm off 1297.Ar \&[ IPv6_addr \&] : port 1298.Sm on 1299.El 1300.Pp 1301Multiple forwards may be specified by separating them with whitespace. 1302An argument of 1303.Cm any 1304can be used to remove all restrictions and permit any forwarding requests. 1305An argument of 1306.Cm none 1307can be used to prohibit all forwarding requests. 1308The wildcard 1309.Sq * 1310can be used for host or port to allow all hosts or ports respectively. 1311Otherwise, no pattern matching or address lookups are performed on supplied 1312names. 1313By default all port forwarding requests are permitted. 1314.It Cm PermitRootLogin 1315Specifies whether root can log in using 1316.Xr ssh 1 . 1317The argument must be 1318.Cm yes , 1319.Cm prohibit-password , 1320.Cm forced-commands-only , 1321or 1322.Cm no . 1323The default is 1324.Cm prohibit-password . 1325.Pp 1326If this option is set to 1327.Cm prohibit-password 1328(or its deprecated alias, 1329.Cm without-password ) , 1330password and keyboard-interactive authentication are disabled for root. 1331.Pp 1332If this option is set to 1333.Cm forced-commands-only , 1334root login with public key authentication will be allowed, 1335but only if the 1336.Ar command 1337option has been specified 1338(which may be useful for taking remote backups even if root login is 1339normally not allowed). 1340All other authentication methods are disabled for root. 1341.Pp 1342If this option is set to 1343.Cm no , 1344root is not allowed to log in. 1345.It Cm PermitTTY 1346Specifies whether 1347.Xr pty 4 1348allocation is permitted. 1349The default is 1350.Cm yes . 1351.It Cm PermitTunnel 1352Specifies whether 1353.Xr tun 4 1354device forwarding is allowed. 1355The argument must be 1356.Cm yes , 1357.Cm point-to-point 1358(layer 3), 1359.Cm ethernet 1360(layer 2), or 1361.Cm no . 1362Specifying 1363.Cm yes 1364permits both 1365.Cm point-to-point 1366and 1367.Cm ethernet . 1368The default is 1369.Cm no . 1370.Pp 1371Independent of this setting, the permissions of the selected 1372.Xr tun 4 1373device must allow access to the user. 1374.It Cm PermitUserEnvironment 1375Specifies whether 1376.Pa ~/.ssh/environment 1377and 1378.Cm environment= 1379options in 1380.Pa ~/.ssh/authorized_keys 1381are processed by 1382.Xr sshd 8 . 1383Valid options are 1384.Cm yes , 1385.Cm no 1386or a pattern-list specifying which environment variable names to accept 1387(for example 1388.Qq LANG,LC_* ) . 1389The default is 1390.Cm no . 1391Enabling environment processing may enable users to bypass access 1392restrictions in some configurations using mechanisms such as 1393.Ev LD_PRELOAD . 1394.It Cm PermitUserRC 1395Specifies whether any 1396.Pa ~/.ssh/rc 1397file is executed. 1398The default is 1399.Cm yes . 1400.It Cm PidFile 1401Specifies the file that contains the process ID of the 1402SSH daemon, or 1403.Cm none 1404to not write one. 1405The default is 1406.Pa /var/run/sshd.pid . 1407.It Cm Port 1408Specifies the port number that 1409.Xr sshd 8 1410listens on. 1411The default is 22. 1412Multiple options of this type are permitted. 1413See also 1414.Cm ListenAddress . 1415.It Cm PrintLastLog 1416Specifies whether 1417.Xr sshd 8 1418should print the date and time of the last user login when a user logs 1419in interactively. 1420The default is 1421.Cm yes . 1422.It Cm PrintMotd 1423Specifies whether 1424.Xr sshd 8 1425should print 1426.Pa /etc/motd 1427when a user logs in interactively. 1428(On some systems it is also printed by the shell, 1429.Pa /etc/profile , 1430or equivalent.) 1431The default is 1432.Cm yes . 1433.It Cm PubkeyAcceptedKeyTypes 1434Specifies the key types that will be accepted for public key authentication 1435as a list of comma-separated patterns. 1436Alternately if the specified list begins with a 1437.Sq + 1438character, then the specified key types will be appended to the default set 1439instead of replacing them. 1440If the specified list begins with a 1441.Sq - 1442character, then the specified key types (including wildcards) will be removed 1443from the default set instead of replacing them. 1444If the specified list begins with a 1445.Sq ^ 1446character, then the specified key types will be placed at the head of the 1447default set. 1448The default for this option is: 1449.Bd -literal -offset 3n 1450ecdsa-sha2-nistp256-cert-v01@openssh.com, 1451ecdsa-sha2-nistp384-cert-v01@openssh.com, 1452ecdsa-sha2-nistp521-cert-v01@openssh.com, 1453sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1454ssh-ed25519-cert-v01@openssh.com, 1455sk-ssh-ed25519-cert-v01@openssh.com, 1456rsa-sha2-512-cert-v01@openssh.com, 1457rsa-sha2-256-cert-v01@openssh.com, 1458ssh-rsa-cert-v01@openssh.com, 1459ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1460sk-ecdsa-sha2-nistp256@openssh.com, 1461ssh-ed25519,sk-ssh-ed25519@openssh.com, 1462rsa-sha2-512,rsa-sha2-256,ssh-rsa 1463.Ed 1464.Pp 1465The list of available key types may also be obtained using 1466.Qq ssh -Q PubkeyAcceptedKeyTypes . 1467.It Cm PubkeyAuthOptions 1468Sets one or more public key authentication options. 1469Two option keywords are currently supported: 1470.Cm none 1471(the default; indicating no additional options are enabled) 1472and 1473.Cm touch-required . 1474.Pp 1475The 1476.Cm touch-required 1477option causes public key authentication using a FIDO authenticator algorithm 1478(i.e.\& 1479.Cm ecdsa-sk 1480or 1481.Cm ed25519-sk ) 1482to always require the signature to attest that a physically present user 1483explicitly confirmed the authentication (usually by touching the authenticator). 1484By default, 1485.Xr sshd 8 1486requires user presence unless overridden with an authorized_keys option. 1487The 1488.Cm touch-required 1489flag disables this override. 1490This option has no effect for other, non-authenticator public key types. 1491.It Cm PubkeyAuthentication 1492Specifies whether public key authentication is allowed. 1493The default is 1494.Cm yes . 1495.It Cm RekeyLimit 1496Specifies the maximum amount of data that may be transmitted before the 1497session key is renegotiated, optionally followed a maximum amount of 1498time that may pass before the session key is renegotiated. 1499The first argument is specified in bytes and may have a suffix of 1500.Sq K , 1501.Sq M , 1502or 1503.Sq G 1504to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1505The default is between 1506.Sq 1G 1507and 1508.Sq 4G , 1509depending on the cipher. 1510The optional second value is specified in seconds and may use any of the 1511units documented in the 1512.Sx TIME FORMATS 1513section. 1514The default value for 1515.Cm RekeyLimit 1516is 1517.Cm default none , 1518which means that rekeying is performed after the cipher's default amount 1519of data has been sent or received and no time based rekeying is done. 1520.It Cm RevokedKeys 1521Specifies revoked public keys file, or 1522.Cm none 1523to not use one. 1524Keys listed in this file will be refused for public key authentication. 1525Note that if this file is not readable, then public key authentication will 1526be refused for all users. 1527Keys may be specified as a text file, listing one public key per line, or as 1528an OpenSSH Key Revocation List (KRL) as generated by 1529.Xr ssh-keygen 1 . 1530For more information on KRLs, see the KEY REVOCATION LISTS section in 1531.Xr ssh-keygen 1 . 1532.It Cm RDomain 1533Specifies an explicit routing domain that is applied after authentication 1534has completed. 1535The user session, as well and any forwarded or listening IP sockets, 1536will be bound to this 1537.Xr rdomain 4 . 1538If the routing domain is set to 1539.Cm \&%D , 1540then the domain in which the incoming connection was received will be applied. 1541.It Cm SecurityKeyProvider 1542Specifies a path to a library that will be used when loading 1543FIDO authenticator-hosted keys, overriding the default of using 1544the built-in USB HID support. 1545.It Cm SetEnv 1546Specifies one or more environment variables to set in child sessions started 1547by 1548.Xr sshd 8 1549as 1550.Dq NAME=VALUE . 1551The environment value may be quoted (e.g. if it contains whitespace 1552characters). 1553Environment variables set by 1554.Cm SetEnv 1555override the default environment and any variables specified by the user 1556via 1557.Cm AcceptEnv 1558or 1559.Cm PermitUserEnvironment . 1560.It Cm StreamLocalBindMask 1561Sets the octal file creation mode mask 1562.Pq umask 1563used when creating a Unix-domain socket file for local or remote 1564port forwarding. 1565This option is only used for port forwarding to a Unix-domain socket file. 1566.Pp 1567The default value is 0177, which creates a Unix-domain socket file that is 1568readable and writable only by the owner. 1569Note that not all operating systems honor the file mode on Unix-domain 1570socket files. 1571.It Cm StreamLocalBindUnlink 1572Specifies whether to remove an existing Unix-domain socket file for local 1573or remote port forwarding before creating a new one. 1574If the socket file already exists and 1575.Cm StreamLocalBindUnlink 1576is not enabled, 1577.Nm sshd 1578will be unable to forward the port to the Unix-domain socket file. 1579This option is only used for port forwarding to a Unix-domain socket file. 1580.Pp 1581The argument must be 1582.Cm yes 1583or 1584.Cm no . 1585The default is 1586.Cm no . 1587.It Cm StrictModes 1588Specifies whether 1589.Xr sshd 8 1590should check file modes and ownership of the 1591user's files and home directory before accepting login. 1592This is normally desirable because novices sometimes accidentally leave their 1593directory or files world-writable. 1594The default is 1595.Cm yes . 1596Note that this does not apply to 1597.Cm ChrootDirectory , 1598whose permissions and ownership are checked unconditionally. 1599.It Cm Subsystem 1600Configures an external subsystem (e.g. file transfer daemon). 1601Arguments should be a subsystem name and a command (with optional arguments) 1602to execute upon subsystem request. 1603.Pp 1604The command 1605.Cm sftp-server 1606implements the SFTP file transfer subsystem. 1607.Pp 1608Alternately the name 1609.Cm internal-sftp 1610implements an in-process SFTP server. 1611This may simplify configurations using 1612.Cm ChrootDirectory 1613to force a different filesystem root on clients. 1614.Pp 1615By default no subsystems are defined. 1616.It Cm SyslogFacility 1617Gives the facility code that is used when logging messages from 1618.Xr sshd 8 . 1619The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1620LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1621The default is AUTH. 1622.It Cm TCPKeepAlive 1623Specifies whether the system should send TCP keepalive messages to the 1624other side. 1625If they are sent, death of the connection or crash of one 1626of the machines will be properly noticed. 1627However, this means that 1628connections will die if the route is down temporarily, and some people 1629find it annoying. 1630On the other hand, if TCP keepalives are not sent, 1631sessions may hang indefinitely on the server, leaving 1632.Qq ghost 1633users and consuming server resources. 1634.Pp 1635The default is 1636.Cm yes 1637(to send TCP keepalive messages), and the server will notice 1638if the network goes down or the client host crashes. 1639This avoids infinitely hanging sessions. 1640.Pp 1641To disable TCP keepalive messages, the value should be set to 1642.Cm no . 1643.It Cm TrustedUserCAKeys 1644Specifies a file containing public keys of certificate authorities that are 1645trusted to sign user certificates for authentication, or 1646.Cm none 1647to not use one. 1648Keys are listed one per line; empty lines and comments starting with 1649.Ql # 1650are allowed. 1651If a certificate is presented for authentication and has its signing CA key 1652listed in this file, then it may be used for authentication for any user 1653listed in the certificate's principals list. 1654Note that certificates that lack a list of principals will not be permitted 1655for authentication using 1656.Cm TrustedUserCAKeys . 1657For more details on certificates, see the CERTIFICATES section in 1658.Xr ssh-keygen 1 . 1659.It Cm UseDNS 1660Specifies whether 1661.Xr sshd 8 1662should look up the remote host name, and to check that 1663the resolved host name for the remote IP address maps back to the 1664very same IP address. 1665.Pp 1666If this option is set to 1667.Cm no 1668(the default) then only addresses and not host names may be used in 1669.Pa ~/.ssh/authorized_keys 1670.Cm from 1671and 1672.Nm 1673.Cm Match 1674.Cm Host 1675directives. 1676.It Cm VersionAddendum 1677Optionally specifies additional text to append to the SSH protocol banner 1678sent by the server upon connection. 1679The default is 1680.Cm none . 1681.It Cm X11DisplayOffset 1682Specifies the first display number available for 1683.Xr sshd 8 Ns 's 1684X11 forwarding. 1685This prevents sshd from interfering with real X11 servers. 1686The default is 10. 1687.It Cm X11Forwarding 1688Specifies whether X11 forwarding is permitted. 1689The argument must be 1690.Cm yes 1691or 1692.Cm no . 1693The default is 1694.Cm no . 1695.Pp 1696When X11 forwarding is enabled, there may be additional exposure to 1697the server and to client displays if the 1698.Xr sshd 8 1699proxy display is configured to listen on the wildcard address (see 1700.Cm X11UseLocalhost ) , 1701though this is not the default. 1702Additionally, the authentication spoofing and authentication data 1703verification and substitution occur on the client side. 1704The security risk of using X11 forwarding is that the client's X11 1705display server may be exposed to attack when the SSH client requests 1706forwarding (see the warnings for 1707.Cm ForwardX11 1708in 1709.Xr ssh_config 5 ) . 1710A system administrator may have a stance in which they want to 1711protect clients that may expose themselves to attack by unwittingly 1712requesting X11 forwarding, which can warrant a 1713.Cm no 1714setting. 1715.Pp 1716Note that disabling X11 forwarding does not prevent users from 1717forwarding X11 traffic, as users can always install their own forwarders. 1718.It Cm X11UseLocalhost 1719Specifies whether 1720.Xr sshd 8 1721should bind the X11 forwarding server to the loopback address or to 1722the wildcard address. 1723By default, 1724sshd binds the forwarding server to the loopback address and sets the 1725hostname part of the 1726.Ev DISPLAY 1727environment variable to 1728.Cm localhost . 1729This prevents remote hosts from connecting to the proxy display. 1730However, some older X11 clients may not function with this 1731configuration. 1732.Cm X11UseLocalhost 1733may be set to 1734.Cm no 1735to specify that the forwarding server should be bound to the wildcard 1736address. 1737The argument must be 1738.Cm yes 1739or 1740.Cm no . 1741The default is 1742.Cm yes . 1743.It Cm XAuthLocation 1744Specifies the full pathname of the 1745.Xr xauth 1 1746program, or 1747.Cm none 1748to not use one. 1749The default is 1750.Pa /usr/X11R6/bin/xauth . 1751.El 1752.Sh TIME FORMATS 1753.Xr sshd 8 1754command-line arguments and configuration file options that specify time 1755may be expressed using a sequence of the form: 1756.Sm off 1757.Ar time Op Ar qualifier , 1758.Sm on 1759where 1760.Ar time 1761is a positive integer value and 1762.Ar qualifier 1763is one of the following: 1764.Pp 1765.Bl -tag -width Ds -compact -offset indent 1766.It Aq Cm none 1767seconds 1768.It Cm s | Cm S 1769seconds 1770.It Cm m | Cm M 1771minutes 1772.It Cm h | Cm H 1773hours 1774.It Cm d | Cm D 1775days 1776.It Cm w | Cm W 1777weeks 1778.El 1779.Pp 1780Each member of the sequence is added together to calculate 1781the total time value. 1782.Pp 1783Time format examples: 1784.Pp 1785.Bl -tag -width Ds -compact -offset indent 1786.It 600 1787600 seconds (10 minutes) 1788.It 10m 178910 minutes 1790.It 1h30m 17911 hour 30 minutes (90 minutes) 1792.El 1793.Sh TOKENS 1794Arguments to some keywords can make use of tokens, 1795which are expanded at runtime: 1796.Pp 1797.Bl -tag -width XXXX -offset indent -compact 1798.It %% 1799A literal 1800.Sq % . 1801.It \&%D 1802The routing domain in which the incoming connection was received. 1803.It %F 1804The fingerprint of the CA key. 1805.It %f 1806The fingerprint of the key or certificate. 1807.It %h 1808The home directory of the user. 1809.It %i 1810The key ID in the certificate. 1811.It %K 1812The base64-encoded CA key. 1813.It %k 1814The base64-encoded key or certificate for authentication. 1815.It %s 1816The serial number of the certificate. 1817.It \&%T 1818The type of the CA key. 1819.It %t 1820The key or certificate type. 1821.It \&%U 1822The numeric user ID of the target user. 1823.It %u 1824The username. 1825.El 1826.Pp 1827.Cm AuthorizedKeysCommand 1828accepts the tokens %%, %f, %h, %k, %t, %U, and %u. 1829.Pp 1830.Cm AuthorizedKeysFile 1831accepts the tokens %%, %h, %U, and %u. 1832.Pp 1833.Cm AuthorizedPrincipalsCommand 1834accepts the tokens %%, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 1835.Pp 1836.Cm AuthorizedPrincipalsFile 1837accepts the tokens %%, %h, %U, and %u. 1838.Pp 1839.Cm ChrootDirectory 1840accepts the tokens %%, %h, %U, and %u. 1841.Pp 1842.Cm RoutingDomain 1843accepts the token %D. 1844.Sh FILES 1845.Bl -tag -width Ds 1846.It Pa /etc/ssh/sshd_config 1847Contains configuration data for 1848.Xr sshd 8 . 1849This file should be writable by root only, but it is recommended 1850(though not necessary) that it be world-readable. 1851.El 1852.Sh SEE ALSO 1853.Xr sftp-server 8 , 1854.Xr sshd 8 1855.Sh AUTHORS 1856.An -nosplit 1857OpenSSH is a derivative of the original and free 1858ssh 1.2.12 release by 1859.An Tatu Ylonen . 1860.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 1861.An Theo de Raadt 1862and 1863.An Dug Song 1864removed many bugs, re-added newer features and 1865created OpenSSH. 1866.An Markus Friedl 1867contributed the support for SSH protocol versions 1.5 and 2.0. 1868.An Niels Provos 1869and 1870.An Markus Friedl 1871contributed support for privilege separation. 1872