1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.350 2023/07/28 05:42:36 jmc Exp $ 37.Dd $Mdocdate: July 28 2023 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51Unless noted otherwise, for each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123This keyword may appear multiple times in 124.Nm 125with each instance appending to the list. 126.It Cm AllowStreamLocalForwarding 127Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 128The available options are 129.Cm yes 130(the default) 131or 132.Cm all 133to allow StreamLocal forwarding, 134.Cm no 135to prevent all StreamLocal forwarding, 136.Cm local 137to allow local (from the perspective of 138.Xr ssh 1 ) 139forwarding only or 140.Cm remote 141to allow remote forwarding only. 142Note that disabling StreamLocal forwarding does not improve security unless 143users are also denied shell access, as they can always install their 144own forwarders. 145.It Cm AllowTcpForwarding 146Specifies whether TCP forwarding is permitted. 147The available options are 148.Cm yes 149(the default) 150or 151.Cm all 152to allow TCP forwarding, 153.Cm no 154to prevent all TCP forwarding, 155.Cm local 156to allow local (from the perspective of 157.Xr ssh 1 ) 158forwarding only or 159.Cm remote 160to allow remote forwarding only. 161Note that disabling TCP forwarding does not improve security unless 162users are also denied shell access, as they can always install their 163own forwarders. 164.It Cm AllowUsers 165This keyword can be followed by a list of user name patterns, separated 166by spaces. 167If specified, login is allowed only for user names that 168match one of the patterns. 169Only user names are valid; a numerical user ID is not recognized. 170By default, login is allowed for all users. 171If the pattern takes the form USER@HOST then USER and HOST 172are separately checked, restricting logins to particular 173users from particular hosts. 174HOST criteria may additionally contain addresses to match in CIDR 175address/masklen format. 176The allow/deny users directives are processed in the following order: 177.Cm DenyUsers , 178.Cm AllowUsers . 179.Pp 180See PATTERNS in 181.Xr ssh_config 5 182for more information on patterns. 183This keyword may appear multiple times in 184.Nm 185with each instance appending to the list. 186.It Cm AuthenticationMethods 187Specifies the authentication methods that must be successfully completed 188for a user to be granted access. 189This option must be followed by one or more lists of comma-separated 190authentication method names, or by the single string 191.Cm any 192to indicate the default behaviour of accepting any single authentication 193method. 194If the default is overridden, then successful authentication requires 195completion of every method in at least one of these lists. 196.Pp 197For example, 198.Qq publickey,password publickey,keyboard-interactive 199would require the user to complete public key authentication, followed by 200either password or keyboard interactive authentication. 201Only methods that are next in one or more lists are offered at each stage, 202so for this example it would not be possible to attempt password or 203keyboard-interactive authentication before public key. 204.Pp 205For keyboard interactive authentication it is also possible to 206restrict authentication to a specific device by appending a 207colon followed by the device identifier 208.Cm bsdauth , 209.Cm pam , 210or 211.Cm skey , 212depending on the server configuration. 213For example, 214.Qq keyboard-interactive:bsdauth 215would restrict keyboard interactive authentication to the 216.Cm bsdauth 217device. 218.Pp 219If the publickey method is listed more than once, 220.Xr sshd 8 221verifies that keys that have been used successfully are not reused for 222subsequent authentications. 223For example, 224.Qq publickey,publickey 225requires successful authentication using two different public keys. 226.Pp 227Note that each authentication method listed should also be explicitly enabled 228in the configuration. 229.Pp 230The available authentication methods are: 231.Qq gssapi-with-mic , 232.Qq hostbased , 233.Qq keyboard-interactive , 234.Qq none 235(used for access to password-less accounts when 236.Cm PermitEmptyPasswords 237is enabled), 238.Qq password 239and 240.Qq publickey . 241.It Cm AuthorizedKeysCommand 242Specifies a program to be used to look up the user's public keys. 243The program must be owned by root, not writable by group or others and 244specified by an absolute path. 245Arguments to 246.Cm AuthorizedKeysCommand 247accept the tokens described in the 248.Sx TOKENS 249section. 250If no arguments are specified then the username of the target user is used. 251.Pp 252The program should produce on standard output zero or 253more lines of authorized_keys output (see 254.Sx AUTHORIZED_KEYS 255in 256.Xr sshd 8 ) . 257.Cm AuthorizedKeysCommand 258is tried after the usual 259.Cm AuthorizedKeysFile 260files and will not be executed if a matching key is found there. 261By default, no 262.Cm AuthorizedKeysCommand 263is run. 264.It Cm AuthorizedKeysCommandUser 265Specifies the user under whose account the 266.Cm AuthorizedKeysCommand 267is run. 268It is recommended to use a dedicated user that has no other role on the host 269than running authorized keys commands. 270If 271.Cm AuthorizedKeysCommand 272is specified but 273.Cm AuthorizedKeysCommandUser 274is not, then 275.Xr sshd 8 276will refuse to start. 277.It Cm AuthorizedKeysFile 278Specifies the file that contains the public keys used for user authentication. 279The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 280.Xr sshd 8 . 281Arguments to 282.Cm AuthorizedKeysFile 283accept the tokens described in the 284.Sx TOKENS 285section. 286After expansion, 287.Cm AuthorizedKeysFile 288is taken to be an absolute path or one relative to the user's home 289directory. 290Multiple files may be listed, separated by whitespace. 291Alternately this option may be set to 292.Cm none 293to skip checking for user keys in files. 294The default is 295.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 296.It Cm AuthorizedPrincipalsCommand 297Specifies a program to be used to generate the list of allowed 298certificate principals as per 299.Cm AuthorizedPrincipalsFile . 300The program must be owned by root, not writable by group or others and 301specified by an absolute path. 302Arguments to 303.Cm AuthorizedPrincipalsCommand 304accept the tokens described in the 305.Sx TOKENS 306section. 307If no arguments are specified then the username of the target user is used. 308.Pp 309The program should produce on standard output zero or 310more lines of 311.Cm AuthorizedPrincipalsFile 312output. 313If either 314.Cm AuthorizedPrincipalsCommand 315or 316.Cm AuthorizedPrincipalsFile 317is specified, then certificates offered by the client for authentication 318must contain a principal that is listed. 319By default, no 320.Cm AuthorizedPrincipalsCommand 321is run. 322.It Cm AuthorizedPrincipalsCommandUser 323Specifies the user under whose account the 324.Cm AuthorizedPrincipalsCommand 325is run. 326It is recommended to use a dedicated user that has no other role on the host 327than running authorized principals commands. 328If 329.Cm AuthorizedPrincipalsCommand 330is specified but 331.Cm AuthorizedPrincipalsCommandUser 332is not, then 333.Xr sshd 8 334will refuse to start. 335.It Cm AuthorizedPrincipalsFile 336Specifies a file that lists principal names that are accepted for 337certificate authentication. 338When using certificates signed by a key listed in 339.Cm TrustedUserCAKeys , 340this file lists names, one of which must appear in the certificate for it 341to be accepted for authentication. 342Names are listed one per line preceded by key options (as described in 343.Sx AUTHORIZED_KEYS FILE FORMAT 344in 345.Xr sshd 8 ) . 346Empty lines and comments starting with 347.Ql # 348are ignored. 349.Pp 350Arguments to 351.Cm AuthorizedPrincipalsFile 352accept the tokens described in the 353.Sx TOKENS 354section. 355After expansion, 356.Cm AuthorizedPrincipalsFile 357is taken to be an absolute path or one relative to the user's home directory. 358The default is 359.Cm none , 360i.e. not to use a principals file \(en in this case, the username 361of the user must appear in a certificate's principals list for it to be 362accepted. 363.Pp 364Note that 365.Cm AuthorizedPrincipalsFile 366is only used when authentication proceeds using a CA listed in 367.Cm TrustedUserCAKeys 368and is not consulted for certification authorities trusted via 369.Pa ~/.ssh/authorized_keys , 370though the 371.Cm principals= 372key option offers a similar facility (see 373.Xr sshd 8 374for details). 375.It Cm Banner 376The contents of the specified file are sent to the remote user before 377authentication is allowed. 378If the argument is 379.Cm none 380then no banner is displayed. 381By default, no banner is displayed. 382.It Cm CASignatureAlgorithms 383Specifies which algorithms are allowed for signing of certificates 384by certificate authorities (CAs). 385The default is: 386.Bd -literal -offset indent 387ssh-ed25519,ecdsa-sha2-nistp256, 388ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 389sk-ssh-ed25519@openssh.com, 390sk-ecdsa-sha2-nistp256@openssh.com, 391rsa-sha2-512,rsa-sha2-256 392.Ed 393.Pp 394If the specified list begins with a 395.Sq + 396character, then the specified algorithms will be appended to the default set 397instead of replacing them. 398If the specified list begins with a 399.Sq - 400character, then the specified algorithms (including wildcards) will be removed 401from the default set instead of replacing them. 402.Pp 403Certificates signed using other algorithms will not be accepted for 404public key or host-based authentication. 405.It Cm ChannelTimeout 406Specifies whether and how quickly 407.Xr sshd 8 408should close inactive channels. 409Timeouts are specified as one or more 410.Dq type=interval 411pairs separated by whitespace, where the 412.Dq type 413must be a channel type name (as described in the table below), optionally 414containing wildcard characters. 415.Pp 416The timeout value 417.Dq interval 418is specified in seconds or may use any of the units documented in the 419.Sx TIME FORMATS 420section. 421For example, 422.Dq session:*=5m 423would cause all sessions to terminate after five minutes of inactivity. 424Specifying a zero value disables the inactivity timeout. 425.Pp 426The available channel types include: 427.Bl -tag -width Ds 428.It Cm agent-connection 429Open connections to 430.Xr ssh-agent 1 . 431.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com 432Open TCP or Unix socket (respectively) connections that have 433been established from a 434.Xr ssh 1 435local forwarding, i.e.\& 436.Cm LocalForward 437or 438.Cm DynamicForward . 439.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com 440Open TCP or Unix socket (respectively) connections that have been 441established to a 442.Xr sshd 8 443listening on behalf of a 444.Xr ssh 1 445remote forwarding, i.e.\& 446.Cm RemoteForward . 447.It Cm session:command 448Command execution sessions. 449.It Cm session:shell 450Interactive shell sessions. 451.It Cm session:subsystem:... 452Subsystem sessions, e.g. for 453.Xr sftp 1 , 454which could be identified as 455.Cm session:subsystem:sftp . 456.It Cm x11-connection 457Open X11 forwarding sessions. 458.El 459.Pp 460Note that in all the above cases, terminating an inactive session does not 461guarantee to remove all resources associated with the session, e.g. shell 462processes or X11 clients relating to the session may continue to execute. 463.Pp 464Moreover, terminating an inactive channel or session does not necessarily 465close the SSH connection, nor does it prevent a client from 466requesting another channel of the same type. 467In particular, expiring an inactive forwarding session does not prevent 468another identical forwarding from being subsequently created. 469See also 470.Cm UnusedConnectionTimeout , 471which may be used in conjunction with this option. 472.Pp 473The default is not to expire channels of any type for inactivity. 474.It Cm ChrootDirectory 475Specifies the pathname of a directory to 476.Xr chroot 2 477to after authentication. 478At session startup 479.Xr sshd 8 480checks that all components of the pathname are root-owned directories 481which are not writable by any other user or group. 482After the chroot, 483.Xr sshd 8 484changes the working directory to the user's home directory. 485Arguments to 486.Cm ChrootDirectory 487accept the tokens described in the 488.Sx TOKENS 489section. 490.Pp 491The 492.Cm ChrootDirectory 493must contain the necessary files and directories to support the 494user's session. 495For an interactive session this requires at least a shell, typically 496.Xr sh 1 , 497and basic 498.Pa /dev 499nodes such as 500.Xr null 4 , 501.Xr zero 4 , 502.Xr stdin 4 , 503.Xr stdout 4 , 504.Xr stderr 4 , 505and 506.Xr tty 4 507devices. 508For file transfer sessions using SFTP 509no additional configuration of the environment is necessary if the in-process 510sftp-server is used, 511though sessions which use logging may require 512.Pa /dev/log 513inside the chroot directory on some operating systems (see 514.Xr sftp-server 8 515for details). 516.Pp 517For safety, it is very important that the directory hierarchy be 518prevented from modification by other processes on the system (especially 519those outside the jail). 520Misconfiguration can lead to unsafe environments which 521.Xr sshd 8 522cannot detect. 523.Pp 524The default is 525.Cm none , 526indicating not to 527.Xr chroot 2 . 528.It Cm Ciphers 529Specifies the ciphers allowed. 530Multiple ciphers must be comma-separated. 531If the specified list begins with a 532.Sq + 533character, then the specified ciphers will be appended to the default set 534instead of replacing them. 535If the specified list begins with a 536.Sq - 537character, then the specified ciphers (including wildcards) will be removed 538from the default set instead of replacing them. 539If the specified list begins with a 540.Sq ^ 541character, then the specified ciphers will be placed at the head of the 542default set. 543.Pp 544The supported ciphers are: 545.Pp 546.Bl -item -compact -offset indent 547.It 5483des-cbc 549.It 550aes128-cbc 551.It 552aes192-cbc 553.It 554aes256-cbc 555.It 556aes128-ctr 557.It 558aes192-ctr 559.It 560aes256-ctr 561.It 562aes128-gcm@openssh.com 563.It 564aes256-gcm@openssh.com 565.It 566chacha20-poly1305@openssh.com 567.El 568.Pp 569The default is: 570.Bd -literal -offset indent 571chacha20-poly1305@openssh.com, 572aes128-ctr,aes192-ctr,aes256-ctr, 573aes128-gcm@openssh.com,aes256-gcm@openssh.com 574.Ed 575.Pp 576The list of available ciphers may also be obtained using 577.Qq ssh -Q cipher . 578.It Cm ClientAliveCountMax 579Sets the number of client alive messages which may be sent without 580.Xr sshd 8 581receiving any messages back from the client. 582If this threshold is reached while client alive messages are being sent, 583sshd will disconnect the client, terminating the session. 584It is important to note that the use of client alive messages is very 585different from 586.Cm TCPKeepAlive . 587The client alive messages are sent through the encrypted channel 588and therefore will not be spoofable. 589The TCP keepalive option enabled by 590.Cm TCPKeepAlive 591is spoofable. 592The client alive mechanism is valuable when the client or 593server depend on knowing when a connection has become unresponsive. 594.Pp 595The default value is 3. 596If 597.Cm ClientAliveInterval 598is set to 15, and 599.Cm ClientAliveCountMax 600is left at the default, unresponsive SSH clients 601will be disconnected after approximately 45 seconds. 602Setting a zero 603.Cm ClientAliveCountMax 604disables connection termination. 605.It Cm ClientAliveInterval 606Sets a timeout interval in seconds after which if no data has been received 607from the client, 608.Xr sshd 8 609will send a message through the encrypted 610channel to request a response from the client. 611The default 612is 0, indicating that these messages will not be sent to the client. 613.It Cm Compression 614Specifies whether compression is enabled after 615the user has authenticated successfully. 616The argument must be 617.Cm yes , 618.Cm delayed 619(a legacy synonym for 620.Cm yes ) 621or 622.Cm no . 623The default is 624.Cm yes . 625.It Cm DenyGroups 626This keyword can be followed by a list of group name patterns, separated 627by spaces. 628Login is disallowed for users whose primary group or supplementary 629group list matches one of the patterns. 630Only group names are valid; a numerical group ID is not recognized. 631By default, login is allowed for all groups. 632The allow/deny groups directives are processed in the following order: 633.Cm DenyGroups , 634.Cm AllowGroups . 635.Pp 636See PATTERNS in 637.Xr ssh_config 5 638for more information on patterns. 639This keyword may appear multiple times in 640.Nm 641with each instance appending to the list. 642.It Cm DenyUsers 643This keyword can be followed by a list of user name patterns, separated 644by spaces. 645Login is disallowed for user names that match one of the patterns. 646Only user names are valid; a numerical user ID is not recognized. 647By default, login is allowed for all users. 648If the pattern takes the form USER@HOST then USER and HOST 649are separately checked, restricting logins to particular 650users from particular hosts. 651HOST criteria may additionally contain addresses to match in CIDR 652address/masklen format. 653The allow/deny users directives are processed in the following order: 654.Cm DenyUsers , 655.Cm AllowUsers . 656.Pp 657See PATTERNS in 658.Xr ssh_config 5 659for more information on patterns. 660This keyword may appear multiple times in 661.Nm 662with each instance appending to the list. 663.It Cm DisableForwarding 664Disables all forwarding features, including X11, 665.Xr ssh-agent 1 , 666TCP and StreamLocal. 667This option overrides all other forwarding-related options and may 668simplify restricted configurations. 669.It Cm ExposeAuthInfo 670Writes a temporary file containing a list of authentication methods and 671public credentials (e.g. keys) used to authenticate the user. 672The location of the file is exposed to the user session through the 673.Ev SSH_USER_AUTH 674environment variable. 675The default is 676.Cm no . 677.It Cm FingerprintHash 678Specifies the hash algorithm used when logging key fingerprints. 679Valid options are: 680.Cm md5 681and 682.Cm sha256 . 683The default is 684.Cm sha256 . 685.It Cm ForceCommand 686Forces the execution of the command specified by 687.Cm ForceCommand , 688ignoring any command supplied by the client and 689.Pa ~/.ssh/rc 690if present. 691The command is invoked by using the user's login shell with the -c option. 692This applies to shell, command, or subsystem execution. 693It is most useful inside a 694.Cm Match 695block. 696The command originally supplied by the client is available in the 697.Ev SSH_ORIGINAL_COMMAND 698environment variable. 699Specifying a command of 700.Cm internal-sftp 701will force the use of an in-process SFTP server that requires no support 702files when used with 703.Cm ChrootDirectory . 704The default is 705.Cm none . 706.It Cm GatewayPorts 707Specifies whether remote hosts are allowed to connect to ports 708forwarded for the client. 709By default, 710.Xr sshd 8 711binds remote port forwardings to the loopback address. 712This prevents other remote hosts from connecting to forwarded ports. 713.Cm GatewayPorts 714can be used to specify that sshd 715should allow remote port forwardings to bind to non-loopback addresses, thus 716allowing other hosts to connect. 717The argument may be 718.Cm no 719to force remote port forwardings to be available to the local host only, 720.Cm yes 721to force remote port forwardings to bind to the wildcard address, or 722.Cm clientspecified 723to allow the client to select the address to which the forwarding is bound. 724The default is 725.Cm no . 726.It Cm GSSAPIAuthentication 727Specifies whether user authentication based on GSSAPI is allowed. 728The default is 729.Cm no . 730.It Cm GSSAPICleanupCredentials 731Specifies whether to automatically destroy the user's credentials cache 732on logout. 733The default is 734.Cm yes . 735.It Cm GSSAPIStrictAcceptorCheck 736Determines whether to be strict about the identity of the GSSAPI acceptor 737a client authenticates against. 738If set to 739.Cm yes 740then the client must authenticate against the host 741service on the current hostname. 742If set to 743.Cm no 744then the client may authenticate against any service key stored in the 745machine's default store. 746This facility is provided to assist with operation on multi homed machines. 747The default is 748.Cm yes . 749.It Cm HostbasedAcceptedAlgorithms 750Specifies the signature algorithms that will be accepted for hostbased 751authentication as a list of comma-separated patterns. 752Alternately if the specified list begins with a 753.Sq + 754character, then the specified signature algorithms will be appended to 755the default set instead of replacing them. 756If the specified list begins with a 757.Sq - 758character, then the specified signature algorithms (including wildcards) 759will be removed from the default set instead of replacing them. 760If the specified list begins with a 761.Sq ^ 762character, then the specified signature algorithms will be placed at 763the head of the default set. 764The default for this option is: 765.Bd -literal -offset 3n 766ssh-ed25519-cert-v01@openssh.com, 767ecdsa-sha2-nistp256-cert-v01@openssh.com, 768ecdsa-sha2-nistp384-cert-v01@openssh.com, 769ecdsa-sha2-nistp521-cert-v01@openssh.com, 770sk-ssh-ed25519-cert-v01@openssh.com, 771sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 772rsa-sha2-512-cert-v01@openssh.com, 773rsa-sha2-256-cert-v01@openssh.com, 774ssh-ed25519, 775ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 776sk-ssh-ed25519@openssh.com, 777sk-ecdsa-sha2-nistp256@openssh.com, 778rsa-sha2-512,rsa-sha2-256 779.Ed 780.Pp 781The list of available signature algorithms may also be obtained using 782.Qq ssh -Q HostbasedAcceptedAlgorithms . 783This was formerly named HostbasedAcceptedKeyTypes. 784.It Cm HostbasedAuthentication 785Specifies whether rhosts or /etc/hosts.equiv authentication together 786with successful public key client host authentication is allowed 787(host-based authentication). 788The default is 789.Cm no . 790.It Cm HostbasedUsesNameFromPacketOnly 791Specifies whether or not the server will attempt to perform a reverse 792name lookup when matching the name in the 793.Pa ~/.shosts , 794.Pa ~/.rhosts , 795and 796.Pa /etc/hosts.equiv 797files during 798.Cm HostbasedAuthentication . 799A setting of 800.Cm yes 801means that 802.Xr sshd 8 803uses the name supplied by the client rather than 804attempting to resolve the name from the TCP connection itself. 805The default is 806.Cm no . 807.It Cm HostCertificate 808Specifies a file containing a public host certificate. 809The certificate's public key must match a private host key already specified 810by 811.Cm HostKey . 812The default behaviour of 813.Xr sshd 8 814is not to load any certificates. 815.It Cm HostKey 816Specifies a file containing a private host key 817used by SSH. 818The defaults are 819.Pa /etc/ssh/ssh_host_ecdsa_key , 820.Pa /etc/ssh/ssh_host_ed25519_key 821and 822.Pa /etc/ssh/ssh_host_rsa_key . 823.Pp 824Note that 825.Xr sshd 8 826will refuse to use a file if it is group/world-accessible 827and that the 828.Cm HostKeyAlgorithms 829option restricts which of the keys are actually used by 830.Xr sshd 8 . 831.Pp 832It is possible to have multiple host key files. 833It is also possible to specify public host key files instead. 834In this case operations on the private key will be delegated 835to an 836.Xr ssh-agent 1 . 837.It Cm HostKeyAgent 838Identifies the UNIX-domain socket used to communicate 839with an agent that has access to the private host keys. 840If the string 841.Qq SSH_AUTH_SOCK 842is specified, the location of the socket will be read from the 843.Ev SSH_AUTH_SOCK 844environment variable. 845.It Cm HostKeyAlgorithms 846Specifies the host key signature algorithms 847that the server offers. 848The default for this option is: 849.Bd -literal -offset 3n 850ssh-ed25519-cert-v01@openssh.com, 851ecdsa-sha2-nistp256-cert-v01@openssh.com, 852ecdsa-sha2-nistp384-cert-v01@openssh.com, 853ecdsa-sha2-nistp521-cert-v01@openssh.com, 854sk-ssh-ed25519-cert-v01@openssh.com, 855sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 856rsa-sha2-512-cert-v01@openssh.com, 857rsa-sha2-256-cert-v01@openssh.com, 858ssh-ed25519, 859ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 860sk-ssh-ed25519@openssh.com, 861sk-ecdsa-sha2-nistp256@openssh.com, 862rsa-sha2-512,rsa-sha2-256 863.Ed 864.Pp 865The list of available signature algorithms may also be obtained using 866.Qq ssh -Q HostKeyAlgorithms . 867.It Cm IgnoreRhosts 868Specifies whether to ignore per-user 869.Pa .rhosts 870and 871.Pa .shosts 872files during 873.Cm HostbasedAuthentication . 874The system-wide 875.Pa /etc/hosts.equiv 876and 877.Pa /etc/shosts.equiv 878are still used regardless of this setting. 879.Pp 880Accepted values are 881.Cm yes 882(the default) to ignore all per-user files, 883.Cm shosts-only 884to allow the use of 885.Pa .shosts 886but to ignore 887.Pa .rhosts 888or 889.Cm no 890to allow both 891.Pa .shosts 892and 893.Pa rhosts . 894.It Cm IgnoreUserKnownHosts 895Specifies whether 896.Xr sshd 8 897should ignore the user's 898.Pa ~/.ssh/known_hosts 899during 900.Cm HostbasedAuthentication 901and use only the system-wide known hosts file 902.Pa /etc/ssh/ssh_known_hosts . 903The default is 904.Dq no . 905.It Cm Include 906Include the specified configuration file(s). 907Multiple pathnames may be specified and each pathname may contain 908.Xr glob 7 909wildcards that will be expanded and processed in lexical order. 910Files without absolute paths are assumed to be in 911.Pa /etc/ssh . 912An 913.Cm Include 914directive may appear inside a 915.Cm Match 916block 917to perform conditional inclusion. 918.It Cm IPQoS 919Specifies the IPv4 type-of-service or DSCP class for the connection. 920Accepted values are 921.Cm af11 , 922.Cm af12 , 923.Cm af13 , 924.Cm af21 , 925.Cm af22 , 926.Cm af23 , 927.Cm af31 , 928.Cm af32 , 929.Cm af33 , 930.Cm af41 , 931.Cm af42 , 932.Cm af43 , 933.Cm cs0 , 934.Cm cs1 , 935.Cm cs2 , 936.Cm cs3 , 937.Cm cs4 , 938.Cm cs5 , 939.Cm cs6 , 940.Cm cs7 , 941.Cm ef , 942.Cm le , 943.Cm lowdelay , 944.Cm throughput , 945.Cm reliability , 946a numeric value, or 947.Cm none 948to use the operating system default. 949This option may take one or two arguments, separated by whitespace. 950If one argument is specified, it is used as the packet class unconditionally. 951If two values are specified, the first is automatically selected for 952interactive sessions and the second for non-interactive sessions. 953The default is 954.Cm af21 955(Low-Latency Data) 956for interactive sessions and 957.Cm cs1 958(Lower Effort) 959for non-interactive sessions. 960.It Cm KbdInteractiveAuthentication 961Specifies whether to allow keyboard-interactive authentication. 962All authentication styles from 963.Xr login.conf 5 964are supported. 965The default is 966.Cm yes . 967The argument to this keyword must be 968.Cm yes 969or 970.Cm no . 971.Cm ChallengeResponseAuthentication 972is a deprecated alias for this. 973.It Cm KerberosAuthentication 974Specifies whether the password provided by the user for 975.Cm PasswordAuthentication 976will be validated through the Kerberos KDC. 977To use this option, the server needs a 978Kerberos servtab which allows the verification of the KDC's identity. 979The default is 980.Cm no . 981.It Cm KerberosGetAFSToken 982If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 983an AFS token before accessing the user's home directory. 984The default is 985.Cm no . 986.It Cm KerberosOrLocalPasswd 987If password authentication through Kerberos fails then 988the password will be validated via any additional local mechanism 989such as 990.Pa /etc/passwd . 991The default is 992.Cm yes . 993.It Cm KerberosTicketCleanup 994Specifies whether to automatically destroy the user's ticket cache 995file on logout. 996The default is 997.Cm yes . 998.It Cm KexAlgorithms 999Specifies the available KEX (Key Exchange) algorithms. 1000Multiple algorithms must be comma-separated. 1001Alternately if the specified list begins with a 1002.Sq + 1003character, then the specified algorithms will be appended to the default set 1004instead of replacing them. 1005If the specified list begins with a 1006.Sq - 1007character, then the specified algorithms (including wildcards) will be removed 1008from the default set instead of replacing them. 1009If the specified list begins with a 1010.Sq ^ 1011character, then the specified algorithms will be placed at the head of the 1012default set. 1013The supported algorithms are: 1014.Pp 1015.Bl -item -compact -offset indent 1016.It 1017curve25519-sha256 1018.It 1019curve25519-sha256@libssh.org 1020.It 1021diffie-hellman-group1-sha1 1022.It 1023diffie-hellman-group14-sha1 1024.It 1025diffie-hellman-group14-sha256 1026.It 1027diffie-hellman-group16-sha512 1028.It 1029diffie-hellman-group18-sha512 1030.It 1031diffie-hellman-group-exchange-sha1 1032.It 1033diffie-hellman-group-exchange-sha256 1034.It 1035ecdh-sha2-nistp256 1036.It 1037ecdh-sha2-nistp384 1038.It 1039ecdh-sha2-nistp521 1040.It 1041sntrup761x25519-sha512@openssh.com 1042.El 1043.Pp 1044The default is: 1045.Bd -literal -offset indent 1046sntrup761x25519-sha512@openssh.com, 1047curve25519-sha256,curve25519-sha256@libssh.org, 1048ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 1049diffie-hellman-group-exchange-sha256, 1050diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 1051diffie-hellman-group14-sha256 1052.Ed 1053.Pp 1054The list of available key exchange algorithms may also be obtained using 1055.Qq ssh -Q KexAlgorithms . 1056.It Cm ListenAddress 1057Specifies the local addresses 1058.Xr sshd 8 1059should listen on. 1060The following forms may be used: 1061.Pp 1062.Bl -item -offset indent -compact 1063.It 1064.Cm ListenAddress 1065.Sm off 1066.Ar hostname | address 1067.Sm on 1068.Op Cm rdomain Ar domain 1069.It 1070.Cm ListenAddress 1071.Sm off 1072.Ar hostname : port 1073.Sm on 1074.Op Cm rdomain Ar domain 1075.It 1076.Cm ListenAddress 1077.Sm off 1078.Ar IPv4_address : port 1079.Sm on 1080.Op Cm rdomain Ar domain 1081.It 1082.Cm ListenAddress 1083.Sm off 1084.Oo Ar hostname | address Oc : Ar port 1085.Sm on 1086.Op Cm rdomain Ar domain 1087.El 1088.Pp 1089The optional 1090.Cm rdomain 1091qualifier requests 1092.Xr sshd 8 1093listen in an explicit routing domain. 1094If 1095.Ar port 1096is not specified, 1097sshd will listen on the address and all 1098.Cm Port 1099options specified. 1100The default is to listen on all local addresses on the current default 1101routing domain. 1102Multiple 1103.Cm ListenAddress 1104options are permitted. 1105For more information on routing domains, see 1106.Xr rdomain 4 . 1107.It Cm LoginGraceTime 1108The server disconnects after this time if the user has not 1109successfully logged in. 1110If the value is 0, there is no time limit. 1111The default is 120 seconds. 1112.It Cm LogLevel 1113Gives the verbosity level that is used when logging messages from 1114.Xr sshd 8 . 1115The possible values are: 1116QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1117The default is INFO. 1118DEBUG and DEBUG1 are equivalent. 1119DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1120Logging with a DEBUG level violates the privacy of users and is not recommended. 1121.It Cm LogVerbose 1122Specify one or more overrides to LogLevel. 1123An override consists of a pattern lists that matches the source file, function 1124and line number to force detailed logging for. 1125For example, an override pattern of: 1126.Bd -literal -offset indent 1127kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1128.Ed 1129.Pp 1130would enable detailed logging for line 1000 of 1131.Pa kex.c , 1132everything in the 1133.Fn kex_exchange_identification 1134function, and all code in the 1135.Pa packet.c 1136file. 1137This option is intended for debugging and no overrides are enabled by default. 1138.It Cm MACs 1139Specifies the available MAC (message authentication code) algorithms. 1140The MAC algorithm is used for data integrity protection. 1141Multiple algorithms must be comma-separated. 1142If the specified list begins with a 1143.Sq + 1144character, then the specified algorithms will be appended to the default set 1145instead of replacing them. 1146If the specified list begins with a 1147.Sq - 1148character, then the specified algorithms (including wildcards) will be removed 1149from the default set instead of replacing them. 1150If the specified list begins with a 1151.Sq ^ 1152character, then the specified algorithms will be placed at the head of the 1153default set. 1154.Pp 1155The algorithms that contain 1156.Qq -etm 1157calculate the MAC after encryption (encrypt-then-mac). 1158These are considered safer and their use recommended. 1159The supported MACs are: 1160.Pp 1161.Bl -item -compact -offset indent 1162.It 1163hmac-md5 1164.It 1165hmac-md5-96 1166.It 1167hmac-sha1 1168.It 1169hmac-sha1-96 1170.It 1171hmac-sha2-256 1172.It 1173hmac-sha2-512 1174.It 1175umac-64@openssh.com 1176.It 1177umac-128@openssh.com 1178.It 1179hmac-md5-etm@openssh.com 1180.It 1181hmac-md5-96-etm@openssh.com 1182.It 1183hmac-sha1-etm@openssh.com 1184.It 1185hmac-sha1-96-etm@openssh.com 1186.It 1187hmac-sha2-256-etm@openssh.com 1188.It 1189hmac-sha2-512-etm@openssh.com 1190.It 1191umac-64-etm@openssh.com 1192.It 1193umac-128-etm@openssh.com 1194.El 1195.Pp 1196The default is: 1197.Bd -literal -offset indent 1198umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1199hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1200hmac-sha1-etm@openssh.com, 1201umac-64@openssh.com,umac-128@openssh.com, 1202hmac-sha2-256,hmac-sha2-512,hmac-sha1 1203.Ed 1204.Pp 1205The list of available MAC algorithms may also be obtained using 1206.Qq ssh -Q mac . 1207.It Cm Match 1208Introduces a conditional block. 1209If all of the criteria on the 1210.Cm Match 1211line are satisfied, the keywords on the following lines override those 1212set in the global section of the config file, until either another 1213.Cm Match 1214line or the end of the file. 1215If a keyword appears in multiple 1216.Cm Match 1217blocks that are satisfied, only the first instance of the keyword is 1218applied. 1219.Pp 1220The arguments to 1221.Cm Match 1222are one or more criteria-pattern pairs or the single token 1223.Cm All 1224which matches all criteria. 1225The available criteria are 1226.Cm User , 1227.Cm Group , 1228.Cm Host , 1229.Cm LocalAddress , 1230.Cm LocalPort , 1231.Cm RDomain , 1232and 1233.Cm Address 1234(with 1235.Cm RDomain 1236representing the 1237.Xr rdomain 4 1238on which the connection was received). 1239.Pp 1240The match patterns may consist of single entries or comma-separated 1241lists and may use the wildcard and negation operators described in the 1242.Sx PATTERNS 1243section of 1244.Xr ssh_config 5 . 1245.Pp 1246The patterns in an 1247.Cm Address 1248criteria may additionally contain addresses to match in CIDR 1249address/masklen format, 1250such as 192.0.2.0/24 or 2001:db8::/32. 1251Note that the mask length provided must be consistent with the address - 1252it is an error to specify a mask length that is too long for the address 1253or one with bits set in this host portion of the address. 1254For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1255.Pp 1256Only a subset of keywords may be used on the lines following a 1257.Cm Match 1258keyword. 1259Available keywords are 1260.Cm AcceptEnv , 1261.Cm AllowAgentForwarding , 1262.Cm AllowGroups , 1263.Cm AllowStreamLocalForwarding , 1264.Cm AllowTcpForwarding , 1265.Cm AllowUsers , 1266.Cm AuthenticationMethods , 1267.Cm AuthorizedKeysCommand , 1268.Cm AuthorizedKeysCommandUser , 1269.Cm AuthorizedKeysFile , 1270.Cm AuthorizedPrincipalsCommand , 1271.Cm AuthorizedPrincipalsCommandUser , 1272.Cm AuthorizedPrincipalsFile , 1273.Cm Banner , 1274.Cm CASignatureAlgorithms , 1275.Cm ChannelTimeout , 1276.Cm ChrootDirectory , 1277.Cm ClientAliveCountMax , 1278.Cm ClientAliveInterval , 1279.Cm DenyGroups , 1280.Cm DenyUsers , 1281.Cm DisableForwarding , 1282.Cm ExposeAuthInfo , 1283.Cm ForceCommand , 1284.Cm GatewayPorts , 1285.Cm GSSAPIAuthentication , 1286.Cm HostbasedAcceptedAlgorithms , 1287.Cm HostbasedAuthentication , 1288.Cm HostbasedUsesNameFromPacketOnly , 1289.Cm IgnoreRhosts , 1290.Cm Include , 1291.Cm IPQoS , 1292.Cm KbdInteractiveAuthentication , 1293.Cm KerberosAuthentication , 1294.Cm LogLevel , 1295.Cm MaxAuthTries , 1296.Cm MaxSessions , 1297.Cm PasswordAuthentication , 1298.Cm PermitEmptyPasswords , 1299.Cm PermitListen , 1300.Cm PermitOpen , 1301.Cm PermitRootLogin , 1302.Cm PermitTTY , 1303.Cm PermitTunnel , 1304.Cm PermitUserRC , 1305.Cm PubkeyAcceptedAlgorithms , 1306.Cm PubkeyAuthentication , 1307.Cm PubkeyAuthOptions , 1308.Cm RekeyLimit , 1309.Cm RevokedKeys , 1310.Cm RDomain , 1311.Cm SetEnv , 1312.Cm StreamLocalBindMask , 1313.Cm StreamLocalBindUnlink , 1314.Cm TrustedUserCAKeys , 1315.Cm UnusedConnectionTimeout , 1316.Cm X11DisplayOffset , 1317.Cm X11Forwarding 1318and 1319.Cm X11UseLocalhost . 1320.It Cm MaxAuthTries 1321Specifies the maximum number of authentication attempts permitted per 1322connection. 1323Once the number of failures reaches half this value, 1324additional failures are logged. 1325The default is 6. 1326.It Cm MaxSessions 1327Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1328sessions permitted per network connection. 1329Multiple sessions may be established by clients that support connection 1330multiplexing. 1331Setting 1332.Cm MaxSessions 1333to 1 will effectively disable session multiplexing, whereas setting it to 0 1334will prevent all shell, login and subsystem sessions while still permitting 1335forwarding. 1336The default is 10. 1337.It Cm MaxStartups 1338Specifies the maximum number of concurrent unauthenticated connections to the 1339SSH daemon. 1340Additional connections will be dropped until authentication succeeds or the 1341.Cm LoginGraceTime 1342expires for a connection. 1343The default is 10:30:100. 1344.Pp 1345Alternatively, random early drop can be enabled by specifying 1346the three colon separated values 1347start:rate:full (e.g. "10:30:60"). 1348.Xr sshd 8 1349will refuse connection attempts with a probability of rate/100 (30%) 1350if there are currently start (10) unauthenticated connections. 1351The probability increases linearly and all connection attempts 1352are refused if the number of unauthenticated connections reaches full (60). 1353.It Cm ModuliFile 1354Specifies the 1355.Xr moduli 5 1356file that contains the Diffie-Hellman groups used for the 1357.Dq diffie-hellman-group-exchange-sha1 1358and 1359.Dq diffie-hellman-group-exchange-sha256 1360key exchange methods. 1361The default is 1362.Pa /etc/moduli . 1363.It Cm PasswordAuthentication 1364Specifies whether password authentication is allowed. 1365The default is 1366.Cm yes . 1367.It Cm PermitEmptyPasswords 1368When password authentication is allowed, it specifies whether the 1369server allows login to accounts with empty password strings. 1370The default is 1371.Cm no . 1372.It Cm PermitListen 1373Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1374The listen specification must be one of the following forms: 1375.Pp 1376.Bl -item -offset indent -compact 1377.It 1378.Cm PermitListen 1379.Sm off 1380.Ar port 1381.Sm on 1382.It 1383.Cm PermitListen 1384.Sm off 1385.Ar host : port 1386.Sm on 1387.El 1388.Pp 1389Multiple permissions may be specified by separating them with whitespace. 1390An argument of 1391.Cm any 1392can be used to remove all restrictions and permit any listen requests. 1393An argument of 1394.Cm none 1395can be used to prohibit all listen requests. 1396The host name may contain wildcards as described in the PATTERNS section in 1397.Xr ssh_config 5 . 1398The wildcard 1399.Sq * 1400can also be used in place of a port number to allow all ports. 1401By default all port forwarding listen requests are permitted. 1402Note that the 1403.Cm GatewayPorts 1404option may further restrict which addresses may be listened on. 1405Note also that 1406.Xr ssh 1 1407will request a listen host of 1408.Dq localhost 1409if no listen host was specifically requested, and this name is 1410treated differently to explicit localhost addresses of 1411.Dq 127.0.0.1 1412and 1413.Dq ::1 . 1414.It Cm PermitOpen 1415Specifies the destinations to which TCP port forwarding is permitted. 1416The forwarding specification must be one of the following forms: 1417.Pp 1418.Bl -item -offset indent -compact 1419.It 1420.Cm PermitOpen 1421.Sm off 1422.Ar host : port 1423.Sm on 1424.It 1425.Cm PermitOpen 1426.Sm off 1427.Ar IPv4_addr : port 1428.Sm on 1429.It 1430.Cm PermitOpen 1431.Sm off 1432.Ar \&[ IPv6_addr \&] : port 1433.Sm on 1434.El 1435.Pp 1436Multiple forwards may be specified by separating them with whitespace. 1437An argument of 1438.Cm any 1439can be used to remove all restrictions and permit any forwarding requests. 1440An argument of 1441.Cm none 1442can be used to prohibit all forwarding requests. 1443The wildcard 1444.Sq * 1445can be used for host or port to allow all hosts or ports respectively. 1446Otherwise, no pattern matching or address lookups are performed on supplied 1447names. 1448By default all port forwarding requests are permitted. 1449.It Cm PermitRootLogin 1450Specifies whether root can log in using 1451.Xr ssh 1 . 1452The argument must be 1453.Cm yes , 1454.Cm prohibit-password , 1455.Cm forced-commands-only , 1456or 1457.Cm no . 1458The default is 1459.Cm prohibit-password . 1460.Pp 1461If this option is set to 1462.Cm prohibit-password 1463(or its deprecated alias, 1464.Cm without-password ) , 1465password and keyboard-interactive authentication are disabled for root. 1466.Pp 1467If this option is set to 1468.Cm forced-commands-only , 1469root login with public key authentication will be allowed, 1470but only if the 1471.Ar command 1472option has been specified 1473(which may be useful for taking remote backups even if root login is 1474normally not allowed). 1475All other authentication methods are disabled for root. 1476.Pp 1477If this option is set to 1478.Cm no , 1479root is not allowed to log in. 1480.It Cm PermitTTY 1481Specifies whether 1482.Xr pty 4 1483allocation is permitted. 1484The default is 1485.Cm yes . 1486.It Cm PermitTunnel 1487Specifies whether 1488.Xr tun 4 1489device forwarding is allowed. 1490The argument must be 1491.Cm yes , 1492.Cm point-to-point 1493(layer 3), 1494.Cm ethernet 1495(layer 2), or 1496.Cm no . 1497Specifying 1498.Cm yes 1499permits both 1500.Cm point-to-point 1501and 1502.Cm ethernet . 1503The default is 1504.Cm no . 1505.Pp 1506Independent of this setting, the permissions of the selected 1507.Xr tun 4 1508device must allow access to the user. 1509.It Cm PermitUserEnvironment 1510Specifies whether 1511.Pa ~/.ssh/environment 1512and 1513.Cm environment= 1514options in 1515.Pa ~/.ssh/authorized_keys 1516are processed by 1517.Xr sshd 8 . 1518Valid options are 1519.Cm yes , 1520.Cm no 1521or a pattern-list specifying which environment variable names to accept 1522(for example 1523.Qq LANG,LC_* ) . 1524The default is 1525.Cm no . 1526Enabling environment processing may enable users to bypass access 1527restrictions in some configurations using mechanisms such as 1528.Ev LD_PRELOAD . 1529.It Cm PermitUserRC 1530Specifies whether any 1531.Pa ~/.ssh/rc 1532file is executed. 1533The default is 1534.Cm yes . 1535.It Cm PerSourceMaxStartups 1536Specifies the number of unauthenticated connections allowed from a 1537given source address, or 1538.Dq none 1539if there is no limit. 1540This limit is applied in addition to 1541.Cm MaxStartups , 1542whichever is lower. 1543The default is 1544.Cm none . 1545.It Cm PerSourceNetBlockSize 1546Specifies the number of bits of source address that are grouped together 1547for the purposes of applying PerSourceMaxStartups limits. 1548Values for IPv4 and optionally IPv6 may be specified, separated by a colon. 1549The default is 1550.Cm 32:128 , 1551which means each address is considered individually. 1552.It Cm PidFile 1553Specifies the file that contains the process ID of the 1554SSH daemon, or 1555.Cm none 1556to not write one. 1557The default is 1558.Pa /var/run/sshd.pid . 1559.It Cm Port 1560Specifies the port number that 1561.Xr sshd 8 1562listens on. 1563The default is 22. 1564Multiple options of this type are permitted. 1565See also 1566.Cm ListenAddress . 1567.It Cm PrintLastLog 1568Specifies whether 1569.Xr sshd 8 1570should print the date and time of the last user login when a user logs 1571in interactively. 1572The default is 1573.Cm yes . 1574.It Cm PrintMotd 1575Specifies whether 1576.Xr sshd 8 1577should print 1578.Pa /etc/motd 1579when a user logs in interactively. 1580(On some systems it is also printed by the shell, 1581.Pa /etc/profile , 1582or equivalent.) 1583The default is 1584.Cm yes . 1585.It Cm PubkeyAcceptedAlgorithms 1586Specifies the signature algorithms that will be accepted for public key 1587authentication as a list of comma-separated patterns. 1588Alternately if the specified list begins with a 1589.Sq + 1590character, then the specified algorithms will be appended to the default set 1591instead of replacing them. 1592If the specified list begins with a 1593.Sq - 1594character, then the specified algorithms (including wildcards) will be removed 1595from the default set instead of replacing them. 1596If the specified list begins with a 1597.Sq ^ 1598character, then the specified algorithms will be placed at the head of the 1599default set. 1600The default for this option is: 1601.Bd -literal -offset 3n 1602ssh-ed25519-cert-v01@openssh.com, 1603ecdsa-sha2-nistp256-cert-v01@openssh.com, 1604ecdsa-sha2-nistp384-cert-v01@openssh.com, 1605ecdsa-sha2-nistp521-cert-v01@openssh.com, 1606sk-ssh-ed25519-cert-v01@openssh.com, 1607sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1608rsa-sha2-512-cert-v01@openssh.com, 1609rsa-sha2-256-cert-v01@openssh.com, 1610ssh-ed25519, 1611ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1612sk-ssh-ed25519@openssh.com, 1613sk-ecdsa-sha2-nistp256@openssh.com, 1614rsa-sha2-512,rsa-sha2-256 1615.Ed 1616.Pp 1617The list of available signature algorithms may also be obtained using 1618.Qq ssh -Q PubkeyAcceptedAlgorithms . 1619.It Cm PubkeyAuthOptions 1620Sets one or more public key authentication options. 1621The supported keywords are: 1622.Cm none 1623(the default; indicating no additional options are enabled), 1624.Cm touch-required 1625and 1626.Cm verify-required . 1627.Pp 1628The 1629.Cm touch-required 1630option causes public key authentication using a FIDO authenticator algorithm 1631(i.e.\& 1632.Cm ecdsa-sk 1633or 1634.Cm ed25519-sk ) 1635to always require the signature to attest that a physically present user 1636explicitly confirmed the authentication (usually by touching the authenticator). 1637By default, 1638.Xr sshd 8 1639requires user presence unless overridden with an authorized_keys option. 1640The 1641.Cm touch-required 1642flag disables this override. 1643.Pp 1644The 1645.Cm verify-required 1646option requires a FIDO key signature attest that the user was verified, 1647e.g. via a PIN. 1648.Pp 1649Neither the 1650.Cm touch-required 1651or 1652.Cm verify-required 1653options have any effect for other, non-FIDO, public key types. 1654.It Cm PubkeyAuthentication 1655Specifies whether public key authentication is allowed. 1656The default is 1657.Cm yes . 1658.It Cm RekeyLimit 1659Specifies the maximum amount of data that may be transmitted or received 1660before the session key is renegotiated, optionally followed by a maximum 1661amount of time that may pass before the session key is renegotiated. 1662The first argument is specified in bytes and may have a suffix of 1663.Sq K , 1664.Sq M , 1665or 1666.Sq G 1667to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1668The default is between 1669.Sq 1G 1670and 1671.Sq 4G , 1672depending on the cipher. 1673The optional second value is specified in seconds and may use any of the 1674units documented in the 1675.Sx TIME FORMATS 1676section. 1677The default value for 1678.Cm RekeyLimit 1679is 1680.Cm default none , 1681which means that rekeying is performed after the cipher's default amount 1682of data has been sent or received and no time based rekeying is done. 1683.It Cm RequiredRSASize 1684Specifies the minimum RSA key size (in bits) that 1685.Xr sshd 8 1686will accept. 1687User and host-based authentication keys smaller than this limit will be 1688refused. 1689The default is 1690.Cm 1024 1691bits. 1692Note that this limit may only be raised from the default. 1693.It Cm RevokedKeys 1694Specifies revoked public keys file, or 1695.Cm none 1696to not use one. 1697Keys listed in this file will be refused for public key authentication. 1698Note that if this file is not readable, then public key authentication will 1699be refused for all users. 1700Keys may be specified as a text file, listing one public key per line, or as 1701an OpenSSH Key Revocation List (KRL) as generated by 1702.Xr ssh-keygen 1 . 1703For more information on KRLs, see the KEY REVOCATION LISTS section in 1704.Xr ssh-keygen 1 . 1705.It Cm RDomain 1706Specifies an explicit routing domain that is applied after authentication 1707has completed. 1708The user session, as well as any forwarded or listening IP sockets, 1709will be bound to this 1710.Xr rdomain 4 . 1711If the routing domain is set to 1712.Cm \&%D , 1713then the domain in which the incoming connection was received will be applied. 1714.It Cm SecurityKeyProvider 1715Specifies a path to a library that will be used when loading 1716FIDO authenticator-hosted keys, overriding the default of using 1717the built-in USB HID support. 1718.It Cm SetEnv 1719Specifies one or more environment variables to set in child sessions started 1720by 1721.Xr sshd 8 1722as 1723.Dq NAME=VALUE . 1724The environment value may be quoted (e.g. if it contains whitespace 1725characters). 1726Environment variables set by 1727.Cm SetEnv 1728override the default environment and any variables specified by the user 1729via 1730.Cm AcceptEnv 1731or 1732.Cm PermitUserEnvironment . 1733.It Cm StreamLocalBindMask 1734Sets the octal file creation mode mask 1735.Pq umask 1736used when creating a Unix-domain socket file for local or remote 1737port forwarding. 1738This option is only used for port forwarding to a Unix-domain socket file. 1739.Pp 1740The default value is 0177, which creates a Unix-domain socket file that is 1741readable and writable only by the owner. 1742Note that not all operating systems honor the file mode on Unix-domain 1743socket files. 1744.It Cm StreamLocalBindUnlink 1745Specifies whether to remove an existing Unix-domain socket file for local 1746or remote port forwarding before creating a new one. 1747If the socket file already exists and 1748.Cm StreamLocalBindUnlink 1749is not enabled, 1750.Nm sshd 1751will be unable to forward the port to the Unix-domain socket file. 1752This option is only used for port forwarding to a Unix-domain socket file. 1753.Pp 1754The argument must be 1755.Cm yes 1756or 1757.Cm no . 1758The default is 1759.Cm no . 1760.It Cm StrictModes 1761Specifies whether 1762.Xr sshd 8 1763should check file modes and ownership of the 1764user's files and home directory before accepting login. 1765This is normally desirable because novices sometimes accidentally leave their 1766directory or files world-writable. 1767The default is 1768.Cm yes . 1769Note that this does not apply to 1770.Cm ChrootDirectory , 1771whose permissions and ownership are checked unconditionally. 1772.It Cm Subsystem 1773Configures an external subsystem (e.g. file transfer daemon). 1774Arguments should be a subsystem name and a command (with optional arguments) 1775to execute upon subsystem request. 1776.Pp 1777The command 1778.Cm sftp-server 1779implements the SFTP file transfer subsystem. 1780.Pp 1781Alternately the name 1782.Cm internal-sftp 1783implements an in-process SFTP server. 1784This may simplify configurations using 1785.Cm ChrootDirectory 1786to force a different filesystem root on clients. 1787.Pp 1788By default no subsystems are defined. 1789.It Cm SyslogFacility 1790Gives the facility code that is used when logging messages from 1791.Xr sshd 8 . 1792The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1793LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1794The default is AUTH. 1795.It Cm TCPKeepAlive 1796Specifies whether the system should send TCP keepalive messages to the 1797other side. 1798If they are sent, death of the connection or crash of one 1799of the machines will be properly noticed. 1800However, this means that 1801connections will die if the route is down temporarily, and some people 1802find it annoying. 1803On the other hand, if TCP keepalives are not sent, 1804sessions may hang indefinitely on the server, leaving 1805.Qq ghost 1806users and consuming server resources. 1807.Pp 1808The default is 1809.Cm yes 1810(to send TCP keepalive messages), and the server will notice 1811if the network goes down or the client host crashes. 1812This avoids infinitely hanging sessions. 1813.Pp 1814To disable TCP keepalive messages, the value should be set to 1815.Cm no . 1816.It Cm TrustedUserCAKeys 1817Specifies a file containing public keys of certificate authorities that are 1818trusted to sign user certificates for authentication, or 1819.Cm none 1820to not use one. 1821Keys are listed one per line; empty lines and comments starting with 1822.Ql # 1823are allowed. 1824If a certificate is presented for authentication and has its signing CA key 1825listed in this file, then it may be used for authentication for any user 1826listed in the certificate's principals list. 1827Note that certificates that lack a list of principals will not be permitted 1828for authentication using 1829.Cm TrustedUserCAKeys . 1830For more details on certificates, see the CERTIFICATES section in 1831.Xr ssh-keygen 1 . 1832.It Cm UnusedConnectionTimeout 1833Specifies whether and how quickly 1834.Xr sshd 8 1835should close client connections with no open channels. 1836Open channels include active shell, command execution or subsystem 1837sessions, connected network, socket, agent or X11 forwardings. 1838Forwarding listeners, such as those from the 1839.Xr ssh 1 1840.Fl R 1841flag, are not considered as open channels and do not prevent the timeout. 1842The timeout value 1843is specified in seconds or may use any of the units documented in the 1844.Sx TIME FORMATS 1845section. 1846.Pp 1847Note that this timeout starts when the client connection completes 1848user authentication but before the client has an opportunity to open any 1849channels. 1850Caution should be used when using short timeout values, as they may not 1851provide sufficient time for the client to request and open its channels 1852before terminating the connection. 1853.Pp 1854The default 1855.Cm none 1856is to never expire connections for having no open channels. 1857This option may be useful in conjunction with 1858.Cm ChannelTimeout . 1859.It Cm UseDNS 1860Specifies whether 1861.Xr sshd 8 1862should look up the remote host name, and to check that 1863the resolved host name for the remote IP address maps back to the 1864very same IP address. 1865.Pp 1866If this option is set to 1867.Cm no 1868(the default) then only addresses and not host names may be used in 1869.Pa ~/.ssh/authorized_keys 1870.Cm from 1871and 1872.Nm 1873.Cm Match 1874.Cm Host 1875directives. 1876.It Cm VersionAddendum 1877Optionally specifies additional text to append to the SSH protocol banner 1878sent by the server upon connection. 1879The default is 1880.Cm none . 1881.It Cm X11DisplayOffset 1882Specifies the first display number available for 1883.Xr sshd 8 Ns 's 1884X11 forwarding. 1885This prevents sshd from interfering with real X11 servers. 1886The default is 10. 1887.It Cm X11Forwarding 1888Specifies whether X11 forwarding is permitted. 1889The argument must be 1890.Cm yes 1891or 1892.Cm no . 1893The default is 1894.Cm no . 1895.Pp 1896When X11 forwarding is enabled, there may be additional exposure to 1897the server and to client displays if the 1898.Xr sshd 8 1899proxy display is configured to listen on the wildcard address (see 1900.Cm X11UseLocalhost ) , 1901though this is not the default. 1902Additionally, the authentication spoofing and authentication data 1903verification and substitution occur on the client side. 1904The security risk of using X11 forwarding is that the client's X11 1905display server may be exposed to attack when the SSH client requests 1906forwarding (see the warnings for 1907.Cm ForwardX11 1908in 1909.Xr ssh_config 5 ) . 1910A system administrator may have a stance in which they want to 1911protect clients that may expose themselves to attack by unwittingly 1912requesting X11 forwarding, which can warrant a 1913.Cm no 1914setting. 1915.Pp 1916Note that disabling X11 forwarding does not prevent users from 1917forwarding X11 traffic, as users can always install their own forwarders. 1918.It Cm X11UseLocalhost 1919Specifies whether 1920.Xr sshd 8 1921should bind the X11 forwarding server to the loopback address or to 1922the wildcard address. 1923By default, 1924sshd binds the forwarding server to the loopback address and sets the 1925hostname part of the 1926.Ev DISPLAY 1927environment variable to 1928.Cm localhost . 1929This prevents remote hosts from connecting to the proxy display. 1930However, some older X11 clients may not function with this 1931configuration. 1932.Cm X11UseLocalhost 1933may be set to 1934.Cm no 1935to specify that the forwarding server should be bound to the wildcard 1936address. 1937The argument must be 1938.Cm yes 1939or 1940.Cm no . 1941The default is 1942.Cm yes . 1943.It Cm XAuthLocation 1944Specifies the full pathname of the 1945.Xr xauth 1 1946program, or 1947.Cm none 1948to not use one. 1949The default is 1950.Pa /usr/X11R6/bin/xauth . 1951.El 1952.Sh TIME FORMATS 1953.Xr sshd 8 1954command-line arguments and configuration file options that specify time 1955may be expressed using a sequence of the form: 1956.Sm off 1957.Ar time Op Ar qualifier , 1958.Sm on 1959where 1960.Ar time 1961is a positive integer value and 1962.Ar qualifier 1963is one of the following: 1964.Pp 1965.Bl -tag -width Ds -compact -offset indent 1966.It Aq Cm none 1967seconds 1968.It Cm s | Cm S 1969seconds 1970.It Cm m | Cm M 1971minutes 1972.It Cm h | Cm H 1973hours 1974.It Cm d | Cm D 1975days 1976.It Cm w | Cm W 1977weeks 1978.El 1979.Pp 1980Each member of the sequence is added together to calculate 1981the total time value. 1982.Pp 1983Time format examples: 1984.Pp 1985.Bl -tag -width Ds -compact -offset indent 1986.It 600 1987600 seconds (10 minutes) 1988.It 10m 198910 minutes 1990.It 1h30m 19911 hour 30 minutes (90 minutes) 1992.El 1993.Sh TOKENS 1994Arguments to some keywords can make use of tokens, 1995which are expanded at runtime: 1996.Pp 1997.Bl -tag -width XXXX -offset indent -compact 1998.It %% 1999A literal 2000.Sq % . 2001.It \&%C 2002Identifies the connection endpoints, containing 2003four space-separated values: client address, client port number, 2004server address, and server port number. 2005.It \&%D 2006The routing domain in which the incoming connection was received. 2007.It %F 2008The fingerprint of the CA key. 2009.It %f 2010The fingerprint of the key or certificate. 2011.It %h 2012The home directory of the user. 2013.It %i 2014The key ID in the certificate. 2015.It %K 2016The base64-encoded CA key. 2017.It %k 2018The base64-encoded key or certificate for authentication. 2019.It %s 2020The serial number of the certificate. 2021.It \&%T 2022The type of the CA key. 2023.It %t 2024The key or certificate type. 2025.It \&%U 2026The numeric user ID of the target user. 2027.It %u 2028The username. 2029.El 2030.Pp 2031.Cm AuthorizedKeysCommand 2032accepts the tokens %%, %C, %D, %f, %h, %k, %t, %U, and %u. 2033.Pp 2034.Cm AuthorizedKeysFile 2035accepts the tokens %%, %h, %U, and %u. 2036.Pp 2037.Cm AuthorizedPrincipalsCommand 2038accepts the tokens %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 2039.Pp 2040.Cm AuthorizedPrincipalsFile 2041accepts the tokens %%, %h, %U, and %u. 2042.Pp 2043.Cm ChrootDirectory 2044accepts the tokens %%, %h, %U, and %u. 2045.Pp 2046.Cm RoutingDomain 2047accepts the token %D. 2048.Sh FILES 2049.Bl -tag -width Ds 2050.It Pa /etc/ssh/sshd_config 2051Contains configuration data for 2052.Xr sshd 8 . 2053This file should be writable by root only, but it is recommended 2054(though not necessary) that it be world-readable. 2055.El 2056.Sh SEE ALSO 2057.Xr sftp-server 8 , 2058.Xr sshd 8 2059.Sh AUTHORS 2060.An -nosplit 2061OpenSSH is a derivative of the original and free 2062ssh 1.2.12 release by 2063.An Tatu Ylonen . 2064.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 2065.An Theo de Raadt 2066and 2067.An Dug Song 2068removed many bugs, re-added newer features and 2069created OpenSSH. 2070.An Markus Friedl 2071contributed the support for SSH protocol versions 1.5 and 2.0. 2072.An Niels Provos 2073and 2074.An Markus Friedl 2075contributed support for privilege separation. 2076