1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.374 2024/09/15 08:27:38 jmc Exp $ 37.Dd $Mdocdate: September 15 2024 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51Unless noted otherwise, for each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123This keyword may appear multiple times in 124.Nm 125with each instance appending to the list. 126.It Cm AllowStreamLocalForwarding 127Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 128The available options are 129.Cm yes 130(the default) 131or 132.Cm all 133to allow StreamLocal forwarding, 134.Cm no 135to prevent all StreamLocal forwarding, 136.Cm local 137to allow local (from the perspective of 138.Xr ssh 1 ) 139forwarding only or 140.Cm remote 141to allow remote forwarding only. 142Note that disabling StreamLocal forwarding does not improve security unless 143users are also denied shell access, as they can always install their 144own forwarders. 145.It Cm AllowTcpForwarding 146Specifies whether TCP forwarding is permitted. 147The available options are 148.Cm yes 149(the default) 150or 151.Cm all 152to allow TCP forwarding, 153.Cm no 154to prevent all TCP forwarding, 155.Cm local 156to allow local (from the perspective of 157.Xr ssh 1 ) 158forwarding only or 159.Cm remote 160to allow remote forwarding only. 161Note that disabling TCP forwarding does not improve security unless 162users are also denied shell access, as they can always install their 163own forwarders. 164.It Cm AllowUsers 165This keyword can be followed by a list of user name patterns, separated 166by spaces. 167If specified, login is allowed only for user names that 168match one of the patterns. 169Only user names are valid; a numerical user ID is not recognized. 170By default, login is allowed for all users. 171If the pattern takes the form USER@HOST then USER and HOST 172are separately checked, restricting logins to particular 173users from particular hosts. 174HOST criteria may additionally contain addresses to match in CIDR 175address/masklen format. 176The allow/deny users directives are processed in the following order: 177.Cm DenyUsers , 178.Cm AllowUsers . 179.Pp 180See PATTERNS in 181.Xr ssh_config 5 182for more information on patterns. 183This keyword may appear multiple times in 184.Nm 185with each instance appending to the list. 186.It Cm AuthenticationMethods 187Specifies the authentication methods that must be successfully completed 188for a user to be granted access. 189This option must be followed by one or more lists of comma-separated 190authentication method names, or by the single string 191.Cm any 192to indicate the default behaviour of accepting any single authentication 193method. 194If the default is overridden, then successful authentication requires 195completion of every method in at least one of these lists. 196.Pp 197For example, 198.Qq publickey,password publickey,keyboard-interactive 199would require the user to complete public key authentication, followed by 200either password or keyboard interactive authentication. 201Only methods that are next in one or more lists are offered at each stage, 202so for this example it would not be possible to attempt password or 203keyboard-interactive authentication before public key. 204.Pp 205For keyboard interactive authentication it is also possible to 206restrict authentication to a specific device by appending a 207colon followed by the device identifier 208.Cm bsdauth 209or 210.Cm pam . 211depending on the server configuration. 212For example, 213.Qq keyboard-interactive:bsdauth 214would restrict keyboard interactive authentication to the 215.Cm bsdauth 216device. 217.Pp 218If the publickey method is listed more than once, 219.Xr sshd 8 220verifies that keys that have been used successfully are not reused for 221subsequent authentications. 222For example, 223.Qq publickey,publickey 224requires successful authentication using two different public keys. 225.Pp 226Note that each authentication method listed should also be explicitly enabled 227in the configuration. 228.Pp 229The available authentication methods are: 230.Qq gssapi-with-mic , 231.Qq hostbased , 232.Qq keyboard-interactive , 233.Qq none 234(used for access to password-less accounts when 235.Cm PermitEmptyPasswords 236is enabled), 237.Qq password 238and 239.Qq publickey . 240.It Cm AuthorizedKeysCommand 241Specifies a program to be used to look up the user's public keys. 242The program must be owned by root, not writable by group or others and 243specified by an absolute path. 244Arguments to 245.Cm AuthorizedKeysCommand 246accept the tokens described in the 247.Sx TOKENS 248section. 249If no arguments are specified then the username of the target user is used. 250.Pp 251The program should produce on standard output zero or 252more lines of authorized_keys output (see 253.Sx AUTHORIZED_KEYS 254in 255.Xr sshd 8 ) . 256.Cm AuthorizedKeysCommand 257is tried after the usual 258.Cm AuthorizedKeysFile 259files and will not be executed if a matching key is found there. 260By default, no 261.Cm AuthorizedKeysCommand 262is run. 263.It Cm AuthorizedKeysCommandUser 264Specifies the user under whose account the 265.Cm AuthorizedKeysCommand 266is run. 267It is recommended to use a dedicated user that has no other role on the host 268than running authorized keys commands. 269If 270.Cm AuthorizedKeysCommand 271is specified but 272.Cm AuthorizedKeysCommandUser 273is not, then 274.Xr sshd 8 275will refuse to start. 276.It Cm AuthorizedKeysFile 277Specifies the file that contains the public keys used for user authentication. 278The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 279.Xr sshd 8 . 280Arguments to 281.Cm AuthorizedKeysFile 282accept the tokens described in the 283.Sx TOKENS 284section. 285After expansion, 286.Cm AuthorizedKeysFile 287is taken to be an absolute path or one relative to the user's home 288directory. 289Multiple files may be listed, separated by whitespace. 290Alternately this option may be set to 291.Cm none 292to skip checking for user keys in files. 293The default is 294.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 295.It Cm AuthorizedPrincipalsCommand 296Specifies a program to be used to generate the list of allowed 297certificate principals as per 298.Cm AuthorizedPrincipalsFile . 299The program must be owned by root, not writable by group or others and 300specified by an absolute path. 301Arguments to 302.Cm AuthorizedPrincipalsCommand 303accept the tokens described in the 304.Sx TOKENS 305section. 306If no arguments are specified then the username of the target user is used. 307.Pp 308The program should produce on standard output zero or 309more lines of 310.Cm AuthorizedPrincipalsFile 311output. 312If either 313.Cm AuthorizedPrincipalsCommand 314or 315.Cm AuthorizedPrincipalsFile 316is specified, then certificates offered by the client for authentication 317must contain a principal that is listed. 318By default, no 319.Cm AuthorizedPrincipalsCommand 320is run. 321.It Cm AuthorizedPrincipalsCommandUser 322Specifies the user under whose account the 323.Cm AuthorizedPrincipalsCommand 324is run. 325It is recommended to use a dedicated user that has no other role on the host 326than running authorized principals commands. 327If 328.Cm AuthorizedPrincipalsCommand 329is specified but 330.Cm AuthorizedPrincipalsCommandUser 331is not, then 332.Xr sshd 8 333will refuse to start. 334.It Cm AuthorizedPrincipalsFile 335Specifies a file that lists principal names that are accepted for 336certificate authentication. 337When using certificates signed by a key listed in 338.Cm TrustedUserCAKeys , 339this file lists names, one of which must appear in the certificate for it 340to be accepted for authentication. 341Names are listed one per line preceded by key options (as described in 342.Sx AUTHORIZED_KEYS FILE FORMAT 343in 344.Xr sshd 8 ) . 345Empty lines and comments starting with 346.Ql # 347are ignored. 348.Pp 349Arguments to 350.Cm AuthorizedPrincipalsFile 351accept the tokens described in the 352.Sx TOKENS 353section. 354After expansion, 355.Cm AuthorizedPrincipalsFile 356is taken to be an absolute path or one relative to the user's home directory. 357The default is 358.Cm none , 359i.e. not to use a principals file \(en in this case, the username 360of the user must appear in a certificate's principals list for it to be 361accepted. 362.Pp 363Note that 364.Cm AuthorizedPrincipalsFile 365is only used when authentication proceeds using a CA listed in 366.Cm TrustedUserCAKeys 367and is not consulted for certification authorities trusted via 368.Pa ~/.ssh/authorized_keys , 369though the 370.Cm principals= 371key option offers a similar facility (see 372.Xr sshd 8 373for details). 374.It Cm Banner 375The contents of the specified file are sent to the remote user before 376authentication is allowed. 377If the argument is 378.Cm none 379then no banner is displayed. 380By default, no banner is displayed. 381.It Cm CASignatureAlgorithms 382Specifies which algorithms are allowed for signing of certificates 383by certificate authorities (CAs). 384The default is: 385.Bd -literal -offset indent 386ssh-ed25519,ecdsa-sha2-nistp256, 387ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 388sk-ssh-ed25519@openssh.com, 389sk-ecdsa-sha2-nistp256@openssh.com, 390rsa-sha2-512,rsa-sha2-256 391.Ed 392.Pp 393If the specified list begins with a 394.Sq + 395character, then the specified algorithms will be appended to the default set 396instead of replacing them. 397If the specified list begins with a 398.Sq - 399character, then the specified algorithms (including wildcards) will be removed 400from the default set instead of replacing them. 401.Pp 402Certificates signed using other algorithms will not be accepted for 403public key or host-based authentication. 404.It Cm ChannelTimeout 405Specifies whether and how quickly 406.Xr sshd 8 407should close inactive channels. 408Timeouts are specified as one or more 409.Dq type=interval 410pairs separated by whitespace, where the 411.Dq type 412must be the special keyword 413.Dq global 414or a channel type name from the list below, optionally containing 415wildcard characters. 416.Pp 417The timeout value 418.Dq interval 419is specified in seconds or may use any of the units documented in the 420.Sx TIME FORMATS 421section. 422For example, 423.Dq session=5m 424would cause interactive sessions to terminate after five minutes of 425inactivity. 426Specifying a zero value disables the inactivity timeout. 427.Pp 428The special timeout 429.Dq global 430applies to all active channels, taken together. 431Traffic on any active channel will reset the timeout, but when the timeout 432expires then all open channels will be closed. 433Note that this global timeout is not matched by wildcards and must be 434specified explicitly. 435.Pp 436The available channel type names include: 437.Bl -tag -width Ds 438.It Cm agent-connection 439Open connections to 440.Xr ssh-agent 1 . 441.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com 442Open TCP or Unix socket (respectively) connections that have 443been established from a 444.Xr ssh 1 445local forwarding, i.e.\& 446.Cm LocalForward 447or 448.Cm DynamicForward . 449.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com 450Open TCP or Unix socket (respectively) connections that have been 451established to a 452.Xr sshd 8 453listening on behalf of a 454.Xr ssh 1 455remote forwarding, i.e.\& 456.Cm RemoteForward . 457.It Cm session 458The interactive main session, including shell session, command execution, 459.Xr scp 1 , 460.Xr sftp 1 , 461etc. 462.It Cm tun-connection 463Open 464.Cm TunnelForward 465connections. 466.It Cm x11-connection 467Open X11 forwarding sessions. 468.El 469.Pp 470Note that in all the above cases, terminating an inactive session does not 471guarantee to remove all resources associated with the session, e.g. shell 472processes or X11 clients relating to the session may continue to execute. 473.Pp 474Moreover, terminating an inactive channel or session does not necessarily 475close the SSH connection, nor does it prevent a client from 476requesting another channel of the same type. 477In particular, expiring an inactive forwarding session does not prevent 478another identical forwarding from being subsequently created. 479.Pp 480The default is not to expire channels of any type for inactivity. 481.It Cm ChrootDirectory 482Specifies the pathname of a directory to 483.Xr chroot 2 484to after authentication. 485At session startup 486.Xr sshd 8 487checks that all components of the pathname are root-owned directories 488which are not writable by group or others. 489After the chroot, 490.Xr sshd 8 491changes the working directory to the user's home directory. 492Arguments to 493.Cm ChrootDirectory 494accept the tokens described in the 495.Sx TOKENS 496section. 497.Pp 498The 499.Cm ChrootDirectory 500must contain the necessary files and directories to support the 501user's session. 502For an interactive session this requires at least a shell, typically 503.Xr sh 1 , 504and basic 505.Pa /dev 506nodes such as 507.Xr null 4 , 508.Xr zero 4 , 509.Xr stdin 4 , 510.Xr stdout 4 , 511.Xr stderr 4 , 512and 513.Xr tty 4 514devices. 515For file transfer sessions using SFTP 516no additional configuration of the environment is necessary if the in-process 517sftp-server is used, 518though sessions which use logging may require 519.Pa /dev/log 520inside the chroot directory on some operating systems (see 521.Xr sftp-server 8 522for details). 523.Pp 524For safety, it is very important that the directory hierarchy be 525prevented from modification by other processes on the system (especially 526those outside the jail). 527Misconfiguration can lead to unsafe environments which 528.Xr sshd 8 529cannot detect. 530.Pp 531The default is 532.Cm none , 533indicating not to 534.Xr chroot 2 . 535.It Cm Ciphers 536Specifies the ciphers allowed. 537Multiple ciphers must be comma-separated. 538If the specified list begins with a 539.Sq + 540character, then the specified ciphers will be appended to the default set 541instead of replacing them. 542If the specified list begins with a 543.Sq - 544character, then the specified ciphers (including wildcards) will be removed 545from the default set instead of replacing them. 546If the specified list begins with a 547.Sq ^ 548character, then the specified ciphers will be placed at the head of the 549default set. 550.Pp 551The supported ciphers are: 552.Pp 553.Bl -item -compact -offset indent 554.It 5553des-cbc 556.It 557aes128-cbc 558.It 559aes192-cbc 560.It 561aes256-cbc 562.It 563aes128-ctr 564.It 565aes192-ctr 566.It 567aes256-ctr 568.It 569aes128-gcm@openssh.com 570.It 571aes256-gcm@openssh.com 572.It 573chacha20-poly1305@openssh.com 574.El 575.Pp 576The default is: 577.Bd -literal -offset indent 578chacha20-poly1305@openssh.com, 579aes128-ctr,aes192-ctr,aes256-ctr, 580aes128-gcm@openssh.com,aes256-gcm@openssh.com 581.Ed 582.Pp 583The list of available ciphers may also be obtained using 584.Qq ssh -Q cipher . 585.It Cm ClientAliveCountMax 586Sets the number of client alive messages which may be sent without 587.Xr sshd 8 588receiving any messages back from the client. 589If this threshold is reached while client alive messages are being sent, 590sshd will disconnect the client, terminating the session. 591It is important to note that the use of client alive messages is very 592different from 593.Cm TCPKeepAlive . 594The client alive messages are sent through the encrypted channel 595and therefore will not be spoofable. 596The TCP keepalive option enabled by 597.Cm TCPKeepAlive 598is spoofable. 599The client alive mechanism is valuable when the client or 600server depend on knowing when a connection has become unresponsive. 601.Pp 602The default value is 3. 603If 604.Cm ClientAliveInterval 605is set to 15, and 606.Cm ClientAliveCountMax 607is left at the default, unresponsive SSH clients 608will be disconnected after approximately 45 seconds. 609Setting a zero 610.Cm ClientAliveCountMax 611disables connection termination. 612.It Cm ClientAliveInterval 613Sets a timeout interval in seconds after which if no data has been received 614from the client, 615.Xr sshd 8 616will send a message through the encrypted 617channel to request a response from the client. 618The default 619is 0, indicating that these messages will not be sent to the client. 620.It Cm Compression 621Specifies whether compression is enabled after 622the user has authenticated successfully. 623The argument must be 624.Cm yes , 625.Cm delayed 626(a legacy synonym for 627.Cm yes ) 628or 629.Cm no . 630The default is 631.Cm yes . 632.It Cm DenyGroups 633This keyword can be followed by a list of group name patterns, separated 634by spaces. 635Login is disallowed for users whose primary group or supplementary 636group list matches one of the patterns. 637Only group names are valid; a numerical group ID is not recognized. 638By default, login is allowed for all groups. 639The allow/deny groups directives are processed in the following order: 640.Cm DenyGroups , 641.Cm AllowGroups . 642.Pp 643See PATTERNS in 644.Xr ssh_config 5 645for more information on patterns. 646This keyword may appear multiple times in 647.Nm 648with each instance appending to the list. 649.It Cm DenyUsers 650This keyword can be followed by a list of user name patterns, separated 651by spaces. 652Login is disallowed for user names that match one of the patterns. 653Only user names are valid; a numerical user ID is not recognized. 654By default, login is allowed for all users. 655If the pattern takes the form USER@HOST then USER and HOST 656are separately checked, restricting logins to particular 657users from particular hosts. 658HOST criteria may additionally contain addresses to match in CIDR 659address/masklen format. 660The allow/deny users directives are processed in the following order: 661.Cm DenyUsers , 662.Cm AllowUsers . 663.Pp 664See PATTERNS in 665.Xr ssh_config 5 666for more information on patterns. 667This keyword may appear multiple times in 668.Nm 669with each instance appending to the list. 670.It Cm DisableForwarding 671Disables all forwarding features, including X11, 672.Xr ssh-agent 1 , 673TCP and StreamLocal. 674This option overrides all other forwarding-related options and may 675simplify restricted configurations. 676.It Cm ExposeAuthInfo 677Writes a temporary file containing a list of authentication methods and 678public credentials (e.g. keys) used to authenticate the user. 679The location of the file is exposed to the user session through the 680.Ev SSH_USER_AUTH 681environment variable. 682The default is 683.Cm no . 684.It Cm FingerprintHash 685Specifies the hash algorithm used when logging key fingerprints. 686Valid options are: 687.Cm md5 688and 689.Cm sha256 . 690The default is 691.Cm sha256 . 692.It Cm ForceCommand 693Forces the execution of the command specified by 694.Cm ForceCommand , 695ignoring any command supplied by the client and 696.Pa ~/.ssh/rc 697if present. 698The command is invoked by using the user's login shell with the -c option. 699This applies to shell, command, or subsystem execution. 700It is most useful inside a 701.Cm Match 702block. 703The command originally supplied by the client is available in the 704.Ev SSH_ORIGINAL_COMMAND 705environment variable. 706Specifying a command of 707.Cm internal-sftp 708will force the use of an in-process SFTP server that requires no support 709files when used with 710.Cm ChrootDirectory . 711The default is 712.Cm none . 713.It Cm GatewayPorts 714Specifies whether remote hosts are allowed to connect to ports 715forwarded for the client. 716By default, 717.Xr sshd 8 718binds remote port forwardings to the loopback address. 719This prevents other remote hosts from connecting to forwarded ports. 720.Cm GatewayPorts 721can be used to specify that sshd 722should allow remote port forwardings to bind to non-loopback addresses, thus 723allowing other hosts to connect. 724The argument may be 725.Cm no 726to force remote port forwardings to be available to the local host only, 727.Cm yes 728to force remote port forwardings to bind to the wildcard address, or 729.Cm clientspecified 730to allow the client to select the address to which the forwarding is bound. 731The default is 732.Cm no . 733.It Cm GSSAPIAuthentication 734Specifies whether user authentication based on GSSAPI is allowed. 735The default is 736.Cm no . 737.It Cm GSSAPICleanupCredentials 738Specifies whether to automatically destroy the user's credentials cache 739on logout. 740The default is 741.Cm yes . 742.It Cm GSSAPIStrictAcceptorCheck 743Determines whether to be strict about the identity of the GSSAPI acceptor 744a client authenticates against. 745If set to 746.Cm yes 747then the client must authenticate against the host 748service on the current hostname. 749If set to 750.Cm no 751then the client may authenticate against any service key stored in the 752machine's default store. 753This facility is provided to assist with operation on multi homed machines. 754The default is 755.Cm yes . 756.It Cm HostbasedAcceptedAlgorithms 757Specifies the signature algorithms that will be accepted for hostbased 758authentication as a list of comma-separated patterns. 759Alternately if the specified list begins with a 760.Sq + 761character, then the specified signature algorithms will be appended to 762the default set instead of replacing them. 763If the specified list begins with a 764.Sq - 765character, then the specified signature algorithms (including wildcards) 766will be removed from the default set instead of replacing them. 767If the specified list begins with a 768.Sq ^ 769character, then the specified signature algorithms will be placed at 770the head of the default set. 771The default for this option is: 772.Bd -literal -offset 3n 773ssh-ed25519-cert-v01@openssh.com, 774ecdsa-sha2-nistp256-cert-v01@openssh.com, 775ecdsa-sha2-nistp384-cert-v01@openssh.com, 776ecdsa-sha2-nistp521-cert-v01@openssh.com, 777sk-ssh-ed25519-cert-v01@openssh.com, 778sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 779rsa-sha2-512-cert-v01@openssh.com, 780rsa-sha2-256-cert-v01@openssh.com, 781ssh-ed25519, 782ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 783sk-ssh-ed25519@openssh.com, 784sk-ecdsa-sha2-nistp256@openssh.com, 785rsa-sha2-512,rsa-sha2-256 786.Ed 787.Pp 788The list of available signature algorithms may also be obtained using 789.Qq ssh -Q HostbasedAcceptedAlgorithms . 790This was formerly named HostbasedAcceptedKeyTypes. 791.It Cm HostbasedAuthentication 792Specifies whether rhosts or /etc/hosts.equiv authentication together 793with successful public key client host authentication is allowed 794(host-based authentication). 795The default is 796.Cm no . 797.It Cm HostbasedUsesNameFromPacketOnly 798Specifies whether or not the server will attempt to perform a reverse 799name lookup when matching the name in the 800.Pa ~/.shosts , 801.Pa ~/.rhosts , 802and 803.Pa /etc/hosts.equiv 804files during 805.Cm HostbasedAuthentication . 806A setting of 807.Cm yes 808means that 809.Xr sshd 8 810uses the name supplied by the client rather than 811attempting to resolve the name from the TCP connection itself. 812The default is 813.Cm no . 814.It Cm HostCertificate 815Specifies a file containing a public host certificate. 816The certificate's public key must match a private host key already specified 817by 818.Cm HostKey . 819The default behaviour of 820.Xr sshd 8 821is not to load any certificates. 822.It Cm HostKey 823Specifies a file containing a private host key 824used by SSH. 825The defaults are 826.Pa /etc/ssh/ssh_host_ecdsa_key , 827.Pa /etc/ssh/ssh_host_ed25519_key 828and 829.Pa /etc/ssh/ssh_host_rsa_key . 830.Pp 831Note that 832.Xr sshd 8 833will refuse to use a file if it is group/world-accessible 834and that the 835.Cm HostKeyAlgorithms 836option restricts which of the keys are actually used by 837.Xr sshd 8 . 838.Pp 839It is possible to have multiple host key files. 840It is also possible to specify public host key files instead. 841In this case operations on the private key will be delegated 842to an 843.Xr ssh-agent 1 . 844.It Cm HostKeyAgent 845Identifies the UNIX-domain socket used to communicate 846with an agent that has access to the private host keys. 847If the string 848.Qq SSH_AUTH_SOCK 849is specified, the location of the socket will be read from the 850.Ev SSH_AUTH_SOCK 851environment variable. 852.It Cm HostKeyAlgorithms 853Specifies the host key signature algorithms 854that the server offers. 855The default for this option is: 856.Bd -literal -offset 3n 857ssh-ed25519-cert-v01@openssh.com, 858ecdsa-sha2-nistp256-cert-v01@openssh.com, 859ecdsa-sha2-nistp384-cert-v01@openssh.com, 860ecdsa-sha2-nistp521-cert-v01@openssh.com, 861sk-ssh-ed25519-cert-v01@openssh.com, 862sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 863rsa-sha2-512-cert-v01@openssh.com, 864rsa-sha2-256-cert-v01@openssh.com, 865ssh-ed25519, 866ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 867sk-ssh-ed25519@openssh.com, 868sk-ecdsa-sha2-nistp256@openssh.com, 869rsa-sha2-512,rsa-sha2-256 870.Ed 871.Pp 872The list of available signature algorithms may also be obtained using 873.Qq ssh -Q HostKeyAlgorithms . 874.It Cm IgnoreRhosts 875Specifies whether to ignore per-user 876.Pa .rhosts 877and 878.Pa .shosts 879files during 880.Cm HostbasedAuthentication . 881The system-wide 882.Pa /etc/hosts.equiv 883and 884.Pa /etc/ssh/shosts.equiv 885are still used regardless of this setting. 886.Pp 887Accepted values are 888.Cm yes 889(the default) to ignore all per-user files, 890.Cm shosts-only 891to allow the use of 892.Pa .shosts 893but to ignore 894.Pa .rhosts 895or 896.Cm no 897to allow both 898.Pa .shosts 899and 900.Pa rhosts . 901.It Cm IgnoreUserKnownHosts 902Specifies whether 903.Xr sshd 8 904should ignore the user's 905.Pa ~/.ssh/known_hosts 906during 907.Cm HostbasedAuthentication 908and use only the system-wide known hosts file 909.Pa /etc/ssh/ssh_known_hosts . 910The default is 911.Dq no . 912.It Cm Include 913Include the specified configuration file(s). 914Multiple pathnames may be specified and each pathname may contain 915.Xr glob 7 916wildcards that will be expanded and processed in lexical order. 917Files without absolute paths are assumed to be in 918.Pa /etc/ssh . 919An 920.Cm Include 921directive may appear inside a 922.Cm Match 923block 924to perform conditional inclusion. 925.It Cm IPQoS 926Specifies the IPv4 type-of-service or DSCP class for the connection. 927Accepted values are 928.Cm af11 , 929.Cm af12 , 930.Cm af13 , 931.Cm af21 , 932.Cm af22 , 933.Cm af23 , 934.Cm af31 , 935.Cm af32 , 936.Cm af33 , 937.Cm af41 , 938.Cm af42 , 939.Cm af43 , 940.Cm cs0 , 941.Cm cs1 , 942.Cm cs2 , 943.Cm cs3 , 944.Cm cs4 , 945.Cm cs5 , 946.Cm cs6 , 947.Cm cs7 , 948.Cm ef , 949.Cm le , 950.Cm lowdelay , 951.Cm throughput , 952.Cm reliability , 953a numeric value, or 954.Cm none 955to use the operating system default. 956This option may take one or two arguments, separated by whitespace. 957If one argument is specified, it is used as the packet class unconditionally. 958If two values are specified, the first is automatically selected for 959interactive sessions and the second for non-interactive sessions. 960The default is 961.Cm af21 962(Low-Latency Data) 963for interactive sessions and 964.Cm cs1 965(Lower Effort) 966for non-interactive sessions. 967.It Cm KbdInteractiveAuthentication 968Specifies whether to allow keyboard-interactive authentication. 969All authentication styles from 970.Xr login.conf 5 971are supported. 972The default is 973.Cm yes . 974The argument to this keyword must be 975.Cm yes 976or 977.Cm no . 978.Cm ChallengeResponseAuthentication 979is a deprecated alias for this. 980.It Cm KerberosAuthentication 981Specifies whether the password provided by the user for 982.Cm PasswordAuthentication 983will be validated through the Kerberos KDC. 984To use this option, the server needs a 985Kerberos servtab which allows the verification of the KDC's identity. 986The default is 987.Cm no . 988.It Cm KerberosGetAFSToken 989If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 990an AFS token before accessing the user's home directory. 991The default is 992.Cm no . 993.It Cm KerberosOrLocalPasswd 994If password authentication through Kerberos fails then 995the password will be validated via any additional local mechanism 996such as 997.Pa /etc/passwd . 998The default is 999.Cm yes . 1000.It Cm KerberosTicketCleanup 1001Specifies whether to automatically destroy the user's ticket cache 1002file on logout. 1003The default is 1004.Cm yes . 1005.It Cm KexAlgorithms 1006Specifies the permitted KEX (Key Exchange) algorithms that the server will 1007offer to clients. 1008The ordering of this list is not important, as the client specifies the 1009preference order. 1010Multiple algorithms must be comma-separated. 1011.Pp 1012If the specified list begins with a 1013.Sq + 1014character, then the specified algorithms will be appended to the default set 1015instead of replacing them. 1016If the specified list begins with a 1017.Sq - 1018character, then the specified algorithms (including wildcards) will be removed 1019from the default set instead of replacing them. 1020If the specified list begins with a 1021.Sq ^ 1022character, then the specified algorithms will be placed at the head of the 1023default set. 1024.Pp 1025The supported algorithms are: 1026.Pp 1027.Bl -item -compact -offset indent 1028.It 1029curve25519-sha256 1030.It 1031curve25519-sha256@libssh.org 1032.It 1033diffie-hellman-group1-sha1 1034.It 1035diffie-hellman-group14-sha1 1036.It 1037diffie-hellman-group14-sha256 1038.It 1039diffie-hellman-group16-sha512 1040.It 1041diffie-hellman-group18-sha512 1042.It 1043diffie-hellman-group-exchange-sha1 1044.It 1045diffie-hellman-group-exchange-sha256 1046.It 1047ecdh-sha2-nistp256 1048.It 1049ecdh-sha2-nistp384 1050.It 1051ecdh-sha2-nistp521 1052.It 1053mlkem768x25519-sha256 1054.It 1055sntrup761x25519-sha512 1056.It 1057sntrup761x25519-sha512@openssh.com 1058.El 1059.Pp 1060The default is: 1061.Bd -literal -offset indent 1062sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, 1063mlkem768x25519-sha256, 1064curve25519-sha256,curve25519-sha256@libssh.org, 1065ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 1066diffie-hellman-group-exchange-sha256, 1067diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 1068diffie-hellman-group14-sha256 1069.Ed 1070.Pp 1071The list of supported key exchange algorithms may also be obtained using 1072.Qq ssh -Q KexAlgorithms . 1073.It Cm ListenAddress 1074Specifies the local addresses 1075.Xr sshd 8 1076should listen on. 1077The following forms may be used: 1078.Pp 1079.Bl -item -offset indent -compact 1080.It 1081.Cm ListenAddress 1082.Sm off 1083.Ar hostname | address 1084.Sm on 1085.Op Cm rdomain Ar domain 1086.It 1087.Cm ListenAddress 1088.Sm off 1089.Ar hostname : port 1090.Sm on 1091.Op Cm rdomain Ar domain 1092.It 1093.Cm ListenAddress 1094.Sm off 1095.Ar IPv4_address : port 1096.Sm on 1097.Op Cm rdomain Ar domain 1098.It 1099.Cm ListenAddress 1100.Sm off 1101.Oo Ar hostname | address Oc : Ar port 1102.Sm on 1103.Op Cm rdomain Ar domain 1104.El 1105.Pp 1106The optional 1107.Cm rdomain 1108qualifier requests 1109.Xr sshd 8 1110listen in an explicit routing domain. 1111If 1112.Ar port 1113is not specified, 1114sshd will listen on the address and all 1115.Cm Port 1116options specified. 1117The default is to listen on all local addresses on the current default 1118routing domain. 1119Multiple 1120.Cm ListenAddress 1121options are permitted. 1122For more information on routing domains, see 1123.Xr rdomain 4 . 1124.It Cm LoginGraceTime 1125The server disconnects after this time if the user has not 1126successfully logged in. 1127If the value is 0, there is no time limit. 1128The default is 120 seconds. 1129.It Cm LogLevel 1130Gives the verbosity level that is used when logging messages from 1131.Xr sshd 8 . 1132The possible values are: 1133QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1134The default is INFO. 1135DEBUG and DEBUG1 are equivalent. 1136DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1137Logging with a DEBUG level violates the privacy of users and is not recommended. 1138.It Cm LogVerbose 1139Specify one or more overrides to 1140.Cm LogLevel . 1141An override consists of one or more pattern lists that matches the 1142source file, function and line number to force detailed logging for. 1143For example, an override pattern of: 1144.Bd -literal -offset indent 1145kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1146.Ed 1147.Pp 1148would enable detailed logging for line 1000 of 1149.Pa kex.c , 1150everything in the 1151.Fn kex_exchange_identification 1152function, and all code in the 1153.Pa packet.c 1154file. 1155This option is intended for debugging and no overrides are enabled by default. 1156.It Cm MACs 1157Specifies the available MAC (message authentication code) algorithms. 1158The MAC algorithm is used for data integrity protection. 1159Multiple algorithms must be comma-separated. 1160If the specified list begins with a 1161.Sq + 1162character, then the specified algorithms will be appended to the default set 1163instead of replacing them. 1164If the specified list begins with a 1165.Sq - 1166character, then the specified algorithms (including wildcards) will be removed 1167from the default set instead of replacing them. 1168If the specified list begins with a 1169.Sq ^ 1170character, then the specified algorithms will be placed at the head of the 1171default set. 1172.Pp 1173The algorithms that contain 1174.Qq -etm 1175calculate the MAC after encryption (encrypt-then-mac). 1176These are considered safer and their use recommended. 1177The supported MACs are: 1178.Pp 1179.Bl -item -compact -offset indent 1180.It 1181hmac-md5 1182.It 1183hmac-md5-96 1184.It 1185hmac-sha1 1186.It 1187hmac-sha1-96 1188.It 1189hmac-sha2-256 1190.It 1191hmac-sha2-512 1192.It 1193umac-64@openssh.com 1194.It 1195umac-128@openssh.com 1196.It 1197hmac-md5-etm@openssh.com 1198.It 1199hmac-md5-96-etm@openssh.com 1200.It 1201hmac-sha1-etm@openssh.com 1202.It 1203hmac-sha1-96-etm@openssh.com 1204.It 1205hmac-sha2-256-etm@openssh.com 1206.It 1207hmac-sha2-512-etm@openssh.com 1208.It 1209umac-64-etm@openssh.com 1210.It 1211umac-128-etm@openssh.com 1212.El 1213.Pp 1214The default is: 1215.Bd -literal -offset indent 1216umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1217hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1218hmac-sha1-etm@openssh.com, 1219umac-64@openssh.com,umac-128@openssh.com, 1220hmac-sha2-256,hmac-sha2-512,hmac-sha1 1221.Ed 1222.Pp 1223The list of available MAC algorithms may also be obtained using 1224.Qq ssh -Q mac . 1225.It Cm Match 1226Introduces a conditional block. 1227If all of the criteria on the 1228.Cm Match 1229line are satisfied, the keywords on the following lines override those 1230set in the global section of the config file, until either another 1231.Cm Match 1232line or the end of the file. 1233If a keyword appears in multiple 1234.Cm Match 1235blocks that are satisfied, only the first instance of the keyword is 1236applied. 1237.Pp 1238The arguments to 1239.Cm Match 1240are one or more criteria-pattern pairs or one of the single token criteria: 1241.Cm All , 1242which matches all criteria, or 1243.Cm Invalid-User , 1244which matches when the requested user-name does not match any known account. 1245The available criteria are 1246.Cm User , 1247.Cm Group , 1248.Cm Host , 1249.Cm LocalAddress , 1250.Cm LocalPort , 1251.Cm RDomain , 1252and 1253.Cm Address 1254(with 1255.Cm RDomain 1256representing the 1257.Xr rdomain 4 1258on which the connection was received). 1259.Pp 1260The match patterns may consist of single entries or comma-separated 1261lists and may use the wildcard and negation operators described in the 1262.Sx PATTERNS 1263section of 1264.Xr ssh_config 5 . 1265.Pp 1266The patterns in an 1267.Cm Address 1268criteria may additionally contain addresses to match in CIDR 1269address/masklen format, 1270such as 192.0.2.0/24 or 2001:db8::/32. 1271Note that the mask length provided must be consistent with the address - 1272it is an error to specify a mask length that is too long for the address 1273or one with bits set in this host portion of the address. 1274For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1275.Pp 1276Only a subset of keywords may be used on the lines following a 1277.Cm Match 1278keyword. 1279Available keywords are 1280.Cm AcceptEnv , 1281.Cm AllowAgentForwarding , 1282.Cm AllowGroups , 1283.Cm AllowStreamLocalForwarding , 1284.Cm AllowTcpForwarding , 1285.Cm AllowUsers , 1286.Cm AuthenticationMethods , 1287.Cm AuthorizedKeysCommand , 1288.Cm AuthorizedKeysCommandUser , 1289.Cm AuthorizedKeysFile , 1290.Cm AuthorizedPrincipalsCommand , 1291.Cm AuthorizedPrincipalsCommandUser , 1292.Cm AuthorizedPrincipalsFile , 1293.Cm Banner , 1294.Cm CASignatureAlgorithms , 1295.Cm ChannelTimeout , 1296.Cm ChrootDirectory , 1297.Cm ClientAliveCountMax , 1298.Cm ClientAliveInterval , 1299.Cm DenyGroups , 1300.Cm DenyUsers , 1301.Cm DisableForwarding , 1302.Cm ExposeAuthInfo , 1303.Cm ForceCommand , 1304.Cm GatewayPorts , 1305.Cm GSSAPIAuthentication , 1306.Cm HostbasedAcceptedAlgorithms , 1307.Cm HostbasedAuthentication , 1308.Cm HostbasedUsesNameFromPacketOnly , 1309.Cm IgnoreRhosts , 1310.Cm Include , 1311.Cm IPQoS , 1312.Cm KbdInteractiveAuthentication , 1313.Cm KerberosAuthentication , 1314.Cm LogLevel , 1315.Cm MaxAuthTries , 1316.Cm MaxSessions , 1317.Cm PAMServiceName , 1318.Cm PasswordAuthentication , 1319.Cm PermitEmptyPasswords , 1320.Cm PermitListen , 1321.Cm PermitOpen , 1322.Cm PermitRootLogin , 1323.Cm PermitTTY , 1324.Cm PermitTunnel , 1325.Cm PermitUserRC , 1326.Cm PubkeyAcceptedAlgorithms , 1327.Cm PubkeyAuthentication , 1328.Cm PubkeyAuthOptions , 1329.Cm RefuseConnection , 1330.Cm RekeyLimit , 1331.Cm RevokedKeys , 1332.Cm RDomain , 1333.Cm SetEnv , 1334.Cm StreamLocalBindMask , 1335.Cm StreamLocalBindUnlink , 1336.Cm TrustedUserCAKeys , 1337.Cm UnusedConnectionTimeout , 1338.Cm X11DisplayOffset , 1339.Cm X11Forwarding 1340and 1341.Cm X11UseLocalhost . 1342.It Cm MaxAuthTries 1343Specifies the maximum number of authentication attempts permitted per 1344connection. 1345Once the number of failures reaches half this value, 1346additional failures are logged. 1347The default is 6. 1348.It Cm MaxSessions 1349Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1350sessions permitted per network connection. 1351Multiple sessions may be established by clients that support connection 1352multiplexing. 1353Setting 1354.Cm MaxSessions 1355to 1 will effectively disable session multiplexing, whereas setting it to 0 1356will prevent all shell, login and subsystem sessions while still permitting 1357forwarding. 1358The default is 10. 1359.It Cm MaxStartups 1360Specifies the maximum number of concurrent unauthenticated connections to the 1361SSH daemon. 1362Additional connections will be dropped until authentication succeeds or the 1363.Cm LoginGraceTime 1364expires for a connection. 1365The default is 10:30:100. 1366.Pp 1367Alternatively, random early drop can be enabled by specifying 1368the three colon separated values 1369start:rate:full (e.g. "10:30:60"). 1370.Xr sshd 8 1371will refuse connection attempts with a probability of rate/100 (30%) 1372if there are currently start (10) unauthenticated connections. 1373The probability increases linearly and all connection attempts 1374are refused if the number of unauthenticated connections reaches full (60). 1375.It Cm ModuliFile 1376Specifies the 1377.Xr moduli 5 1378file that contains the Diffie-Hellman groups used for the 1379.Dq diffie-hellman-group-exchange-sha1 1380and 1381.Dq diffie-hellman-group-exchange-sha256 1382key exchange methods. 1383The default is 1384.Pa /etc/moduli . 1385.It Cm PAMServiceName 1386Specifies the service name used for Pluggable Authentication Modules (PAM) 1387authentication, authorisation and session controls when 1388.Cm UsePAM 1389is enabled. 1390The default is 1391.Cm sshd . 1392.It Cm PasswordAuthentication 1393Specifies whether password authentication is allowed. 1394Note that passwords may also be accepted via 1395.Cm KbdInteractiveAuthentication . 1396See also 1397.Cm UsePAM . 1398The default is 1399.Cm no . 1400.It Cm PermitEmptyPasswords 1401When password authentication is allowed, it specifies whether the 1402server allows login to accounts with empty password strings. 1403The default is 1404.Cm no . 1405.It Cm PermitListen 1406Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1407The listen specification must be one of the following forms: 1408.Pp 1409.Bl -item -offset indent -compact 1410.It 1411.Cm PermitListen 1412.Sm off 1413.Ar port 1414.Sm on 1415.It 1416.Cm PermitListen 1417.Sm off 1418.Ar host : port 1419.Sm on 1420.El 1421.Pp 1422Multiple permissions may be specified by separating them with whitespace. 1423An argument of 1424.Cm any 1425can be used to remove all restrictions and permit any listen requests. 1426An argument of 1427.Cm none 1428can be used to prohibit all listen requests. 1429The host name may contain wildcards as described in the PATTERNS section in 1430.Xr ssh_config 5 . 1431The wildcard 1432.Sq * 1433can also be used in place of a port number to allow all ports. 1434By default all port forwarding listen requests are permitted. 1435Note that the 1436.Cm GatewayPorts 1437option may further restrict which addresses may be listened on. 1438Note also that 1439.Xr ssh 1 1440will request a listen host of 1441.Dq localhost 1442if no listen host was specifically requested, and this name is 1443treated differently to explicit localhost addresses of 1444.Dq 127.0.0.1 1445and 1446.Dq ::1 . 1447.It Cm PermitOpen 1448Specifies the destinations to which TCP port forwarding is permitted. 1449The forwarding specification must be one of the following forms: 1450.Pp 1451.Bl -item -offset indent -compact 1452.It 1453.Cm PermitOpen 1454.Sm off 1455.Ar host : port 1456.Sm on 1457.It 1458.Cm PermitOpen 1459.Sm off 1460.Ar IPv4_addr : port 1461.Sm on 1462.It 1463.Cm PermitOpen 1464.Sm off 1465.Ar \&[ IPv6_addr \&] : port 1466.Sm on 1467.El 1468.Pp 1469Multiple forwards may be specified by separating them with whitespace. 1470An argument of 1471.Cm any 1472can be used to remove all restrictions and permit any forwarding requests. 1473An argument of 1474.Cm none 1475can be used to prohibit all forwarding requests. 1476The wildcard 1477.Sq * 1478can be used for host or port to allow all hosts or ports respectively. 1479Otherwise, no pattern matching or address lookups are performed on supplied 1480names. 1481By default all port forwarding requests are permitted. 1482.It Cm PermitRootLogin 1483Specifies whether root can log in using 1484.Xr ssh 1 . 1485The argument must be 1486.Cm yes , 1487.Cm prohibit-password , 1488.Cm forced-commands-only , 1489or 1490.Cm no . 1491The default is 1492.Cm no . 1493Note that if 1494.Cm ChallengeResponseAuthentication 1495and 1496.Cm UsePAM 1497are both 1498.Cm yes , 1499this setting may be overridden by the PAM policy. 1500.Pp 1501If this option is set to 1502.Cm prohibit-password 1503(or its deprecated alias, 1504.Cm without-password ) , 1505password and keyboard-interactive authentication are disabled for root. 1506.Pp 1507If this option is set to 1508.Cm forced-commands-only , 1509root login with public key authentication will be allowed, 1510but only if the 1511.Ar command 1512option has been specified 1513(which may be useful for taking remote backups even if root login is 1514normally not allowed). 1515All other authentication methods are disabled for root. 1516.Pp 1517If this option is set to 1518.Cm no , 1519root is not allowed to log in. 1520.It Cm PermitTTY 1521Specifies whether 1522.Xr pty 4 1523allocation is permitted. 1524The default is 1525.Cm yes . 1526.It Cm PermitTunnel 1527Specifies whether 1528.Xr tun 4 1529device forwarding is allowed. 1530The argument must be 1531.Cm yes , 1532.Cm point-to-point 1533(layer 3), 1534.Cm ethernet 1535(layer 2), or 1536.Cm no . 1537Specifying 1538.Cm yes 1539permits both 1540.Cm point-to-point 1541and 1542.Cm ethernet . 1543The default is 1544.Cm no . 1545.Pp 1546Independent of this setting, the permissions of the selected 1547.Xr tun 4 1548device must allow access to the user. 1549.It Cm PermitUserEnvironment 1550Specifies whether 1551.Pa ~/.ssh/environment 1552and 1553.Cm environment= 1554options in 1555.Pa ~/.ssh/authorized_keys 1556are processed by 1557.Xr sshd 8 . 1558Valid options are 1559.Cm yes , 1560.Cm no 1561or a pattern-list specifying which environment variable names to accept 1562(for example 1563.Qq LANG,LC_* ) . 1564The default is 1565.Cm no . 1566Enabling environment processing may enable users to bypass access 1567restrictions in some configurations using mechanisms such as 1568.Ev LD_PRELOAD . 1569.It Cm PermitUserRC 1570Specifies whether any 1571.Pa ~/.ssh/rc 1572file is executed. 1573The default is 1574.Cm yes . 1575.It Cm PerSourceMaxStartups 1576Specifies the number of unauthenticated connections allowed from a 1577given source address, or 1578.Dq none 1579if there is no limit. 1580This limit is applied in addition to 1581.Cm MaxStartups , 1582whichever is lower. 1583The default is 1584.Cm none . 1585.It Cm PerSourceNetBlockSize 1586Specifies the number of bits of source address that are grouped together 1587for the purposes of applying PerSourceMaxStartups limits. 1588Values for IPv4 and optionally IPv6 may be specified, separated by a colon. 1589The default is 1590.Cm 32:128 , 1591which means each address is considered individually. 1592.It Cm PerSourcePenalties 1593Controls penalties for various conditions that may represent attacks on 1594.Xr sshd 8 . 1595If a penalty is enforced against a client then its source address and any 1596others in the same network, as defined by 1597.Cm PerSourceNetBlockSize , 1598will be refused connection for a period. 1599.Pp 1600A penalty doesn't affect concurrent connections in progress, but multiple 1601penalties from the same source from concurrent connections will accumulate 1602up to a maximum. 1603Conversely, penalties are not applied until a minimum threshold time has been 1604accumulated. 1605.Pp 1606Penalties are enabled by default with the default settings listed below 1607but may disabled using the 1608.Cm no 1609keyword. 1610The defaults may be overridden by specifying one or more of the keywords below, 1611separated by whitespace. 1612All keywords accept arguments, e.g.\& 1613.Qq crash:2m . 1614.Bl -tag -width Ds 1615.It Cm crash:duration 1616Specifies how long to refuse clients that cause a crash of 1617.Xr sshd 8 (default: 90s). 1618.It Cm authfail:duration 1619Specifies how long to refuse clients that disconnect after making one or more 1620unsuccessful authentication attempts (default: 5s). 1621.It Cm refuseconnection:duration 1622Specifies how long to refuse clients that were administratively prohibited 1623connection via the 1624.Cm RefuseConnection 1625option (default: 10s). 1626.It Cm noauth:duration 1627Specifies how long to refuse clients that disconnect without attempting 1628authentication (default: 1s). 1629This timeout should be used cautiously otherwise it may penalise legitimate 1630scanning tools such as 1631.Xr ssh-keyscan 1 . 1632.It Cm grace-exceeded:duration 1633Specifies how long to refuse clients that fail to authenticate after 1634.Cm LoginGraceTime 1635(default: 10s). 1636.It Cm max:duration 1637Specifies the maximum time a particular source address range will be refused 1638access for (default: 10m). 1639Repeated penalties will accumulate up to this maximum. 1640.It Cm min:duration 1641Specifies the minimum penalty that must accrue before enforcement begins 1642(default: 15s). 1643.It Cm max-sources4:number , max-sources6:number 1644Specifies the maximum number of client IPv4 and IPv6 address ranges to 1645track for penalties (default: 65536 for both). 1646.It Cm overflow:mode 1647Controls how the server behaves when 1648.Cm max-sources4 1649or 1650.Cm max-sources6 1651is exceeded. 1652There are two operating modes: 1653.Cm deny-all , 1654which denies all incoming connections other than those exempted via 1655.Cm PerSourcePenaltyExemptList 1656until a penalty expires, and 1657.Cm permissive , 1658which allows new connections by removing existing penalties early 1659(default: permissive). 1660Note that client penalties below the 1661.Cm min 1662threshold count against the total number of tracked penalties. 1663IPv4 and IPv6 addresses are tracked separately, so an overflow in one will 1664not affect the other. 1665.It Cm overflow6:mode 1666Allows specifying a different overflow mode for IPv6 addresses. 1667The default it to use the same overflow mode as was specified for IPv4. 1668.El 1669.It Cm PerSourcePenaltyExemptList 1670Specifies a comma-separated list of addresses to exempt from penalties. 1671This list may contain wildcards and CIDR address/masklen ranges. 1672Note that the mask length provided must be consistent with the address - 1673it is an error to specify a mask length that is too long for the address 1674or one with bits set in this host portion of the address. 1675For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1676The default is not to exempt any addresses. 1677.It Cm PidFile 1678Specifies the file that contains the process ID of the 1679SSH daemon, or 1680.Cm none 1681to not write one. 1682The default is 1683.Pa /var/run/sshd.pid . 1684.It Cm Port 1685Specifies the port number that 1686.Xr sshd 8 1687listens on. 1688The default is 22. 1689Multiple options of this type are permitted. 1690See also 1691.Cm ListenAddress . 1692.It Cm PrintLastLog 1693Specifies whether 1694.Xr sshd 8 1695should print the date and time of the last user login when a user logs 1696in interactively. 1697The default is 1698.Cm yes . 1699.It Cm PrintMotd 1700Specifies whether 1701.Xr sshd 8 1702should print 1703.Pa /etc/motd 1704when a user logs in interactively. 1705(On some systems it is also printed by the shell, 1706.Pa /etc/profile , 1707or equivalent.) 1708The default is 1709.Cm yes . 1710.It Cm PubkeyAcceptedAlgorithms 1711Specifies the signature algorithms that will be accepted for public key 1712authentication as a list of comma-separated patterns. 1713Alternately if the specified list begins with a 1714.Sq + 1715character, then the specified algorithms will be appended to the default set 1716instead of replacing them. 1717If the specified list begins with a 1718.Sq - 1719character, then the specified algorithms (including wildcards) will be removed 1720from the default set instead of replacing them. 1721If the specified list begins with a 1722.Sq ^ 1723character, then the specified algorithms will be placed at the head of the 1724default set. 1725The default for this option is: 1726.Bd -literal -offset 3n 1727ssh-ed25519-cert-v01@openssh.com, 1728ecdsa-sha2-nistp256-cert-v01@openssh.com, 1729ecdsa-sha2-nistp384-cert-v01@openssh.com, 1730ecdsa-sha2-nistp521-cert-v01@openssh.com, 1731sk-ssh-ed25519-cert-v01@openssh.com, 1732sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1733rsa-sha2-512-cert-v01@openssh.com, 1734rsa-sha2-256-cert-v01@openssh.com, 1735ssh-ed25519, 1736ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1737sk-ssh-ed25519@openssh.com, 1738sk-ecdsa-sha2-nistp256@openssh.com, 1739rsa-sha2-512,rsa-sha2-256 1740.Ed 1741.Pp 1742The list of available signature algorithms may also be obtained using 1743.Qq ssh -Q PubkeyAcceptedAlgorithms . 1744.It Cm PubkeyAuthOptions 1745Sets one or more public key authentication options. 1746The supported keywords are: 1747.Cm none 1748(the default; indicating no additional options are enabled), 1749.Cm touch-required 1750and 1751.Cm verify-required . 1752.Pp 1753The 1754.Cm touch-required 1755option causes public key authentication using a FIDO authenticator algorithm 1756(i.e.\& 1757.Cm ecdsa-sk 1758or 1759.Cm ed25519-sk ) 1760to always require the signature to attest that a physically present user 1761explicitly confirmed the authentication (usually by touching the authenticator). 1762By default, 1763.Xr sshd 8 1764requires user presence unless overridden with an authorized_keys option. 1765The 1766.Cm touch-required 1767flag disables this override. 1768.Pp 1769The 1770.Cm verify-required 1771option requires a FIDO key signature attest that the user was verified, 1772e.g. via a PIN. 1773.Pp 1774Neither the 1775.Cm touch-required 1776or 1777.Cm verify-required 1778options have any effect for other, non-FIDO, public key types. 1779.It Cm PubkeyAuthentication 1780Specifies whether public key authentication is allowed. 1781The default is 1782.Cm yes . 1783.It Cm RefuseConnection 1784Indicates that 1785.Xr sshd 8 1786should unconditionally terminate the connection. 1787Additionally, a 1788.Cm refuseconnection 1789penalty may be recorded against the source of the connection if 1790.Cm PerSourcePenalties 1791are enabled. 1792This option is only really useful in a 1793.Cm Match 1794block. 1795.It Cm RekeyLimit 1796Specifies the maximum amount of data that may be transmitted or received 1797before the session key is renegotiated, optionally followed by a maximum 1798amount of time that may pass before the session key is renegotiated. 1799The first argument is specified in bytes and may have a suffix of 1800.Sq K , 1801.Sq M , 1802or 1803.Sq G 1804to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1805The default is between 1806.Sq 1G 1807and 1808.Sq 4G , 1809depending on the cipher. 1810The optional second value is specified in seconds and may use any of the 1811units documented in the 1812.Sx TIME FORMATS 1813section. 1814The default value for 1815.Cm RekeyLimit 1816is 1817.Cm default none , 1818which means that rekeying is performed after the cipher's default amount 1819of data has been sent or received and no time based rekeying is done. 1820.It Cm RequiredRSASize 1821Specifies the minimum RSA key size (in bits) that 1822.Xr sshd 8 1823will accept. 1824User and host-based authentication keys smaller than this limit will be 1825refused. 1826The default is 1827.Cm 1024 1828bits. 1829Note that this limit may only be raised from the default. 1830.It Cm RevokedKeys 1831Specifies revoked public keys file, or 1832.Cm none 1833to not use one. 1834Keys listed in this file will be refused for public key authentication. 1835Note that if this file is not readable, then public key authentication will 1836be refused for all users. 1837Keys may be specified as a text file, listing one public key per line, or as 1838an OpenSSH Key Revocation List (KRL) as generated by 1839.Xr ssh-keygen 1 . 1840For more information on KRLs, see the KEY REVOCATION LISTS section in 1841.Xr ssh-keygen 1 . 1842.It Cm RDomain 1843Specifies an explicit routing domain that is applied after authentication 1844has completed. 1845The user session, as well as any forwarded or listening IP sockets, 1846will be bound to this 1847.Xr rdomain 4 . 1848If the routing domain is set to 1849.Cm \&%D , 1850then the domain in which the incoming connection was received will be applied. 1851.It Cm SecurityKeyProvider 1852Specifies a path to a library that will be used when loading 1853FIDO authenticator-hosted keys, overriding the default of using 1854the built-in USB HID support. 1855.It Cm SetEnv 1856Specifies one or more environment variables to set in child sessions started 1857by 1858.Xr sshd 8 1859as 1860.Dq NAME=VALUE . 1861The environment value may be quoted (e.g. if it contains whitespace 1862characters). 1863Environment variables set by 1864.Cm SetEnv 1865override the default environment and any variables specified by the user 1866via 1867.Cm AcceptEnv 1868or 1869.Cm PermitUserEnvironment . 1870.It Cm SshdSessionPath 1871Overrides the default path to the 1872.Cm sshd-session 1873binary that is invoked to handle each connection. 1874The default is 1875.Pa /usr/libexec/sshd-session . 1876This option is intended for use by tests. 1877.It Cm StreamLocalBindMask 1878Sets the octal file creation mode mask 1879.Pq umask 1880used when creating a Unix-domain socket file for local or remote 1881port forwarding. 1882This option is only used for port forwarding to a Unix-domain socket file. 1883.Pp 1884The default value is 0177, which creates a Unix-domain socket file that is 1885readable and writable only by the owner. 1886Note that not all operating systems honor the file mode on Unix-domain 1887socket files. 1888.It Cm StreamLocalBindUnlink 1889Specifies whether to remove an existing Unix-domain socket file for local 1890or remote port forwarding before creating a new one. 1891If the socket file already exists and 1892.Cm StreamLocalBindUnlink 1893is not enabled, 1894.Nm sshd 1895will be unable to forward the port to the Unix-domain socket file. 1896This option is only used for port forwarding to a Unix-domain socket file. 1897.Pp 1898The argument must be 1899.Cm yes 1900or 1901.Cm no . 1902The default is 1903.Cm no . 1904.It Cm StrictModes 1905Specifies whether 1906.Xr sshd 8 1907should check file modes and ownership of the 1908user's files and home directory before accepting login. 1909This is normally desirable because novices sometimes accidentally leave their 1910directory or files world-writable. 1911The default is 1912.Cm yes . 1913Note that this does not apply to 1914.Cm ChrootDirectory , 1915whose permissions and ownership are checked unconditionally. 1916.It Cm Subsystem 1917Configures an external subsystem (e.g. file transfer daemon). 1918Arguments should be a subsystem name and a command (with optional arguments) 1919to execute upon subsystem request. 1920.Pp 1921The command 1922.Cm sftp-server 1923implements the SFTP file transfer subsystem. 1924.Pp 1925Alternately the name 1926.Cm internal-sftp 1927implements an in-process SFTP server. 1928This may simplify configurations using 1929.Cm ChrootDirectory 1930to force a different filesystem root on clients. 1931It accepts the same command line arguments as 1932.Cm sftp-server 1933and even though it is in-process, settings such as 1934.Cm LogLevel 1935or 1936.Cm SyslogFacility 1937do not apply to it and must be set explicitly via 1938command line arguments. 1939.Pp 1940By default no subsystems are defined. 1941.It Cm SyslogFacility 1942Gives the facility code that is used when logging messages from 1943.Xr sshd 8 . 1944The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1945LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1946The default is AUTH. 1947.It Cm TCPKeepAlive 1948Specifies whether the system should send TCP keepalive messages to the 1949other side. 1950If they are sent, death of the connection or crash of one 1951of the machines will be properly noticed. 1952However, this means that 1953connections will die if the route is down temporarily, and some people 1954find it annoying. 1955On the other hand, if TCP keepalives are not sent, 1956sessions may hang indefinitely on the server, leaving 1957.Qq ghost 1958users and consuming server resources. 1959.Pp 1960The default is 1961.Cm yes 1962(to send TCP keepalive messages), and the server will notice 1963if the network goes down or the client host crashes. 1964This avoids infinitely hanging sessions. 1965.Pp 1966To disable TCP keepalive messages, the value should be set to 1967.Cm no . 1968.It Cm TrustedUserCAKeys 1969Specifies a file containing public keys of certificate authorities that are 1970trusted to sign user certificates for authentication, or 1971.Cm none 1972to not use one. 1973Keys are listed one per line; empty lines and comments starting with 1974.Ql # 1975are allowed. 1976If a certificate is presented for authentication and has its signing CA key 1977listed in this file, then it may be used for authentication for any user 1978listed in the certificate's principals list. 1979Note that certificates that lack a list of principals will not be permitted 1980for authentication using 1981.Cm TrustedUserCAKeys . 1982For more details on certificates, see the CERTIFICATES section in 1983.Xr ssh-keygen 1 . 1984.It Cm UnusedConnectionTimeout 1985Specifies whether and how quickly 1986.Xr sshd 8 1987should close client connections with no open channels. 1988Open channels include active shell, command execution or subsystem 1989sessions, connected network, socket, agent or X11 forwardings. 1990Forwarding listeners, such as those from the 1991.Xr ssh 1 1992.Fl R 1993flag, are not considered as open channels and do not prevent the timeout. 1994The timeout value 1995is specified in seconds or may use any of the units documented in the 1996.Sx TIME FORMATS 1997section. 1998.Pp 1999Note that this timeout starts when the client connection completes 2000user authentication but before the client has an opportunity to open any 2001channels. 2002Caution should be used when using short timeout values, as they may not 2003provide sufficient time for the client to request and open its channels 2004before terminating the connection. 2005.Pp 2006The default 2007.Cm none 2008is to never expire connections for having no open channels. 2009This option may be useful in conjunction with 2010.Cm ChannelTimeout . 2011.It Cm UseBlacklist 2012Specifies whether 2013.Xr sshd 8 2014attempts to send authentication success and failure messages 2015to the 2016.Xr blacklistd 8 2017daemon. 2018The default is 2019.Cm no . 2020For forward compatibility with an upcoming 2021.Xr blacklistd 2022rename, the 2023.Cm UseBlocklist 2024alias can be used instead. 2025.It Cm UseDNS 2026Specifies whether 2027.Xr sshd 8 2028should look up the remote host name, and to check that 2029the resolved host name for the remote IP address maps back to the 2030very same IP address. 2031.Pp 2032If this option is set to 2033.Cm no , 2034then only addresses and not host names may be used in 2035.Pa ~/.ssh/authorized_keys 2036.Cm from 2037and 2038.Nm 2039.Cm Match 2040.Cm Host 2041directives. 2042The default is 2043.Dq yes . 2044.It Cm UsePAM 2045Enables the Pluggable Authentication Module interface. 2046If set to 2047.Cm yes 2048this will enable PAM authentication using 2049.Cm KbdInteractiveAuthentication 2050and 2051.Cm PasswordAuthentication 2052in addition to PAM account and session module processing for all 2053authentication types. 2054.Pp 2055Because PAM keyboard-interactive authentication usually serves an equivalent 2056role to password authentication, you should disable either 2057.Cm PasswordAuthentication 2058or 2059.Cm KbdInteractiveAuthentication . 2060.Pp 2061If 2062.Cm UsePAM 2063is enabled, you will not be able to run 2064.Xr sshd 8 2065as a non-root user. 2066The default is 2067.Cm yes . 2068.It Cm VersionAddendum 2069Optionally specifies additional text to append to the SSH protocol banner 2070sent by the server upon connection. 2071The default is 2072.Qq FreeBSD-20250219 . 2073The value 2074.Cm none 2075may be used to disable this. 2076.It Cm X11DisplayOffset 2077Specifies the first display number available for 2078.Xr sshd 8 Ns 's 2079X11 forwarding. 2080This prevents sshd from interfering with real X11 servers. 2081The default is 10. 2082.It Cm X11Forwarding 2083Specifies whether X11 forwarding is permitted. 2084The argument must be 2085.Cm yes 2086or 2087.Cm no . 2088The default is 2089.Cm no . 2090.Pp 2091When X11 forwarding is enabled, there may be additional exposure to 2092the server and to client displays if the 2093.Xr sshd 8 2094proxy display is configured to listen on the wildcard address (see 2095.Cm X11UseLocalhost ) , 2096though this is not the default. 2097Additionally, the authentication spoofing and authentication data 2098verification and substitution occur on the client side. 2099The security risk of using X11 forwarding is that the client's X11 2100display server may be exposed to attack when the SSH client requests 2101forwarding (see the warnings for 2102.Cm ForwardX11 2103in 2104.Xr ssh_config 5 ) . 2105A system administrator may have a stance in which they want to 2106protect clients that may expose themselves to attack by unwittingly 2107requesting X11 forwarding, which can warrant a 2108.Cm no 2109setting. 2110.Pp 2111Note that disabling X11 forwarding does not prevent users from 2112forwarding X11 traffic, as users can always install their own forwarders. 2113.It Cm X11UseLocalhost 2114Specifies whether 2115.Xr sshd 8 2116should bind the X11 forwarding server to the loopback address or to 2117the wildcard address. 2118By default, 2119sshd binds the forwarding server to the loopback address and sets the 2120hostname part of the 2121.Ev DISPLAY 2122environment variable to 2123.Cm localhost . 2124This prevents remote hosts from connecting to the proxy display. 2125However, some older X11 clients may not function with this 2126configuration. 2127.Cm X11UseLocalhost 2128may be set to 2129.Cm no 2130to specify that the forwarding server should be bound to the wildcard 2131address. 2132The argument must be 2133.Cm yes 2134or 2135.Cm no . 2136The default is 2137.Cm yes . 2138.It Cm XAuthLocation 2139Specifies the full pathname of the 2140.Xr xauth 1 2141program, or 2142.Cm none 2143to not use one. 2144The default is 2145.Pa /usr/local/bin/xauth . 2146.El 2147.Sh TIME FORMATS 2148.Xr sshd 8 2149command-line arguments and configuration file options that specify time 2150may be expressed using a sequence of the form: 2151.Sm off 2152.Ar time Op Ar qualifier , 2153.Sm on 2154where 2155.Ar time 2156is a positive integer value and 2157.Ar qualifier 2158is one of the following: 2159.Pp 2160.Bl -tag -width Ds -compact -offset indent 2161.It Aq Cm none 2162seconds 2163.It Cm s | Cm S 2164seconds 2165.It Cm m | Cm M 2166minutes 2167.It Cm h | Cm H 2168hours 2169.It Cm d | Cm D 2170days 2171.It Cm w | Cm W 2172weeks 2173.El 2174.Pp 2175Each member of the sequence is added together to calculate 2176the total time value. 2177.Pp 2178Time format examples: 2179.Pp 2180.Bl -tag -width Ds -compact -offset indent 2181.It 600 2182600 seconds (10 minutes) 2183.It 10m 218410 minutes 2185.It 1h30m 21861 hour 30 minutes (90 minutes) 2187.El 2188.Sh TOKENS 2189Arguments to some keywords can make use of tokens, 2190which are expanded at runtime: 2191.Pp 2192.Bl -tag -width XXXX -offset indent -compact 2193.It %% 2194A literal 2195.Sq % . 2196.It \&%C 2197Identifies the connection endpoints, containing 2198four space-separated values: client address, client port number, 2199server address, and server port number. 2200.It \&%D 2201The routing domain in which the incoming connection was received. 2202.It %F 2203The fingerprint of the CA key. 2204.It %f 2205The fingerprint of the key or certificate. 2206.It %h 2207The home directory of the user. 2208.It %i 2209The key ID in the certificate. 2210.It %K 2211The base64-encoded CA key. 2212.It %k 2213The base64-encoded key or certificate for authentication. 2214.It %s 2215The serial number of the certificate. 2216.It \&%T 2217The type of the CA key. 2218.It %t 2219The key or certificate type. 2220.It \&%U 2221The numeric user ID of the target user. 2222.It %u 2223The username. 2224.El 2225.Pp 2226.Cm AuthorizedKeysCommand 2227accepts the tokens %%, %C, %D, %f, %h, %k, %t, %U, and %u. 2228.Pp 2229.Cm AuthorizedKeysFile 2230accepts the tokens %%, %h, %U, and %u. 2231.Pp 2232.Cm AuthorizedPrincipalsCommand 2233accepts the tokens %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 2234.Pp 2235.Cm AuthorizedPrincipalsFile 2236accepts the tokens %%, %h, %U, and %u. 2237.Pp 2238.Cm ChrootDirectory 2239accepts the tokens %%, %h, %U, and %u. 2240.Pp 2241.Cm RoutingDomain 2242accepts the token %D. 2243.Sh FILES 2244.Bl -tag -width Ds 2245.It Pa /etc/ssh/sshd_config 2246Contains configuration data for 2247.Xr sshd 8 . 2248This file should be writable by root only, but it is recommended 2249(though not necessary) that it be world-readable. 2250.El 2251.Sh SEE ALSO 2252.Xr sftp-server 8 , 2253.Xr sshd 8 2254.Sh AUTHORS 2255.An -nosplit 2256OpenSSH is a derivative of the original and free 2257ssh 1.2.12 release by 2258.An Tatu Ylonen . 2259.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 2260.An Theo de Raadt 2261and 2262.An Dug Song 2263removed many bugs, re-added newer features and 2264created OpenSSH. 2265.An Markus Friedl 2266contributed the support for SSH protocol versions 1.5 and 2.0. 2267.An Niels Provos 2268and 2269.An Markus Friedl 2270contributed support for privilege separation. 2271