1.\" 2.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" All rights reserved 5.\" 6.\" As far as I am concerned, the code I have written for this software 7.\" can be used freely for any purpose. Any derived versions of this 8.\" software must be clearly marked as such, and if the derived work is 9.\" incompatible with the protocol description in the RFC file, it must be 10.\" called by a name other than "ssh" or "Secure Shell". 11.\" 12.\" Copyright (c) 1999,2000 Markus Friedl. All rights reserved. 13.\" Copyright (c) 1999 Aaron Campbell. All rights reserved. 14.\" Copyright (c) 1999 Theo de Raadt. All rights reserved. 15.\" 16.\" Redistribution and use in source and binary forms, with or without 17.\" modification, are permitted provided that the following conditions 18.\" are met: 19.\" 1. Redistributions of source code must retain the above copyright 20.\" notice, this list of conditions and the following disclaimer. 21.\" 2. Redistributions in binary form must reproduce the above copyright 22.\" notice, this list of conditions and the following disclaimer in the 23.\" documentation and/or other materials provided with the distribution. 24.\" 25.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35.\" 36.\" $OpenBSD: sshd_config.5,v 1.355 2024/02/21 06:17:29 djm Exp $ 37.Dd $Mdocdate: February 21 2024 $ 38.Dt SSHD_CONFIG 5 39.Os 40.Sh NAME 41.Nm sshd_config 42.Nd OpenSSH daemon configuration file 43.Sh DESCRIPTION 44.Xr sshd 8 45reads configuration data from 46.Pa /etc/ssh/sshd_config 47(or the file specified with 48.Fl f 49on the command line). 50The file contains keyword-argument pairs, one per line. 51Unless noted otherwise, for each keyword, the first obtained value will be used. 52Lines starting with 53.Ql # 54and empty lines are interpreted as comments. 55Arguments may optionally be enclosed in double quotes 56.Pq \&" 57in order to represent arguments containing spaces. 58.Pp 59The possible 60keywords and their meanings are as follows (note that 61keywords are case-insensitive and arguments are case-sensitive): 62.Bl -tag -width Ds 63.It Cm AcceptEnv 64Specifies what environment variables sent by the client will be copied into 65the session's 66.Xr environ 7 . 67See 68.Cm SendEnv 69and 70.Cm SetEnv 71in 72.Xr ssh_config 5 73for how to configure the client. 74The 75.Ev TERM 76environment variable is always accepted whenever the client 77requests a pseudo-terminal as it is required by the protocol. 78Variables are specified by name, which may contain the wildcard characters 79.Ql * 80and 81.Ql \&? . 82Multiple environment variables may be separated by whitespace or spread 83across multiple 84.Cm AcceptEnv 85directives. 86Be warned that some environment variables could be used to bypass restricted 87user environments. 88For this reason, care should be taken in the use of this directive. 89The default is not to accept any environment variables. 90.It Cm AddressFamily 91Specifies which address family should be used by 92.Xr sshd 8 . 93Valid arguments are 94.Cm any 95(the default), 96.Cm inet 97(use IPv4 only), or 98.Cm inet6 99(use IPv6 only). 100.It Cm AllowAgentForwarding 101Specifies whether 102.Xr ssh-agent 1 103forwarding is permitted. 104The default is 105.Cm yes . 106Note that disabling agent forwarding does not improve security 107unless users are also denied shell access, as they can always install 108their own forwarders. 109.It Cm AllowGroups 110This keyword can be followed by a list of group name patterns, separated 111by spaces. 112If specified, login is allowed only for users whose primary 113group or supplementary group list matches one of the patterns. 114Only group names are valid; a numerical group ID is not recognized. 115By default, login is allowed for all groups. 116The allow/deny groups directives are processed in the following order: 117.Cm DenyGroups , 118.Cm AllowGroups . 119.Pp 120See PATTERNS in 121.Xr ssh_config 5 122for more information on patterns. 123This keyword may appear multiple times in 124.Nm 125with each instance appending to the list. 126.It Cm AllowStreamLocalForwarding 127Specifies whether StreamLocal (Unix-domain socket) forwarding is permitted. 128The available options are 129.Cm yes 130(the default) 131or 132.Cm all 133to allow StreamLocal forwarding, 134.Cm no 135to prevent all StreamLocal forwarding, 136.Cm local 137to allow local (from the perspective of 138.Xr ssh 1 ) 139forwarding only or 140.Cm remote 141to allow remote forwarding only. 142Note that disabling StreamLocal forwarding does not improve security unless 143users are also denied shell access, as they can always install their 144own forwarders. 145.It Cm AllowTcpForwarding 146Specifies whether TCP forwarding is permitted. 147The available options are 148.Cm yes 149(the default) 150or 151.Cm all 152to allow TCP forwarding, 153.Cm no 154to prevent all TCP forwarding, 155.Cm local 156to allow local (from the perspective of 157.Xr ssh 1 ) 158forwarding only or 159.Cm remote 160to allow remote forwarding only. 161Note that disabling TCP forwarding does not improve security unless 162users are also denied shell access, as they can always install their 163own forwarders. 164.It Cm AllowUsers 165This keyword can be followed by a list of user name patterns, separated 166by spaces. 167If specified, login is allowed only for user names that 168match one of the patterns. 169Only user names are valid; a numerical user ID is not recognized. 170By default, login is allowed for all users. 171If the pattern takes the form USER@HOST then USER and HOST 172are separately checked, restricting logins to particular 173users from particular hosts. 174HOST criteria may additionally contain addresses to match in CIDR 175address/masklen format. 176The allow/deny users directives are processed in the following order: 177.Cm DenyUsers , 178.Cm AllowUsers . 179.Pp 180See PATTERNS in 181.Xr ssh_config 5 182for more information on patterns. 183This keyword may appear multiple times in 184.Nm 185with each instance appending to the list. 186.It Cm AuthenticationMethods 187Specifies the authentication methods that must be successfully completed 188for a user to be granted access. 189This option must be followed by one or more lists of comma-separated 190authentication method names, or by the single string 191.Cm any 192to indicate the default behaviour of accepting any single authentication 193method. 194If the default is overridden, then successful authentication requires 195completion of every method in at least one of these lists. 196.Pp 197For example, 198.Qq publickey,password publickey,keyboard-interactive 199would require the user to complete public key authentication, followed by 200either password or keyboard interactive authentication. 201Only methods that are next in one or more lists are offered at each stage, 202so for this example it would not be possible to attempt password or 203keyboard-interactive authentication before public key. 204.Pp 205For keyboard interactive authentication it is also possible to 206restrict authentication to a specific device by appending a 207colon followed by the device identifier 208.Cm bsdauth 209or 210.Cm pam . 211depending on the server configuration. 212For example, 213.Qq keyboard-interactive:bsdauth 214would restrict keyboard interactive authentication to the 215.Cm bsdauth 216device. 217.Pp 218If the publickey method is listed more than once, 219.Xr sshd 8 220verifies that keys that have been used successfully are not reused for 221subsequent authentications. 222For example, 223.Qq publickey,publickey 224requires successful authentication using two different public keys. 225.Pp 226Note that each authentication method listed should also be explicitly enabled 227in the configuration. 228.Pp 229The available authentication methods are: 230.Qq gssapi-with-mic , 231.Qq hostbased , 232.Qq keyboard-interactive , 233.Qq none 234(used for access to password-less accounts when 235.Cm PermitEmptyPasswords 236is enabled), 237.Qq password 238and 239.Qq publickey . 240.It Cm AuthorizedKeysCommand 241Specifies a program to be used to look up the user's public keys. 242The program must be owned by root, not writable by group or others and 243specified by an absolute path. 244Arguments to 245.Cm AuthorizedKeysCommand 246accept the tokens described in the 247.Sx TOKENS 248section. 249If no arguments are specified then the username of the target user is used. 250.Pp 251The program should produce on standard output zero or 252more lines of authorized_keys output (see 253.Sx AUTHORIZED_KEYS 254in 255.Xr sshd 8 ) . 256.Cm AuthorizedKeysCommand 257is tried after the usual 258.Cm AuthorizedKeysFile 259files and will not be executed if a matching key is found there. 260By default, no 261.Cm AuthorizedKeysCommand 262is run. 263.It Cm AuthorizedKeysCommandUser 264Specifies the user under whose account the 265.Cm AuthorizedKeysCommand 266is run. 267It is recommended to use a dedicated user that has no other role on the host 268than running authorized keys commands. 269If 270.Cm AuthorizedKeysCommand 271is specified but 272.Cm AuthorizedKeysCommandUser 273is not, then 274.Xr sshd 8 275will refuse to start. 276.It Cm AuthorizedKeysFile 277Specifies the file that contains the public keys used for user authentication. 278The format is described in the AUTHORIZED_KEYS FILE FORMAT section of 279.Xr sshd 8 . 280Arguments to 281.Cm AuthorizedKeysFile 282accept the tokens described in the 283.Sx TOKENS 284section. 285After expansion, 286.Cm AuthorizedKeysFile 287is taken to be an absolute path or one relative to the user's home 288directory. 289Multiple files may be listed, separated by whitespace. 290Alternately this option may be set to 291.Cm none 292to skip checking for user keys in files. 293The default is 294.Qq .ssh/authorized_keys .ssh/authorized_keys2 . 295.It Cm AuthorizedPrincipalsCommand 296Specifies a program to be used to generate the list of allowed 297certificate principals as per 298.Cm AuthorizedPrincipalsFile . 299The program must be owned by root, not writable by group or others and 300specified by an absolute path. 301Arguments to 302.Cm AuthorizedPrincipalsCommand 303accept the tokens described in the 304.Sx TOKENS 305section. 306If no arguments are specified then the username of the target user is used. 307.Pp 308The program should produce on standard output zero or 309more lines of 310.Cm AuthorizedPrincipalsFile 311output. 312If either 313.Cm AuthorizedPrincipalsCommand 314or 315.Cm AuthorizedPrincipalsFile 316is specified, then certificates offered by the client for authentication 317must contain a principal that is listed. 318By default, no 319.Cm AuthorizedPrincipalsCommand 320is run. 321.It Cm AuthorizedPrincipalsCommandUser 322Specifies the user under whose account the 323.Cm AuthorizedPrincipalsCommand 324is run. 325It is recommended to use a dedicated user that has no other role on the host 326than running authorized principals commands. 327If 328.Cm AuthorizedPrincipalsCommand 329is specified but 330.Cm AuthorizedPrincipalsCommandUser 331is not, then 332.Xr sshd 8 333will refuse to start. 334.It Cm AuthorizedPrincipalsFile 335Specifies a file that lists principal names that are accepted for 336certificate authentication. 337When using certificates signed by a key listed in 338.Cm TrustedUserCAKeys , 339this file lists names, one of which must appear in the certificate for it 340to be accepted for authentication. 341Names are listed one per line preceded by key options (as described in 342.Sx AUTHORIZED_KEYS FILE FORMAT 343in 344.Xr sshd 8 ) . 345Empty lines and comments starting with 346.Ql # 347are ignored. 348.Pp 349Arguments to 350.Cm AuthorizedPrincipalsFile 351accept the tokens described in the 352.Sx TOKENS 353section. 354After expansion, 355.Cm AuthorizedPrincipalsFile 356is taken to be an absolute path or one relative to the user's home directory. 357The default is 358.Cm none , 359i.e. not to use a principals file \(en in this case, the username 360of the user must appear in a certificate's principals list for it to be 361accepted. 362.Pp 363Note that 364.Cm AuthorizedPrincipalsFile 365is only used when authentication proceeds using a CA listed in 366.Cm TrustedUserCAKeys 367and is not consulted for certification authorities trusted via 368.Pa ~/.ssh/authorized_keys , 369though the 370.Cm principals= 371key option offers a similar facility (see 372.Xr sshd 8 373for details). 374.It Cm Banner 375The contents of the specified file are sent to the remote user before 376authentication is allowed. 377If the argument is 378.Cm none 379then no banner is displayed. 380By default, no banner is displayed. 381.It Cm CASignatureAlgorithms 382Specifies which algorithms are allowed for signing of certificates 383by certificate authorities (CAs). 384The default is: 385.Bd -literal -offset indent 386ssh-ed25519,ecdsa-sha2-nistp256, 387ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 388sk-ssh-ed25519@openssh.com, 389sk-ecdsa-sha2-nistp256@openssh.com, 390rsa-sha2-512,rsa-sha2-256 391.Ed 392.Pp 393If the specified list begins with a 394.Sq + 395character, then the specified algorithms will be appended to the default set 396instead of replacing them. 397If the specified list begins with a 398.Sq - 399character, then the specified algorithms (including wildcards) will be removed 400from the default set instead of replacing them. 401.Pp 402Certificates signed using other algorithms will not be accepted for 403public key or host-based authentication. 404.It Cm ChannelTimeout 405Specifies whether and how quickly 406.Xr sshd 8 407should close inactive channels. 408Timeouts are specified as one or more 409.Dq type=interval 410pairs separated by whitespace, where the 411.Dq type 412must be the special keyword 413.Dq global 414or a channel type name from the list below, optionally containing 415wildcard characters. 416.Pp 417The timeout value 418.Dq interval 419is specified in seconds or may use any of the units documented in the 420.Sx TIME FORMATS 421section. 422For example, 423.Dq session=5m 424would cause interactive sessions to terminate after five minutes of 425inactivity. 426Specifying a zero value disables the inactivity timeout. 427.Pp 428The special timeout 429.Dq global 430applies to all active channels, taken together. 431Traffic on any active channel will reset the timeout, but when the timeout 432expires then all open channels will be closed. 433Note that this global timeout is not matched by wildcards and must be 434specified explicitly. 435.Pp 436The available channel type names include: 437.Bl -tag -width Ds 438.It Cm agent-connection 439Open connections to 440.Xr ssh-agent 1 . 441.It Cm direct-tcpip , Cm direct-streamlocal@openssh.com 442Open TCP or Unix socket (respectively) connections that have 443been established from a 444.Xr ssh 1 445local forwarding, i.e.\& 446.Cm LocalForward 447or 448.Cm DynamicForward . 449.It Cm forwarded-tcpip , Cm forwarded-streamlocal@openssh.com 450Open TCP or Unix socket (respectively) connections that have been 451established to a 452.Xr sshd 8 453listening on behalf of a 454.Xr ssh 1 455remote forwarding, i.e.\& 456.Cm RemoteForward . 457.It Cm session 458The interactive main session, including shell session, command execution, 459.Xr scp 1 , 460.Xr sftp 1 , 461etc. 462.It Cm tun-connection 463Open 464.Cm TunnelForward 465connections. 466.It Cm x11-connection 467Open X11 forwarding sessions. 468.El 469.Pp 470Note that in all the above cases, terminating an inactive session does not 471guarantee to remove all resources associated with the session, e.g. shell 472processes or X11 clients relating to the session may continue to execute. 473.Pp 474Moreover, terminating an inactive channel or session does not necessarily 475close the SSH connection, nor does it prevent a client from 476requesting another channel of the same type. 477In particular, expiring an inactive forwarding session does not prevent 478another identical forwarding from being subsequently created. 479.Pp 480The default is not to expire channels of any type for inactivity. 481.It Cm ChrootDirectory 482Specifies the pathname of a directory to 483.Xr chroot 2 484to after authentication. 485At session startup 486.Xr sshd 8 487checks that all components of the pathname are root-owned directories 488which are not writable by group or others. 489After the chroot, 490.Xr sshd 8 491changes the working directory to the user's home directory. 492Arguments to 493.Cm ChrootDirectory 494accept the tokens described in the 495.Sx TOKENS 496section. 497.Pp 498The 499.Cm ChrootDirectory 500must contain the necessary files and directories to support the 501user's session. 502For an interactive session this requires at least a shell, typically 503.Xr sh 1 , 504and basic 505.Pa /dev 506nodes such as 507.Xr null 4 , 508.Xr zero 4 , 509.Xr stdin 4 , 510.Xr stdout 4 , 511.Xr stderr 4 , 512and 513.Xr tty 4 514devices. 515For file transfer sessions using SFTP 516no additional configuration of the environment is necessary if the in-process 517sftp-server is used, 518though sessions which use logging may require 519.Pa /dev/log 520inside the chroot directory on some operating systems (see 521.Xr sftp-server 8 522for details). 523.Pp 524For safety, it is very important that the directory hierarchy be 525prevented from modification by other processes on the system (especially 526those outside the jail). 527Misconfiguration can lead to unsafe environments which 528.Xr sshd 8 529cannot detect. 530.Pp 531The default is 532.Cm none , 533indicating not to 534.Xr chroot 2 . 535.It Cm Ciphers 536Specifies the ciphers allowed. 537Multiple ciphers must be comma-separated. 538If the specified list begins with a 539.Sq + 540character, then the specified ciphers will be appended to the default set 541instead of replacing them. 542If the specified list begins with a 543.Sq - 544character, then the specified ciphers (including wildcards) will be removed 545from the default set instead of replacing them. 546If the specified list begins with a 547.Sq ^ 548character, then the specified ciphers will be placed at the head of the 549default set. 550.Pp 551The supported ciphers are: 552.Pp 553.Bl -item -compact -offset indent 554.It 5553des-cbc 556.It 557aes128-cbc 558.It 559aes192-cbc 560.It 561aes256-cbc 562.It 563aes128-ctr 564.It 565aes192-ctr 566.It 567aes256-ctr 568.It 569aes128-gcm@openssh.com 570.It 571aes256-gcm@openssh.com 572.It 573chacha20-poly1305@openssh.com 574.El 575.Pp 576The default is: 577.Bd -literal -offset indent 578chacha20-poly1305@openssh.com, 579aes128-ctr,aes192-ctr,aes256-ctr, 580aes128-gcm@openssh.com,aes256-gcm@openssh.com 581.Ed 582.Pp 583The list of available ciphers may also be obtained using 584.Qq ssh -Q cipher . 585.It Cm ClientAliveCountMax 586Sets the number of client alive messages which may be sent without 587.Xr sshd 8 588receiving any messages back from the client. 589If this threshold is reached while client alive messages are being sent, 590sshd will disconnect the client, terminating the session. 591It is important to note that the use of client alive messages is very 592different from 593.Cm TCPKeepAlive . 594The client alive messages are sent through the encrypted channel 595and therefore will not be spoofable. 596The TCP keepalive option enabled by 597.Cm TCPKeepAlive 598is spoofable. 599The client alive mechanism is valuable when the client or 600server depend on knowing when a connection has become unresponsive. 601.Pp 602The default value is 3. 603If 604.Cm ClientAliveInterval 605is set to 15, and 606.Cm ClientAliveCountMax 607is left at the default, unresponsive SSH clients 608will be disconnected after approximately 45 seconds. 609Setting a zero 610.Cm ClientAliveCountMax 611disables connection termination. 612.It Cm ClientAliveInterval 613Sets a timeout interval in seconds after which if no data has been received 614from the client, 615.Xr sshd 8 616will send a message through the encrypted 617channel to request a response from the client. 618The default 619is 0, indicating that these messages will not be sent to the client. 620.It Cm Compression 621Specifies whether compression is enabled after 622the user has authenticated successfully. 623The argument must be 624.Cm yes , 625.Cm delayed 626(a legacy synonym for 627.Cm yes ) 628or 629.Cm no . 630The default is 631.Cm yes . 632.It Cm DenyGroups 633This keyword can be followed by a list of group name patterns, separated 634by spaces. 635Login is disallowed for users whose primary group or supplementary 636group list matches one of the patterns. 637Only group names are valid; a numerical group ID is not recognized. 638By default, login is allowed for all groups. 639The allow/deny groups directives are processed in the following order: 640.Cm DenyGroups , 641.Cm AllowGroups . 642.Pp 643See PATTERNS in 644.Xr ssh_config 5 645for more information on patterns. 646This keyword may appear multiple times in 647.Nm 648with each instance appending to the list. 649.It Cm DenyUsers 650This keyword can be followed by a list of user name patterns, separated 651by spaces. 652Login is disallowed for user names that match one of the patterns. 653Only user names are valid; a numerical user ID is not recognized. 654By default, login is allowed for all users. 655If the pattern takes the form USER@HOST then USER and HOST 656are separately checked, restricting logins to particular 657users from particular hosts. 658HOST criteria may additionally contain addresses to match in CIDR 659address/masklen format. 660The allow/deny users directives are processed in the following order: 661.Cm DenyUsers , 662.Cm AllowUsers . 663.Pp 664See PATTERNS in 665.Xr ssh_config 5 666for more information on patterns. 667This keyword may appear multiple times in 668.Nm 669with each instance appending to the list. 670.It Cm DisableForwarding 671Disables all forwarding features, including X11, 672.Xr ssh-agent 1 , 673TCP and StreamLocal. 674This option overrides all other forwarding-related options and may 675simplify restricted configurations. 676.It Cm ExposeAuthInfo 677Writes a temporary file containing a list of authentication methods and 678public credentials (e.g. keys) used to authenticate the user. 679The location of the file is exposed to the user session through the 680.Ev SSH_USER_AUTH 681environment variable. 682The default is 683.Cm no . 684.It Cm FingerprintHash 685Specifies the hash algorithm used when logging key fingerprints. 686Valid options are: 687.Cm md5 688and 689.Cm sha256 . 690The default is 691.Cm sha256 . 692.It Cm ForceCommand 693Forces the execution of the command specified by 694.Cm ForceCommand , 695ignoring any command supplied by the client and 696.Pa ~/.ssh/rc 697if present. 698The command is invoked by using the user's login shell with the -c option. 699This applies to shell, command, or subsystem execution. 700It is most useful inside a 701.Cm Match 702block. 703The command originally supplied by the client is available in the 704.Ev SSH_ORIGINAL_COMMAND 705environment variable. 706Specifying a command of 707.Cm internal-sftp 708will force the use of an in-process SFTP server that requires no support 709files when used with 710.Cm ChrootDirectory . 711The default is 712.Cm none . 713.It Cm GatewayPorts 714Specifies whether remote hosts are allowed to connect to ports 715forwarded for the client. 716By default, 717.Xr sshd 8 718binds remote port forwardings to the loopback address. 719This prevents other remote hosts from connecting to forwarded ports. 720.Cm GatewayPorts 721can be used to specify that sshd 722should allow remote port forwardings to bind to non-loopback addresses, thus 723allowing other hosts to connect. 724The argument may be 725.Cm no 726to force remote port forwardings to be available to the local host only, 727.Cm yes 728to force remote port forwardings to bind to the wildcard address, or 729.Cm clientspecified 730to allow the client to select the address to which the forwarding is bound. 731The default is 732.Cm no . 733.It Cm GSSAPIAuthentication 734Specifies whether user authentication based on GSSAPI is allowed. 735The default is 736.Cm no . 737.It Cm GSSAPICleanupCredentials 738Specifies whether to automatically destroy the user's credentials cache 739on logout. 740The default is 741.Cm yes . 742.It Cm GSSAPIStrictAcceptorCheck 743Determines whether to be strict about the identity of the GSSAPI acceptor 744a client authenticates against. 745If set to 746.Cm yes 747then the client must authenticate against the host 748service on the current hostname. 749If set to 750.Cm no 751then the client may authenticate against any service key stored in the 752machine's default store. 753This facility is provided to assist with operation on multi homed machines. 754The default is 755.Cm yes . 756.It Cm HostbasedAcceptedAlgorithms 757Specifies the signature algorithms that will be accepted for hostbased 758authentication as a list of comma-separated patterns. 759Alternately if the specified list begins with a 760.Sq + 761character, then the specified signature algorithms will be appended to 762the default set instead of replacing them. 763If the specified list begins with a 764.Sq - 765character, then the specified signature algorithms (including wildcards) 766will be removed from the default set instead of replacing them. 767If the specified list begins with a 768.Sq ^ 769character, then the specified signature algorithms will be placed at 770the head of the default set. 771The default for this option is: 772.Bd -literal -offset 3n 773ssh-ed25519-cert-v01@openssh.com, 774ecdsa-sha2-nistp256-cert-v01@openssh.com, 775ecdsa-sha2-nistp384-cert-v01@openssh.com, 776ecdsa-sha2-nistp521-cert-v01@openssh.com, 777sk-ssh-ed25519-cert-v01@openssh.com, 778sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 779rsa-sha2-512-cert-v01@openssh.com, 780rsa-sha2-256-cert-v01@openssh.com, 781ssh-ed25519, 782ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 783sk-ssh-ed25519@openssh.com, 784sk-ecdsa-sha2-nistp256@openssh.com, 785rsa-sha2-512,rsa-sha2-256 786.Ed 787.Pp 788The list of available signature algorithms may also be obtained using 789.Qq ssh -Q HostbasedAcceptedAlgorithms . 790This was formerly named HostbasedAcceptedKeyTypes. 791.It Cm HostbasedAuthentication 792Specifies whether rhosts or /etc/hosts.equiv authentication together 793with successful public key client host authentication is allowed 794(host-based authentication). 795The default is 796.Cm no . 797.It Cm HostbasedUsesNameFromPacketOnly 798Specifies whether or not the server will attempt to perform a reverse 799name lookup when matching the name in the 800.Pa ~/.shosts , 801.Pa ~/.rhosts , 802and 803.Pa /etc/hosts.equiv 804files during 805.Cm HostbasedAuthentication . 806A setting of 807.Cm yes 808means that 809.Xr sshd 8 810uses the name supplied by the client rather than 811attempting to resolve the name from the TCP connection itself. 812The default is 813.Cm no . 814.It Cm HostCertificate 815Specifies a file containing a public host certificate. 816The certificate's public key must match a private host key already specified 817by 818.Cm HostKey . 819The default behaviour of 820.Xr sshd 8 821is not to load any certificates. 822.It Cm HostKey 823Specifies a file containing a private host key 824used by SSH. 825The defaults are 826.Pa /etc/ssh/ssh_host_ecdsa_key , 827.Pa /etc/ssh/ssh_host_ed25519_key 828and 829.Pa /etc/ssh/ssh_host_rsa_key . 830.Pp 831Note that 832.Xr sshd 8 833will refuse to use a file if it is group/world-accessible 834and that the 835.Cm HostKeyAlgorithms 836option restricts which of the keys are actually used by 837.Xr sshd 8 . 838.Pp 839It is possible to have multiple host key files. 840It is also possible to specify public host key files instead. 841In this case operations on the private key will be delegated 842to an 843.Xr ssh-agent 1 . 844.It Cm HostKeyAgent 845Identifies the UNIX-domain socket used to communicate 846with an agent that has access to the private host keys. 847If the string 848.Qq SSH_AUTH_SOCK 849is specified, the location of the socket will be read from the 850.Ev SSH_AUTH_SOCK 851environment variable. 852.It Cm HostKeyAlgorithms 853Specifies the host key signature algorithms 854that the server offers. 855The default for this option is: 856.Bd -literal -offset 3n 857ssh-ed25519-cert-v01@openssh.com, 858ecdsa-sha2-nistp256-cert-v01@openssh.com, 859ecdsa-sha2-nistp384-cert-v01@openssh.com, 860ecdsa-sha2-nistp521-cert-v01@openssh.com, 861sk-ssh-ed25519-cert-v01@openssh.com, 862sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 863rsa-sha2-512-cert-v01@openssh.com, 864rsa-sha2-256-cert-v01@openssh.com, 865ssh-ed25519, 866ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 867sk-ssh-ed25519@openssh.com, 868sk-ecdsa-sha2-nistp256@openssh.com, 869rsa-sha2-512,rsa-sha2-256 870.Ed 871.Pp 872The list of available signature algorithms may also be obtained using 873.Qq ssh -Q HostKeyAlgorithms . 874.It Cm IgnoreRhosts 875Specifies whether to ignore per-user 876.Pa .rhosts 877and 878.Pa .shosts 879files during 880.Cm HostbasedAuthentication . 881The system-wide 882.Pa /etc/hosts.equiv 883and 884.Pa /etc/ssh/shosts.equiv 885are still used regardless of this setting. 886.Pp 887Accepted values are 888.Cm yes 889(the default) to ignore all per-user files, 890.Cm shosts-only 891to allow the use of 892.Pa .shosts 893but to ignore 894.Pa .rhosts 895or 896.Cm no 897to allow both 898.Pa .shosts 899and 900.Pa rhosts . 901.It Cm IgnoreUserKnownHosts 902Specifies whether 903.Xr sshd 8 904should ignore the user's 905.Pa ~/.ssh/known_hosts 906during 907.Cm HostbasedAuthentication 908and use only the system-wide known hosts file 909.Pa /etc/ssh/ssh_known_hosts . 910The default is 911.Dq no . 912.It Cm Include 913Include the specified configuration file(s). 914Multiple pathnames may be specified and each pathname may contain 915.Xr glob 7 916wildcards that will be expanded and processed in lexical order. 917Files without absolute paths are assumed to be in 918.Pa /etc/ssh . 919An 920.Cm Include 921directive may appear inside a 922.Cm Match 923block 924to perform conditional inclusion. 925.It Cm IPQoS 926Specifies the IPv4 type-of-service or DSCP class for the connection. 927Accepted values are 928.Cm af11 , 929.Cm af12 , 930.Cm af13 , 931.Cm af21 , 932.Cm af22 , 933.Cm af23 , 934.Cm af31 , 935.Cm af32 , 936.Cm af33 , 937.Cm af41 , 938.Cm af42 , 939.Cm af43 , 940.Cm cs0 , 941.Cm cs1 , 942.Cm cs2 , 943.Cm cs3 , 944.Cm cs4 , 945.Cm cs5 , 946.Cm cs6 , 947.Cm cs7 , 948.Cm ef , 949.Cm le , 950.Cm lowdelay , 951.Cm throughput , 952.Cm reliability , 953a numeric value, or 954.Cm none 955to use the operating system default. 956This option may take one or two arguments, separated by whitespace. 957If one argument is specified, it is used as the packet class unconditionally. 958If two values are specified, the first is automatically selected for 959interactive sessions and the second for non-interactive sessions. 960The default is 961.Cm af21 962(Low-Latency Data) 963for interactive sessions and 964.Cm cs1 965(Lower Effort) 966for non-interactive sessions. 967.It Cm KbdInteractiveAuthentication 968Specifies whether to allow keyboard-interactive authentication. 969All authentication styles from 970.Xr login.conf 5 971are supported. 972The default is 973.Cm yes . 974The argument to this keyword must be 975.Cm yes 976or 977.Cm no . 978.Cm ChallengeResponseAuthentication 979is a deprecated alias for this. 980.It Cm KerberosAuthentication 981Specifies whether the password provided by the user for 982.Cm PasswordAuthentication 983will be validated through the Kerberos KDC. 984To use this option, the server needs a 985Kerberos servtab which allows the verification of the KDC's identity. 986The default is 987.Cm no . 988.It Cm KerberosGetAFSToken 989If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire 990an AFS token before accessing the user's home directory. 991The default is 992.Cm no . 993.It Cm KerberosOrLocalPasswd 994If password authentication through Kerberos fails then 995the password will be validated via any additional local mechanism 996such as 997.Pa /etc/passwd . 998The default is 999.Cm yes . 1000.It Cm KerberosTicketCleanup 1001Specifies whether to automatically destroy the user's ticket cache 1002file on logout. 1003The default is 1004.Cm yes . 1005.It Cm KexAlgorithms 1006Specifies the available KEX (Key Exchange) algorithms. 1007Multiple algorithms must be comma-separated. 1008Alternately if the specified list begins with a 1009.Sq + 1010character, then the specified algorithms will be appended to the default set 1011instead of replacing them. 1012If the specified list begins with a 1013.Sq - 1014character, then the specified algorithms (including wildcards) will be removed 1015from the default set instead of replacing them. 1016If the specified list begins with a 1017.Sq ^ 1018character, then the specified algorithms will be placed at the head of the 1019default set. 1020The supported algorithms are: 1021.Pp 1022.Bl -item -compact -offset indent 1023.It 1024curve25519-sha256 1025.It 1026curve25519-sha256@libssh.org 1027.It 1028diffie-hellman-group1-sha1 1029.It 1030diffie-hellman-group14-sha1 1031.It 1032diffie-hellman-group14-sha256 1033.It 1034diffie-hellman-group16-sha512 1035.It 1036diffie-hellman-group18-sha512 1037.It 1038diffie-hellman-group-exchange-sha1 1039.It 1040diffie-hellman-group-exchange-sha256 1041.It 1042ecdh-sha2-nistp256 1043.It 1044ecdh-sha2-nistp384 1045.It 1046ecdh-sha2-nistp521 1047.It 1048sntrup761x25519-sha512@openssh.com 1049.El 1050.Pp 1051The default is: 1052.Bd -literal -offset indent 1053sntrup761x25519-sha512@openssh.com, 1054curve25519-sha256,curve25519-sha256@libssh.org, 1055ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, 1056diffie-hellman-group-exchange-sha256, 1057diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, 1058diffie-hellman-group14-sha256 1059.Ed 1060.Pp 1061The list of available key exchange algorithms may also be obtained using 1062.Qq ssh -Q KexAlgorithms . 1063.It Cm ListenAddress 1064Specifies the local addresses 1065.Xr sshd 8 1066should listen on. 1067The following forms may be used: 1068.Pp 1069.Bl -item -offset indent -compact 1070.It 1071.Cm ListenAddress 1072.Sm off 1073.Ar hostname | address 1074.Sm on 1075.Op Cm rdomain Ar domain 1076.It 1077.Cm ListenAddress 1078.Sm off 1079.Ar hostname : port 1080.Sm on 1081.Op Cm rdomain Ar domain 1082.It 1083.Cm ListenAddress 1084.Sm off 1085.Ar IPv4_address : port 1086.Sm on 1087.Op Cm rdomain Ar domain 1088.It 1089.Cm ListenAddress 1090.Sm off 1091.Oo Ar hostname | address Oc : Ar port 1092.Sm on 1093.Op Cm rdomain Ar domain 1094.El 1095.Pp 1096The optional 1097.Cm rdomain 1098qualifier requests 1099.Xr sshd 8 1100listen in an explicit routing domain. 1101If 1102.Ar port 1103is not specified, 1104sshd will listen on the address and all 1105.Cm Port 1106options specified. 1107The default is to listen on all local addresses on the current default 1108routing domain. 1109Multiple 1110.Cm ListenAddress 1111options are permitted. 1112For more information on routing domains, see 1113.Xr rdomain 4 . 1114.It Cm LoginGraceTime 1115The server disconnects after this time if the user has not 1116successfully logged in. 1117If the value is 0, there is no time limit. 1118The default is 120 seconds. 1119.It Cm LogLevel 1120Gives the verbosity level that is used when logging messages from 1121.Xr sshd 8 . 1122The possible values are: 1123QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. 1124The default is INFO. 1125DEBUG and DEBUG1 are equivalent. 1126DEBUG2 and DEBUG3 each specify higher levels of debugging output. 1127Logging with a DEBUG level violates the privacy of users and is not recommended. 1128.It Cm LogVerbose 1129Specify one or more overrides to 1130.Cm LogLevel . 1131An override consists of a pattern lists that matches the source file, function 1132and line number to force detailed logging for. 1133For example, an override pattern of: 1134.Bd -literal -offset indent 1135kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1136.Ed 1137.Pp 1138would enable detailed logging for line 1000 of 1139.Pa kex.c , 1140everything in the 1141.Fn kex_exchange_identification 1142function, and all code in the 1143.Pa packet.c 1144file. 1145This option is intended for debugging and no overrides are enabled by default. 1146.It Cm MACs 1147Specifies the available MAC (message authentication code) algorithms. 1148The MAC algorithm is used for data integrity protection. 1149Multiple algorithms must be comma-separated. 1150If the specified list begins with a 1151.Sq + 1152character, then the specified algorithms will be appended to the default set 1153instead of replacing them. 1154If the specified list begins with a 1155.Sq - 1156character, then the specified algorithms (including wildcards) will be removed 1157from the default set instead of replacing them. 1158If the specified list begins with a 1159.Sq ^ 1160character, then the specified algorithms will be placed at the head of the 1161default set. 1162.Pp 1163The algorithms that contain 1164.Qq -etm 1165calculate the MAC after encryption (encrypt-then-mac). 1166These are considered safer and their use recommended. 1167The supported MACs are: 1168.Pp 1169.Bl -item -compact -offset indent 1170.It 1171hmac-md5 1172.It 1173hmac-md5-96 1174.It 1175hmac-sha1 1176.It 1177hmac-sha1-96 1178.It 1179hmac-sha2-256 1180.It 1181hmac-sha2-512 1182.It 1183umac-64@openssh.com 1184.It 1185umac-128@openssh.com 1186.It 1187hmac-md5-etm@openssh.com 1188.It 1189hmac-md5-96-etm@openssh.com 1190.It 1191hmac-sha1-etm@openssh.com 1192.It 1193hmac-sha1-96-etm@openssh.com 1194.It 1195hmac-sha2-256-etm@openssh.com 1196.It 1197hmac-sha2-512-etm@openssh.com 1198.It 1199umac-64-etm@openssh.com 1200.It 1201umac-128-etm@openssh.com 1202.El 1203.Pp 1204The default is: 1205.Bd -literal -offset indent 1206umac-64-etm@openssh.com,umac-128-etm@openssh.com, 1207hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, 1208hmac-sha1-etm@openssh.com, 1209umac-64@openssh.com,umac-128@openssh.com, 1210hmac-sha2-256,hmac-sha2-512,hmac-sha1 1211.Ed 1212.Pp 1213The list of available MAC algorithms may also be obtained using 1214.Qq ssh -Q mac . 1215.It Cm Match 1216Introduces a conditional block. 1217If all of the criteria on the 1218.Cm Match 1219line are satisfied, the keywords on the following lines override those 1220set in the global section of the config file, until either another 1221.Cm Match 1222line or the end of the file. 1223If a keyword appears in multiple 1224.Cm Match 1225blocks that are satisfied, only the first instance of the keyword is 1226applied. 1227.Pp 1228The arguments to 1229.Cm Match 1230are one or more criteria-pattern pairs or the single token 1231.Cm All 1232which matches all criteria. 1233The available criteria are 1234.Cm User , 1235.Cm Group , 1236.Cm Host , 1237.Cm LocalAddress , 1238.Cm LocalPort , 1239.Cm RDomain , 1240and 1241.Cm Address 1242(with 1243.Cm RDomain 1244representing the 1245.Xr rdomain 4 1246on which the connection was received). 1247.Pp 1248The match patterns may consist of single entries or comma-separated 1249lists and may use the wildcard and negation operators described in the 1250.Sx PATTERNS 1251section of 1252.Xr ssh_config 5 . 1253.Pp 1254The patterns in an 1255.Cm Address 1256criteria may additionally contain addresses to match in CIDR 1257address/masklen format, 1258such as 192.0.2.0/24 or 2001:db8::/32. 1259Note that the mask length provided must be consistent with the address - 1260it is an error to specify a mask length that is too long for the address 1261or one with bits set in this host portion of the address. 1262For example, 192.0.2.0/33 and 192.0.2.0/8, respectively. 1263.Pp 1264Only a subset of keywords may be used on the lines following a 1265.Cm Match 1266keyword. 1267Available keywords are 1268.Cm AcceptEnv , 1269.Cm AllowAgentForwarding , 1270.Cm AllowGroups , 1271.Cm AllowStreamLocalForwarding , 1272.Cm AllowTcpForwarding , 1273.Cm AllowUsers , 1274.Cm AuthenticationMethods , 1275.Cm AuthorizedKeysCommand , 1276.Cm AuthorizedKeysCommandUser , 1277.Cm AuthorizedKeysFile , 1278.Cm AuthorizedPrincipalsCommand , 1279.Cm AuthorizedPrincipalsCommandUser , 1280.Cm AuthorizedPrincipalsFile , 1281.Cm Banner , 1282.Cm CASignatureAlgorithms , 1283.Cm ChannelTimeout , 1284.Cm ChrootDirectory , 1285.Cm ClientAliveCountMax , 1286.Cm ClientAliveInterval , 1287.Cm DenyGroups , 1288.Cm DenyUsers , 1289.Cm DisableForwarding , 1290.Cm ExposeAuthInfo , 1291.Cm ForceCommand , 1292.Cm GatewayPorts , 1293.Cm GSSAPIAuthentication , 1294.Cm HostbasedAcceptedAlgorithms , 1295.Cm HostbasedAuthentication , 1296.Cm HostbasedUsesNameFromPacketOnly , 1297.Cm IgnoreRhosts , 1298.Cm Include , 1299.Cm IPQoS , 1300.Cm KbdInteractiveAuthentication , 1301.Cm KerberosAuthentication , 1302.Cm LogLevel , 1303.Cm MaxAuthTries , 1304.Cm MaxSessions , 1305.Cm PasswordAuthentication , 1306.Cm PermitEmptyPasswords , 1307.Cm PermitListen , 1308.Cm PermitOpen , 1309.Cm PermitRootLogin , 1310.Cm PermitTTY , 1311.Cm PermitTunnel , 1312.Cm PermitUserRC , 1313.Cm PubkeyAcceptedAlgorithms , 1314.Cm PubkeyAuthentication , 1315.Cm PubkeyAuthOptions , 1316.Cm RekeyLimit , 1317.Cm RevokedKeys , 1318.Cm RDomain , 1319.Cm SetEnv , 1320.Cm StreamLocalBindMask , 1321.Cm StreamLocalBindUnlink , 1322.Cm TrustedUserCAKeys , 1323.Cm UnusedConnectionTimeout , 1324.Cm X11DisplayOffset , 1325.Cm X11Forwarding 1326and 1327.Cm X11UseLocalhost . 1328.It Cm MaxAuthTries 1329Specifies the maximum number of authentication attempts permitted per 1330connection. 1331Once the number of failures reaches half this value, 1332additional failures are logged. 1333The default is 6. 1334.It Cm MaxSessions 1335Specifies the maximum number of open shell, login or subsystem (e.g. sftp) 1336sessions permitted per network connection. 1337Multiple sessions may be established by clients that support connection 1338multiplexing. 1339Setting 1340.Cm MaxSessions 1341to 1 will effectively disable session multiplexing, whereas setting it to 0 1342will prevent all shell, login and subsystem sessions while still permitting 1343forwarding. 1344The default is 10. 1345.It Cm MaxStartups 1346Specifies the maximum number of concurrent unauthenticated connections to the 1347SSH daemon. 1348Additional connections will be dropped until authentication succeeds or the 1349.Cm LoginGraceTime 1350expires for a connection. 1351The default is 10:30:100. 1352.Pp 1353Alternatively, random early drop can be enabled by specifying 1354the three colon separated values 1355start:rate:full (e.g. "10:30:60"). 1356.Xr sshd 8 1357will refuse connection attempts with a probability of rate/100 (30%) 1358if there are currently start (10) unauthenticated connections. 1359The probability increases linearly and all connection attempts 1360are refused if the number of unauthenticated connections reaches full (60). 1361.It Cm ModuliFile 1362Specifies the 1363.Xr moduli 5 1364file that contains the Diffie-Hellman groups used for the 1365.Dq diffie-hellman-group-exchange-sha1 1366and 1367.Dq diffie-hellman-group-exchange-sha256 1368key exchange methods. 1369The default is 1370.Pa /etc/moduli . 1371.It Cm PasswordAuthentication 1372Specifies whether password authentication is allowed. 1373Note that passwords may also be accepted via 1374.Cm KbdInteractiveAuthentication . 1375See also 1376.Cm UsePAM . 1377The default is 1378.Cm no . 1379.It Cm PermitEmptyPasswords 1380When password authentication is allowed, it specifies whether the 1381server allows login to accounts with empty password strings. 1382The default is 1383.Cm no . 1384.It Cm PermitListen 1385Specifies the addresses/ports on which a remote TCP port forwarding may listen. 1386The listen specification must be one of the following forms: 1387.Pp 1388.Bl -item -offset indent -compact 1389.It 1390.Cm PermitListen 1391.Sm off 1392.Ar port 1393.Sm on 1394.It 1395.Cm PermitListen 1396.Sm off 1397.Ar host : port 1398.Sm on 1399.El 1400.Pp 1401Multiple permissions may be specified by separating them with whitespace. 1402An argument of 1403.Cm any 1404can be used to remove all restrictions and permit any listen requests. 1405An argument of 1406.Cm none 1407can be used to prohibit all listen requests. 1408The host name may contain wildcards as described in the PATTERNS section in 1409.Xr ssh_config 5 . 1410The wildcard 1411.Sq * 1412can also be used in place of a port number to allow all ports. 1413By default all port forwarding listen requests are permitted. 1414Note that the 1415.Cm GatewayPorts 1416option may further restrict which addresses may be listened on. 1417Note also that 1418.Xr ssh 1 1419will request a listen host of 1420.Dq localhost 1421if no listen host was specifically requested, and this name is 1422treated differently to explicit localhost addresses of 1423.Dq 127.0.0.1 1424and 1425.Dq ::1 . 1426.It Cm PermitOpen 1427Specifies the destinations to which TCP port forwarding is permitted. 1428The forwarding specification must be one of the following forms: 1429.Pp 1430.Bl -item -offset indent -compact 1431.It 1432.Cm PermitOpen 1433.Sm off 1434.Ar host : port 1435.Sm on 1436.It 1437.Cm PermitOpen 1438.Sm off 1439.Ar IPv4_addr : port 1440.Sm on 1441.It 1442.Cm PermitOpen 1443.Sm off 1444.Ar \&[ IPv6_addr \&] : port 1445.Sm on 1446.El 1447.Pp 1448Multiple forwards may be specified by separating them with whitespace. 1449An argument of 1450.Cm any 1451can be used to remove all restrictions and permit any forwarding requests. 1452An argument of 1453.Cm none 1454can be used to prohibit all forwarding requests. 1455The wildcard 1456.Sq * 1457can be used for host or port to allow all hosts or ports respectively. 1458Otherwise, no pattern matching or address lookups are performed on supplied 1459names. 1460By default all port forwarding requests are permitted. 1461.It Cm PermitRootLogin 1462Specifies whether root can log in using 1463.Xr ssh 1 . 1464The argument must be 1465.Cm yes , 1466.Cm prohibit-password , 1467.Cm forced-commands-only , 1468or 1469.Cm no . 1470The default is 1471.Cm no . 1472Note that if 1473.Cm ChallengeResponseAuthentication 1474and 1475.Cm UsePAM 1476are both 1477.Cm yes , 1478this setting may be overridden by the PAM policy. 1479.Pp 1480If this option is set to 1481.Cm prohibit-password 1482(or its deprecated alias, 1483.Cm without-password ) , 1484password and keyboard-interactive authentication are disabled for root. 1485.Pp 1486If this option is set to 1487.Cm forced-commands-only , 1488root login with public key authentication will be allowed, 1489but only if the 1490.Ar command 1491option has been specified 1492(which may be useful for taking remote backups even if root login is 1493normally not allowed). 1494All other authentication methods are disabled for root. 1495.Pp 1496If this option is set to 1497.Cm no , 1498root is not allowed to log in. 1499.It Cm PermitTTY 1500Specifies whether 1501.Xr pty 4 1502allocation is permitted. 1503The default is 1504.Cm yes . 1505.It Cm PermitTunnel 1506Specifies whether 1507.Xr tun 4 1508device forwarding is allowed. 1509The argument must be 1510.Cm yes , 1511.Cm point-to-point 1512(layer 3), 1513.Cm ethernet 1514(layer 2), or 1515.Cm no . 1516Specifying 1517.Cm yes 1518permits both 1519.Cm point-to-point 1520and 1521.Cm ethernet . 1522The default is 1523.Cm no . 1524.Pp 1525Independent of this setting, the permissions of the selected 1526.Xr tun 4 1527device must allow access to the user. 1528.It Cm PermitUserEnvironment 1529Specifies whether 1530.Pa ~/.ssh/environment 1531and 1532.Cm environment= 1533options in 1534.Pa ~/.ssh/authorized_keys 1535are processed by 1536.Xr sshd 8 . 1537Valid options are 1538.Cm yes , 1539.Cm no 1540or a pattern-list specifying which environment variable names to accept 1541(for example 1542.Qq LANG,LC_* ) . 1543The default is 1544.Cm no . 1545Enabling environment processing may enable users to bypass access 1546restrictions in some configurations using mechanisms such as 1547.Ev LD_PRELOAD . 1548.It Cm PermitUserRC 1549Specifies whether any 1550.Pa ~/.ssh/rc 1551file is executed. 1552The default is 1553.Cm yes . 1554.It Cm PerSourceMaxStartups 1555Specifies the number of unauthenticated connections allowed from a 1556given source address, or 1557.Dq none 1558if there is no limit. 1559This limit is applied in addition to 1560.Cm MaxStartups , 1561whichever is lower. 1562The default is 1563.Cm none . 1564.It Cm PerSourceNetBlockSize 1565Specifies the number of bits of source address that are grouped together 1566for the purposes of applying PerSourceMaxStartups limits. 1567Values for IPv4 and optionally IPv6 may be specified, separated by a colon. 1568The default is 1569.Cm 32:128 , 1570which means each address is considered individually. 1571.It Cm PidFile 1572Specifies the file that contains the process ID of the 1573SSH daemon, or 1574.Cm none 1575to not write one. 1576The default is 1577.Pa /var/run/sshd.pid . 1578.It Cm Port 1579Specifies the port number that 1580.Xr sshd 8 1581listens on. 1582The default is 22. 1583Multiple options of this type are permitted. 1584See also 1585.Cm ListenAddress . 1586.It Cm PrintLastLog 1587Specifies whether 1588.Xr sshd 8 1589should print the date and time of the last user login when a user logs 1590in interactively. 1591The default is 1592.Cm yes . 1593.It Cm PrintMotd 1594Specifies whether 1595.Xr sshd 8 1596should print 1597.Pa /etc/motd 1598when a user logs in interactively. 1599(On some systems it is also printed by the shell, 1600.Pa /etc/profile , 1601or equivalent.) 1602The default is 1603.Cm yes . 1604.It Cm PubkeyAcceptedAlgorithms 1605Specifies the signature algorithms that will be accepted for public key 1606authentication as a list of comma-separated patterns. 1607Alternately if the specified list begins with a 1608.Sq + 1609character, then the specified algorithms will be appended to the default set 1610instead of replacing them. 1611If the specified list begins with a 1612.Sq - 1613character, then the specified algorithms (including wildcards) will be removed 1614from the default set instead of replacing them. 1615If the specified list begins with a 1616.Sq ^ 1617character, then the specified algorithms will be placed at the head of the 1618default set. 1619The default for this option is: 1620.Bd -literal -offset 3n 1621ssh-ed25519-cert-v01@openssh.com, 1622ecdsa-sha2-nistp256-cert-v01@openssh.com, 1623ecdsa-sha2-nistp384-cert-v01@openssh.com, 1624ecdsa-sha2-nistp521-cert-v01@openssh.com, 1625sk-ssh-ed25519-cert-v01@openssh.com, 1626sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, 1627rsa-sha2-512-cert-v01@openssh.com, 1628rsa-sha2-256-cert-v01@openssh.com, 1629ssh-ed25519, 1630ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, 1631sk-ssh-ed25519@openssh.com, 1632sk-ecdsa-sha2-nistp256@openssh.com, 1633rsa-sha2-512,rsa-sha2-256 1634.Ed 1635.Pp 1636The list of available signature algorithms may also be obtained using 1637.Qq ssh -Q PubkeyAcceptedAlgorithms . 1638.It Cm PubkeyAuthOptions 1639Sets one or more public key authentication options. 1640The supported keywords are: 1641.Cm none 1642(the default; indicating no additional options are enabled), 1643.Cm touch-required 1644and 1645.Cm verify-required . 1646.Pp 1647The 1648.Cm touch-required 1649option causes public key authentication using a FIDO authenticator algorithm 1650(i.e.\& 1651.Cm ecdsa-sk 1652or 1653.Cm ed25519-sk ) 1654to always require the signature to attest that a physically present user 1655explicitly confirmed the authentication (usually by touching the authenticator). 1656By default, 1657.Xr sshd 8 1658requires user presence unless overridden with an authorized_keys option. 1659The 1660.Cm touch-required 1661flag disables this override. 1662.Pp 1663The 1664.Cm verify-required 1665option requires a FIDO key signature attest that the user was verified, 1666e.g. via a PIN. 1667.Pp 1668Neither the 1669.Cm touch-required 1670or 1671.Cm verify-required 1672options have any effect for other, non-FIDO, public key types. 1673.It Cm PubkeyAuthentication 1674Specifies whether public key authentication is allowed. 1675The default is 1676.Cm yes . 1677.It Cm RekeyLimit 1678Specifies the maximum amount of data that may be transmitted or received 1679before the session key is renegotiated, optionally followed by a maximum 1680amount of time that may pass before the session key is renegotiated. 1681The first argument is specified in bytes and may have a suffix of 1682.Sq K , 1683.Sq M , 1684or 1685.Sq G 1686to indicate Kilobytes, Megabytes, or Gigabytes, respectively. 1687The default is between 1688.Sq 1G 1689and 1690.Sq 4G , 1691depending on the cipher. 1692The optional second value is specified in seconds and may use any of the 1693units documented in the 1694.Sx TIME FORMATS 1695section. 1696The default value for 1697.Cm RekeyLimit 1698is 1699.Cm default none , 1700which means that rekeying is performed after the cipher's default amount 1701of data has been sent or received and no time based rekeying is done. 1702.It Cm RequiredRSASize 1703Specifies the minimum RSA key size (in bits) that 1704.Xr sshd 8 1705will accept. 1706User and host-based authentication keys smaller than this limit will be 1707refused. 1708The default is 1709.Cm 1024 1710bits. 1711Note that this limit may only be raised from the default. 1712.It Cm RevokedKeys 1713Specifies revoked public keys file, or 1714.Cm none 1715to not use one. 1716Keys listed in this file will be refused for public key authentication. 1717Note that if this file is not readable, then public key authentication will 1718be refused for all users. 1719Keys may be specified as a text file, listing one public key per line, or as 1720an OpenSSH Key Revocation List (KRL) as generated by 1721.Xr ssh-keygen 1 . 1722For more information on KRLs, see the KEY REVOCATION LISTS section in 1723.Xr ssh-keygen 1 . 1724.It Cm RDomain 1725Specifies an explicit routing domain that is applied after authentication 1726has completed. 1727The user session, as well as any forwarded or listening IP sockets, 1728will be bound to this 1729.Xr rdomain 4 . 1730If the routing domain is set to 1731.Cm \&%D , 1732then the domain in which the incoming connection was received will be applied. 1733.It Cm SecurityKeyProvider 1734Specifies a path to a library that will be used when loading 1735FIDO authenticator-hosted keys, overriding the default of using 1736the built-in USB HID support. 1737.It Cm SetEnv 1738Specifies one or more environment variables to set in child sessions started 1739by 1740.Xr sshd 8 1741as 1742.Dq NAME=VALUE . 1743The environment value may be quoted (e.g. if it contains whitespace 1744characters). 1745Environment variables set by 1746.Cm SetEnv 1747override the default environment and any variables specified by the user 1748via 1749.Cm AcceptEnv 1750or 1751.Cm PermitUserEnvironment . 1752.It Cm StreamLocalBindMask 1753Sets the octal file creation mode mask 1754.Pq umask 1755used when creating a Unix-domain socket file for local or remote 1756port forwarding. 1757This option is only used for port forwarding to a Unix-domain socket file. 1758.Pp 1759The default value is 0177, which creates a Unix-domain socket file that is 1760readable and writable only by the owner. 1761Note that not all operating systems honor the file mode on Unix-domain 1762socket files. 1763.It Cm StreamLocalBindUnlink 1764Specifies whether to remove an existing Unix-domain socket file for local 1765or remote port forwarding before creating a new one. 1766If the socket file already exists and 1767.Cm StreamLocalBindUnlink 1768is not enabled, 1769.Nm sshd 1770will be unable to forward the port to the Unix-domain socket file. 1771This option is only used for port forwarding to a Unix-domain socket file. 1772.Pp 1773The argument must be 1774.Cm yes 1775or 1776.Cm no . 1777The default is 1778.Cm no . 1779.It Cm StrictModes 1780Specifies whether 1781.Xr sshd 8 1782should check file modes and ownership of the 1783user's files and home directory before accepting login. 1784This is normally desirable because novices sometimes accidentally leave their 1785directory or files world-writable. 1786The default is 1787.Cm yes . 1788Note that this does not apply to 1789.Cm ChrootDirectory , 1790whose permissions and ownership are checked unconditionally. 1791.It Cm Subsystem 1792Configures an external subsystem (e.g. file transfer daemon). 1793Arguments should be a subsystem name and a command (with optional arguments) 1794to execute upon subsystem request. 1795.Pp 1796The command 1797.Cm sftp-server 1798implements the SFTP file transfer subsystem. 1799.Pp 1800Alternately the name 1801.Cm internal-sftp 1802implements an in-process SFTP server. 1803This may simplify configurations using 1804.Cm ChrootDirectory 1805to force a different filesystem root on clients. 1806It accepts the same command line arguments as 1807.Cm sftp-server 1808and even though it is in-process, settings such as 1809.Cm LogLevel 1810or 1811.Cm SyslogFacility 1812do not apply to it and must be set explicitly via 1813command line arguments. 1814.Pp 1815By default no subsystems are defined. 1816.It Cm SyslogFacility 1817Gives the facility code that is used when logging messages from 1818.Xr sshd 8 . 1819The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, 1820LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. 1821The default is AUTH. 1822.It Cm TCPKeepAlive 1823Specifies whether the system should send TCP keepalive messages to the 1824other side. 1825If they are sent, death of the connection or crash of one 1826of the machines will be properly noticed. 1827However, this means that 1828connections will die if the route is down temporarily, and some people 1829find it annoying. 1830On the other hand, if TCP keepalives are not sent, 1831sessions may hang indefinitely on the server, leaving 1832.Qq ghost 1833users and consuming server resources. 1834.Pp 1835The default is 1836.Cm yes 1837(to send TCP keepalive messages), and the server will notice 1838if the network goes down or the client host crashes. 1839This avoids infinitely hanging sessions. 1840.Pp 1841To disable TCP keepalive messages, the value should be set to 1842.Cm no . 1843.It Cm TrustedUserCAKeys 1844Specifies a file containing public keys of certificate authorities that are 1845trusted to sign user certificates for authentication, or 1846.Cm none 1847to not use one. 1848Keys are listed one per line; empty lines and comments starting with 1849.Ql # 1850are allowed. 1851If a certificate is presented for authentication and has its signing CA key 1852listed in this file, then it may be used for authentication for any user 1853listed in the certificate's principals list. 1854Note that certificates that lack a list of principals will not be permitted 1855for authentication using 1856.Cm TrustedUserCAKeys . 1857For more details on certificates, see the CERTIFICATES section in 1858.Xr ssh-keygen 1 . 1859.It Cm UnusedConnectionTimeout 1860Specifies whether and how quickly 1861.Xr sshd 8 1862should close client connections with no open channels. 1863Open channels include active shell, command execution or subsystem 1864sessions, connected network, socket, agent or X11 forwardings. 1865Forwarding listeners, such as those from the 1866.Xr ssh 1 1867.Fl R 1868flag, are not considered as open channels and do not prevent the timeout. 1869The timeout value 1870is specified in seconds or may use any of the units documented in the 1871.Sx TIME FORMATS 1872section. 1873.Pp 1874Note that this timeout starts when the client connection completes 1875user authentication but before the client has an opportunity to open any 1876channels. 1877Caution should be used when using short timeout values, as they may not 1878provide sufficient time for the client to request and open its channels 1879before terminating the connection. 1880.Pp 1881The default 1882.Cm none 1883is to never expire connections for having no open channels. 1884This option may be useful in conjunction with 1885.Cm ChannelTimeout . 1886.It Cm UseBlacklist 1887Specifies whether 1888.Xr sshd 8 1889attempts to send authentication success and failure messages 1890to the 1891.Xr blacklistd 8 1892daemon. 1893The default is 1894.Cm no . 1895For forward compatibility with an upcoming 1896.Xr blacklistd 1897rename, the 1898.Cm UseBlocklist 1899alias can be used instead. 1900.It Cm UseDNS 1901Specifies whether 1902.Xr sshd 8 1903should look up the remote host name, and to check that 1904the resolved host name for the remote IP address maps back to the 1905very same IP address. 1906.Pp 1907If this option is set to 1908.Cm no , 1909then only addresses and not host names may be used in 1910.Pa ~/.ssh/authorized_keys 1911.Cm from 1912and 1913.Nm 1914.Cm Match 1915.Cm Host 1916directives. 1917The default is 1918.Dq yes . 1919.It Cm UsePAM 1920Enables the Pluggable Authentication Module interface. 1921If set to 1922.Cm yes 1923this will enable PAM authentication using 1924.Cm KbdInteractiveAuthentication 1925and 1926.Cm PasswordAuthentication 1927in addition to PAM account and session module processing for all 1928authentication types. 1929.Pp 1930Because PAM keyboard-interactive authentication usually serves an equivalent 1931role to password authentication, you should disable either 1932.Cm PasswordAuthentication 1933or 1934.Cm KbdInteractiveAuthentication . 1935.Pp 1936If 1937.Cm UsePAM 1938is enabled, you will not be able to run 1939.Xr sshd 8 1940as a non-root user. 1941The default is 1942.Cm yes . 1943.It Cm VersionAddendum 1944Optionally specifies additional text to append to the SSH protocol banner 1945sent by the server upon connection. 1946The default is 1947.Qq FreeBSD-20240318 . 1948The value 1949.Cm none 1950may be used to disable this. 1951.It Cm X11DisplayOffset 1952Specifies the first display number available for 1953.Xr sshd 8 Ns 's 1954X11 forwarding. 1955This prevents sshd from interfering with real X11 servers. 1956The default is 10. 1957.It Cm X11Forwarding 1958Specifies whether X11 forwarding is permitted. 1959The argument must be 1960.Cm yes 1961or 1962.Cm no . 1963The default is 1964.Cm no . 1965.Pp 1966When X11 forwarding is enabled, there may be additional exposure to 1967the server and to client displays if the 1968.Xr sshd 8 1969proxy display is configured to listen on the wildcard address (see 1970.Cm X11UseLocalhost ) , 1971though this is not the default. 1972Additionally, the authentication spoofing and authentication data 1973verification and substitution occur on the client side. 1974The security risk of using X11 forwarding is that the client's X11 1975display server may be exposed to attack when the SSH client requests 1976forwarding (see the warnings for 1977.Cm ForwardX11 1978in 1979.Xr ssh_config 5 ) . 1980A system administrator may have a stance in which they want to 1981protect clients that may expose themselves to attack by unwittingly 1982requesting X11 forwarding, which can warrant a 1983.Cm no 1984setting. 1985.Pp 1986Note that disabling X11 forwarding does not prevent users from 1987forwarding X11 traffic, as users can always install their own forwarders. 1988.It Cm X11UseLocalhost 1989Specifies whether 1990.Xr sshd 8 1991should bind the X11 forwarding server to the loopback address or to 1992the wildcard address. 1993By default, 1994sshd binds the forwarding server to the loopback address and sets the 1995hostname part of the 1996.Ev DISPLAY 1997environment variable to 1998.Cm localhost . 1999This prevents remote hosts from connecting to the proxy display. 2000However, some older X11 clients may not function with this 2001configuration. 2002.Cm X11UseLocalhost 2003may be set to 2004.Cm no 2005to specify that the forwarding server should be bound to the wildcard 2006address. 2007The argument must be 2008.Cm yes 2009or 2010.Cm no . 2011The default is 2012.Cm yes . 2013.It Cm XAuthLocation 2014Specifies the full pathname of the 2015.Xr xauth 1 2016program, or 2017.Cm none 2018to not use one. 2019The default is 2020.Pa /usr/local/bin/xauth . 2021.El 2022.Sh TIME FORMATS 2023.Xr sshd 8 2024command-line arguments and configuration file options that specify time 2025may be expressed using a sequence of the form: 2026.Sm off 2027.Ar time Op Ar qualifier , 2028.Sm on 2029where 2030.Ar time 2031is a positive integer value and 2032.Ar qualifier 2033is one of the following: 2034.Pp 2035.Bl -tag -width Ds -compact -offset indent 2036.It Aq Cm none 2037seconds 2038.It Cm s | Cm S 2039seconds 2040.It Cm m | Cm M 2041minutes 2042.It Cm h | Cm H 2043hours 2044.It Cm d | Cm D 2045days 2046.It Cm w | Cm W 2047weeks 2048.El 2049.Pp 2050Each member of the sequence is added together to calculate 2051the total time value. 2052.Pp 2053Time format examples: 2054.Pp 2055.Bl -tag -width Ds -compact -offset indent 2056.It 600 2057600 seconds (10 minutes) 2058.It 10m 205910 minutes 2060.It 1h30m 20611 hour 30 minutes (90 minutes) 2062.El 2063.Sh TOKENS 2064Arguments to some keywords can make use of tokens, 2065which are expanded at runtime: 2066.Pp 2067.Bl -tag -width XXXX -offset indent -compact 2068.It %% 2069A literal 2070.Sq % . 2071.It \&%C 2072Identifies the connection endpoints, containing 2073four space-separated values: client address, client port number, 2074server address, and server port number. 2075.It \&%D 2076The routing domain in which the incoming connection was received. 2077.It %F 2078The fingerprint of the CA key. 2079.It %f 2080The fingerprint of the key or certificate. 2081.It %h 2082The home directory of the user. 2083.It %i 2084The key ID in the certificate. 2085.It %K 2086The base64-encoded CA key. 2087.It %k 2088The base64-encoded key or certificate for authentication. 2089.It %s 2090The serial number of the certificate. 2091.It \&%T 2092The type of the CA key. 2093.It %t 2094The key or certificate type. 2095.It \&%U 2096The numeric user ID of the target user. 2097.It %u 2098The username. 2099.El 2100.Pp 2101.Cm AuthorizedKeysCommand 2102accepts the tokens %%, %C, %D, %f, %h, %k, %t, %U, and %u. 2103.Pp 2104.Cm AuthorizedKeysFile 2105accepts the tokens %%, %h, %U, and %u. 2106.Pp 2107.Cm AuthorizedPrincipalsCommand 2108accepts the tokens %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U, and %u. 2109.Pp 2110.Cm AuthorizedPrincipalsFile 2111accepts the tokens %%, %h, %U, and %u. 2112.Pp 2113.Cm ChrootDirectory 2114accepts the tokens %%, %h, %U, and %u. 2115.Pp 2116.Cm RoutingDomain 2117accepts the token %D. 2118.Sh FILES 2119.Bl -tag -width Ds 2120.It Pa /etc/ssh/sshd_config 2121Contains configuration data for 2122.Xr sshd 8 . 2123This file should be writable by root only, but it is recommended 2124(though not necessary) that it be world-readable. 2125.El 2126.Sh SEE ALSO 2127.Xr sftp-server 8 , 2128.Xr sshd 8 2129.Sh AUTHORS 2130.An -nosplit 2131OpenSSH is a derivative of the original and free 2132ssh 1.2.12 release by 2133.An Tatu Ylonen . 2134.An Aaron Campbell , Bob Beck , Markus Friedl , Niels Provos , 2135.An Theo de Raadt 2136and 2137.An Dug Song 2138removed many bugs, re-added newer features and 2139created OpenSSH. 2140.An Markus Friedl 2141contributed the support for SSH protocol versions 1.5 and 2.0. 2142.An Niels Provos 2143and 2144.An Markus Friedl 2145contributed support for privilege separation. 2146