SSHD_CONFIG(5) File Formats Manual SSHD_CONFIG(5) sshd_config - OpenSSH sshd(8) /etc/ssh/sshd_config ( -f ). ( ) . . `#' . (") . ( ): AcceptEnv environ(7). SendEnv SetEnv ssh_config(5) . TERM (pseudo-terminal) . (wildcard) `*' `?'. AcceptEnv. . . . AddressFamily (address family) sshd(8). any () inet ( IPv4 ) inet6 ( IPv6 only). AllowAgentForwarding ssh-agent(1) . yes. (shell) . AllowGroups . . (GID). . AllowGroups DenyGroups. PATTERNS ssh_config(5) . sshd_config . AllowStreamLocalForwarding StreamLocal ( Unix- domain socket) . yes () all StreamLocal no StreamLocal local ( ssh(1)) remote . StreamLocal (shell) . AllowTcpForwarding TCP . yes () all TCP no TCP local ( ssh(1)) remote . TCP (shell) . AllowUsers . . (UID). . USER@HOST USER HOST . HOST CIDR (/ ). AllowUsers DenyUsers. PATTERNS ssh_config(5) . sshd_config . AuthenticationMethods . any . . "publickey,password publickey,keyboard-interactive" (keyboard-interactive). . bsdauth pam . "keyboard-interactive:bsdauth" bsdauth . (publickey) sshd(8) . "publickey,publickey" . . : "gssapi-with-mic" "hostbased" "keyboard-interactive" "none" ( PermitEmptyPasswords) "password" "publickey". AuthorizedKeysCommand . (root) . AuthorizedKeysCommand (tokens) TOKENS. . (standard output) authorized_keys ( AUTHORIZED_KEYS sshd(8)). AuthorizedKeysCommand AuthorizedKeysFile . AuthorizedKeysCommand. . AuthorizedKeysCommandUser AuthorizedKeysCommand . . AuthorizedKeysCommand AuthorizedKeysCommandUser sshd(8) . AuthorizedKeysFile . AUTHORIZED_KEYS FILE FORMAT sshd(8). AuthorizedKeysFile (wildcards) TOKENS. AuthorizedKeysFile . . none . ".ssh/authorized_keys .ssh/authorized_keys2". . AuthorizedPrincipalsCommand (principals) AuthorizedPrincipalsFile. (root) . AuthorizedPrincipalsCommand TOKENS. . AuthorizedPrincipalsFile. AuthorizedPrincipalsCommand AuthorizedPrincipalsFile . AuthorizedPrincipalsCommand. . AuthorizedPrincipalsCommandUser AuthorizedPrincipalsCommand . . AuthorizedPrincipalsCommand AuthorizedPrincipalsCommandUser sshd(8) . AuthorizedPrincipalsFile (principal names) . TrustedUserCAKeys . ( AUTHORIZED_KEYS FILE FORMAT sshd(8)). `#'. AuthorizedPrincipalsFile TOKENS. AuthorizedPrincipalsFile . none . . AuthorizedPrincipalsFile (CA) TrustedUserCAKeys ~/.ssh/authorized_keys principals= ( sshd(8) ). Banner . none (banner). . CASignatureAlgorithms (CAs). : ssh-ed25519,ecdsa-sha2-nistp256, ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256 `+' . `-' ( ) . . ChannelTimeout sshd(8) . "type=interval" "type" "global" . "interval" TIME FORMATS. "session=5m" . . "global" . . . : agent-connection ssh-agent(1). direct-tcpip, direct-streamlocal@openssh.com TCP Unix ( ) ssh(1) LocalForward DynamicForward. forwarded-tcpip, forwarded-streamlocal@openssh.com TCP Unix ( ) sshd(8) ssh(1) RemoteForward. session scp(1) sftp(1) . tun-connection TunnelForward. x11-connection X11. X11 . SSH . . . ChrootDirectory chroot(2) . sshd(8) (root) . chroot sshd(8) . ChrootDirectory TOKENS. ChrootDirectory . (shell) sh(1) /dev null(4) zero(4) stdin(4) stdout(4) stderr(4) tty(4). SFTP sftp (in-process) (logging) /dev/log chroot ( sftp-server(8) ). ( ). sshd(8) . none chroot(2). Ciphers (ciphers) . . `+' . `-' ( ) . `^' . : 3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com : chacha20-poly1305@openssh.com, aes128-gcm@openssh.com,aes256-gcm@openssh.com, aes128-ctr,aes192-ctr,aes256-ctr "ssh -Q cipher". ClientAliveCountMax (client alive messages) sshd(8) . sshd . TCPKeepAlive. (non-spoofable). TCP keepalive TCPKeepAlive . . 3. ClientAliveInterval 15 ClientAliveCountMax SSH 45 . ClientAliveCountMax . ClientAliveInterval sshd(8) . 0 . Compression . yes delayed ( yes) no. yes. DenyGroups . . . . AllowGroups DenyGroups. PATTERNS ssh_config(5) . sshd_config . DenyUsers . . . . USER@HOST USER HOST . HOST CIDR. AllowUsers DenyUsers. PATTERNS ssh_config(5) . sshd_config . DisableForwarding (forwarding) X11 ssh-agent(1) TCP StreamLocal. . ExposeAuthInfo ( ) . SSH_USER_AUTH. no. FingerprintHash (hash algorithm) . : md5 sha256. sha256. ForceCommand ForceCommand ~/.ssh/rc . -c. . Match. SSH_ORIGINAL_COMMAND. internal-sftp SFTP ChrootDirectory. none. TCP (agent) (socket) X11. DisableForwarding. GatewayPorts . sshd(8) (loopback address). . GatewayPorts sshd . no yes (wildcard address) clientspecified . no. GSSAPIAuthentication GSSAPI . no. GSSAPICleanupCredentials (credentials cache) . yes. GSSAPIDelegateCredentials (delegated credentials) . yes. GSSAPIStrictAcceptorCheck GSSAPI (GSSAPI acceptor) . yes . no . (multi-homed). yes. HostbasedAcceptedAlgorithms (hostbased authentication) . `+' . `-' ( ) . `^' . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256 "ssh -Q HostbasedAcceptedAlgorithms". HostbasedAcceptedKeyTypes. HostbasedAuthentication rhosts /etc/hosts.equiv ( ). no. HostbasedUsesNameFromPacketOnly (reverse name lookup) ~/.shosts ~/.rhosts /etc/hosts.equiv HostbasedAuthentication. yes sshd(8) (resolve) TCP . no. HostCertificate . HostKey. sshd(8) . HostKey SSH. /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key. sshd(8) / (group/world- accessible) HostKeyAlgorithms sshd(8). . . ssh-agent(1). HostKeyAgent (UNIX- domain socket) (agent) . "SSH_AUTH_SOCK" SSH_AUTH_SOCK. HostKeyAlgorithms . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256 "ssh -Q HostKeyAlgorithms". IgnoreRhosts .rhosts .shosts HostbasedAuthentication. /etc/hosts.equiv /etc/ssh/shosts.equiv . yes () shosts-only .shosts .rhosts no .shosts rhosts. IgnoreUserKnownHosts sshd(8) ~/.ssh/known_hosts HostbasedAuthentication /etc/ssh/ssh_known_hosts. "no". Include . glob(7) . /etc/ssh. Include Match . IPQoS Differentiated Services Field Codepoint (DSCP) . af11 af12 af13 af21 af22 af23 af31 af32 af33 af41 af42 af43 cs0 cs1 cs2 cs3 cs4 cs5 cs6 cs7 ef le none . . . . ef ( Expedited Forwarding) none ( ) . KbdInteractiveAuthentication (keyboard-interactive) . login.conf(5) . yes. yes no. ChallengeResponseAuthentication (deprecated) . KerberosAuthentication PasswordAuthentication (Kerberos KDC). servtab KDC. no. KerberosGetAFSToken (AFS) 5 (Kerberos 5 TGT) AFS (AFS token) . no. KerberosOrLocalPasswd /etc/passwd. yes. KerberosTicketCleanup (ticket cache file) . yes. KexAlgorithms (KEX) . . . `+' . `-' ( ) . `^' . : curve25519-sha256 curve25519-sha256@libssh.org diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 mlkem768x25519-sha256 sntrup761x25519-sha512 sntrup761x25519-sha512@openssh.com : mlkem768x25519-sha256, sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 "ssh -Q KexAlgorithms". ListenAddress (listen) sshd(8). : ListenAddress hostname|address [rdomain domain] ListenAddress hostname:port [rdomain domain] ListenAddress IPv4_address:port [rdomain domain] ListenAddress [hostname|address]:port [rdomain domain] rdomain sshd(8) (routing domain) . port sshd Port . . ListenAddress. rdomain(4). LoginGraceTime . 0 . 120 . LogLevel (verbosity level) sshd(8). : QUIET FATAL ERROR INFO VERBOSE DEBUG DEBUG1 DEBUG2 DEBUG3. INFO. DEBUG DEBUG1 . DEBUG2 DEBUG3 (debugging). DEBUG . LogVerbose (override) LogLevel. . : kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1000 kex.c kex_exchange_identification() packet.c. . MACs (MAC) . MAC (data integrity). . `+' . `-' ( ) . `^' . "-etm" MAC ( encrypt-then-mac). . MAC : hmac-md5 hmac-md5-96 hmac-sha1 hmac-sha1-96 hmac-sha2-256 hmac-sha2-512 umac-64@openssh.com umac-128@openssh.com hmac-md5-etm@openssh.com hmac-md5-96-etm@openssh.com hmac-sha1-etm@openssh.com hmac-sha1-96-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com umac-64-etm@openssh.com umac-128-etm@openssh.com : umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com,umac-128@openssh.com, hmac-sha2-256,hmac-sha2-512,hmac-sha1 MAC "ssh -Q mac". Match (conditional block). Match Match . Match . Match ( ) : All Invalid-User . User Group Host LocalAddress LocalPort Version RDomain Address ( RDomain rdomain(4) ). (negation) PATTERNS ssh_config(5). Address CIDR (/ ) 192.0.2.0/24 2001:db8::/32. . 192.0.2.0/33 192.0.2.0/8 . Version sshd(8) "OpenSSH_10.0". Match. : AcceptEnv AllowAgentForwarding AllowGroups AllowStreamLocalForwarding AllowTcpForwarding AllowUsers AuthenticationMethods AuthorizedKeysCommand AuthorizedKeysCommandUser AuthorizedKeysFile AuthorizedPrincipalsCommand AuthorizedPrincipalsCommandUser AuthorizedPrincipalsFile Banner CASignatureAlgorithms ChannelTimeout ChrootDirectory ClientAliveCountMax ClientAliveInterval DenyGroups DenyUsers DisableForwarding ExposeAuthInfo ForceCommand GatewayPorts GSSAPIAuthentication HostbasedAcceptedAlgorithms HostbasedAuthentication HostbasedUsesNameFromPacketOnly IgnoreRhosts Include IPQoS KbdInteractiveAuthentication KerberosAuthentication LogLevel MaxAuthTries MaxSessions PAMServiceName PasswordAuthentication PermitEmptyPasswords PermitListen PermitOpen PermitRootLogin PermitTTY PermitTunnel PermitUserRC PubkeyAcceptedAlgorithms PubkeyAuthentication PubkeyAuthOptions RefuseConnection RekeyLimit RevokedKeys RDomain SetEnv StreamLocalBindMask StreamLocalBindUnlink TrustedUserCAKeys UnusedConnectionTimeout X11DisplayOffset X11Forwarding X11UseLocalhost. MaxAuthTries . . 6. MaxSessions (shell) ( sftp) . (connection multiplexing). MaxSessions 1 0 . 10. MaxStartups SSH. (drop) LoginGraceTime . (random early drop) start:rate:full ( "10:30:60"). 10:30:100. sshd(8) rate/100 ( 30%) start ( 10) . full ( 60). ModuliFile moduli(5) - (Diffie-Hellman groups) "diffie-hellman-group-exchange-sha1" "diffie-hellman-group-exchange-sha256". /etc/ssh/moduli. PAMServiceName (PAM) UsePAM. sshd. PasswordAuthentication . yes. PermitEmptyPasswords . no. PermitListen / TCP . : PermitListen port PermitListen host:port . any . none . PATTERNS ssh_config(5). `*' . . GatewayPorts . ssh(1) "localhost" localhost "127.0.0.1" "::1". PermitOpen TCP . : PermitOpen host:port PermitOpen IPv4_addr:port PermitOpen [IPv6_addr]:port . any . none . `*' . . . PermitRootLogin (root) ssh(1). yes prohibit-password forced-commands-only no. prohibit-password. prohibit-password ( without-password) (root). forced-commands-only command ( ). . no . PermitTTY pty(4) . yes. PermitTunnel tun(4) . yes point-to-point ( 3) ethernet ( 2) no. yes point-to-point ethernet. no. tun(4) . PermitUserEnvironment ~/.ssh/environment environment= ~/.ssh/authorized_keys sshd(8). yes no ( "LANG,LC_*"). no. LD_PRELOAD. PermitUserRC ~/.ssh/rc . yes. PerSourceMaxStartups "none" . MaxStartups . none. PerSourceNetBlockSize PerSourceMaxStartups. IPv4 IPv6 . 32:128 . PerSourcePenalties sshd(8). PerSourceNetBlockSize . . . no. . : "crash:2m". crash:duration sshd(8) (: 90s). authfail:duration (: 5s). invaliduser:duration (: 5s). refuseconnection:duration RefuseConnection (: 10s). noauth:duration (: 1s). ssh-keyscan(1). grace-exceeded:duration LoginGraceTime (: 10s). max:duration (: 10m). . min:duration (: 15s). max-sources4:number, max-sources6:number IPv4 IPv6 (: 65536 ). overflow:mode max-sources4 max-sources6. : deny-all PerSourcePenaltyExemptList permissive (: permissive). min . IPv4 IPv6 . overflow6:mode IPv6. IPv4. PerSourcePenaltyExemptList . CIDR (address/masklen). - . 192.0.2.0/33 192.0.2.0/8 . . PidFile SSH none . /run/sshd.pid. Port sshd(8). 22. . ListenAddress. PrintLastLog sshd(8) . yes. PrintMotd sshd(8) /etc/motd . ( /etc/profile .) yes. PubkeyAcceptedAlgorithms . `+' . `-' ( ) . `^' . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256 "ssh -Q PubkeyAcceptedAlgorithms". PubkeyAuthOptions . : none ( ) touch-required verify-required. touch-required FIDO ( ecdsa-sk ed25519-sk) ( ). sshd(8) authorized_keys. touch-required . verify-required FIDO PIN. touch-required verify-required FIDO. PubkeyAuthentication . yes. RefuseConnection sshd(8) . refuseconnection PerSourcePenalties . Match. RekeyLimit . `K' `M' `G' . `1G' `4G' . TIME FORMATS. RekeyLimit default none . RequiredRSASize RSA () sshd(8). . 1024 . . RevokedKeys none . . . OpenSSH (KRL) ssh-keygen(1). sshd(8) . KRL KEY REVOCATION LISTS ssh-keygen(1). RDomain . IP rdomain(4) . %D . SecurityKeyProvider FIDO USB HID . SetEnv sshd(8) "NAME=VALUE". ( ). SetEnv AcceptEnv PermitUserEnvironment. SshdAuthPath sshd-auth . /usr/lib/ssh/sshd-auth. . SshdSessionPath sshd-session . /usr/lib/ssh/sshd-session. . StreamLocalBindMask (umask) . . 0177 - . -. StreamLocalBindUnlink Unix . StreamLocalBindUnlink sshd Unix. Unix. yes no. no. StrictModes sshd(8) . . yes. ChrootDirectory . Subsystem ( ). ( ) . sftp-server SFTP. internal-sftp SFTP . ChrootDirectory . sftp-server LogLevel SyslogFacility . . SyslogFacility sshd(8). : DAEMON USER AUTH LOCAL0 LOCAL1 LOCAL2 LOCAL3 LOCAL4 LOCAL5 LOCAL6 LOCAL7. AUTH. TCPKeepAlive TCP . . . TCP (ghost) . yes ( TCP) . . TCP no. TrustedUserCAKeys none . `#'. (CA) . TrustedUserCAKeys. CERTIFICATES ssh-keygen(1). UnusedConnectionTimeout sshd(8) . X11. -R ssh(1) . TIME FORMATS. . . none . ChannelTimeout. UseDNS sshd(8) IP IP . no () from ~/.ssh/authorized_keys Host Match sshd_config. UsePAM (PAM). yes PAM KbdInteractiveAuthentication PasswordAuthentication PAM . PAM PasswordAuthentication KbdInteractiveAuthentication. UsePAM sshd(8) . no. VersionAddendum SSH . none. X11DisplayOffset X11 sshd(8)'s. sshd X11 . 10. X11Forwarding X11 . yes no. no. X11 sshd(8) ( X11UseLocalhost) . . X11 X11 SSH ( ForwardX11 ssh_config(5)). X11 no. X11 X11 . X11UseLocalhost sshd(8) X11 (loopback) (wildcard). sshd DISPLAY localhost. . X11 . X11UseLocalhost no . yes no. yes. XAuthLocation xauth(1) none . /usr/bin/xauth. sshd(8) : time[qualifier] time qualifier : s | S m | M h | H d | D w | W . : 600 600 seconds (10 minutes) 10m 10 minutes 1h30m 1 hour 30 minutes (90 minutes) (TOKENS) (tokens) . . . sshd_config : %% `%' . %C : . %D . %F (CA). %f . %h . %i . %K (CA) base64. %k base64 . %s . %T (CA). %t . %U . %u . AuthorizedKeysCommand : %%, %C, %D, %f, %h, %k, %t, %U %u. AuthorizedKeysFile : %%, %h, %U %u. AuthorizedPrincipalsCommand : %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U %u. AuthorizedPrincipalsFile %%, %h, %U, %u. ChrootDirectory %%, %h, %U, %u. RoutingDomain %D. /etc/ssh/sshd_config sshd(8). (root) ( ) . sftp-server(8) sshd(8) OpenSSH ssh 1.2.12 Tatu Ylonen. Aaron Campbell Bob Beck Markus Friedl Niels Provos Theo de Raadt Dug Song OpenSSH. Markus Friedl SSH 1.5 2.0. Niels Provos Markus Friedl . 3: https://www.gnu.org/licenses/gpl-3.0.html . . : kde-l10n-ar@kde.org Linux 6.12.107+deb13-amd64 $Mdocdate: 28 2026 $ Linux 6.12.107+deb13-amd64