sshd_config

Listening TCP port; multiple Port directives are allowed. Ensure the firewall and clients permit the chosen port.

Port 2222

Local address on which sshd listens. An address can include a port; ensure it exists on the server.

ListenAddress 192.0.2.10

Select address family: any, inet for IPv4, or inet6 for IPv6.

AddressFamily inet

Path to a server private host key; this is not a user's authentication key. Protect the private file.

HostKey /etc/ssh/ssh_host_ed25519_key

Path to a server host certificate matching a configured host key.

HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub

Allow or deny password authentication. Verify another login method before disabling it.

PasswordAuthentication no

Allow or deny public key authentication. Server permissions and authorized keys still apply.

PubkeyAuthentication yes

Allow keyboard-interactive authentication. The prompts and available methods depend on the server and authentication backend.

KbdInteractiveAuthentication yes

Require one of the space-separated method lists; every comma-separated method in a list must succeed. Each method must also be enabled.

AuthenticationMethods publickey,keyboard-interactive

Control root login: yes, prohibit-password, forced-commands-only, or no. Test an alternative administrative login first.

PermitRootLogin no

Allow accounts with empty passwords to authenticate using password authentication. Enabling this is unsafe.

PermitEmptyPasswords no

Paths to files containing authorized public keys. Relative paths are resolved from the user's home directory; tokens are supported.

AuthorizedKeysFile .ssh/authorized_keys

Check ownership and permissions of user files and home directories before accepting login.

StrictModes yes

Allow only the listed user name patterns; USER@HOST patterns can constrain the origin. Account access is also subject to other restrictions.

AllowUsers alice bob

Deny matching user name patterns. Deny rules take precedence over corresponding allow rules.

DenyUsers guest

Allow only users in matching named groups, subject to other access rules.

AllowGroups sshusers

Deny users in matching named groups; group names, not numeric IDs, are used.

DenyGroups restricted

Control TCP forwarding: yes or all, no, local, or remote. This alone cannot prevent forwarding by users with unrestricted shell access.

AllowTcpForwarding local

Disable forwarding features, overriding other forwarding settings. This can break tunnels and agent or X11 forwarding.

DisableForwarding yes

Control remote forwarding bind addresses: no binds loopback, yes binds wildcard, and clientspecified permits client-selected addresses. Exposing ports has security implications.

GatewayPorts no

Restrict destinations for local TCP forwarding; use host:port entries, any, or none. Names are not resolved for matching.

PermitOpen db.example.com:5432

Restrict listening addresses and ports for remote forwarding; GatewayPorts also affects binding.

PermitListen localhost:18080

Allow SSH authentication-agent forwarding. A remote process with access to the agent socket can request signatures.

AllowAgentForwarding no

Control Unix-domain socket forwarding: yes or all, no, local, or remote.

AllowStreamLocalForwarding no

Enable X11 display forwarding. Enable only where needed and understand the remote display access risk.

X11Forwarding no

Maximum authentication attempts per connection before disconnecting. The server may log failures earlier.

MaxAuthTries 4

Maximum shell, login, or subsystem sessions per SSH connection. Setting zero prevents sessions but may still permit forwarding.

MaxSessions 10

Limit unauthenticated connections. The start:rate:full form progressively rejects connections under load.

MaxStartups 10:30:100

Time allowed for authentication; a duration of zero means no time limit.

LoginGraceTime 60s

Interval in seconds for encrypted SSH-level client-alive probes; zero disables these probes.

ClientAliveInterval 30

Number of unanswered SSH-level client-alive probes tolerated before disconnecting. Use with ClientAliveInterval.

ClientAliveCountMax 3

Control TCP keepalive messages. These are separate from encrypted SSH client-alive probes.

TCPKeepAlive yes

Enable PAM integration on builds that support it. PAM policy and available authentication methods vary by system.

UsePAM yes

Allow allocation of a pseudo-terminal. Disabling it affects interactive sessions.

PermitTTY yes

Replace the requested command with a fixed command. Validate access and restrictions carefully before enabling.

ForceCommand internal-sftp

Define a named subsystem and its command; internal-sftp is the built-in SFTP server.

Subsystem sftp internal-sftp

Confine a session to a directory after authentication. Directory ownership and permissions are strictly checked; provision required files for the intended session.

ChrootDirectory /srv/sftp/%u

Start a conditional block for matching users, groups, addresses, or other supported criteria. Only certain directives are permitted inside it.

Match User sftpuser
    ForceCommand internal-sftp

Include configuration files by path or glob. Ordering matters because the first obtained value generally applies.

Include /etc/ssh/sshd_config.d/*.conf

Set logging verbosity, such as QUIET, FATAL, ERROR, INFO, VERBOSE, or DEBUG. Detailed logs may expose sensitive information.

LogLevel INFO

Choose the syslog facility used for SSH server messages; system logging configuration determines where they appear.

SyslogFacility AUTH

Send the contents of a specified file before authentication. Use none to disable a configured banner.

Banner /etc/issue.net

Allow named client-supplied environment variables. Some variables can bypass restricted environments, so allow only what is needed.

AcceptEnv LANG LC_*

Control user-provided environment settings. Enabling them can bypass restrictions through environment variables.

PermitUserEnvironment no

Control whether sshd prints the message of the day at interactive login. PAM or another service may also print it.

PrintMotd no

Control compression. Supported values and timing vary by OpenSSH version.

Compression no

Set the data threshold and optionally the time interval for rekeying. Use values appropriate for the server version.

RekeyLimit 1G 1h

Select permitted encryption algorithms. Replacing the default list may reduce compatibility; use ssh -Q cipher to inspect client-supported algorithms.

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com

Select key exchange algorithms. Restricting this list can break clients; verify support on both sides.

KexAlgorithms curve25519-sha256

Select permitted public-key signature algorithms for user authentication. Verify compatibility before changing the default list.

PubkeyAcceptedAlgorithms ssh-ed25519

Select host-key signature algorithms offered by the server. The configured host key must support the chosen algorithm.

HostKeyAlgorithms ssh-ed25519

File containing trusted user certificate authority public keys for certificate authentication.

TrustedUserCAKeys /etc/ssh/user_ca.pub

File containing revoked public keys or a key revocation list. A missing or unreadable configured file can prevent public-key authentication.

RevokedKeys /etc/ssh/revoked_keys

File listing principals permitted for a user certificate signed by a trusted CA; token expansion is supported.

AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

Append text to the SSH protocol banner; none disables the added text.

VersionAddendum none

Run a trusted, root-owned program to obtain public keys. Configure its execution account and follow the manual's ownership requirements.

AuthorizedKeysCommand /usr/local/libexec/ssh-keys %u

Account used to run AuthorizedKeysCommand; a dedicated account is recommended.

AuthorizedKeysCommandUser sshkeys

Run a trusted program to obtain permitted certificate principals. Configure its execution account separately.

AuthorizedPrincipalsCommand /usr/local/libexec/ssh-principals %u

Account used to run AuthorizedPrincipalsCommand; use a dedicated account.

AuthorizedPrincipalsCommandUser sshprincipals

Restrict certificate authority signature algorithms accepted for SSH certificates. Verify CA and client compatibility before changes.

CASignatureAlgorithms ssh-ed25519

Expire inactive channels by channel type and duration; availability and supported channel types depend on version. Expiry need not terminate the SSH connection.

ChannelTimeout session=1h

Expose authentication information through a temporary file referenced by SSH_USER_AUTH; consider access to authentication details.

ExposeAuthInfo no

Select the hash used for key fingerprints, such as sha256 or md5. Prefer SHA-256.

FingerprintHash sha256

Control GSSAPI user authentication when supported by the server build.

GSSAPIAuthentication no

Control whether delegated GSSAPI credentials are destroyed at logout; build support varies.

GSSAPICleanupCredentials yes

Control storing delegated GSSAPI credentials for user sessions when supported.

GSSAPIDelegateCredentials no

Control whether the server requires the correct GSSAPI host identity. Disabling verification has security implications.

GSSAPIStrictAcceptorCheck yes

Select algorithms accepted for host-based authentication. Availability varies by OpenSSH version.

HostbasedAcceptedAlgorithms ssh-ed25519

Control host-based authentication; it requires additional trust and host configuration.

HostbasedAuthentication no

Control whether host-based authentication uses the name supplied by the client instead of DNS. Review the trust implications.

HostbasedUsesNameFromPacketOnly no

Specify the agent socket used to access host private keys. The agent and its socket must be available to sshd.

HostKeyAgent /run/ssh-hostkey-agent.sock

Control use of per-user rhosts or shosts files for host-based authentication; accepted values vary by version.

IgnoreRhosts yes

Control whether user-specific known_hosts files are ignored during host-based authentication.

IgnoreUserKnownHosts yes

Control Kerberos password authentication when built and configured with Kerberos support.

KerberosAuthentication no

Control obtaining an AFS token for a Kerberos-authenticated user where the build supports it.

KerberosGetAFSToken no

Control whether failed Kerberos password validation falls back to local password authentication.

KerberosOrLocalPasswd no

Control removal of a user's Kerberos ticket cache at logout where supported.

KerberosTicketCleanup yes

Override logging verbosity for matching source locations. It is intended for troubleshooting and may expose sensitive information.

LogVerbose kex.c:*:1000

Path to the moduli file used for Diffie-Hellman group exchange; maintain it according to platform guidance.

ModuliFile /etc/ssh/moduli

Select the PAM service name on builds that support this directive; PAM policy for the selected service must exist.

PAMServiceName sshd

Control tun device forwarding: yes, point-to-point, ethernet, or no. Additional system privileges and configuration may be required.

PermitTunnel no

Control execution of the user's SSH rc file. Disabling it can affect user session setup.

PermitUserRC no

Limit simultaneous unauthenticated connections per source address or source group; version support varies.

PerSourceMaxStartups 10

Set IPv4 and IPv6 prefix lengths used to group sources for per-source connection limits.

PerSourceNetBlockSize 32:128

Configure penalties for problematic sources. Supported penalty types, values, and defaults vary by OpenSSH version.

PerSourcePenalties no

List source addresses or CIDR ranges exempt from per-source penalties; ensure exemptions are narrowly scoped.

PerSourcePenaltyExemptList 192.0.2.0/24

Path to the server process ID file. Ensure the service manager and permissions agree with this path.

PidFile /run/sshd.pid

Control printing the previous login time for interactive logins. Availability may depend on platform support.

PrintLastLog yes

Set public-key authentication options, including security-key touch or verification requirements when supported.

PubkeyAuthOptions touch-required

Refuse a connection, typically inside a Match block. Availability varies by version.

Match User blocked
    RefuseConnection yes

Set the minimum RSA key size accepted by sshd. Lower values may weaken security and some versions impose a minimum.

RequiredRSASize 3072

Select a routing domain for the session on platforms that support routing domains. This is platform-specific.

RDomain 1

Path to a FIDO security-key middleware library; leaving it unset uses the built-in support where available.

SecurityKeyProvider /usr/local/lib/libsk-libfido2.so

Path to the sshd authentication helper on versions and platforms that support it. Normally managed by the package.

SshdAuthPath /usr/libexec/sshd-auth

Path to the sshd session helper on versions and platforms that support it. Normally managed by the package.

SshdSessionPath /usr/libexec/sshd-session

Set the octal file mode creation mask for a Unix-domain forwarding socket.

StreamLocalBindMask 0177

Control whether an existing Unix-domain socket is removed before creating a forwarding listener.

StreamLocalBindUnlink no

Close connections with no open channels after the specified time. Affected behavior and availability vary by version.

UnusedConnectionTimeout 5m

Set the first display number available for X11 forwarding.

X11DisplayOffset 10

Bind the X11 forwarding server to loopback when enabled; disabling it can expose the display more widely.

X11UseLocalhost yes

Path to the xauth program used for X11 forwarding where applicable.

XAuthLocation /usr/bin/xauth

Set IP quality-of-service markings for interactive and non-interactive sessions. Network devices may interpret or ignore these markings.

IPQoS lowdelay throughput

Select message authentication code algorithms. Changing the defaults can affect security and client compatibility.

MACs hmac-sha2-256-etm@openssh.com

Set environment variables for child sessions. These values override variables accepted from clients or user environment files.

SetEnv LANG=en_US.UTF-8

Control reverse DNS lookup and verification for connecting clients. Enabling it may add delay if DNS is slow.

UseDNS no