SSHD(8) System Manager's Manual SSHD(8) (NAME) sshd - OpenSSH (SYNOPSIS) sshd [-46DdeGiqTtV] [-C connection_spec] [-c host_certificate_file] [-E log_file] [-f config_file] [-g login_grace_time] [-h host_key_file] [-o option] [-p port] [-u len] (DESCRIPTION) sshd (OpenSSH Daemon) ssh(1) . . sshd . /etc/rc . (fork). . sshd ( sshd_config(5)) . sshd SIGHUP ( /usr/sbin/sshd) . : -4 sshd IPv4 . -6 sshd IPv6 . -C connection_spec -T . Match . keyword=value -C . "addr", "user", "host", "laddr", "lport" "rdomain" (resolved) (routing domain) . "invalid-user" ( ) . -c host_certificate_file sshd . -h HostKey . -D sshd (detach ) . sshd . -d (Debug). . (fork(2)) . . -d . 3 . -E log_file log_file . -e . -f config_file . /etc/ssh/sshd_config . sshd . -G . . Match -C . -g login_grace_time (grace time) ( 120 ). . . -h host_key_file . sshd (root) ( ). /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_mldsa44_ed25519_key /etc/ssh/ssh_host_rsa_key. . -i sshd inetd(8) . -o option . . sshd_config(5) . -p port ( 22). . Port . ListenAddress . -q (Quiet). . . -T (Extended test mode). . Match -C . -G -t . -t (Test mode). . sshd . -u len utmp . len (dotted decimal) . . -u0 utmp . -u0 DNS sshd . DNS HostbasedAuthentication from="pattern-list" . DNS USER@HOST AllowUsers DenyUsers . -V . (AUTHENTICATION) OpenSSH SSH . . . . (Forward secrecy) - (Diffie-Hellman) . . . . (MAC) . . (host-based) (public key) - (challenge-response) . . DenyUsers DenyGroups . . ( AIX) passwd ( `*LK*' Solaris UnixWare `*' HP- UX `Nologin' Tru64 `*LOCKED*' FreeBSD `!' ). passwd ( `NP' `*NP*' ). . (pseudo-tty) X11 TCP (agent) . sshd -c . . / . X11 . (LOGIN PROCESS) sshd : 1. tty /etc/motd ( ~/.hushlogin (FILES) ). 2. tty . 3. /etc/nologin ( ). 4. . 5. (environment) . 6. ~/.ssh/environment . PermitUserEnvironment sshd_config(5) . 7. . 8. ~/.ssh/rc PermitUserRC sshd_config(5) /etc/ssh/sshrc xauth(1) . "rc" X11 . SSHRC . 9. . . SSHRC ~/.ssh/rc sh(1) . stdout stderr . X11 "proto cookie" ( DISPLAY ). xauth(1) sshd xauth X11 . AFS . : if read proto cookie && [ -n "$DISPLAY" ]; then if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then # X11UseLocalhost=yes echo add unix:`echo $DISPLAY | cut -c11-` $proto $cookie else # X11UseLocalhost=no echo add $DISPLAY $proto $cookie fi | xauth -q - fi /etc/ssh/sshrc xauth . AUTHORIZED_KEYS (AUTHORIZED_KEYS FILE FORMAT) AuthorizedKeysFile ~/.ssh/authorized_keys ~/.ssh/authorized_keys2 . ( `#' ). : (options) (keytype) base64 (comment). . : sk-ecdsa-sha2-nistp256@openssh.com ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 sk-ssh-ed25519@openssh.com ssh-ed25519 ssh-mldsa44-ed25519@openssh.com ssh-rsa (comment) ( ). ( ) RSA . id_ecdsa.pub, id_ecdsa_sk.pub, id_ed25519.pub, id_ed25519_sk.pub, id_mldsa44_ed25519 id_rsa.pub . sshd RSA . ( ) . . ( ): agent-forwarding restrict . cert-authority (CA) . . . command="command" . ( ) . pty pty tty . (8-bit clean) pty no-pty . . . . TCP / X11 restrict. SSH_ORIGINAL_COMMAND . . ForceCommand sshd_config(5) . (forced-command) . environment="NAME=value" . . . PermitUserEnvironment . expiry-time="timespec" . YYYYMMDD[Z] YYYYMMDDHHMM[SS][Z] . Z UTC . from="pattern-list" IP . PATTERNS ssh_config(5) . from IP CIDR (/ ) . : ( ) . ( / ). no-agent-forwarding . no-port-forwarding TCP . . command . no-pty tty ( pty ). no-user-rc ~/.ssh/rc . no-X11-forwarding X11 . X11 . permitlisten="[host:]port" -R ssh(1) () . IPv6 . permitlisten . PATTERNS ssh_config(5) . * . GatewayPorts . ssh(1) "localhost" "127.0.0.1" "::1" . permitopen="host:port" -L ssh(1) . IPv6 . permitopen . / . * . port-forwarding restrict . principals="principals" cert-authority (principals) . . cert-authority . pty tty restrict . no-touch-required ( ) . FIDO ecdsa-sk ed25519-sk . verify-required PIN. FIDO ecdsa-sk ed25519-sk . restrict X11 PTY ~/.ssh/rc . authorized_keys . tunnel="n" tun(4) . . user-rc ~/.ssh/rc restrict . X11-forwarding X11 restrict . authorized_keys: # Comments are allowed at start of line. Blank lines are allowed. # Plain key, no restrictions ssh-rsa ... # Forced command, disable PTY and all forwarding restrict,command="dump /home" ssh-rsa ... # Restriction of ssh -L forwarding destinations permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa ... # Restriction of ssh -R forwarding listeners permitlisten="localhost:8080",permitlisten="[::1]:22000" ssh-rsa ... # Configuration for tunnel forwarding tunnel="0",command="sh /etc/netstart tun0" ssh-rsa ... # Override of restriction to allow PTY allocation restrict,pty,command="nethack" ssh-rsa ... # Allow FIDO key without requiring touch no-touch-required sk-ecdsa-sha2-nistp256@openssh.com ... # Require user-verification (e.g. PIN or biometric) for FIDO key verify-required sk-ecdsa-sha2-nistp256@openssh.com ... # Trust CA key, allow touch-less FIDO if requested in certificate cert-authority,no-touch-required,principals="user_a" ssh-rsa ... SSH_KNOWN_HOSTS (SSH_KNOWN_HOSTS FILE FORMAT) /etc/ssh/ssh_known_hosts ~/.ssh/known_hosts . ( ) : . : () (hostnames) (keytype) base64 (comment). . (marker) "@cert-authority" (CA) "@revoked" . . (hostnames) (`*' `?' ) . sshd HostbasedAuthentication . ssh(1) HostkeyAlias ssh(1) ( ) CanonicalizeHostname ssh(1) . `!' (negation) : ( ) . `[' `]' `:' . () . `|' . . base64 /etc/ssh/ssh_host_rsa_key.pub . . `#' . . "@cert-authority" . (revoked) . "@revoked" ssh(1) . ( ) . . . . ssh-keyscan(1) /etc/ssh/ssh_host_rsa_key.pub . ssh-keygen(1) ~/.ssh/known_hosts () . ssh_known_hosts: # Comments allowed at start of line cvs.example.net,192.0.2.10 ssh-rsa AAAA1234.....= # A hashed hostname |1|JfKTdBh7rNbXkVAQCRp4OQoPfmI=|USECr3SWf1JUPsms5AqfD5QfxkM= ssh-rsa AAAA1234.....= # A revoked key @revoked * ssh-rsa AAAAB5W... # A CA key, accepted for any host in *.mydomain.com or *.mydomain.org @cert-authority *.mydomain.org,*.mydomain.com ssh-rsa AAAAB5W... (FILES) ~/.hushlogin /etc/motd PrintLastLog PrintMotd . Banner . ~/.rhosts ( ssh(1) ). NFS (world-readable) sshd . . / . ~/.shosts .rhosts rlogin/rsh . ~/.ssh/ . // . ~/.ssh/authorized_keys (ECDSA, Ed25519, RSA) . . / . ~/.ssh . sshd StrictModes "no" . ~/.ssh/environment ( ). ( `#' ) name=value . . PermitUserEnvironment . ~/.ssh/known_hosts . . ( ) . ~/.ssh/rc . . /etc/hosts.equiv ( ssh(1) ). . /etc/ssh/moduli - "Diffie-Hellman Group Exchange" . moduli(5) . . /etc/motd motd(5) . /etc/nologin sshd . . . /etc/ssh/shosts.equiv hosts.equiv rlogin/rsh . /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_mldsa44_ed25519_key /etc/ssh/ssh_host_rsa_key . . sshd . /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_mldsa44_ed25519_key.pub /etc/ssh/ssh_host_rsa_key.pub . . . . ssh-keygen(1) . /etc/ssh/ssh_known_hosts . . . . /etc/ssh/sshd_config sshd . sshd_config(5) . /etc/ssh/sshrc ~/.ssh/rc . . /usr/share/empty.sshd chroot(2) sshd (privilege separation) . . /run/sshd.pid (PID) sshd ( ). . (SEE ALSO) scp(1), sftp(1), ssh(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1), chroot(2), login.conf(5), moduli(5), sshd_config(5), inetd(8), sftp-server(8) (AUTHORS) OpenSSH ssh 1.2.12 Tatu Ylonen . Aaron Campbell Bob Beck Markus Friedl Niels Provos Theo de Raadt Dug Song OpenSSH . Markus Friedl SSH 1.5 2.0 . Niels Provos Markus Friedl (privilege separation) . Linux 6.12.107+deb13-amd64 July 11, 2026 Linux 6.12.107+deb13-amd64