SSHD_CONFIG(5) File Formats Manual SSHD_CONFIG(5) (NAME) sshd_config - OpenSSH (DESCRIPTION) sshd(8) /etc/ssh/sshd_config ( -f ) . - . . `#' () . (") . ( ): AcceptEnv environ(7) . SendEnv SetEnv ssh_config(5) . TERM (pseudo-terminal) . (wildcard) `*' `?' . AcceptEnv . . . . AddressFamily sshd(8) . : any () inet ( IPv4) inet6 ( IPv6). AllowAgentForwarding () ssh-agent(1) . yes . (shell) . AllowGroups . . . . DenyGroups AllowGroups . PATTERNS ssh_config(5) . sshd_config . AllowStreamLocalForwarding StreamLocal ( - Unix-domain socket) . : yes () all StreamLocal no StreamLocal local ( ssh(1)) remote . StreamLocal . AllowTcpForwarding TCP . : yes () all TCP no TCP local ( ssh(1)) remote . TCP . AllowUsers . . . . USER@HOST USER HOST . HOST / CIDR . DenyUsers AllowUsers . PATTERNS ssh_config(5) . sshd_config . AuthenticationMethods . any . . "publickey,password publickey,keyboard-interactive" . . bsdauth pam . "keyboard-interactive:bsdauth" bsdauth . publickey sshd(8) . "publickey,publickey" . . : "gssapi-with-mic " "hostbased " "keyboard-interactive " "none" ( PermitEmptyPasswords ) "password" "publickey". AuthorizedKeysCommand . root . AuthorizedKeysCommand TOKENS . . authorized_keys ( AUTHORIZED_KEYS sshd(8) ). AuthorizedKeysCommand AuthorizedKeysFile . AuthorizedKeysCommand . . AuthorizedKeysCommandUser AuthorizedKeysCommand . . AuthorizedKeysCommand AuthorizedKeysCommandUser sshd(8) . AuthorizedKeysFile . AUTHORIZED_KEYS FILE FORMAT sshd(8) . AuthorizedKeysFile TOKENS . AuthorizedKeysFile . . none . ".ssh/authorized_keys .ssh/authorized_keys2" . . AuthorizedPrincipalsCommand (principals) AuthorizedPrincipalsFile . root . AuthorizedPrincipalsCommand TOKENS . . AuthorizedPrincipalsFile . AuthorizedPrincipalsCommand AuthorizedPrincipalsFile (principal) . AuthorizedPrincipalsCommand . . AuthorizedPrincipalsCommandUser AuthorizedPrincipalsCommand . . AuthorizedPrincipalsCommand AuthorizedPrincipalsCommandUser sshd(8) . AuthorizedPrincipalsFile ( - principal names) . TrustedUserCAKeys . ( AUTHORIZED_KEYS FILE FORMAT sshd(8) ). `#' . AuthorizedPrincipalsFile TOKENS . AuthorizedPrincipalsFile . none - . . AuthorizedPrincipalsFile (CA) TrustedUserCAKeys ~/.ssh/authorized_keys principals= ( sshd(8) ). Banner . none . . CASignatureAlgorithms (CAs) . : ssh-ed25519,ecdsa-sha2-nistp256, ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, ssh-mldsa44-ed25519@openssh.com `+' . `-' ( ) . . ChannelTimeout sshd(8) . "type=interval" "type" "global" . "interval" TIME FORMATS . "session=5m" . . "global" . . . : agent-connection ssh-agent(1). direct-tcpip, direct-streamlocal@openssh.com TCP ( ) ssh(1) LocalForward DynamicForward. forwarded-tcpip, forwarded-streamlocal@openssh.com TCP ( ) sshd(8) ssh(1) RemoteForward. session scp(1) sftp(1) . tun-connection TunnelForward. x11-connection X11. X11 . SSH . . . ChrootDirectory chroot(2) . sshd(8) root . chroot sshd(8) . ChrootDirectory TOKENS . ChrootDirectory . ( sh(1)) /dev null(4) zero(4) stdin(4) stdout(4) stderr(4) tty(4) . SFTP sftp-server /dev/log chroot ( sftp-server(8) ). ( jail) . sshd(8) . none chroot(2) . Ciphers . . `+' . `-' ( ) . `^' . : 3des-cbc aes128-cbc aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr aes128-gcm@openssh.com aes256-gcm@openssh.com chacha20-poly1305@openssh.com : chacha20-poly1305@openssh.com, aes128-gcm@openssh.com,aes256-gcm@openssh.com, aes128-ctr,aes192-ctr,aes256-ctr "ssh -Q cipher" . ClientAliveCountMax (client alive messages) sshd(8) . sshd . TCPKeepAlive . . TCP keepalive TCPKeepAlive . . . ClientAliveInterval ClientAliveCountMax SSH . ClientAliveCountMax . ClientAliveInterval (timeout) sshd(8) . . Compression . yes delayed ( yes) no . yes . SSH . ( ) . . DenyGroups . . . . DenyGroups AllowGroups . PATTERNS ssh_config(5) . sshd_config . DenyUsers . . . . USER@HOST USER HOST . HOST / CIDR . DenyUsers AllowUsers . PATTERNS ssh_config(5) . sshd_config . DisableForwarding X11 ssh-agent(1) TCP StreamLocal . . ExposeAuthInfo ( ) . SSH_USER_AUTH . no . FingerprintHash () . : md5 sha256. sha256 . ForceCommand ForceCommand ~/.ssh/rc ( ) . -c . . Match . SSH_ORIGINAL_COMMAND . internal-sftp SFTP ChrootDirectory . none . TCP X11 . DisableForwarding. GatewayPorts . sshd(8) loopback . . GatewayPorts sshd loopback . no yes (wildcard) clientspecified . no . GSSAPIAuthentication GSSAPI . no . GSSAPICleanupCredentials . yes . GSSAPIDelegateCredentials . yes . GSSAPIStrictAcceptorCheck GSSAPI . yes . no . (multi-homed) . yes . Active Directory . HostbasedAcceptedAlgorithms . `+' . `-' ( ) . `^' . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, ssh-mldsa44-ed25519@openssh.com "ssh -Q HostbasedAcceptedAlgorithms" . HostbasedAcceptedKeyTypes . HostbasedAuthentication rhosts /etc/hosts.equiv ( ). no . HostbasedUsesNameFromPacketOnly ~/.shosts ~/.rhosts /etc/hosts.equiv HostbasedAuthentication (reverse name lookup) . yes sshd(8) TCP . no . HostCertificate . HostKey . sshd(8) . HostKey SSH . : /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_mldsa44_ed25519_key /etc/ssh/ssh_host_rsa_key. sshd(8) / HostKeyAlgorithms sshd(8) . . . ssh-agent(1) . HostKeyAgent . "SSH_AUTH_SOCK" SSH_AUTH_SOCK . HostKeyAlgorithms . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, ssh-mldsa44-ed25519@openssh.com "ssh -Q HostKeyAlgorithms" . IgnoreRhosts .rhosts .shosts HostbasedAuthentication . /etc/hosts.equiv /etc/ssh/shosts.equiv . : yes () shosts-only .shosts .rhosts no .shosts rhosts. IgnoreUserKnownHosts sshd(8) ~/.ssh/known_hosts HostbasedAuthentication /etc/ssh/ssh_known_hosts . "no" . Include () . glob(7) . /etc/ssh . Include Match . IPQoS Differentiated Services Field Codepoint (DSCP) . : af11 af12 af13 af21 af22 af23 af31 af32 af33 af41 af42 af43 cs0 cs1 cs2 cs3 cs4 cs5 cs6 cs7 ef le none . . . . ef (Expedited Forwarding) none ( ) . KbdInteractiveAuthentication . login.conf(5) . yes . yes no . ChallengeResponseAuthentication . KerberosAuthentication PasswordAuthentication Kerberos KDC . servtab KDC . no . KerberosGetAFSToken AFS Kerberos 5 TGT AFS . no . KerberosOrLocalPasswd /etc/passwd . yes . KerberosTicketCleanup . yes . KexAlgorithms KEX ( - Key Exchange) . . . `+' . `-' ( ) . `^' . : curve25519-sha256 curve25519-sha256@libssh.org diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 mlkem768nistp256-sha256 mlkem768x25519-sha256 sntrup761x25519-sha512 sntrup761x25519-sha512@openssh.com : mlkem768x25519-sha256, sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com, curve25519-sha256,curve25519-sha256@libssh.org, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 "ssh -Q KexAlgorithms" . ListenAddress sshd(8) . : ListenAddress hostname|address [rdomain domain] ListenAddress hostname:port [rdomain domain] ListenAddress IPv4_address:port [rdomain domain] ListenAddress [hostname|address]:port [rdomain domain] rdomain sshd(8) . port sshd Port . . ListenAddress . rdomain(4) . LoginGraceTime . 0 . 120 . LogLevel sshd(8) . : QUIET FATAL ERROR INFO VERBOSE DEBUG DEBUG1 DEBUG2 DEBUG3. INFO . DEBUG DEBUG1 . DEBUG2 DEBUG3 . DEBUG . LogVerbose (override) LogLevel . . : kex.c:*:1000,*:kex_exchange_identification():*,packet.c:* 1000 kex.c kex_exchange_identification() packet.c . . MACs MAC ( - message authentication code) . MAC . . `+' . `-' ( ) . `^' . "-etm" MAC (-- - encrypt-then-mac). . MAC : hmac-md5 hmac-md5-96 hmac-sha1 hmac-sha1-96 hmac-sha2-256 hmac-sha2-512 umac-64@openssh.com umac-128@openssh.com hmac-md5-etm@openssh.com hmac-md5-96-etm@openssh.com hmac-sha1-etm@openssh.com hmac-sha1-96-etm@openssh.com hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com umac-64-etm@openssh.com umac-128-etm@openssh.com : umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com,umac-128@openssh.com, hmac-sha2-256,hmac-sha2-512,hmac-sha1 MAC "ssh -Q mac" . Match . Match Match . Match . Match - : All Invalid-User . : User Group Host LocalAddress LocalPort Version RDomain Address ( RDomain rdomain(4) ). PATTERNS ssh_config(5) . Address / CIDR 192.0.2.0/24 2001:db8::/32 . - . 192.0.2.0/33 192.0.2.0/8. Version sshd(8) "OpenSSH_10.0". Match . : AcceptEnv AllowAgentForwarding AllowGroups AllowStreamLocalForwarding AllowTcpForwarding AllowUsers AuthenticationMethods AuthorizedKeysCommand AuthorizedKeysCommandUser AuthorizedKeysFile AuthorizedPrincipalsCommand AuthorizedPrincipalsCommandUser AuthorizedPrincipalsFile Banner CASignatureAlgorithms ChannelTimeout ChrootDirectory ClientAliveCountMax ClientAliveInterval DenyGroups DenyUsers DisableForwarding ExposeAuthInfo ForceCommand GatewayPorts GSSAPIAuthentication HostbasedAcceptedAlgorithms HostbasedAuthentication HostbasedUsesNameFromPacketOnly IgnoreRhosts Include IPQoS KbdInteractiveAuthentication KerberosAuthentication LogLevel MaxAuthTries MaxSessions PAMServiceName PasswordAuthentication PermitEmptyPasswords PermitListen PermitOpen PermitRootLogin PermitTTY PermitTunnel PermitUserRC PubkeyAcceptedAlgorithms PubkeyAuthentication PubkeyAuthOptions RefuseConnection RekeyLimit RevokedKeys RDomain SetEnv StreamLocalBindMask StreamLocalBindUnlink TrustedUserCAKeys UnusedConnectionTimeout X11DisplayOffset X11Forwarding X11UseLocalhost. MaxAuthTries . . . MaxSessions ( sftp) . . MaxSessions 1 0 . 10 . MaxStartups SSH . LoginGraceTime . start:rate:full ( "10:30:60") . 10:30:100 . start () sshd(8) rate/100 () . full () . ModuliFile moduli(5) - "diffie-hellman-group-exchange-sha1" "diffie-hellman-group-exchange-sha256" . /etc/ssh/moduli . PAMServiceName (PAM) UsePAM . sshd . PasswordAuthentication . yes . PermitEmptyPasswords . no . PermitListen / TCP . : PermitListen port PermitListen host:port . any . none . PATTERNS ssh_config(5) . `*' . . GatewayPorts . ssh(1) "localhost" "127.0.0.1" "::1" . PermitOpen TCP . : PermitOpen host:port PermitOpen IPv4_addr:port PermitOpen [IPv6_addr]:port . any . none . `*' . . . PermitRootLogin root ssh(1) . yes prohibit-password forced-commands-only no . prohibit-password . prohibit-password ( without-password) root . forced-commands-only root command ( root ). root . no root . PermitTTY pty(4) . yes . PermitTunnel tun(4) . yes point-to-point ( ) ethernet ( ) no . yes point-to-point ethernet . no . tun(4) . PermitUserEnvironment ~/.ssh/environment environment= ~/.ssh/authorized_keys sshd(8) . : yes no ( "LANG,LC_*"). no . LD_PRELOAD . PermitUserRC ~/.ssh/rc . yes . PerSourceMaxStartups "none" . MaxStartups . none . PerSourceNetBlockSize PerSourceMaxStartups . IPv4 IPv6 . 32:128 . PerSourcePenalties sshd(8) . ( PerSourceNetBlockSize ) . . . no . . "crash:2m". crash:duration ( ) sshd(8) (: 90s). authfail:duration (: 5s). invaliduser:duration (: 5s). refuseconnection:duration RefuseConnection (: 10s). noauth:duration (: 1s). ssh-keyscan(1) . grace-exceeded:duration LoginGraceTime (: 10s). max:duration (: 10m). . min:duration (: 15s). max-sources4:number, max-sources6:number IPv4 IPv6 (: 65536 ). overflow:mode max-sources4 max-sources6 . : deny-all PerSourcePenaltyExemptList permissive (: permissive). min . IPv4 IPv6 . overflow6:mode IPv6 . IPv4 . PerSourcePenaltyExemptList . / CIDR . - . 192.0.2.0/33 192.0.2.0/8. . PidFile (PID) SSH none . /run/sshd.pid . Port sshd(8) . 22 . . ListenAddress . PrintLastLog sshd(8) . yes . PrintMotd sshd(8) /etc/motd . ( /etc/profile .) yes . PubkeyAcceptedAlgorithms . `+' . `-' ( ) . `^' . : ssh-ed25519-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-mldsa44-ed25519-cert-v01@openssh.com, ssh-ed25519, ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com, webauthn-sk-ecdsa-sha2-nistp256@openssh.com, rsa-sha2-512,rsa-sha2-256, ssh-mldsa44-ed25519@openssh.com "ssh -Q PubkeyAcceptedAlgorithms" . PubkeyAuthOptions . : none ( ) touch-required verify-required. touch-required FIDO ( ecdsa-sk ed25519-sk) ( ). sshd(8) authorized_keys . touch-required . verify-required FIDO PIN. touch-required verify-required FIDO . PubkeyAuthentication . yes . RefuseConnection sshd(8) . PerSourcePenalties refuseconnection . Match . RekeyLimit . `K ' `M' `G' . `1G' `4G' . TIME FORMATS . RekeyLimit default none . RequiredRSASize RSA ( ) sshd(8) . . 1024 . . RevokedKeys none . . . (KRL) ssh-keygen(1) . sshd(8) . KRL KEY REVOCATION LISTS ssh-keygen(1) . RDomain . IP rdomain(4) . %D . SecurityKeyProvider FIDO USB HID . SetEnv sshd(8) "NAME=VALUE" . ( ). SetEnv AcceptEnv PermitUserEnvironment () . SshdAuthPath sshd-auth . /usr/lib/ssh/sshd-auth . . SshdSessionPath sshd-session . /usr/lib/ssh/sshd-session . . StreamLocalBindMask (umask) . . 0177 . . StreamLocalBindUnlink . StreamLocalBindUnlink sshd . . yes no . no . StrictModes sshd(8) . . yes . ChrootDirectory . Subsystem ( ) . ( ) . sftp-server SFTP . internal-sftp SFTP . ChrootDirectory . sftp-server LogLevel SyslogFacility . . SyslogFacility (facility code) sshd(8) . : DAEMON USER AUTH LOCAL0 LOCAL1 LOCAL2 LOCAL3 LOCAL4 LOCAL5 LOCAL6 LOCAL7. AUTH . TCPKeepAlive TCP keepalive . . . keepalive TCP " (ghost)" . yes ( TCP keepalive) . . TCP keepalive no . TrustedUserCAKeys none . `#' . CA (principals) . TrustedUserCAKeys . CERTIFICATES ssh-keygen(1) . UnusedConnectionTimeout sshd(8) . X11 . -R ssh(1) . TIME FORMATS . . . none . ChannelTimeout . UseDNS sshd(8) IP IP . no () from ~/.ssh/authorized_keys Match Host sshd_config . UsePAM (PAM) . yes PAM KbdInteractiveAuthentication PasswordAuthentication PAM . PAM PasswordAuthentication KbdInteractiveAuthentication . UsePAM sshd(8) root . no . VersionAddendum SSH . none . X11DisplayOffset X11 sshd(8) . sshd X11 . 10 . X11Forwarding X11 . yes no . no . X11 sshd(8) (wildcard) ( X11UseLocalhost ) . . X11 X11 SSH ( ForwardX11 ssh_config(5) ). X11 no . X11 X11 . X11UseLocalhost sshd(8) X11 loopback (wildcard). sshd loopback DISPLAY localhost . . X11 . X11UseLocalhost no . yes no . yes . XAuthLocation xauth(1) none . /usr/bin/xauth . (TIME FORMATS) sshd(8) : time[qualifier], time qualifier : s | S m | M h | H d | D w | W . : 600 600 (10 ) 10m 10 1h30m 1 30 (90 ) (TOKENS) . . . sshd_config : %% `%'. %C : . %D . %F (CA). %f . %h . %i . %K Base64 (CA). %k Base64 . %s . %T CA. %t . %U (UID) . %u . AuthorizedKeysCommand %%, %C, %D, %f, %h, %k, %t, %U %u . AuthorizedKeysFile %%, %h, %U %u . AuthorizedPrincipalsCommand %%, %C, %D, %F, %f, %h, %i, %K, %k, %s, %T, %t, %U %u . AuthorizedPrincipalsFile %%, %h, %U %u . ChrootDirectory %%, %h, %U %u . RoutingDomain %D . (FILES) /etc/ssh/sshd_config sshd(8) . root ( ) . (SEE ALSO) sftp-server(8), sshd(8) (AUTHORS) OpenSSH ssh 1.2.12 Tatu Ylonen . Aaron Campbell Bob Beck Markus Friedl Niels Provos Theo de Raadt Dug Song OpenSSH . Markus Friedl SSH 1.5 2.0 . Niels Provos Markus Friedl (privilege separation) . Linux 6.12.107+deb13-amd64 August 8, 2026 Linux 6.12.107+deb13-amd64