Skip site navigation (1)Skip section navigation (2)

FreeBSD Man Pages

Man Page or Keyword Search:
Man Architecture
Apropos Keyword Search (all sections) Output format
home | help
SSHD_CONFIG(5)		  FreeBSD File Formats Manual		SSHD_CONFIG(5)

NAME
     sshd_config -- OpenSSH SSH	daemon configuration file

SYNOPSIS
     /etc/ssh/sshd_config

DESCRIPTION
     sshd reads	configuration data from	/etc/ssh/sshd_config (or the file
     specified with -f on the command line).  The file contains	keyword-argu-
     ment pairs, one per line.	Lines starting with `#'	and empty lines	are
     interpreted as comments.

     The possible keywords and their meanings are as follows (note that	key-
     words are case-insensitive	and arguments are case-sensitive):

     AllowGroups
	     This keyword can be followed by a list of group name patterns,
	     separated by spaces.  If specified, login is allowed only for
	     users whose primary group or supplementary	group list matches one
	     of	the patterns.  `*' and `?' can be used as wildcards in the
	     patterns.	Only group names are valid; a numerical	group ID is
	     not recognized.  By default, login	is allowed for all groups.

     AllowTcpForwarding
	     Specifies whether TCP forwarding is permitted.  The default is
	     ``yes''.  Note that disabling TCP forwarding does not improve
	     security unless users are also denied shell access, as they can
	     always install their own forwarders.

     AllowUsers
	     This keyword can be followed by a list of user name patterns,
	     separated by spaces.  If specified, login is allowed only for
	     user names	that match one of the patterns.	 `*' and `?' can be
	     used as wildcards in the patterns.	 Only user names are valid; a
	     numerical user ID is not recognized.  By default, login is
	     allowed for all users.  If	the pattern takes the form USER@HOST
	     then USER and HOST	are separately checked,	restricting logins to
	     particular	users from particular hosts.

     AuthorizedKeysFile
	     Specifies the file	that contains the public keys that can be used
	     for user authentication.  AuthorizedKeysFile may contain tokens
	     of	the form %T which are substituted during connection set-up.
	     The following tokens are defined: %% is replaced by a literal
	     '%', %h is	replaced by the	home directory of the user being
	     authenticated and %u is replaced by the username of that user.
	     After expansion, AuthorizedKeysFile is taken to be	an absolute
	     path or one relative to the user's	home directory.	 The default
	     is	``.ssh/authorized_keys''.

     Banner  In	some jurisdictions, sending a warning message before authenti-
	     cation may	be relevant for	getting	legal protection.  The con-
	     tents of the specified file are sent to the remote	user before
	     authentication is allowed.	 This option is	only available for
	     protocol version 2.  By default, no banner	is displayed.

     ChallengeResponseAuthentication
	     Specifies whether challenge-response authentication is allowed.
	     Specifically, in FreeBSD, this controls the use of	PAM (see
	     pam(3)) for authentication.  Note that this affects the effec-
	     tiveness of the PasswordAuthentication and	PermitRootLogin	vari-
	     ables.  The default is ``yes''.

     Ciphers
	     Specifies the ciphers allowed for protocol	version	2.  Multiple
	     ciphers must be comma-separated.  The default is

	       ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
		 aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr''

     ClientAliveInterval
	     Sets a timeout interval in	seconds	after which if no data has
	     been received from	the client, sshd will send a message through
	     the encrypted channel to request a	response from the client.  The
	     default is	0, indicating that these messages will not be sent to
	     the client.  This option applies to protocol version 2 only.

     ClientAliveCountMax
	     Sets the number of	client alive messages (see above) which	may be
	     sent without sshd receiving any messages back from	the client.
	     If	this threshold is reached while	client alive messages are
	     being sent, sshd will disconnect the client, terminating the ses-
	     sion.  It is important to note that the use of client alive mes-
	     sages is very different from TCPKeepAlive (below).	 The client
	     alive messages are	sent through the encrypted channel and there-
	     fore will not be spoofable.  The TCP keepalive option enabled by
	     TCPKeepAlive is spoofable.	 The client alive mechanism is valu-
	     able when the client or server depend on knowing when a connec-
	     tion has become inactive.

	     The default value is 3.  If ClientAliveInterval (above) is	set to
	     15, and ClientAliveCountMax is left at the	default, unresponsive
	     ssh clients will be disconnected after approximately 45 seconds.

     Compression
	     Specifies whether compression is allowed.	The argument must be
	     ``yes'' or	``no''.	 The default is	``yes''.

     DenyGroups
	     This keyword can be followed by a list of group name patterns,
	     separated by spaces.  Login is disallowed for users whose primary
	     group or supplementary group list matches one of the patterns.
	     `*' and `?' can be	used as	wildcards in the patterns.  Only group
	     names are valid; a	numerical group	ID is not recognized.  By
	     default, login is allowed for all groups.

     DenyUsers
	     This keyword can be followed by a list of user name patterns,
	     separated by spaces.  Login is disallowed for user	names that
	     match one of the patterns.	 `*' and `?' can be used as wildcards
	     in	the patterns.  Only user names are valid; a numerical user ID
	     is	not recognized.	 By default, login is allowed for all users.
	     If	the pattern takes the form USER@HOST then USER and HOST	are
	     separately	checked, restricting logins to particular users	from
	     particular	hosts.

     GatewayPorts
	     Specifies whether remote hosts are	allowed	to connect to ports
	     forwarded for the client.	By default, sshd binds remote port
	     forwardings to the	loopback address.  This	prevents other remote
	     hosts from	connecting to forwarded	ports.	GatewayPorts can be
	     used to specify that sshd should bind remote port forwardings to
	     the wildcard address, thus	allowing remote	hosts to connect to
	     forwarded ports.  The argument must be ``yes'' or ``no''.	The
	     default is	``no''.

     GSSAPIAuthentication
	     Specifies whether user authentication based on GSSAPI is allowed.
	     The default is ``no''.  Note that this option applies to protocol
	     version 2 only.

     GSSAPICleanupCredentials
	     Specifies whether to automatically	destroy	the user's credentials
	     cache on logout.  The default is ``yes''.	Note that this option
	     applies to	protocol version 2 only.

     HostbasedAuthentication
	     Specifies whether rhosts or /etc/hosts.equiv authentication
	     together with successful public key client	host authentication is
	     allowed (hostbased	authentication).  This option is similar to
	     RhostsRSAAuthentication and applies to protocol version 2 only.
	     The default is ``no''.

     HostKey
	     Specifies a file containing a private host	key used by SSH.  The
	     default is	/etc/ssh/ssh_host_key for protocol version 1, and
	     /etc/ssh/ssh_host_dsa_key for protocol version 2.	Note that sshd
	     will refuse to use	a file if it is	group/world-accessible.	 It is
	     possible to have multiple host key	files.	``rsa1'' keys are used
	     for version 1 and ``dsa'' or ``rsa'' are used for version 2 of
	     the SSH protocol.

     IgnoreRhosts
	     Specifies that .rhosts and	.shosts	files will not be used in
	     RhostsRSAAuthentication or	HostbasedAuthentication.

	     /etc/hosts.equiv and /etc/ssh/shosts.equiv	are still used.	 The
	     default is	``yes''.

     IgnoreUserKnownHosts
	     Specifies whether sshd should ignore the user's
	     $HOME/.ssh/known_hosts during RhostsRSAAuthentication or
	     HostbasedAuthentication.  The default is ``no''.

     KerberosAuthentication
	     Specifies whether the password provided by	the user for
	     PasswordAuthentication will be validated through the Kerberos
	     KDC.  To use this option, the server needs	a Kerberos servtab
	     which allows the verification of the KDC's	identity.  Default is
	     ``no''.

     KerberosGetAFSToken
	     If	AFS is active and the user has a Kerberos 5 TGT, attempt to
	     aquire an AFS token before	accessing the user's home directory.
	     Default is	``no''.

     KerberosOrLocalPasswd
	     If	set then if password authentication through Kerberos fails
	     then the password will be validated via any additional local
	     mechanism such as /etc/passwd.  Default is	``yes''.

     KerberosTicketCleanup
	     Specifies whether to automatically	destroy	the user's ticket
	     cache file	on logout.  Default is ``yes''.

     KeyRegenerationInterval
	     In	protocol version 1, the	ephemeral server key is	automatically
	     regenerated after this many seconds (if it	has been used).	 The
	     purpose of	regeneration is	to prevent decrypting captured ses-
	     sions by later breaking into the machine and stealing the keys.
	     The key is	never stored anywhere.	If the value is	0, the key is
	     never regenerated.	 The default is	3600 (seconds).

     ListenAddress
	     Specifies the local addresses sshd	should listen on.  The follow-
	     ing forms may be used:

		   ListenAddress host|IPv4_addr|IPv6_addr
		   ListenAddress host|IPv4_addr:port
		   ListenAddress [host|IPv6_addr]:port

	     If	port is	not specified, sshd will listen	on the address and all
	     prior Port	options	specified.  The	default	is to listen on	all
	     local addresses.  Multiple	ListenAddress options are permitted.
	     Additionally, any Port options must precede this option for non
	     port qualified addresses.

     LoginGraceTime
	     The server	disconnects after this time if the user	has not	suc-
	     cessfully logged in.  If the value	is 0, there is no time limit.
	     The default is 120	seconds.

     LogLevel
	     Gives the verbosity level that is used when logging messages from
	     sshd.  The	possible values	are: QUIET, FATAL, ERROR, INFO,	VER-
	     BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
	     DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
	     higher levels of debugging	output.	 Logging with a	DEBUG level
	     violates the privacy of users and is not recommended.

     MACs    Specifies the available MAC (message authentication code) algo-
	     rithms.  The MAC algorithm	is used	in protocol version 2 for data
	     integrity protection.  Multiple algorithms	must be	comma-sepa-
	     rated.  The default is
	     ``hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96''.

     MaxStartups
	     Specifies the maximum number of concurrent	unauthenticated	con-
	     nections to the sshd daemon.  Additional connections will be
	     dropped until authentication succeeds or the LoginGraceTime
	     expires for a connection.	The default is 10.

	     Alternatively, random early drop can be enabled by	specifying the
	     three colon separated values ``start:rate:full'' (e.g.,
	     "10:30:60").  sshd	will refuse connection attempts	with a proba-
	     bility of ``rate/100'' (30%) if there are currently ``start''
	     (10) unauthenticated connections.	The probability	increases lin-
	     early and all connection attempts are refused if the number of
	     unauthenticated connections reaches ``full'' (60).

     PasswordAuthentication
	     Specifies whether password	authentication is allowed.  The
	     default is	``no'',	unless sshd was	built without PAM support, in
	     which case	the default is ``yes''.	 Note that if
	     ChallengeResponseAuthentication is	``yes'', and the PAM authenti-
	     cation policy for sshd includes pam_unix(8), password authentica-
	     tion will be allowed through the challenge-response mechanism
	     regardless	of the value of	PasswordAuthentication.

     PermitEmptyPasswords
	     When password authentication is allowed, it specifies whether the
	     server allows login to accounts with empty	password strings.  The
	     default is	``no''.

     PermitRootLogin
	     Specifies whether root can	login using ssh(1).  The argument must
	     be	``yes'', ``without-password'', ``forced-commands-only''	or
	     ``no''.  The default is ``no''.  Note that	if
	     ChallengeResponseAuthentication is	``yes'', the root user may be
	     allowed in	with its password even if PermitRootLogin is set to
	     ``without-password''.

	     If	this option is set to ``without-password'' password authenti-
	     cation is disabled	for root.  Note	that other authentication
	     methods (e.g., keyboard-interactive/PAM) may still	allow root to
	     login using a password.

	     If	this option is set to ``forced-commands-only'' root login with
	     public key	authentication will be allowed,	but only if the
	     command option has	been specified (which may be useful for	taking
	     remote backups even if root login is normally not allowed).  All
	     other authentication methods are disabled for root.

	     If	this option is set to ``no'' root is not allowed to login.

     PermitUserEnvironment
	     Specifies whether ~/.ssh/environment and environment= options in
	     ~/.ssh/authorized_keys are	processed by sshd.  The	default	is
	     ``no''.  Enabling environment processing may enable users to
	     bypass access restrictions	in some	configurations using mecha-
	     nisms such	as LD_PRELOAD.

     PidFile
	     Specifies the file	that contains the process ID of	the sshd dae-
	     mon.  The default is /var/run/sshd.pid.

     Port    Specifies the port	number that sshd listens on.  The default is
	     22.  Multiple options of this type	are permitted.	See also
	     ListenAddress.

     PrintLastLog
	     Specifies whether sshd should print the date and time when	the
	     user last logged in.  The default is ``yes''.

     PrintMotd
	     Specifies whether sshd should print /etc/motd when	a user logs in
	     interactively.  (On some systems it is also printed by the	shell,
	     /etc/profile, or equivalent.)  The	default	is ``yes''.

     Protocol
	     Specifies the protocol versions sshd supports.  The possible val-
	     ues are ``1'' and ``2''.  Multiple	versions must be comma-sepa-
	     rated.  The default is ``2''.  Note that the order	of the proto-
	     col list does not indicate	preference, because the	client selects
	     among multiple protocol versions offered by the server.  Specify-
	     ing ``2,1'' is identical to ``1,2''.

     PubkeyAuthentication
	     Specifies whether public key authentication is allowed.  The
	     default is	``yes''.  Note that this option	applies	to protocol
	     version 2 only.

     RhostsRSAAuthentication
	     Specifies whether rhosts or /etc/hosts.equiv authentication
	     together with successful RSA host authentication is allowed.  The
	     default is	``no''.	 This option applies to	protocol version 1
	     only.

     RSAAuthentication
	     Specifies whether pure RSA	authentication is allowed.  The
	     default is	``yes''.  This option applies to protocol version 1
	     only.

     ServerKeyBits
	     Defines the number	of bits	in the ephemeral protocol version 1
	     server key.  The minimum value is 512, and	the default is 768.

     StrictModes
	     Specifies whether sshd should check file modes and	ownership of
	     the user's	files and home directory before	accepting login.  This
	     is	normally desirable because novices sometimes accidentally
	     leave their directory or files world-writable.  The default is
	     ``yes''.

     Subsystem
	     Configures	an external subsystem (e.g., file transfer daemon).
	     Arguments should be a subsystem name and a	command	to execute
	     upon subsystem request.  The command sftp-server(8) implements
	     the ``sftp'' file transfer	subsystem.  By default no subsystems
	     are defined.  Note	that this option applies to protocol version 2
	     only.

     SyslogFacility
	     Gives the facility	code that is used when logging messages	from
	     sshd.  The	possible values	are: DAEMON, USER, AUTH, LOCAL0,
	     LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The
	     default is	AUTH.

     TCPKeepAlive
	     Specifies whether the system should send TCP keepalive messages
	     to	the other side.	 If they are sent, death of the	connection or
	     crash of one of the machines will be properly noticed.  However,
	     this means	that connections will die if the route is down tempo-
	     rarily, and some people find it annoying.	On the other hand, if
	     TCP keepalives are	not sent, sessions may hang indefinitely on
	     the server, leaving ``ghost'' users and consuming server
	     resources.

	     The default is ``yes'' (to	send TCP keepalive messages), and the
	     server will notice	if the network goes down or the	client host
	     crashes.  This avoids infinitely hanging sessions.

	     To	disable	TCP keepalive messages,	the value should be set	to
	     ``no''.

     UseDNS  Specifies whether sshd should lookup the remote host name and
	     check that	the resolved host name for the remote IP address maps
	     back to the very same IP address.	The default is ``yes''.

     UseLogin
	     Specifies whether login(1)	is used	for interactive	login ses-
	     sions.  The default is ``no''.  Note that login(1)	is never used
	     for remote	command	execution.  Note also, that if this is
	     enabled, X11Forwarding will be disabled because login(1) does not
	     know how to handle	xauth(1) cookies.  If UsePrivilegeSeparation
	     is	specified, it will be disabled after authentication.

     UsePAM  Enables PAM authentication	(via challenge-response) and session
	     set up.  If you enable this, you should probably disable
	     PasswordAuthentication.  If you enable then you will not be able
	     to	run sshd as a non-root user.  The default is ``yes''.

     UsePrivilegeSeparation
	     Specifies whether sshd separates privileges by creating an
	     unprivileged child	process	to deal	with incoming network traffic.
	     After successful authentication, another process will be created
	     that has the privilege of the authenticated user.	The goal of
	     privilege separation is to	prevent	privilege escalation by	con-
	     taining any corruption within the unprivileged processes.	The
	     default is	``yes''.

     VersionAddendum
	     Specifies a string	to append to the regular version string	to
	     identify OS- or site-specific modifications.  The default is
	     ``FreeBSD-20040419''.

     X11DisplayOffset
	     Specifies the first display number	available for sshd's X11 for-
	     warding.  This prevents sshd from interfering with	real X11
	     servers.  The default is 10.

     X11Forwarding
	     Specifies whether X11 forwarding is permitted.  The argument must
	     be	``yes''	or ``no''.  The	default	is ``yes''.

	     When X11 forwarding is enabled, there may be additional exposure
	     to	the server and to client displays if the sshd proxy display is
	     configured	to listen on the wildcard address (see X11UseLocalhost
	     below), however this is not the default.  Additionally, the
	     authentication spoofing and authentication	data verification and
	     substitution occur	on the client side.  The security risk of
	     using X11 forwarding is that the client's X11 display server may
	     be	exposed	to attack when the ssh client requests forwarding (see
	     the warnings for ForwardX11 in ssh_config(5)).  A system adminis-
	     trator may	have a stance in which they want to protect clients
	     that may expose themselves	to attack by unwittingly requesting
	     X11 forwarding, which can warrant a ``no''	setting.

	     Note that disabling X11 forwarding	does not prevent users from
	     forwarding	X11 traffic, as	users can always install their own
	     forwarders.  X11 forwarding is automatically disabled if UseLogin
	     is	enabled.

     X11UseLocalhost
	     Specifies whether sshd should bind	the X11	forwarding server to
	     the loopback address or to	the wildcard address.  By default,
	     sshd binds	the forwarding server to the loopback address and sets
	     the hostname part of the DISPLAY environment variable to
	     ``localhost''.  This prevents remote hosts	from connecting	to the
	     proxy display.  However, some older X11 clients may not function
	     with this configuration.  X11UseLocalhost may be set to ``no'' to
	     specify that the forwarding server	should be bound	to the wild-
	     card address.  The	argument must be ``yes'' or ``no''.  The
	     default is	``yes''.

     XAuthLocation
	     Specifies the full	pathname of the	xauth(1) program.  The default
	     is	/usr/X11R6/bin/xauth.

   Time	Formats
     sshd command-line arguments and configuration file	options	that specify
     time may be expressed using a sequence of the form: time[qualifier],
     where time	is a positive integer value and	qualifier is one of the	fol-
     lowing:

	   <none>  seconds
	   s | S   seconds
	   m | M   minutes
	   h | H   hours
	   d | D   days
	   w | W   weeks

     Each member of the	sequence is added together to calculate	the total time
     value.

     Time format examples:

	   600	   600 seconds (10 minutes)
	   10m	   10 minutes
	   1h30m   1 hour 30 minutes (90 minutes)

FILES
     /etc/ssh/sshd_config
	     Contains configuration data for sshd.  This file should be
	     writable by root only, but	it is recommended (though not neces-
	     sary) that	it be world-readable.

SEE ALSO
     sshd(8)

AUTHORS
     OpenSSH is	a derivative of	the original and free ssh 1.2.12 release by
     Tatu Ylonen.  Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo
     de	Raadt and Dug Song removed many	bugs, re-added newer features and cre-
     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
     for privilege separation.

FreeBSD	9.2		      September	25, 1999		   FreeBSD 9.2

NAME | SYNOPSIS | DESCRIPTION | FILES | SEE ALSO | AUTHORS

Want to link to this manual page? Use this URL:
<http://www.freebsd.org/cgi/man.cgi?query=sshd_config&sektion=5&manpath=FreeBSD+5.3-RELEASE>

home | help