SSHD2_CONFIG(5)

NAME
sshd2_config - format of configuration file for sshd2

CONFIGURATION FILE
Sshd2 reads configuration data from /etc/ssh2/sshd2_config (or the file specified with -f on the command line). The file contains keyword-value pairs, one per line. Lines starting with '#' and empty lines are interpreted as comments. For a description of the configuration file format, see ssh2_config(5). The following keywords are possible. The keywords are not case-sensitive.

AllowAgentForwarding or ForwardAgent
    Specifies whether agent forwarding is permitted. This parameter is implemented mainly for completeness. Usually, you should allow users to freely forward agent connections. The argument must be The default is "yes".

AllowedAuthentications
    This keyword specifies the authentication methods that are allowed. Please note that the order is important when you are trying to connect. If you put hostbased first, the program will try hostbased before trying any of the other means of authentication. This is a comma-separated list currently consisting of the following words: password, publickey, pam-1@ssh.com, kerberos-1@ssh.com, kerberos-tgt-1@ssh.com, kerberos-2@ssh.com, kerberos-tgt-2@ssh.com, securid-1@ssh.com, and hostbased. Each specifies an authentication method. The default is "publickey,password". With RequiredAuthentications, the system administrator can force the users to complete several authentications before they are considered authenticated. Like in AllowedAuthentications, the order of operations is important. The same options for AllowedAuthentications are used here. Note: versions of sshd2 before 3.1.0 required RequiredAuthentications to be a subset of AllowedAuthentications. This is no longer the case, and if RequiredAuthentications is specified, AllowedAuthentications is simply ignored.

AllowGroups
    This keyword can be followed by any number of group name patterns, separated by commas. If specified, login is allowed only if one of the groups the user belongs to matches one of the patterns. Patterns are matched using the egrep syntax (see sshregex(1)), or the syntax specified by ``metaconfig''. You can use the comma ',' character in the patterns by escaping it with '\' (backslash). By default, all users are allowed to log in. Note that the all other login authentication steps must still be successfully completed. AllowGroups and DenyGroups are additional restrictions.

AllowHosts
    This keyword can be followed by any number of host name patterns, separated by commas. If specified, login is allowed only from hosts whose name matches one of the patterns. Patterns are matched using the egrep syntax (see sshregex(1)), or the syntax specified by ``metaconfig''. If you wish that the pattern will only be matched with the host's IP address (thereby ignoring the canonical host name), you should prefix your pattern with "\i". You can also use subnet masks (e.g `127.0.0.0/8') by prefixing the pattern with "\m". Normal name servers are used to map the client's host name into a canonical host name. If the name cannot be mapped, the IP address is used as the host name. By default, all hosts are allowed to connect. Note that sshd2 can also be configured to use tcp_wrappers using the --with-libwrap compile-time configuration option.

AllowSHosts
    This keyword can be followed by any number of host name patterns, separated by commas. If specified, the .shosts (and .rhosts, /etc/hosts.equiv and /etc/shosts.equiv) entries are only honored for hosts whose name matches one of the patterns. Otherwise, this parameter is parsed and matched the same way as AllowHosts.

AllowTcpForwarding
    Specifies whether TCP forwarding is permitted. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. The argument must be The default is "yes".

AllowTcpForwardingForGroups
    The syntax is the same as in AllowGroups, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

AllowTcpForwardingForUsers
    Syntax is the same as in AllowUsers, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

AllowUsers
    This keyword can be followed by any number of user name patterns or user@host patterns, separated by commas. Host name is handled as a pattern, so the rules below apply. Host name can also be a pure DNS name or the IP address. If you want to match only the numerical IP-address, prefix pattern with "\i" (see AllowHosts). If specified, login is allowed as users whose name matches one of the patterns. Patterns are matched using the egrep syntax (see sshregex(1)), or the syntax specified by ``metaconfig''. You can use the comma ',' character in the patterns by escaping it with '\' (backslash). By default, all users are allowed to log in. Note that all the other login authentication steps must still be successfully completed. AllowUsers and DenyUsers are additional restrictions.

AllowX11Forwarding or X11Forwarding or ForwardX11
    Specifies whether X11 forwarding is permitted. The default is "yes". Note that disabling X11 forwarding does not improve security in any way, as users can always install their own forwarders. The argument must be

AuthorizationFile
    Specifies the name of the user's authorization file.

BannerMessageFile
    Specifies the path to the message that is sent to the client before authentication. Note, however, that the client is not obliged to show this message. The default is /etc/ssh2/ssh_banner_message.

CheckMail
    Specifies if sshd should print information whether there is new mail or not when a user logs in interactively. (On some systems this information is also printed by the shell, /etc/profile, or equivalent.) The argument must be The default is "yes".

ChRootGroups
    Specifies whether sshd should give the user who belongs to the defined group a chrooted environment. This keeps the user who belongs to this group in a "jail" where they can only move around in their home directory and lower. This is not a default option, but it can be added, and the groups are defined on the server in /etc/group. More than one group can be listed, and the groups must be separated by a comma. Otherwise, this option follows the logic of DenyGroups.

ChRootUsers
    Specifies whether sshd should give the user a chrooted environment. This keeps the user in a "jail" where they can only move around in their home directory and lower. This is not a default option, but it can be added, and the users are defined on the server in /etc/passwd. More than one user can be listed, and the users must be separated by a comma. Otherwise, this option follows the logic of DenyUsers.

Ciphers
    Specifies the ciphers to use for encrypting the session. Currently, aes, blowfish, twofish, arcfour, cast, 3des, and des are supported. Multiple ciphers can be specified as a comma-separated list. Special values to this option are any, anystd that allows only standard (see below) ciphers (and 'none'), and anycipher that allows either any available cipher or excludes nonencrypting cipher mode none but allows all others. anystdcipher is the same as anycipher above, but includes only those ciphers mentioned in the IETF-SecSH-draft (excluding 'none').

DenyGroups
    This keyword can be followed by any number of group name patterns, separated by commas. If specified, login is denied if one of the groups the user belongs to matches one of the patterns. Otherwise, this option is parsed and matched identically with AllowGroups. By default, all users are allowed to log in. If a user's group matches with both a pattern in DenyGroups and one in AllowGroups, login will be denied. Note that the all other login authentication steps must still be successfully completed. AllowGroups and DenyGroups are additional restrictions.

DenyHosts
    This keyword can be followed by any number of host name patterns, separated by commas. If specified, login is disallowed from hosts whose names match any of the patterns. See AllowHosts.

DenySHosts
    This keyword can be followed by any number of host name patterns, separated by commas. If specified, .shosts (and .rhosts, /etc/hosts.equiv and /etc/shosts.equiv) entries whose name matches any of the patterns will be ignored. See AllowSHosts.

DenyTcpForwardingForGroups
    The syntax is the same as in DenyGroups, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

DenyTcpForwardingForUsers
    The syntax is the same as in DenyUsers, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

DenyUsers
    This keyword can be followed by any number of user name patterns or user@host patterns, separated by commas. If specified, login is disallowed as users whose name matches one of the patterns. Otherwise, this option is parsed and matched identically with AllowUsers. If a user's name matches with both a pattern in DenyUsers and one in AllowUsers, login is denied. Note that the all other login authentication steps must still be successfully completed. AllowUsers and DenyUsers are additional restrictions.

ForcePTTYAllocation
    Force tty allocation, i.e., allocate a tty even if a command is given. The argument must be (not yet implemented)

ForwardAgent
    See AllowAgentForwarding.

HostbasedAuthForceClientHostnameDNSMatch
    If the host name given by the client does not match the one found in DNS, fail host-based authentication. (defaults to "no". Note that this differs from 2.4 and earlier releases.)

HostKeyFile
    Specifies the file containing the private host key (default /etc/ssh2/hostkey).

IdleTimeOut
    Sets the idle timeout limit to time in seconds (s or nothing after number), in minutes (m), in hours (h), in days (d), or in weeks (w). If the connection has been idle (all channels) for that long time, the connection is closed down.

IdentityFile
    Specifies the file containing the identity user public key (default identification).

IgnoreRhosts
    Specifies that the rhosts and shosts files will not be used in "hostbased" authentication (see AllowedAuthentications). /etc/hosts.equiv and /etc/shosts.equiv are still used (if "hostbased" authentication is used). The argument must be The default is "no".

IgnoreRootRhosts
    Specifies that the rhosts and shosts files will not be used in authentication for root. The default is the value of IgnoreRhosts.

KeepAlive
    Specifies whether the system should send keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find it annoying. On the other hand, if keepalives are not sent, sessions may hang indefinitely on the server, leaving "ghost" users and consuming server resources. The default is "yes" (to send keepalives), and the server will notice if the network goes down or the client host reboots. This avoids infinitely hanging sessions. To disable keepalives, the value should be set to "no" in both the server and the client configuration files.

ListenAddress
    Specifies the IP address of the interface where the sshd2 server socket is bound.

LoginGraceTime
    The server disconnects after this time if the user has not successfully logged in. If the value is 0, there is no time limit. The default is 600 (seconds).

MACs
    Specifies the MAC (Message Authentication Code) algorithm to use for data integrity verification. Currently, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160 and hmac-ripemd160-96 are supported, of which hmac-sha1, hmac-sha1-96, hmac-md5 and hmac-md5-96 are included in all distributions. Multiple MACs can be specified as a comma-separated list. Special values to this option are any, anystd, that allows only standard (see below) MACs (and 'none'), and anymac that allows either any available MAC or excludes none but allows all others. anystdmac is the same as anymac above, but includes only those MACs mentioned in the IETF-SecSH-draft (excluding 'none').

MaxBroadcastsPerSecond
    Specifies how many UDP broadcasts server handles per second. The default value is 0 and no broadcasts are handled at all. Broadcasts that exceed the limit are silently ignored. Received unrecognized UDP datagrams also consume the capacity defined by this option.

MaxConnections
    Specifies the maximum number of connections sshd2 will handle simultaneously. This is useful in systems where spamming sshd2 with new connections can cause the system to become unstable or crash. The argument is a positive number. 0 means that number of connections is unlimited (by sshd2). Note that by using (at least) xinetd you achieve the same effect.

NoDelay
    If "yes", enable socket option TCP_NODELAY. The argument must be Default is "no".

PasswordGuesses
    Specifies the number of tries that the user has when using password authentication. The default is 3. Then, shalt thou count to three. No more. No less.

PermitEmptyPasswords
    When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The argument must be

PermitRootLogin
    Specifies whether the root can log in using ssh2. May be set to "yes", "nopwd", or "no". The default is "yes", allowing root logins through any of the authentication types allowed for other users. The "nopwd" value disables password-authenticated root logins. The "no" value disables root logins through any of the authentication methods. ("nopwd" and "no" are equivalent unless you have a .rhosts or .shosts in the root home directory and you have not set up public key authentication for root.) Root login with public-key authentication when the "command" option has been specified will be allowed regardless of the value of this setting (which may be useful for taking remote backups even if root login is normally not allowed).

Port
    Specifies the port number that sshd2 listens on. The current default is 22.

PrintMotd
    Specifies whether sshd2 should print /etc/motd when a user logs in interactively. The default is "yes". The argument must be

PublicHostKeyFile
    Specifies the file containing the public host key (default /etc/ssh2/hostkey.pub). Note: In most cases, the order of configuration parameters is not an issue. Here, it is safe if you specify HostKeyFile first before this parameter.

QuietMode
    Specifies whether the system runs in quiet mode. In quiet mode, nothing is logged in the system log, except fatal errors. The argument must be

RandomSeedFile
    Specifies the name of the random seed file.

RekeyIntervalSeconds
    Specifies the interval in seconds at which the key exchange will be done again. The default is 3600 seconds (1 hour). A value of '0' turns rekey requests off. This does not prevent the client from requesting rekeys. Other clients (not ssh2) may not have rekey capabilities implemented correctly, and they might not like rekey requests. This means that they may possibly close the connection or even crash.

RequiredAuthentications
    Related to AllowedAuthentications, this is used to specify what authentication methods the users must complete before continuing. If this value is left empty, it does not mean that no authentications are required. It means that the client can authenticate itself with any of the authentications given in AllowedAuthentications. This parameter has no default. Note: versions of sshd2 before 3.1.0 required RequiredAuthentications to be a subset of AllowedAuthentications. This is no longer the case, and if RequiredAuthentications is specified, AllowedAuthentications is simply ignored.

RequireReverseMapping
    This is used to check whether hostname DNS lookup must succeed when checking whether connections from host are allowed using AllowHosts and DenyHosts. If this is set to yes, then if name lookup fails, the connection is denied. If set to no, if name lookup fails, the remote host's IP address is used to check whether it is allowed to connect. This is probably not what you want if you have specified only host names (not IP addresses) with {Allow,Deny}Hosts. The default is "no". The argument must be

SettableEnvironmentVars
    This keyword can be followed by any number of patterns, separated by commas. Patterns are matched using the egrep syntax (see sshregex(1)), or the syntax specified by ``metaconfig''. You can use the comma ',' character in the patterns by escaping it with '\' (backslash). By default, no environment variables can be set (but the default /etc/ssh2/sshd2_config file specifies some common and safe environment variables). With this option, you can allow setting of some or all environment variables. This option is used to check whether setting is allowed by the client (ssh2), by the user's $HOME/.ssh2/environment file or public key options. This is not used when setting variables from /etc/environment or other "root-only" files, as the user doesn't have control over those anyway. Note that this option only changes the setting of environment variables before the user's shell is run. After that, the user is of course free to set whatever variables she wants on that environment.

Ssh1Compatibility
    Specifies whether to use SSH1 compatibility code. With this option, sshd1 is executed when the client supports only SSH 1.x protocols. The argument must be

Sshd1ConfigFile
    Specifies alternate config file to specify for sshd1, when it is executed by sshd2 in compatibility mode. Note: this is only used, if sshd2 is executed with the "-f" argument.

Sshd1Path
    Specifies the path to sshd1 daemon which will be executed if the client supports only SSH 1.x protocols. The arguments for sshd2 are passed on to sshd1.

SshPAMClientPath
    Specifies the path to ssh-pam-client, which is used as a helper application to converse with the PAM modules by sshd2.

StrictModes
    Specifies whether sshd2 should check file modes and ownership of the user's home directory and rhosts files before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The argument must be The default is "yes". (not yet implemented)

Subsystem-<subsystem name>
    Specifies a subsystem. The argument is a command which will be executed when the subsystem is requested. Sftp uses a subsystem of sshd2 to transfer files securely. In order to use the sftp server, you must have the following subsystem definition:
    subsystem-sftp    sftp-server

SyslogFacility
    Gives the facility code that is used when logging messages from sshd2. The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH.

UserConfigDirectory
    Specifies where user-specific configuration data should be fetched from. With this the administration can control whatever configuration parameters they wish that are normally the users' domain. This is given as a pattern string which is expanded by sshd2. %D is the user's home directory, %U is user's login name, %IU is the user's user ID (uid) and %IG is his group ID (gid). The default is %D/.ssh2.

UserKnownHosts
    Specifies whether the user's $HOME/.ssh2/knownhosts/ directory can be used to fetch host public keys when using "hostbased" authentication. The argument must be The default is "yes".

VerboseMode
    Verbose mode. Causes sshd2 to print debugging messages about its progress. This is helpful in debugging connection, authentication, and configuration problems. Also causes sshd2 to not fork on connection, so only one connection is handled.

AUTHORS

SSH Communications Security Corp For more information, see http://www.ssh.com.

SEE ALSO
sshd2(8), sshd-check-conf(5), sshregex(1)