OpenSSH server configuration directives¶

Synopsis¶

/etc/ssh/sshd_config
/etc/ssh/sshd_config.d/*.conf

Keyword argument [argument …]

Match criterion pattern [criterion pattern …]
    Keyword argument

Description¶

sshd_config is the configuration file of the OpenSSH server, sshd(8). Each line holds a keyword followed by one or more arguments, separated by spaces (or an optional =). Keywords are case-insensitive; arguments are case-sensitive. Lines starting with #, and empty lines, are ignored. Arguments containing spaces can be enclosed in double quotes.

For most keywords, the first value read is used and later values are ignored. Keywords that accept lists, such as AllowUsers, AcceptEnv, HostKey, ListenAddress and Port, accumulate values from every occurrence instead.

Include reads further files at the point where it appears. On Debian, Ubuntu, AlmaLinux, Rocky Linux and Arch, /etc/ssh/sshd_config has Include /etc/ssh/sshd_config.d/*.conf before any active (uncommented) setting, so drop-in files are read before the active settings of the main file and, because the first value wins, take precedence over them. On Gentoo the Include line is near the end of the file, after the commented-out defaults, with a comment saying that all Match blocks must follow it; a setting uncommented above it is read first and takes precedence over the drop-in files. Drop-in files are read in lexical order of their names.

This page was checked against the following OpenSSH packages in the Magellanic labs:

The Default columns below give the built-in default, as printed by sshd -T -f /dev/null (which reads no configuration file). It was the same on every listed distribution unless a note says otherwise. On AlmaLinux 10 and Rocky Linux 10, the algorithm lists that are actually used come from the system crypto policy rather than these built-in defaults; see Cryptography. Distributions change several defaults in the files they ship; see Distribution settings. Only the most commonly used directives are listed; sshd_config(5) on your system is the complete list for its version.

Value types¶

• yes/no: a boolean.
• Time: seconds, or a number with a unit: s, m, h, d or w (for example 90s, 2m, 1h30m). 0 usually means no limit.
• Pattern list: comma-separated patterns, where * matches any characters, ? one character, and a leading ! negates a pattern.
• Algorithm list: comma-separated names. A leading + appends to the default list, - removes from it, and ^ places the names at the front of it.

Authentication¶

Access control¶

Users and groups are refused if they match a deny directive, or if any allow directive is set and they don't match it. AllowUsers, DenyUsers, AllowGroups and DenyGroups may appear more than once; each occurrence adds to the list. Only names are valid, not numeric IDs.

Listening¶

On Ubuntu 26.04, sshd is started through the systemd socket unit ssh.socket, which listens on the port itself; the Port and ListenAddress settings are translated into that unit's configuration by a generator when systemd reloads its configuration.

Forwarding¶

Disabling forwarding doesn't stop a user who has shell access from running their own forwarding software.

Session¶

Cryptography¶

On AlmaLinux 10 and Rocky Linux 10, the algorithm lists and RequiredRSASize are set by the system-wide crypto policy, which is included through /etc/ssh/sshd_config.d/40-redhat-crypto-policies.conf from /etc/crypto-policies/back-ends/opensshserver.config. With the DEFAULT policy, RequiredRSASize is 2048 and KexAlgorithms begins with mlkem768x25519-sha256, as on the other distributions. List the algorithms a build supports with ssh -Q kex, ssh -Q cipher, ssh -Q mac and ssh -Q key.

Logging¶

At INFO, a successful login is logged with the method and, for public keys, the key type and fingerprint, for example Accepted publickey for alice from 192.0.2.10 port 50122 ssh2: ED25519 SHA256:…. On systemd distributions these messages are in the journal of the SSH service unit; on Gentoo with OpenRC they go to the system logger, which with Gentoo's sysklogd configuration writes them to /var/log/auth.log.

Match blocks¶

Match criterion pattern [criterion pattern …]
    Keyword argument
    …

A Match line starts a conditional block. If every criterion on the line matches the connection, the keywords that follow apply to it, until the next Match line or the end of the file. Settings in a matching block override the global value of the same keyword for that connection, wherever the global value was set. If several matching blocks set the same keyword, the first one applies. Because every line after a Match line belongs to the block, Match blocks are normally placed at the end of a file. Match All matches every connection, and is commonly used to end a block early.

Patterns are pattern lists, so Match User alice,bob and Match Address !192.0.2.0/24 are valid. Check sshd_config(5) on your system for criteria added in later releases.

Only some keywords are accepted inside a Match block, mostly those that control authentication, access and forwarding. sshd -t reports a keyword that isn't allowed there.

Distribution settings¶

Settings in the files each distribution ships, as found in the Magellanic lab images. Lines marked cloud come from cloud-init (/etc/ssh/sshd_config.d/50-cloud-init.conf) or from cloud image settings, and are not present on a system installed from the normal installer.

The Gentoo values were observed on Gentoo with OpenRC, where the service is controlled with rc-service sshd. On Gentoo with a systemd profile, systemd also installs the 20-systemd-userdb.conf drop-in that sets AuthorizedKeysCommand, as on Arch.

Examples¶

Show the configuration sshd would use, after reading every file:

sudo sshd -T

Show the configuration that applies to one connection, including Match blocks:

sudo sshd -T -C user=alice,host=client.example.com,addr=192.0.2.10

Check the configuration files for errors without changing the running server:

sudo sshd -t

A drop-in file that allows only public keys and only members of one group, and lets one group use passwords from an internal network:

# /etc/ssh/sshd_config.d/10-example.conf
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
AllowGroups ssh-users sftp-only

Match Group sftp-only Address 198.51.100.0/24
    PasswordAuthentication yes
    ForceCommand internal-sftp
    ChrootDirectory /srv/sftp/%u
    DisableForwarding yes

Files¶

See also¶

• sshd_config(5), sshd(8) and ssh_config(5) (for the PATTERNS section), from the OpenSSH versions listed above
• OpenSSH manual pages and release notes, for changes between versions
• How to harden the SSH server

Related¶

• Tutorial: Log in with SSH keys
• How-to: How to harden the SSH server
• Explanation: How SSH authentication works