SSHD2_CONFIG(5)

NAME
sshd2_config - format of configuration file for sshd2

CONFIGURATION FILE
Sshd2 reads configuration data from /etc/ssh2/sshd2_config (or the file specified with -f on the command line). The file contains keyword-value pairs, one per line. Lines starting with '#' and empty lines are interpreted as comments. The following keywords are possible. Keywords are case insensitive.

AllowAgentForwarding or ForwardAgent
    Specifies whether agent forwarding is permitted. This parameter is implemented mainly for completeness. Usually you should allow users to forward agent connections freely. The argument must be The default is "yes".

AllowedAuthentications
    This keyword specifies the authentications methods that are allowed. This is a comma-separated list currently consisting of the following words: password, publickey and hostbased. Each specifies an authentication method. The default is "publickey,password". With RequiredAuthentications, sysadmin can force users to complete several authentications before they are considered authenticated.

AllowCshrcSourcingWithSubsystems
    If set to "no", gives additional "-f" argument to csh or tcsh when executing subsystems to prevent commands in .cshrc (or .tcshrc) from interfering with, for example, the sftp-server subsystem. The default is "no". The argument must be

AllowGroups
    This keyword can be followed by any number of group name patterns, separated by commas. If specified, login is allowed only if users primary group name matches one of the patterns. Patterns are matched using the zsh-fileglob-syntax (see sshregex(1)). You can use the comma ',' character in the patterns by escaping it with '\' (backslash). If you want to use the escape character in the patterns, you have to escape it ('\\'). By default, logins as all users are allowed. Note that the all other login authentication steps must still be successfully completed. AllowGroups and DenyGroups are additional restrictions.

AllowHosts
    This keyword can be followed by any number of host name patterns, separated by spaces. If specified, login is allowed only from hosts whose name matches one of the patterns. Patterns are matched using the zsh-fileglob-syntax (see sshregex(1)). Normal name servers are used to map the client's host into a canonical host name. If the name cannot be mapped, its IP-address is used as the host name. By default all hosts are allowed to connect. Note that sshd2 can also be configured to use tcp_wrappers using the --with-libwrap compile-time configuration option. Note also, that to prevent people going around this parameter and logging in from hosts like 130.233.evil.org, you should use the [:isdigit:] or similar constructs.

AllowSHosts
    This keyword can be followed by any number of host name patterns, separated by spaces. If specified, the .shosts (and .rhosts, /etc/hosts.equiv and /etc/shosts.equiv) entries are only honored for hosts whose name matches one of the patterns. servers are used to map the client's host into a canonical host name. If the name cannot be mapped, its IP-address is used as the host name. By default all hosts are allowed to connect.

AllowTcpForwarding
    Specifies whether tcp forwarding is permitted. Note that disabling tcp forwarding does not improve security in any way, as users can always install their own forwarders. The argument must be The default is "yes".

AllowTcpForwardingForGroups
    The syntax is the same as in AllowGroups, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

AllowTcpForwardingForUsers
    Syntax is the same as in AllowUsers, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

AllowUsers
    This keyword can be followed by any number of user name patterns or user@host patterns, separated by commas. Host name is handled as a pattern, so rules below apply. Host name can also be a pure DNS name or the IP address. If specified, login is allowed as users whose name matches one of the patterns. Patterns are matched using the zsh-fileglob-syntax (see sshregex(1)). You can use the comma ',' character in the patterns by escaping it with '\' (backslash). If you want to use the escape character in the patterns, you have to escape it ('\\'). By default, logins as all users are allowed. Note that the all other login authentication steps must still be successfully completed. AllowUsers and DenyUsers are additional restrictions.

AllowX11Forwarding or X11Forwarding or ForwardX11
    Specifies whether X11 forwarding is permitted. The default is "yes". Note that disabling X11 forwarding does not improve security in any way, as users can always install their own forwarders. The argument must be

AuthorizationFile
    Specifies the name of the user's authorization file.

CheckMail
    Specifies whether sshd should print information whether you have new mail or not when a user logs in interactively. (On some systems it is also printed by the shell, /etc/profile, or equivalent.) The argument must be The default is "yes".

ChRootGroups
    Specifies whether sshd should give the user who belongs to the defined group a chrooted environment. This keeps the user who belongs to this group in a "jail" where they can only move around in their home directory and lower. This is not a default option, but it can be added, and the groups are defined on the server in /etc/group. More than one group can be listed and must be separated by a comma. Note, that to be effective, the user's primary group should be set to said group.

ChRootUsers
    Specifies whether sshd should give the user a chrooted environment. This keeps the user in a "jail" where they can only move around in their home directory and lower. This is not a default option, but it can be added, and the users are defined on the server in /etc/passwd. More than one user can be listed and must be separated by a comma.

Ciphers
    Specifies the ciphers to use for encrypting the session. Currently, des, 3des, blowfish, idea, arcfour and twofish are supported, of which des, 3des, arcfour, blowfish and twofish are included in all distributions. Multiple ciphers can be specified as a comma-separated list. Special values to this option are any, anystd, that allows only standard (see below) ciphers, and anycipher that allows either any available cipher or excludes nonencrypting cipher mode none but allows all others. anystdcipher is the same as above, but includes only those ciphers mentioned in the IETF-SecSH-draft (excluding 'none').

DenyGroups
    This keyword can be followed by any number of group name patterns, separated by commas. If specified, login is denied if users primary group name matches one of the patterns. Patterns are matched using the zsh-fileglob-syntax (see sshregex(1)). You can use the comma ',' character in the patterns by escaping it with '\' (backslash). If you want to use the escape character in the patterns, you have to escape it ('\\'). By default, logins as all users are allowed. If a user's primary group matches with both a pattern in DenyGroups and AllowGroups, login is denied. Note that the all other login authentication steps must still be successfully completed. AllowGroups and DenyGroups are additional restrictions.

DenyHosts
    This keyword can be followed by any number of host name patterns, separated by commas. If specified, login is disallowed from the hosts whose name matches any of the patterns. See AllowHosts.

DenySHosts
    This keyword can be followed by any number of host name patterns, separated by spaces. If specified, .shosts (and .rhosts, /etc/hosts.equiv and /etc/shosts.equiv) entries whose name matches any of the patterns are ignored.

DenyTcpForwardingForGroups
    The syntax is the same as in DenyGroups, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

DenyTcpForwardingForUsers
    The syntax is the same as in DenyUsers, but instead of login, this controls the ability to forward ports, in remote or local forwarding. Note that disabling TCP forwarding does not improve security in any way, as users can always install their own forwarders. This does, however, help if you deny the user shell access at the same time. See ssh-dummy-shell(1). The argument must be Forwarding is enabled by default.

DenyUsers
    This keyword can be followed by any number of user name patterns or user@host patterns, separated by commas. Host name is handled as a pattern, so rules below apply. Host name can also be a pure DNS name or the IP address. If specified, login is disallowed as users whose name matches one of the patterns. Patterns are matched using the zsh-fileglob-syntax (see sshregex(1)). You can use the comma ',' character in the patterns by escaping it with '\' (backslash). If you want to use the escape character in the patterns, you have to escape it ('\\'). By default, logins as all users are allowed. If a user's name matches with both a pattern in DenyUsers and AllowUsers, login is denied. Note that the all other login authentication steps must still be successfully completed. AllowUsers and DenyUsers are additional restrictions.

ForcePTTYAllocation
    For tty allocation, ie. allocate a tty even if a command is given. The argument must be (not yet implemented)

ForwardAgent
    Specifies whether the connection to the authentication agent (if any) will be forwarded to the remote machine. The argument must be

HostKeyFile
    Specifies the file containing the private host key (default /etc/ssh2/hostkey).

IgnoreRhosts
    Specifies that rhosts and shosts files will not be used in "hostbased"-authentication (see AllowedAuthentications). /etc/hosts.equiv and /etc/shosts.equiv are still used (if "hostbased" authentication is used). The argument must be The default is "no".

IgnoreRootRhosts
    Specifies that rhosts and shosts files will not be used in authentication for root. The default is the value of IgnoreRhosts.

KeepAlive
    Specifies whether the system should send keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find it annoying. On the other hand, if keepalives are not send, sessions may hang indefinitely on the server, leaving "ghost" users and consuming server resources. The default is "yes" (to send keepalives), and the server will notice if the network goes down or the client host reboots. This avoids infinitely hanging sessions. To disable keepalives, the value should be set to "no" in both the server and the client configuration files.

ListenAddress
    Specifies the ip address of the interface where the sshd2 server socket is bind.

LoginGraceTime
    The server disconnects after this time if the user has not successfully logged in. If the value is 0, there is no time limit. The default is 600 (seconds).

MACs
    Specifies the MAC (Message Authentication Code) algorithm to use for data integrity verification. Currently, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96, hmac-ripemd160 and hmac-ripemd160-96 are supported, of which hmac-sha1, hmac-sha1-96, hmac-md5 and hmac-md5-96 are included in all distributions. Multiple MACs can be specified as a comma-separated list. Special values to this option are any, anystd, that allows only standard (see below) MACs, and anymac that allows either any available MAC or excludes none but allows all others. anystdmac is the same as above, but includes only those MACs mentioned in the IETF-SecSH-draft (excluding 'none').

MaxBroadcastsPerSecond
    Specifies how many UDP broadcasts server handles per second. The default value is 0 and no broadcasts are handled at all. Broadcasts that exceed the limit are silently ignored. Also unrecognized UDP datagrams received consume the capacity defined by this option.

MaxConnections
    Specifies the maximum number of connections sshd2 will handle simultaneously. This is useful in systems where spamming sshd2 with new connections can cause the system to become unstable or crash. The argument is a positive number. 0 means that number of connections is unlimited (by sshd2). Note that by using (at least) xinetd you achieve the same effect.

NoDelay
    If "yes", enable socket option TCP_NODELAY. The argument must be Default is "no".

PasswordAuthentication
    Specifies whether to use password authentication. The argument must be Note: This keyword is deprecated. Use AllowedAuthentications and RequiredAuthentications.

PasswordGuesses
    Specifies the number of tries that the user has when using password authentication. The default is 3. Then, shalt thou count to three. No more. No less.

PermitEmptyPasswords
    When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. The argument must be

PermitRootLogin
    Specifies whether the root can log in using ssh2. May be set to "yes", "nopwd", or "no". The default is "yes", allowing root logins through any of the authentication types allowed for other users. The "nopwd" value disables password-authenticated root logins. The "no" value disables root logins through any of the authentication methods. ("nopwd" and "no" are equivalent unless you have a .rhosts or .shosts in the root home directory and you haven't set up public key authentication for root.) Root login with public key authentication when the "command" option has been specified will be allowed regardless of the value of this setting (which may be useful for taking remote backups even if root login is normally not allowed). The default is "yes".The argument must be

Port
    Specifies the port number that sshd2 listens on. The current default is 22.

PrintMotd
    Specifies whether sshd2 should print /etc/motd when a user logs in interactively. The default is "yes". The argument must be

PubKeyAuthentication
    Specifies whether to try public key authentication. RSAAuthentication is a synonym for this keyword, and it is defined for backwards compatibility with ssh1. The argument must be Note: This keyword is deprecated. Use AllowedAuthentications and RequiredAuthentications.

PublicHostKeyFile
    Specifies the file containing the public host key (default /etc/ssh2/hostkey.pub). Note: In most cases the order of config parameters isn't an issue. Here it is safe if you specify HostKeyFile first before this parameter.

RandomSeedFile
    Specifies the name of the randomseed file.

RequiredAuthentications
    Related to AllowedAuthentications, this is used to specify what authentication methods the users must complete before continuing. If this value is left empty, it does not mean that no authentications are required. It means that the client can authenticate itself with any of the authentications given in AllowedAuthentications. This parameter has no default. Note: This parameter has to be a subset for AllowedAuthentications. Otherwise, the server denies connection every time.

RequireReverseMapping
    This is used to check whether hostname DNS lookup must succeed when checking whether connections from host are allowed using AllowHosts and DenyHosts. If this is set to yes, then if name lookup fails, the connection is denied. If set to no, if name lookup fails, the remote host's IP-address is used to check whether it is allowed to connect. This is probably not what you want, if you have specified only hostnames (not IP-addresses) with {Allow,Deny}Hosts. The default is "no". The argument must be

QuietMode
    Specifies whether the system runs in quiet mode. In quiet mode, nothing is logged in the system log, except fatal errors. The argument must be

Ssh1Compatibility
    Specifies whether to use SSH1 compatibility code. With this option, sshd1 is executed when the client supports only SSH 1.x protocols. The argument must be

Sshd1Path
    Specifies the path to sshd1 daemon, which is executed if the client supports only SSH 1.x protocols. The arguments for sshd2 are passed on to sshd1.

StrictModes
    Specifies whether sshd2 should check file modes and ownership of the user's home directory and rhosts files before accepting login. This is normally desirable because novices sometimes accidentally leave their directory or files world-writable. The argument must be The default is "yes". (not yet implemented)

SyslogFacility
    Gives the facility code that is used when logging messages from sshd2. The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH.

UserConfigDirectory
    Specifies where user-specific configuration data should be fetched from. With this the administration can control whatever configuration parameters they wish that are normally the users' domain. This is given as a pattern string, which is expanded by sshd2. %D is the user's home directory, %U is user's login name, %IU is the user's user ID (uid) and %IG is his group ID (gid). The default is %D/.ssh2.

UserKnownHosts
    Specifies whether user's $HOME/.ssh2/knownhosts/ -directory can be used to fetch hosts public keys when using "hostbased"-authentication. The argument must be The default is "yes".

VerboseMode
    Verbose mode. Causes sshd2 to print debugging messages about its progress. This is helpful in debugging connection, authentication, and configuration problems. Also causes sshd2 to not fork on connection, so only one connection is handled.

AUTHORS

SSH Communications Security Corp For more information, see http://www.ssh.com.

SEE ALSO
sshd2(8)