OpenSSH Server

Synopsis #

sshd(8) is the OpenSSH daemon in the OpenBSD base system. It provides encrypted remote shells, remote command execution, file transfer, and optional forwarding. The daemon reads sshd_config(5) from /etc/ssh/sshd_config.

For first-time setup, create an administrator account . Configure Secure Remote Access with OpenSSH provides a lockout-safe procedure for replacing password access with keys. Audit OpenSSH explains algorithm policy, post-quantum key exchange, and ssh-audit findings. Use FIDO Security Keys with OpenSSH covers hardware-backed credentials. This page is a concise operational reference.

Manage the Service #

Inspect, enable, and start the daemon with rcctl(8) :

doas rcctl check sshd
  # Report whether the service is running
doas rcctl enable sshd
  # Enable the service at boot
doas rcctl start sshd
  # Start it now when it is not already running

The installer normally creates host keys. Generate only missing host keys with ssh-keygen(1) :

doas ssh-keygen -A

Display the server’s Ed25519 host-key fingerprint for verification through an independent channel:

doas ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Validate Server Configuration #

Validate configuration syntax and host-key files with sshd(8) before reloading the service with rcctl(8) :

doas sshd -t
  # Produce no output when validation succeeds
doas rcctl reload sshd
  # Apply the validated configuration without ending established sessions

Many defaults are not active lines in /etc/ssh/sshd_config. Inspect the effective configuration with sshd -T:

doas sshd -T | grep -Ei '^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication) '

Settings inside a Match block depend on connection attributes. Supply representative values with -C:

doas sshd -T -C user=admin,addr=198.51.100.25,host=client.example.com

This command evaluates matching only and does not create a connection. A Match block remains in effect until another Match directive or the end of the file. Place global directives before the first Match block. When more than one satisfied block specifies a keyword, the first obtained value is used.

Configure Public-Key Authentication #

Generate an Ed25519 key on the client with ssh-keygen(1) and protect the private key with a passphrase:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

While an existing authentication method still works, use ssh(1) to append the public key to the remote account:

ssh admin@host.example.com 'umask 077; mkdir -p .ssh; cat >> .ssh/authorized_keys' < ~/.ssh/id_ed25519.pub

Test the intended key without allowing a password or keyboard-interactive fallback:

ssh -o IdentitiesOnly=yes -o PreferredAuthentications=publickey \
    -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no \
    -i ~/.ssh/id_ed25519 admin@host.example.com

Only after that test succeeds, an explicit key-only server policy can be placed before any Match block:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Keep an established administrative session and an independent console available while changing authentication. Run sshd(8) with -t, reload the service, and test another new session before closing the recovery session.

Configure the Client #

The client reads ssh_config(5) . A per-host stanza in ~/.ssh/config can record connection settings:

Host prod
    HostName host.example.com
    User admin
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ForwardAgent no
    ForwardX11 no

Use ssh(1) to inspect the effective client configuration without opening a connection:

ssh -G prod | grep -E '^(hostname|user|port|identityfile) '

Verify a new server’s host-key fingerprint through an independent channel before accepting it. ssh-keyscan(1) retrieves keys but does not authenticate them.

Transfer Files #

Use sftp(1) for an interactive transfer session:

sftp admin@host.example.com

Use scp(1) for individual files or recursive directory copies:

scp ./report.txt admin@host.example.com:/home/admin/
scp -r ./reports admin@host.example.com:/home/admin/

Uppercase -P selects a nondefault port. Lowercase -p preserves timestamps and mode bits.

Control Forwarding #

SSH can forward agents, TCP connections, Unix-domain sockets, X11 connections, and tunnel devices. Allow only the features the account needs. For an account that needs neither forwarding nor X11, a scoped restriction is:

Match User admin
    DisableForwarding yes
    PermitTunnel no

This block disables forwarding and tunnel creation. Allow only the features the account needs. Check the settings with sshd(8) using sshd -T -C, then test a new connection.

Provide Restricted SFTP Access #

The in-process SFTP server can support an account without an interactive shell. sshd_config(5) requires every component of the chroot pathname to be a root-owned directory that is not writable by group or others. One policy pattern is:

Match Group sftponly
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp
    DisableForwarding yes
    PermitTunnel no

Create a root-owned chroot and a separate user-owned upload directory inside it. Validate the effective Match result before enabling the account. A chroot limits the visible filesystem but does not replace account, file-permission, and network policy.

Avoid Static Algorithm Lists #

Do not copy fixed cipher, MAC, key-exchange, signature, or host-key allowlists into the configuration without a documented interoperability requirement. Supported OpenSSH updates revise secure defaults and introduce new algorithms. A static list can retain obsolete choices or block future improvements.

Audit OpenSSH is the detailed source for algorithm auditing and optional local policy. It explains why subtractive changes are safer than frozen replacement lists, how to verify post-quantum KEX, and when Diffie-Hellman moduli are relevant.

Diagnose Connections #

Review authentication events with tail(1) :

doas tail -f /var/log/authlog

Use ssh(1) verbose client logging for one controlled test:

ssh -vvv admin@host.example.com

If a connection fails, check the packet path, daemon listener, PF policy, effective server configuration, account state, and .ssh ownership in that order. Do not disable the firewall or remove the original recovery method as an initial diagnostic step.

Report a bug