sshd

Synopsis #

sshd(8) is the OpenSSH daemon in the OpenBSD base system. It provides encrypted remote shells, remote command execution, file transfer, and optional forwarding. The daemon reads sshd_config(5) from /etc/ssh/sshd_config.

Configure Secure Remote Access with OpenSSH provides a lockout-safe procedure for replacing password access with keys. Audit OpenSSH explains algorithm policy, post-quantum key exchange, and ssh-audit findings. Use FIDO Security Keys with OpenSSH covers hardware-backed credentials. This page is a concise operational reference.

Manage the Service #

Inspect, enable, and start the daemon with rcctl(8) :

# rcctl check sshd
  # Report whether the service is running
# rcctl enable sshd
  # Enable the service at boot
# rcctl start sshd
  # Start it now when it is not already running

The installer normally creates host keys. Generate only missing host keys with ssh-keygen(1) :

# ssh-keygen -A

Display the server’s Ed25519 host-key fingerprint for verification through an independent channel:

# ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Validate Server Configuration #

Validate configuration syntax and host-key files with sshd(8) before reloading the service with rcctl(8) :

# sshd -t
  # Produce no output when validation succeeds
# rcctl reload sshd
  # Apply the validated configuration without ending established sessions

Many defaults are not active lines in /etc/ssh/sshd_config. Inspect the effective configuration with sshd -T:

# sshd -T | grep -E '^(port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication) '

Settings inside a Match block depend on connection attributes. Supply representative values with -C:

# sshd -T -C user=admin,addr=198.51.100.25,host=client.example.com

This command evaluates matching only and does not create a connection. A Match block remains in effect until another Match directive or the end of the file. Place global directives before the first Match block. When more than one satisfied block specifies a keyword, the first obtained value is used.

Configure Public-Key Authentication #

Generate an Ed25519 key on the client with ssh-keygen(1) and protect the private key with a passphrase:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

While an existing authentication method still works, use ssh(1) to append the public key to the remote account:

$ ssh admin@host.example.com 'umask 077; mkdir -p .ssh; cat >> .ssh/authorized_keys' < ~/.ssh/id_ed25519.pub

Test the intended key without allowing a password or keyboard-interactive fallback:

$ ssh -o IdentitiesOnly=yes -o PreferredAuthentications=publickey \
    -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no \
    -i ~/.ssh/id_ed25519 admin@host.example.com

Only after that test succeeds, an explicit key-only server policy can be placed before any Match block:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Keep an established administrative session and an independent console available while changing authentication. Run sshd(8) with -t, reload the service, and test another new session before closing the recovery session.

Configure the Client #

The client reads ssh_config(5) . A per-host stanza in ~/.ssh/config can record connection settings:

Host prod
    HostName host.example.com
    User admin
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
    ForwardAgent no
    ForwardX11 no

Use ssh(1) to inspect the effective client configuration without opening a connection:

$ ssh -G prod | grep -E '^(hostname|user|port|identityfile) '

Verify a new server’s host-key fingerprint through an independent channel before accepting it. ssh-keyscan(1) retrieves keys but does not authenticate them.

Transfer Files #

Use sftp(1) for an interactive transfer session:

$ sftp admin@host.example.com

Use scp(1) for individual files or recursive directory copies:

$ scp ./report.txt admin@host.example.com:/home/admin/
$ scp -r ./reports admin@host.example.com:/home/admin/

Uppercase -P selects a nondefault port. Lowercase -p preserves timestamps and mode bits.

Control Forwarding #

SSH can forward agents, TCP connections, Unix-domain sockets, X11 connections, and tunnel devices. Retain only the capabilities required by the account’s role. For an account that needs neither forwarding nor X11, a scoped restriction is:

Match User admin
    DisableForwarding yes

Do not apply this block when the account requires port forwarding, agent forwarding, X11 forwarding, or tunnel creation. Confirm its effect with sshd(8) using sshd -T -C.

Provide Restricted SFTP Access #

The in-process SFTP server can support an account without an interactive shell. sshd_config(5) requires every component of the chroot pathname to be a root-owned directory that is not writable by group or others. One policy pattern is:

Match Group sftponly
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp
    DisableForwarding yes

Create a root-owned chroot and a separate user-owned upload directory inside it. Validate the effective Match result before enabling the account. A chroot limits the visible filesystem but does not replace account, file-permission, and network policy.

Avoid Static Algorithm Lists #

Do not copy fixed cipher, MAC, key-exchange, signature, or host-key allowlists into the configuration without a documented interoperability requirement. Supported OpenSSH updates revise secure defaults and introduce new algorithms. A static list can retain obsolete choices or block future improvements.

Audit OpenSSH is the detailed source for algorithm auditing and optional local policy. It explains why subtractive changes are safer than frozen replacement lists, how to verify post-quantum KEX, and when Diffie-Hellman moduli are relevant.

Diagnose Connections #

Review authentication events with tail(1) :

# tail -f /var/log/authlog

Use ssh(1) verbose client logging for one controlled test:

$ ssh -vvv admin@host.example.com

If a connection fails, check the packet path, daemon listener, PF policy, effective server configuration, account state, and .ssh ownership in that order. Do not disable the firewall or remove the original recovery method as an initial diagnostic step.

Report a bug