The server disconnects after this time if the user has notsuccessfully logged in.If the value is 0, there is no time limit.The default is 120 seconds..It Cm LogLevelGives the verbosity level that is used when logging messages from.Nm sshd .The possible values are:QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.The default is INFO.DEBUG and DEBUG1 are equivalent.DEBUG2 and DEBUG3 each specify higher levels of debugging output.Logging with a DEBUG level violates the privacy of users and is not recommended..It Cm MACsSpecifies the available MAC (message authentication code) algorithms.The MAC algorithm is used in protocol version 2for data integrity protection.Multiple algorithms must be comma-separated.The default is.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 ..It Cm MaxStartupsSpecifies the maximum number of concurrent unauthenticated connections to the.Nm sshddaemon.Additional connections will be dropped until authentication succeeds or the.Cm LoginGraceTimeexpires for a connection.The default is 10..PpAlternatively, random early drop can be enabled by specifyingthe three colon separated values.Dq start:rate:full(e.g., "10:30:60")..Nm sshdwill refuse connection attempts with a probability of.Dq rate/100(30%)if there are currently.Dq start(10)unauthenticated connections.The probability increases linearly and all connection attemptsare refused if the number of unauthenticated connections reaches.Dq full(60)..It Cm PasswordAuthenticationSpecifies whether password authentication is allowed.The default is.Dq yes ..It Cm PermitEmptyPasswordsWhen password authentication is allowed, it specifies whether theserver allows login to accounts with empty password strings.The default is.Dq no ..It Cm PermitRootLoginSpecifies whether root can login using.Xr ssh 1 .The argument must be.Dq yes ,.Dq without-password ,.Dq forced-commands-onlyor.Dq no .The default is.Dq yes ..PpIf this option is set to.Dq without-passwordpassword authentication is disabled for root..PpIf this option is set to.Dq forced-commands-onlyroot login with public key authentication will be allowed,but only if the.Ar commandoption has been specified(which may be useful for taking remote backups even if root login isnormally not allowed). All other authentication methods are disabledfor root..PpIf this option is set to.Dq noroot is not allowed to login..It Cm PermitUserEnvironmentSpecifies whether.Pa ~/.ssh/environmentand.Cm environment=options in.Pa ~/.ssh/authorized_keysare processed by.Nm sshd .The default is.Dq no .Enabling environment processing may enable users to bypass accessrestrictions in some configurations using mechanisms such as.Ev LD_PRELOAD ..It Cm PidFileSpecifies the file that contains the process ID of the.Nm sshddaemon.The default is.Pa /var/run/sshd.pid ..It Cm PortSpecifies the port number that.Nm sshdlistens on.The default is 22.Multiple options of this type are permitted.See also.Cm ListenAddress ..It Cm PrintLastLogSpecifies whether.Nm sshdshould print the date and time when the user last logged in.The default is.Dq yes ..It Cm PrintMotdSpecifies whether.Nm sshdshould print.Pa /etc/motdwhen a user logs in interactively.(On some systems it is also printed by the shell,.Pa /etc/profile ,or equivalent.)The default is.Dq yes ..It Cm ProtocolSpecifies the protocol versions.Nm sshdsupports.The possible values are.Dq 1and.Dq 2 .Multiple versions must be comma-separated.The default is.Dq 2,1 .Note that the order of the protocol list does not indicate preference,because the client selects among multiple protocol versions offeredby the server.Specifying.Dq 2,1is identical to.Dq 1,2 ..It Cm PubkeyAuthenticationSpecifies whether public key authentication is allowed.The default is.Dq yes .Note that this option applies to protocol version 2 only..It Cm RhostsAuthenticationSpecifies whether authentication using rhosts or /etc/hosts.equivfiles is sufficient.Normally, this method should not be permitted because it is insecure..Cm RhostsRSAAuthenticationshould be usedinstead, because it performs RSA-based host authentication in additionto normal rhosts or /etc/hosts.equiv authentication.The default is.Dq no .This option applies to protocol version 1 only..It Cm RhostsRSAAuthenticationSpecifies whether rhosts or /etc/hosts.equiv authentication togetherwith successful RSA host authentication is allowed.The default is.Dq no .This option applies to protocol version 1 only..It Cm RSAAuthenticationSpecifies whether pure RSA authentication is allowed.The default is.Dq yes .This option applies to protocol version 1 only..It Cm ServerKeyBitsDefines the number of bits in the ephemeral protocol version 1 server key.The minimum value is 512, and the default is 768..It Cm StrictModesSpecifies whether.Nm sshdshould check file modes and ownership of theuser's files and home directory before accepting login.This is normally desirable because novices sometimes accidentally leave theirdirectory or files world-writable.The default is.Dq yes ..It Cm SubsystemConfigures an external subsystem (e.g., file transfer daemon).Arguments should be a subsystem name and a command to execute upon subsystemrequest.The command.Xr sftp-server 8implements the.Dq sftpfile transfer subsystem.By default no subsystems are defined.Note that this option applies to protocol version 2 only..It Cm SyslogFacilityGives the facility code that is used when logging messages from.Nm sshd .The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.The default is AUTH..It Cm UseLoginSpecifies whether.Xr login 1is used for interactive login sessions.The default is.Dq no .Note that.Xr login 1is never used for remote command execution.Note also, that if this is enabled,.Cm X11Forwardingwill be disabled because.Xr login 1does not know how to handle.Xr xauth 1cookies.If.Cm UsePrivilegeSeparationis specified, it will be disabled after authentication..It Cm UsePrivilegeSeparationSpecifies whether.Nm sshdseparates privileges by creating an unprivileged child processto deal with incoming network traffic.After successful authentication, another process will be created that hasthe privilege of the authenticated user.The goal of privilege separation is to prevent privilegeescalation by containing any corruption within the unprivileged processes.The default is.Dq yes ..It Cm VerifyReverseMappingSpecifies whether.Nm sshdshould try to verify the remote host name and check thatthe resolved host name for the remote IP address maps back to thevery same IP address.The default is.Dq no ..It Cm X11DisplayOffsetSpecifies the first display number available for.Nm sshd Ns 'sX11 forwarding.This prevents.Nm sshdfrom interfering with real X11 servers.The default is 10..It Cm X11ForwardingSpecifies whether X11 forwarding is permitted.The argument must be.Dq yesor.Dq no .The default is.Dq no ..PpWhen X11 forwarding is enabled, there may be additional exposure tothe server and to client displays if the.Nm sshdproxy display is configured to listen on the wildcard address (see.Cm X11UseLocalhostbelow), however this is not the default.Additionally, the authentication spoofing and authentication dataverification and substitution occur on the client side.The security risk of using X11 forwarding is that the client's X11display server may be exposed to attack when the ssh client requestsforwarding (see the warnings for.Cm ForwardX11in.Xr ssh_config 5 ).A system administrator may have a stance in which they want toprotect clients that may expose themselves to attack by unwittinglyrequesting X11 forwarding, which can warrant a.Dq nosetting..PpNote that disabling X11 forwarding does not prevent users fromforwarding X11 traffic, as users can always install their own forwarders.X11 forwarding is automatically disabled if.Cm UseLoginis enabled..It Cm X11UseLocalhostSpecifies whether.Nm sshdshould bind the X11 forwarding server to the loopback address or tothe wildcard address.By default,.Nm sshdbinds the forwarding server to the loopback address and sets thehostname part of the.Ev DISPLAYenvironment variable to.Dq localhost .This prevents remote hosts from connecting to the proxy display.However, some older X11 clients may not function with thisconfiguration..Cm X11UseLocalhostmay be set to.Dq noto specify that the forwarding server should be bound to the wildcardaddress.The argument must be.Dq yesor.Dq no .The default is.Dq yes ..It Cm XAuthLocationSpecifies the full pathname of the.Xr xauth 1program.The default is.Pa /usr/X11R6/bin/xauth ..El.Ss Time Formats.Pp.Nm sshdcommand-line arguments and configuration file options that specify timemay be expressed using a sequence of the form:.Sm off.Ar time Op Ar qualifier ,.Sm onwhere.Ar timeis a positive integer value and.Ar qualifieris one of the following:.Pp.Bl -tag -width Ds -compact -offset indent.It Cm <none>seconds.It Cm s | Cm Sseconds.It Cm m | Cm Mminutes.It Cm h | Cm Hhours.It Cm d | Cm Ddays.It Cm w | Cm Wweeks.El.PpEach member of the sequence is added together to calculatethe total time value..PpTime format examples:.Pp.Bl -tag -width Ds -compact -offset indent.It 600600 seconds (10 minutes).It 10m10 minutes.It 1h30m1 hour 30 minutes (90 minutes).El.Sh FILES.Bl -tag -width Ds.It Pa /etc/ssh/sshd_configContains configuration data for.Nm sshd .This file should be writable by root only, but it is recommended(though not necessary) that it be world-readable..El.Sh AUTHORSOpenSSH is a derivative of the original and freessh 1.2.12 release by Tatu Ylonen.Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,Theo de Raadt and Dug Songremoved many bugs, re-added newer features andcreated OpenSSH.Markus Friedl contributed the support for SSHprotocol versions 1.5 and 2.0.Niels Provos and Markus Friedl contributed supportfor privilege separation..Sh SEE ALSO.Xr sshd 8