OpenSSH Daemon

https://man.openbsd.org/OpenBSD-current/

Admin

The OpenSSH Daemon (`sshd`) is a program that provides secure encrypted communications between two...

Tokens:7,002

Snippets:61

Trust Score:9.7

Update:1 week ago

Show doc for...

Tokens:

Raw

### Example authorized_keys file with key options

Source: https://man.openbsd.org/sshd

Shows a complete example of an authorized_keys file with comments, plain keys, and various options like restrict, permitopen, permitlisten, tunnel, pty, no-touch-required, verify-required, and cert-authority. Use as a template for configuring SSH key restrictions and forwarding permissions.

```ssh
# Comments are allowed at start of line. Blank lines are allowed.
# Plain key, no restrictions
ssh-rsa ...
# Forced command, disable PTY and all forwarding
restrict,command="dump /home" ssh-rsa ...
# Restriction of ssh -L forwarding destinations
permitopen="192.0.2.1:80",permitopen="192.0.2.2:25" ssh-rsa ...
# Restriction of ssh -R forwarding listeners
permitlisten="localhost:8080",permitlisten="[::1]:22000" ssh-rsa ...
# Configuration for tunnel forwarding
tunnel="0",command="sh /etc/netstart tun0" ssh-rsa ...
# Override of restriction to allow PTY allocation
restrict,pty,command="nethack" ssh-rsa ...
# Allow FIDO key without requiring touch
no-touch-required sk-ecdsa-sha2-nistp256@openssh.com ...
# Require user-verification (e.g. PIN or biometric) for FIDO key
verify-required sk-ecdsa-sha2-nistp256@openssh.com ...
# Trust CA key, allow touch-less FIDO if requested in certificate
cert-authority,no-touch-required,principals="user_a" ssh-rsa ...

```

--------------------------------

### SSHRC: ~/.ssh/rc execution by sh(1)

Source: https://man.openbsd.org/sshd

Used when the file ~/.ssh/rc exists; sh(1) runs it after reading the environment files but before starting the user's shell or command. The rc file receives the X11 authentication protocol and cookie on standard input.

```shell
sh(1)
```

Tokens:

Raw