montaukos.org/docs/man/sshd.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="description" content="MontaukOS manual page: sshd(1) - MontaukOS SSH-2 server">
    <title>sshd(1) - MontaukOS Manual</title>
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&display=swap" rel="stylesheet">
    <style>
        body {
            font-family: 'Open Sans', Arial, sans-serif;
            max-width: 960px;
            margin: 0 auto;
            padding: 1em;
            line-height: 1.5;
            display: flex;
            gap: 2em;
        }
        p { margin: 0 0 0.5em; }
        h2 { margin: 0.5em 0; }
        .sidebar {
            width: 160px;
            flex-shrink: 0;
        }
        .sidebar ul {
            list-style: none;
            padding: 0;
        }
        .sidebar li {
            margin: 0.5em 0;
        }
        .sidebar a {
            color: #0066CC;
            text-decoration: none;
            font-weight: 600;
        }
        .sidebar a:hover {
            color: #004499;
            text-decoration: underline;
        }
        .sidebar .current {
            color: #004499;
        }
        .sidebar hr {
            border: none;
            border-top: 1px solid #999;
            margin: 0.75em 0;
        }
        .main {
            flex: 1;
            min-width: 0;
        }
        a { color: #0000EE; }
        a:visited { color: #0066CC; }
        hr { border-style: solid; border-width: 1px 0 0 0; border-color: #999; }
        pre { background: #f0f0f0; padding: 0.5em; overflow-x: auto; }
        code { background: #f0f0f0; padding: 0 0.15em; }
        pre code { padding: 0; }
        .center { text-align: center; }
        .box {
            border: 1px solid #999;
            padding: 0.5em;
            margin: 0.5em 0;
        }
            @media (max-width: 700px) {
            body {
                flex-direction: column;
                gap: 1em;
                padding: 1em 0.75em;
            }
            .sidebar {
                width: auto;
            }
            .sidebar ul {
                display: flex;
                flex-wrap: wrap;
                gap: 0 1em;
            }
            .sidebar hr {
                width: 100%;
            }
        }
</style>
</head>
<body>

<div class="sidebar">
<ul>
<li><a href="../../index.html">Home</a></li>
<li><a href="../../downloads.html">Downloads</a></li>
<li><a href="../../history.html">History</a></li>
<li><a href="../index.html">Documentation</a></li>
<li><a href="https://git.montaukos.org/daniel/MontaukOS/issues">Issue tracker</a></li>
<li><a href="https://git.montaukos.org/daniel/MontaukOS">Git</a></li>
</ul>
<hr>
<ul>
<li><a href="index.html" class="current">Man Pages</a></li>
</ul>
</div>

<div class="main">
<div class="center">
<h1>sshd(1)</h1>
</div>

<hr>

<pre><code><strong>NAME</strong>
sshd - MontaukOS SSH-2 server

<strong>SYNOPSIS</strong>
    <strong>sshd</strong>

<strong>DESCRIPTION</strong>
    <strong>sshd</strong>
accepts SSH-2 connections and gives each authenticated user a MontaukOS shell.

It is normally launched automatically by
    <strong>init (1)</strong>
and does not require direct user interaction. Remote access is disabled by
default; enable it from Settings &gt; SSH Server, which sets
    <em>services.ssh.enabled</em>
in
    <em>0:/config/init.toml .</em>
The change takes effect on the next boot.

<strong>AUTHENTICATION</strong>
Passwords are the only supported method, checked against the MontaukOS account
database. A user must additionally be listed in the
    <em>[allow]</em>
table of
    <em>0:/config/ssh.toml</em>
before a login is accepted; users absent from that table are refused. The
Settings applet maintains this table.

Failed passwords are delayed, and a connection is dropped after eight attempts.

<strong>CONFIGURATION</strong>

    <em>0:/config/ssh.toml</em>
Listening port
    <em>( server.port ,</em>
default 22) and the per-user
    <em>[allow]</em>
table.

    <em>0:/config/ssh_hostkey.toml</em>
The RSA host key, generated on first start. Note that the filesystem has no
permission model, so this file is readable by any local process; keeping it
separate from
    <em>ssh.toml</em>
limits exposure but is not access control.

<strong>DIAGNOSTICS</strong>
Messages go to the boot console only. They do not appear in
    <strong>klog (1):</strong>
    <strong>SYS_PRINT</strong>
writes the kernel terminal rather than the kernel log ring, and is discarded
entirely once the desktop suppresses console output. There is currently nowhere
to read them from on a running desktop.

<strong>PROTOCOL</strong>
Key exchange is diffie-hellman-group14-sha256 with an rsa-sha2-256 host key;
the transport uses aes128-ctr with hmac-sha2-256. Client-initiated rekeying is
supported. Only one session channel per connection is served, and connections
are handled one at a time.

<strong>LIMITATIONS</strong>
Public key authentication, port forwarding, X11 forwarding, SFTP and SCP are not
implemented.

    <em>exec</em>
requests run the command by feeding it to an interactive shell, so the shell
prompt and the echoed command line appear in the output. Scripts that parse
remote command output should account for this.

<strong>SEE ALSO</strong>
    <strong>shell (1),</strong>
    <strong>init (1)</strong></code></pre>
<hr>

<div class="center">
<a href="../index.html">Back to Documentation Index</a>
</div>

</div>
</body>
</html>