SSH

"The ssh server" refers to OpenSSH 10.6p1 from the openssh package, which is run by the sshd service. It is installed but is not linked into /etc/service, so a new system accepts no ssh connections. Root cannot log in over ssh. Password login is enabled.

Turn it on

# setup --ssh
ssh server enabled
# sv status sshd
run: sshd: (pid 423) 7s; run: log: (pid 422) 7s

setup --ssh replaces /etc/service/sshd with a link to /etc/sv/sshd, and ln -s /etc/sv/sshd /etc/service/sshd has the same effect. The installer does this when the profile server is chosen. To turn the server off again, you must remove the link.

The run script creates /var/empty, generates /etc/ssh/ssh_host_ed25519_key if it is missing and runs sshd -D -e -f /etc/ssh/sshd_config. -e sends the log to standard error, which reaches /var/log/sshd/current. The host key is made at the first start and is not in the stage. It is the only host key, so clients that accept only RSA host keys cannot connect. A flash to a frame taken before the first start removes the key and the next start makes a new one, which clients report as a changed key.

# ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:jok2wXVn7Rx9MescQ3jRN3rh1oT15q38wTDaWMhFMyA root@uranium (ED25519)
# cat /var/log/sshd/current
2026-11-02_17:03:14.68365 Server listening on 0.0.0.0 port 22.
2026-11-02_17:03:14.68392 Server listening on :: port 22.

The configuration

/etc/ssh/sshd_config has nine lines. Every other setting has the OpenSSH default.

Port 22: The port.
HostKey /etc/ssh/ssh_host_ed25519_key: The one host key.
PermitRootLogin no: A login attempt by root is logged as ROOT LOGIN REFUSED FROM 127.0.0.1 port 58560 [preauth].
PasswordAuthentication yes: Passwords are accepted.
KbdInteractiveAuthentication no: No keyboard-interactive prompts.
UsePAM no: Passwords are checked against /etc/shadow directly.
PrintMotd no: No message of the day.
AllowTcpForwarding yes: A user who can log in can forward ports.
X11Forwarding no: No X11 forwarding.

You should check a file before you restart the service. Check it with:

# sshd -t -f /etc/ssh/sshd_config
/etc/ssh/sshd_config: line 10: Bad configuration option: Bogus
/etc/ssh/sshd_config: terminating, 1 bad configuration options

If the service is restarted with such a file, sshd exits at once, runsv starts it again every second, sv status sshd shows a message, and the error is written to the log each time. To recover, fix the file and run sv restart sshd.

Keys

The public key must be placed in ~/.ssh/authorized_keys of the user, in a directory that has mode 700 and is owned by the user:

# mkdir -p /home/ann/.ssh
# cp key.pub /home/ann/.ssh/authorized_keys
# chown -R ann /home/ann/.ssh
# chmod 700 /home/ann/.ssh

A successful login is logged as Accepted publickey for ann from 127.0.0.1 port 58556 ssh2: ED25519 SHA256:.... Once a key works, you may turn passwords off:

# sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
# sshd -t -f /etc/ssh/sshd_config
# sv restart sshd

While passwords are enabled, a client that has no valid key receives Permission denied (publickey,password).

Accounts with no password

sshd refuses an account whose password field in /etc/shadow is !, even if the client has a valid key. adduser -D makes such an account. The log then reads:

User lock1 not allowed because account is locked

The client sees Permission denied (publickey,password). To repair this, set a password with passwd USER. A user that is made with setup --user NAME --password-stdin already has one; see users.

Administration over ssh

Log in as a user in the wheel group and use doas. A command given to ssh runs in a shell that is not a login shell. Its PATH is /usr/bin:/bin:/usr/sbin:/sbin plus the openssh store path, and doas resolves to /usr/bin/doas, the copy in the profile that is not setuid. Call /rod/wrappers/doas by it's path, or open an interactive session, which is a login shell with the right PATH. doas asks for a password with persist and needs a terminal, so use ssh -t.

Firewall

blastdoor accepts new connections to port 22 at a limit of 10 a minute, counted for all sources together, and drops the excess:

tcp dport 22 ct state new limit rate 10/minute burst 5 packets accept

This slows down a person who guesses passwords, and it can delay your own login while a guesser is active. Connections over the loopback interface are accepted before this rule. Nothing else limits password guesses, so on a machine that is reachable from the internet you should use keys.

Another port

# sed -i 's/^Port 22/Port 2222/' /etc/ssh/sshd_config
# sv restart sshd
# blastdoor allow 2222
allowed 2222/tcp
# ls /etc/nftables.d
2222-tcp.nft

The rule for port 22 remains in /etc/nftables.conf and continues to accept connections to port 22 at the rate limit, although nothing listens there. To close the port, you must remove the line and run blastdoor reload.

Log

The log is /var/log/sshd/current, which svlogd keeps; see services. The client programs ssh, scp, sftp, ssh-keygen, ssh-agent, ssh-add, ssh-copy-id and ssh-keyscan are provided by the same package.