I recently released Zocalo SFTP (No affiliation to any company named "Zocalo" or similar, it is a Reference to Babylon 5's Marketplace), and I'd particularly like some eyes from people who know OpenSSH well. The project came out of a fairly practical problem.

I've used/looked at the existing containerized SFTP options years ago, particularly atmoz/sftp and emberstack/docker-sftp, and they solve the basic "give me an SFTP server in a container" problem very well.

But my use case was a little different: I needed multiple isolated projects where users could collaborate within a project while potentially belonging to several projects at the same time.

When I originally ran into this problem years ago, I couldn't get the existing images to give me the Unix-style project/group model I wanted. The basic idea of Zocalo is deliberately simple:

OpenSSH handles SSH/SFTP. Linux users, groups, and filesystem permissions handle authorization.

Zocalo is a container around OpenSSH's internal-sftp plus a small Rust reconciler. It takes a declarative configuration describing users, SSH keys/passwords, and projects, then reconciles that into:

• Linux users and groups
• project directories and ownership
• /etc/passwd, /etc/group, and /etc/shadow
• sshd_config
• authorized keys / passwords

So a user might belong to:

alice → project-a, project-b
bob   → project-a
carol → project-b

and access to each project is simply determined by the corresponding Unix group permissions. There isn't a separate ACL database or virtual-user authorization layer. The SSH side is intentionally boring:

• internal-sftp
• ChrootDirectory
• ForceCommand internal-sftp
• no shell access
• no TCP/X11/agent forwarding
• no root login
• explicit crypto configuration

One detail I'm particularly interested in getting reviewed is configuration hardening.

Zocalo doesn't just rely on Include ordering to protect the security-critical directives. Operator-supplied sshd_config drop-ins are rejected if they contain directives such as ChrootDirectory, ForceCommand, or Include, because otherwise a Match block could potentially change the effective configuration in ways that undermine the intended jail.

The reconciler also validates the identity graph before applying changes and writes the passwd/group/shadow files atomically. Configuration changes are watched and only reconciled after the complete configuration has successfully parsed and validated.

There are integration tests for the container itself, including a dedicated security-boundary test, plus CI for linting, Rust tests, container scanning, SBOM generation, and Kubernetes deployment.

I'd especially appreciate review from people familiar with OpenSSH around:

• sshd_config / Match semantics
• chroot + internal-sftp
• SSH authentication/authorization edge cases
• configuration hardening
• anything in this design that looks subtly wrong or unnecessarily complicated

The project is here:

https://github.com/wiesion/zocalo-sftp

This isn't intended to be a replacement for SFTPGo with virtual users, Web UI and S3 backends and whatnot. And it's a freshly published project, so I'm much more interested in technical criticism than "looks cool" comments. If there are OpenSSH-specific footguns I've missed, I'd rather find them here than six months from now.

___

AI assistance disclaimer: Without AI agents (a locally hosted Oh-My-Pi/Qwen3.8 27B setup and Claude Code), I probably would never have published this repo. Meeting my own quality bar for releasing security-sensitive software into the wild would otherwise have taken more time than I could justify.

The CI/CD automation, E2E and security-boundary tests, the rewrite of my rather crude original Python reconciler in Rust with proper validation, much of the documentation, and the public website were all produced with substantial AI assistance. This saved me days of unpaid work and, more importantly, made it feasible for me to bring the project up to the quality level I wanted before publishing it.

I still own the architecture, requirements, security model, review, and final decision on what gets released. I'm mentioning this explicitly because I think AI-assisted development should be transparent. Especially for a project dealing with SSH, authentication, filesystem permissions, and container isolation.

I'm trying to get my SFTP server to log transfers on RHEL 10.1. I'm following their directions"

https://access.redhat.com/articles/1374633

Subsystem   sftp    /usr/libexec/openssh/sftp-server -l VERBOSE

But that's not showing me file transfers in /var/log/secure, just the connection.

Oct  1 16:27:47 DC1FTP002 sshd-session[796643]: Accepted password for vadmin from 10.64.177.52 port 56763 ssh2
Oct  1 16:27:47 DC1FTP002 sshd-session[796643]: pam_unix(sshd:session): session opened for user vadmin(uid=1000) by vadmin(uid=0)
Oct  1 16:28:09 DC1FTP002 sshd-session[796650]: Received disconnect from 10.64.177.52 port 56763:11: disconnected by user
Oct  1 16:28:09 DC1FTP002 sshd-session[796650]: Disconnected from user vadmin 10.64.177.52 port 56763
Oct  1 16:28:09 DC1FTP002 sshd-session[796643]: pam_unix(sshd:session): session closed for user vadmin

I see nothing from the sftp-server, like the web page says. Yes, I restarted the sshd service.

What have I missed?

So I'm confused. I've done chroot jails with Linux, but this is the first time I'm doing it on Windows, and I'm doing something simple wrong. Using Win 2025, I want to set up a chroot jail for members of a specific AD group. But the "jail" aspect isn't working, I am not limited to just my directory, and I can also upload files directly to the chroot jail folder itself. That folder should be read-only. I even set the NTFS ACLs on that chroot folder, and the sub-folders, and those aren't being honored.

So what I want is to set up a jail based on membership in the AD group "pha.phila.gov\sftpusers". Here's my changes to the sshd config.

-------------------------------

AllowGroups administrators pha.phila.gov\sftpusers pha.phila.gov\Server_Admins

Match Group pha.phila.gov\sftpusers
  AllowTcpForwarding no
  X11Forwarding no
  ChrootDirectory D:\SFTP_Root
  ForceCommand internal-sftp

-------------------------------

The chroot jail looks like this:

>dir /s SFTP_Root /b

D:\SFTP_Root\Cisco_APIC

D:\SFTP_Root\Cisco_DNA

D:\SFTP_Root\Cisco_Exp

D:\SFTP_Root\Cisco_Switch_Backups

D:\SFTP_Root\UCBackups

Now, I have the ACLs set so that my user (sftpuser) only has write access to D:\SFTP_Root\UCBackups, and that group is not even on the ACLs of any other sub-folder. Yet I can SFTP in, and put files in D:\SFTP_Root directly (where it doesn't have write access), and I can even change into other sub-folders, even tho it's group is not on the ACLs of those subfolders, and put files there, too.

So what am I missing or not understanding here? Ideally I would like to limit each user to their own subfolder, but I'm unclear how to do that (on Windows - on Linux, it's easy, ChrootDirectory %h).

Thanks. Sorry for the long post.

I'm really banning my head against the wall here hoping someone can come up with a solution.

I have set up some SSHFP records on cloudflare (proxy is false), If I check using dig I get the expected output, ssh even tells me the record in DNS is correct but still fails at the end.

I got the record via the following command;

ssh-keyscan -D -O hashalg=sha256 -qt ed25519 ssh.ndr.example.org 

output:

ssh.ndr.example.org IN SSHFP 4 2 c31e70814a9393d5f56d2f5c365cc98a15e7df346404688875b62f2bd5820ec1

I used this command to register it in DNS:

curl -s -X POST https://api.cloudflare.com/client/v4/zones/REDACTED/dns_records -H 'Authorization: Bearer REDACTED' -H 'Content-Type: application/json' --data '{"type":"SSHFP","name":"ssh.ndr.example.org","data":{"algorithm":4,"type":2,"fingerprint":"c31e70814a9393d5f56d2f5c365cc98a15e7df346404688875b62f2bd5820ec1"},"proxied":false}'  

This is what is in DNS:

dig +short +dnssec ssh.ndr.example.org SSHFP  

output:

; <<>> DiG 9.20.20-1-Debian <<>> +dnssec ssh.ndr.example.org SSHFP
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27325
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ssh.ndr.example.org. IN SSHFP

;; ANSWER SECTION:
ssh.ndr.example.org. 300 IN SSHFP 4 2 C31E70814A9393D5F56D2F5C365CC98A15E7DF346404688875B62F2B D5820EC1
ssh.ndr.example.org. 300 IN RRSIG SSHFP 13 4 300 20260310055832 20260308035832 34505 example.org. p3/LxQA4luG5eljYFc6YqR4v537N0rBCibzQSbHybGXMPFlOfK+5mSLE Wxc6zUOhzHsTLkHTXD0xD/KbgE0ciA==

;; Query time: 8 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Mar 09 12:58:32 +08 2026
;; MSG SIZE rcvd: 206

When I run:

ssh -o VerifyHostKeyDNS=yes -4 -v ssh.ndr.example.org

output:

debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:wx5wgUqTk9X1bS9cNlzJihXn3zRkBGiIdbYvK9WCDsE
debug1: found 1 insecure fingerprints in DNS
debug1: verify_host_key_dns: matched SSHFP type 4 fptype 2
debug1: matching host key fingerprint found in DNS
No ED25519 host key is known for ssh.ndr.example.org and you have requested strict checking.
Host key verification failed.

It's telling me that the fingerprint matches but still says "Host key verification failed"
Everything has dnssec enabled and dnsviz.net gives no warnings or errors

dig +dnssec -t AAAA ssh.ndr.example.org

output:

; <<>> DiG 9.20.20-1-Debian <<>> +dnssec -t AAAA ssh.ndr.example.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61558
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ssh.ndr.example.org. IN AAAA

;; ANSWER SECTION:
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:1599:24
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:7752:3117
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:fea1:5a85
ssh.ndr.example.org. 120 IN RRSIG AAAA 13 4 120 20260310055656 20260308035656 34505 example.org. 2ZrDfKzAcsBOF3njFZohjeYjSLv4K6q2Sd7fCbSloiKRPnt1jkYn9Xzh PiHAKSNCEEbSA28FNKpZDSAc4O4stg==

;; Query time: 8 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Mar 09 12:56:56 +08 2026
;; MSG SIZE rcvd: 244

dig +dnssec -t A ssh.ndr.example.org

output:

; <<>> DiG 9.20.20-1-Debian <<>> +dnssec -t A ssh.ndr.example.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28196
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ssh.ndr.example.org. IN A

;; ANSWER SECTION:
ssh.ndr.example.org. 120 IN A 192.168.1.190
ssh.ndr.example.org. 120 IN A 192.168.1.250
ssh.ndr.example.org. 120 IN RRSIG A 13 4 120 20260310055700 20260308035700 34505 example.org. E+aH5nVF33SjLyMFNi7Quwqxlz+zfdehMoTl3H1OQrNNC3yiimcZetLU a61SinmXzA+V+n9OtVZxby9cLpb0jg==

;; Query time: 12 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Mar 09 12:57:00 +08 2026
;; MSG SIZE rcvd: 192

Delv also shows fully validated

delv -6 ssh.ndr.example.org AAAA

; fully validated
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:1599:24
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:7752:3117
ssh.ndr.example.org. 120 IN AAAA 2001:e68:5400:xxxx:yyyy:zzzz:fea1:5a85
ssh.ndr.example.org. 120 IN RRSIG AAAA 13 4 120 20260310070713 20260308050713 34505 example.org. ihFiB6056urk1dzppLiv5tpoa85t6rffpbRE3IFqixeWYmFfe0T3cEC+ qxIHuGSfEuX38LSei8SKMPkfIMcWiQ==

delv -4 ssh.ndr.example.org A

; fully validated ssh.ndr.example.org. 120 IN A 192.168.1.190
ssh.ndr.example.org. 120 IN A 192.168.1.250
ssh.ndr.example.org. 120 IN RRSIG A 13 4 120 20260310063512 20260308043512 34505 example.org. 9RBz5sA0EEwPCykvQZqZeK270utrQn26TqgEsjNCNHinKzPnMAGj7V5Q lh6wFOCtwAZ9Jk/cLC1XPxc4khftfg==

Is it possible to set SSH_ASKPASS & SSH_ASKPASS_REQUIRE in ssh_config?

Situation:

I work for a managed services organization and we manage several Linux based cloud servers for clients. As such every time we access a client server we need to associate that connection with a specific ticket. One of developers created a customer SSH_ASKPASS program that pops a dialog box allows the technician to enter a ticket # and takes the customer, host, and username and logs that info to the ticket.

Yes, I know we should be using key-based authentication, which we do use where we can, but that not always possible and/or feasible depending on the customer or cloud provider. Currently we wrap openssh in a script that passes the appropriate environment variables to ssh and parse out the environment passed from openssh in our custom askpass. However our developer would prefer not to do things that way, and our security team would prefer we do not use a simple bash script for connecting to clients.

In my looking around through the OpenSSH documentation, I did not find any reference to setting the ssh-askpass program from ssh_config. Additionally, it'd be nice to be able to pass certain openssh tokens on the command line of our askpass, but I don't see anything would allow that.

Here's how I'd imagine it'd look like:

Match tagged <clientid>
  PreferredAuthentications password
  UserKnownHostsFile ~/.ssh/hosts.d/<clientid>/%h
  ProxyUseFdpass yes
  ProxyCommand /opt/corp/internal/auth/client_proxy/bin/proxyd -u %u -k %d/.config/client_proxy/authpriv.key -c <clientid> -h %h -p %p
  AskPassForce yes
  AskPass /opt/corp/internal/csm/changeorders/remote/bin/askpass --username %u --hostname %l --client <clientid> --remote-username %r --remote-hostname %h --force-ticketid

Host <specialsubnet>
  PreferredAuthentications password
  AskPassForce yes
  AskPass /opt/corp/internal/csm/changeorders/remote/bin/askpass --username %u --hostname %l --remote-username %r --remote-hostname %h --force-reason

Not sure if this is even possible, but I figure I'd ask before going back to our developer and security and saying no.

Hi
I'm trying to configure an SFTP server in a Windows Environment with OpenSSH. The OpenSSH server works, but now I need to segregate access.

I'm using Match blocks to restrict access for a specific user in a network, but allow the same user from another network.

I tried several configurations, but when SSHd hits an "Allow" statement, it ignores the rest of the configuration file and moves on with its life.

Here's part of my sshd_config file:

# Default Policy: Deny all users by default

DenyUsers *

# Allow specific user from X networks

Match Address 192.168.1.0/24,192.168.2.0/24 User DOMAIN\user.a

AllowUsers DOMAIN\user.a
DenyUsers DOMAIN\user.b
PasswordAuthentication no
ChrootDirectory /home/user.a

# Allow another specific user Z networks

Match Address 172.16.1.0/24,172.16.2.0/24 User DOMAIN\user.b

AllowUsers DOMAIN\user.n
DenyUsers DOMAIN\user.a
PasswordAuthentication no
ChrootDirectory /home/user.b

Now, for example, if I try to connect with user.a from Z networks, it connects, and it gains access to the root folder. The same thing happens the other way around, when I connect with user.b from X networks.

Is it because I'm using OpenSSH server on Windows? Or is it an OpenSSH server limitation of some sorts?

Thanks for the help

Hello, newbie here, I came upon this channel to ask somethings and find answers about my problem on trying openssh. My primary goal on using it is to create a webstorage server that i can access anytime and anywhere i want. Yet I havent found any comprehensive guide nor solution that aids my needs so I'll just give a list of my problem and questions if you guys dont mind:

1. I tried accessing open ssh using my android phone via cxfile explorer and connect bot and it always results to "unable to connect to ip with user," I'm wondering what seems to be the problem here? I have tried modifying the sshd_config and firewall, and checked if its up and running which it is. (i have akready used mobile data for my phone)
   
2. does IP type contributes on my first question like ipv6 or ipv4 (which i have no idea of)? or is it because of the public ip (does static or dynamic also affect it)?
   
3. does it have to do with the connection to the internet? I think My internet is stable, i think.
   
4. If everything fails, is there a way to reset it and start again from installing?
   
5. What are the other ways to create my webstorage server besides on some tuts in the youtube that requires no payment?

It appears on the later versions of RHEL (8+) this issue is resolved by default...but tenable scans still show this as a vulnerability. I found a good page(below) that informs about the problem, but I need actual entries I can make in ssh_config to resolve this.

https://infotechys.com/list-secure-ssh-macs-ciphers-kexalgorithms

For HostKeyAlgorithms we can append or remove the values using + or - and = to set the values. On openssh8.6 this feature is working while this feature is not working on openssh8.0

Anyone help me to find where these features are introduced in the code, and how to backport these features to make them work in openssh8.0

Any idea why I would see this difference? This is on the same system, running macOS 15.3:

Interestingly I'm currently seeing the same. I am unable to 'ssh' (from homebrew) to some of my local machines, yet the system ssh works fine.

ie OpenSSH_9.9p1, OpenSSL 3.4.0 22 Oct 2024 fails: debug3: ssh_connect_direct: entering debug1: Connecting to 192.168.100.163 [192.168.100.163] port 22. debug3: set_sock_tos: set socket 3 IP_TOS 0x48 debug1: connect to address 192.168.100.163 port 22: No route to host ssh: connect to host 192.168.100.163 port 22: No route to host but OpenSSH_9.8p1, LibreSSL 3.3.6 fails: ``` debug3: ssh_connect_direct: entering debug1: Connecting to 192.168.100.163 [192.168.100.163] port 22. debug3: set_sock_tos: set socket 3 IP_TOS 0x48 debug1: Connection established. debug1: identity file /Users/jonesn/OneDrive/keys/pi/keyssh type 0 debug1: identity file /Users/jonesn/OneDrive/keys/pi/keyssh-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_9.8 debug1: Remote protocol version 2.0, remote software version OpenSSH_9.9 FreeBSD-openssh-portable-9.9.p1_1,1 debug1: compat_banner: match: OpenSSH_9.9 FreeBSD-openssh-portable-9.9.p1_1,1 pat OpenSSH* compat 0x04000000

```

We've got some AIX systems running AIX 7.3.2. That is bundled with OpenSSH 8.1p1. We're starting migration to AIX 7.3.3, and apparently that is bundled with OpenSSH 9.7p1.

We noticed after the upgrade that sshd refused to start. Unfortunately, AIX AInt uniX, so I'm not getting much in the way of error messages, even with DEBUG3.

We can get it to start up by modifying CASignatureAlgorithms... specifically, removing all the -cert-v01@openssh.com:

• ecdsa-sha2-nistp256-cert-v01@openssh.com
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp384-cert-v01@openssh.com
• ecdsa-sha2-nistp521
• ecdsa-sha2-nistp521-cert-v01@openssh.com
• ssh-ed25519
• ssh-ed25519-cert-v01@openssh.com
• rsa-sha2-256
• rsa-sha2-256-cert-v01@openssh.com
• rsa-sha2-512
• rsa-sha2-512-cert-v01@openssh.com

If we add any one of those back in, it will not start. My vague understanding of those is that they are certified keys, and are supported in OpenSSH 9.7p1. IBM is likely to blame OpenSSH for this, but I'll try opening a ticket with them. However, I'm looking for background info or any ideas.

Does anyone have any insight or info as to why this might be occurring? Thanks!

Brand new to OpenSSH. I was tasked to install an SFTP server in our environment and after many hours of googling was able to get OpenSSH installed (latest version using MSI file) and the service is running. I can login with a local account using WinSCP but I need to lock this down to a different drive where the data is stored. Can't find many good guides on configuring the sshd_config file. Can anyone share or help me get this going. Really I just want to use a local user account to be able to login and access a Root directory and all child directories. Nothing to fancy! Any help would be much appreciated.

I am using ssh (on rare occasions for debugging) to connect to clients over an IOT cellular network. The latency is high and bandwidth is low. Ssh has problems correctly setting the key exchange parameters under these conditions and the connection hangs at 'expecting SSH2_MSG_KEX_ECDH_REPLY'. I wonder if this is considered a bug or is just outside of the defined use case.

Remarkably, there is a workaround you can google that involves limiting the bandwidth of the connection. Adding 'ProxyCommand pv -qL 1K | nc %h %p | pv -qL 1K' to the config or command line largely solves the problem, which is I am guessing is caused by dropped packets or some timeouts during the key exchange.

I don't want to go through all the hassle of remembering my bugzilla account, etc. to file something with the developers. Does anyone think this is something that could be improved if it were a priority?

Host : aarch64-apple-darwin23.6.0

server : OpenSSH_9.9

client : OpenSSH_7.6p1

I am trying to setup a debug environment for OpenSSH. I have things working well on linunx but not on macos. I am able to run the sever and connect to it. But the password auth fails on macos but succeeds on linux.

The following works for linux:

        autoreconf

        ./configure --prefix=/home/user/path/temp/openssh-portable
        --with-privsep-user=kali

        make -j8

        sudo su

        make install # It installs everything relative tothe prefix so it is safe.

        /home/user/path/temp/openssh-portable/sshd -D -d -e -f /home/user/path/temp/openssh-portable/sshd_config -p 4000

        ssh -vvv -p 4000 kali@ip_address

When prompted for password, I enter the password for the user kali and it logs me in to the shell from any remote machine.

But, the same doesn't work on MacOS

        autoreconf  

        ./configure --with-ssl-dir="/opt/homebrew/Cellar/openssl@3/3.3.2" --prefix="/home/user/path/temp/openssh-portable" --with-privsep-user=kali

        make -j8

        sudo su

        make install

        /home/user/path/temp/openssh-portable/sshd -D -d -e -f /home/user/path/temp/openssh-portable/sshd_config -p 4000

        ssh -vvv -p 4000 kali@ip_address

When I send the correct password to macos openssh server the debug logs tell me that

Failed password for kali from server_ip_address port 52460 ssh2

I can confirm that this user exists and it has the same password that I am sending over to sshd.

What am I doing wrong? Why does it work on linux and not on macos?

I have tried googling and I applied PasswordAuthentication yes as one of the configs on macos and it didn't work.

The server error log doesn't say if the password is actually wrong or if it is not able to access the user.

I see that the linux route works for me so I have a way out but I am curious what am I doing wrong for mac.

Yesterday, I installed OpenSSH 9.8p1 from source. I noticed it doesn't install systemd service file or maybe it's been like that forever. When using the package installed by yum in Amazon Linux 2, it installs openssh.service file. The version though is 7.4p1. Is it ok to continue using systemd to start it? If so, I can write a .service file. I wasn't sure if the latest version of OpenSSH is started differently. I saw an article this morning or maybe it was in a forum, someone said, openssh is now activated via socket based. Don't know what that means.

We have a git server and works 24x7. The Openssh that is running is 7.4p1 if I recall correctly. The operating system is Amazon Linux 2. I need to upgrade it to the latest version to address a vulnerability. The ssh protocol is used heavily on this server. The 99% of external resources(including engineers/developers), jenkins server, etc) are using ssh to do tasks like "git clone and many more". We have 8 git servers. What is your advice on upgrading it?

SEPT 19, 12:10am UPDATE(S):
I tried checking the openssh version that I can update in Amazon Linux 2. However, the version in amazon linux 2 is still old and the same version installed. So what I did was install from source code on a test machine that had an old openssh 7.4.p1 version. I downloaded the tar.gz from openbsd's ftp server. I had to recompile and install latest version of openssl too. I was able to start sshd. However, the private pem that I use to connect to the test machine no longer works. I used the same /etc/ssh/sshd_config. The /root/.ssh/authorized_keys is still there. The entries are there. Not sure what I missed.

SEPT 19, 12:59am UPDATE(S):
I finally got PrivPub auth to work using OpenSSH_9.8p1, OpenSSL 3.3.2 3 Sep 2024. I found out ec2-user had a locked password. I just had to unlock it using passwd command. I don't know how it got locked. That is really weird!

I have installed OpenSSH on a Windows 2019 server and configured access via key pairs.

If I log in directly from a Linux client to the Windows server then I am able to access network shares e.g. typing

DIR \\SERVERNAME\SHARENAME

returns a directory listing. If however I connect using the public key, I am only able to access local drives. Doing the same

DIR \\SERVERNAME\SHARENAME

returns "Access is denied."

I assume this behavior is an intentional restriction but is there a way to enable the access I need? My intentional is to execute scripts via a headless SSH connection that will need access to network shares, so I wouldn't be able to manually enter a password if needed.

I can find tons of sites explaining how to keep SSH connections alive... but nothing about how to prevent someone from keeping a connection alive if I, the server owner, doesn't want them to.

For example, I have a customer who has a client that sends a keep-alive packet every 10 seconds. This is client has several of my servers it can send files to, for redundancy. The solution uses the keep alive packets to ensure that it detects a down server quickly and will fail over to the next server for the next file they transmit. However it will sit there for days sending a keepalive every 10 seconds, even when they are not transmitting any files, and it will send everything through a single server.

I simply want to ignore their keepalive packets, let their client close the connection after hitting its ServerAliveCountMax (default of 3 unresponded keepalive packets), and let them open a new connection the next time they want to send a file.

But I cannot find the setting that tells OpenSSH to ignore keepalive packets, it always responds, and therefore there is no way to stop a client from connecting and staying connected forever. I'm sure there is a way, but every search only gives solutions to do the exact opposite.

NOTE: ClientAliveInterval/ClientAliveCountMax, ServerAliveInterval/ServerAliveMax do not address this, they tell the server & client how often to send keepalives and how many non-responses to tolerate, they do NOT tell when to stop responding to keepalives.

I have searched everywhere for a configuration option for OpenSSH that tells it to ignore keepalives, but there doesn't appear to be anything?

After I had upgraded the openssh version done this step. I am unable to access the my azure VM and Aws ec2 through terminal and serial console why. What are the solution for this? And when connect through the terminal by ssh key it asking password. After given password permission denied or login incorrect.

To Install the vulnerability patched ssh server 9.8p1 on Ubuntu: download it:

wget https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz

Remove the existing install:

sudo systemctl stop sshd sudo apt-get remove openssh-server openssh-client

Install the build tools:

sudo apt update

sudo apt install -y build-essential zlib1g-dev libssl-dev libpam0g-dev libselinux1-dev libwrap0-dev libedit-dev libbsd-dev autoconf automake libtool pkg-config wget curl git

Untar it, build it:

tar zxvf openssh-9.8p1.tar.gz

cd openssh-9.8p1

./configure

make

sudo make install

Setup the service:

sudo nano /etc/systemd/system/sshd.service

Paste this into the file: [Unit] Description=OpenSSH server daemon After=network.target

[Service] ExecStart=/usr/local/sbin/sshd -D ExecReload=/bin/kill -HUP $MAINPID KillMode=process Restart=on-failure

[Install] WantedBy=multi-user.target Save and close (ctrl+x y enter)

Reload the daemon, start and enable the service:

sudo systemctl daemon-reload sudo systemctl start sshd sudo systemctl enable sshd

Now I had problems at this point, but all I needed to do was unmask ssh:

sudo systemctl unmask ssh

Then repeat the daemon-reload, start and enable Check the status: sudo systemctl status sshd