SSHD(1)

NAME
sshd - MontaukOS SSH-2 server

SYNOPSIS
sshd

DESCRIPTION
sshd accepts SSH-2 connections and gives each authenticated user a MontaukOS shell. It is normally launched automatically by init(1) and does not require direct user interaction. Remote access is disabled by default; enable it from Settings > SSH Server, which sets services.ssh.enabled in 0:/config/init.toml. The change takes effect on the next boot.

AUTHENTICATION
Passwords are the only supported method, checked against the MontaukOS account database. A user must additionally be listed in the [allow] table of 0:/config/ssh.toml before a login is accepted; users absent from that table are refused. The Settings applet maintains this table. Failed passwords are delayed, and a connection is dropped after eight attempts.

CONFIGURATION

0:/config/ssh.toml
    Listening port (server.port, default 22) and the per-user [allow] table.

0:/config/ssh_hostkey.toml
    The RSA host key, generated on first start. Note that the filesystem has no permission model, so this file is readable by any local process; keeping it separate from ssh.toml limits exposure but is not access control.

DIAGNOSTICS
Messages go to the boot console only. They do not appear in klog(1): SYS_PRINT writes the kernel terminal rather than the kernel log ring, and is discarded entirely once the desktop suppresses console output. There is currently nowhere to read them from on a running desktop.

PROTOCOL
Key exchange is diffie-hellman-group14-sha256 with an rsa-sha2-256 host key; the transport uses aes128-ctr with hmac-sha2-256. Client-initiated rekeying is supported. Only one session channel per connection is served, and connections are handled one at a time.

LIMITATIONS
Public key authentication, port forwarding, X11 forwarding, SFTP and SCP are not implemented. exec requests run the command by feeding it to an interactive shell, so the shell prompt and the echoed command line appear in the output. Scripts that parse remote command output should account for this.

SEE ALSO
shell(1), init(1)