Controls the behaviour of the built-in SSH server, including
security, session limits, IP access rules, and protocol features.
General
- Security Level
-
The cipher and MAC suite to advertise. STRONG
(default) supports only modern algorithms. Reduce if compatibility
with older clients is required, but this weakens security.
- Idle Connection Timeout
-
Seconds of inactivity before an idle SSH session is disconnected.
Default is 600 seconds (10 minutes). Set to 0 to
disable.
- Keep Alive
- When enabled, sends TCP keepalive probes to
detect dead connections. Useful on networks with aggressive NAT
timeouts.
- TCP No Delay
- Disables Nagle's algorithm. May improve
interactive session responsiveness at the cost of slightly higher
packet counts.
Authentication
- Enable Passwords
- Permits username/password authentication.
Disable to enforce public key (or other) authentication only.
- Failed Authentication Count
-
Number of failed authentication attempts allowed per connection
before it is forcibly closed. Default is 15.
- Failed Authentication Threshold
-
Number of failed attempts within a session that triggers a rate-limit
delay. Default is 5.
- Enable Banning
- Automatically bans IPs that repeatedly fail
authentication.
- Temporary Ban Period
-
Duration in seconds that a banned IP is blocked. Default is 300
seconds (5 minutes).
SFTP / SCP
- Enable SCP
- Allows SCP file transfers. Enabled by
default.
- SFTP Charset
-
Character encoding used for SFTP filenames. Default is UTF-8.
- SFTP Window / Packet Sizes
- Fine-tune SFTP transfer performance.
Increase maximum window space for high-latency, high-bandwidth
connections. Defaults are suitable for most deployments.
IP Access Rules
- Allowed IPs
- Whitelist of IP addresses or CIDR ranges
permitted to connect. If this list is non-empty, all other IPs are
denied.
- Blocked IPs
- Blacklist of IP addresses or CIDR ranges
that are always refused, regardless of whitelist rules.
Port Forwarding
- Enable Local Forwarding
- Allows SSH port forwarding (tunnelling).
Disabled by default. Enable only when needed.
- Allowed Forwarding
- When local forwarding is enabled, restrict
forwarding to only the listed host:port combinations.