OpenSSH server configuration

Rowan Puttergill Last review: 2026-06-12
This topic covers installing, starting, and configuring the OpenSSH server (sshd) on Fedora, including system-wide configuration files, enforcing key-based authentication, and other server-side security settings. For client-side configuration and key management, see OpenSSH Client Configuration. For background on the SSH protocol, see About SSH and OpenSSH.

Status: work in progress. Content in this section is in review and being updated. Feedback welcome!

Configuration files

There are two different sets of configuration files: those for client programs (that is, ssh, scp, and sftp), and those for the server (the sshd daemon). System-wide SSH configuration information is stored in the /etc/ssh/ directory as described in System-wide configuration files below. For the user-specific configuration files stored in ~/.ssh/, see User-specific configuration files in OpenSSH Client Configuration.

Tabela 1. System-wide configuration files
File Description

/etc/ssh/moduli

Contains Diffie-Hellman groups used for the “Diffie-Hellman group exchange” key exchange method, which is critical for constructing a secure transport layer. When keys are exchanged at the beginning of an SSH session, a shared, secret value is created which cannot be determined by either party alone. If the file is not available, fixed groups will be used. Other key exchange methods do not need this file.

/etc/ssh/ssh_config

The default SSH client configuration file. Note that it is overridden by ~/.ssh/config if it exists.

/etc/ssh/sshd_config

The configuration file for the sshd daemon.

/etc/ssh/ssh_host_ecdsa_key

The ECDSA private key used by the sshd daemon.

/etc/ssh/ssh_host_ecdsa_key.pub

The ECDSA public key used by the sshd daemon.

/etc/ssh/ssh_host_rsa_key

The RSA private key used by the sshd daemon.

/etc/ssh/ssh_host_rsa_key.pub

The RSA public key used by the sshd daemon.

/etc/ssh/ssh_host_ed25519_key

The EdDSA private key used by the sshd daemon.

/etc/ssh/ssh_host_ed25519_key.pub

The EdDSA public key used by the sshd daemon.

/etc/pam.d/sshd

The PAM configuration file for the sshd daemon.

/etc/sysconfig/sshd

Configuration file for the sshd service.

For information concerning various directives that can be used in the SSH configuration files, see the ssh_config(5) and sshd_config(5) manual pages.

Starting an OpenSSH server

Make sure you have relevant packages installed

To run an OpenSSH server, you must have the openssh-server package installed. If not already installed, run:

$ sudo dnf install openssh-server

To start the sshd daemon in the current session, type the following at a shell prompt:

$ sudo systemctl start sshd.service

To stop the running sshd daemon in the current session, use the following command:

$ sudo systemctl stop sshd.service

If you want the daemon to start automatically at the boot time, use the following command:

$ sudo systemctl enable sshd.service
Created symlink '/etc/systemd/system/multi-user.target.wants/sshd.service' → '/usr/lib/systemd/system/sshd.service'.

See Services and Daemons for more information on how to configure services in Fedora.

Note that if you reinstall the system, a new set of identification keys will be created. As a result, clients who had connected to the system with any of the OpenSSH tools before the reinstall will see the following message:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.

To prevent this, you can backup the relevant files from the /etc/ssh/ directory (see System-wide configuration files for a complete list), and restore them whenever you reinstall the system.

Requiring SSH for remote connections

For SSH to be truly effective, using insecure connection protocols should be prohibited. Otherwise, a user’s password may be protected using SSH for one session, only to be captured later while logging in using Telnet. Some services to disable include telnet, rsh, rlogin, and vsftpd.

These services are not installed by default in Fedora. If required, to make sure these services are not running, type the following commands at a shell prompt:

$ sudo systemctl stop telnet.service
$ sudo systemctl stop rsh.service
$ sudo systemctl stop rlogin.service
$ sudo systemctl stop vsftpd.service

To disable running these services at startup, type:

$ sudo systemctl disable telnet.service
$ sudo systemctl disable rsh.service
$ sudo systemctl disable rlogin.service
$ sudo systemctl disable vsftpd.service

See Services and Daemons for more information on how to configure services in Fedora.

Enforcing key-based authentication

To improve the system security even further, generate SSH key pairs and then enforce key-based authentication by disabling password authentication. To do so, create a drop-in configuration file, for example /etc/ssh/sshd_config.d/01-local.conf. Make sure it is lexicographically before the 50-redhat.conf file, providing Fedora defaults. In a text editor such as vi or nano insert the PasswordAuthentication option as follows:

PasswordAuthentication no

If you are working on a system other than a new default installation, check that PubkeyAuthentication no has not been set in neither /etc/ssh/sshd_config nor any included file from drop-in directory. If connected remotely, not using console or out-of-band access, testing the key-based log in process before disabling password authentication is advised.

To generate SSH key pairs and copy them to this server so that key-based authentication works once password authentication is disabled, see Generating Key Pairs in OpenSSH Client Configuration.

SSH certificates

Configuring HostCertificate, TrustedUserCAKeys, RevokedKeys, and AuthorizedPrincipalsFile for certificate-based authentication is covered as part of the SSH Certificate Authentication use case in Advanced SSH Usage.

Additional resources

For more information on how to configure an OpenSSH server on Fedora, see the resources listed below.

  • sshd(8) — The manual page for the sshd daemon documents available command line options and provides a complete list of supported configuration files and directories.

  • sshd_config(5) — The manual page named sshd_config provides a full description of available SSH daemon configuration options.

For client-side resources and information about the SSH protocol, see OpenSSH Client Configuration and About SSH and OpenSSH.

Want to help? Learn how to contribute to Fedora Docs ›