{
  "name": "sshd",
  "section": 8,
  "title": "OpenSSH-compatible SSH daemon (Bare OS)",
  "synopsis": [
    "sshd [-f config] [-p port] [-D]",
    "bare-sshd [-f config] [-p port] [-D]"
  ],
  "description": "Bare OS SSH server backed by vendored bare-ssh2 in the booter. Listens on a TCP port (default 22, config default 127.0.0.1), negotiates SSH-2, and runs login shells or remote commands through the same execLine/shell pipeline as the console. Host keys are stored on the writable personal drive (see HostKey in sshd_config). Password authentication verifies the same account passphrase as login(1); successful password auth calls unlockIdentity like an interactive login (shared session identity). Public keys are read from AuthorizedKeysFile under $HOME. Initd unit bare-openssh starts the server at session boot unless disabled. Privilege separation like Unix sshd is not available; the server runs in the booter process.",
  "options": [
    {
      "flag": "-f FILE",
      "meaning": "Path to sshd_config (default /etc/ssh/sshd_config on the system image)"
    },
    {
      "flag": "-p PORT",
      "meaning": "Listen port (overrides Port in config)"
    },
    {
      "flag": "-D",
      "meaning": "Run in foreground (blocking) for debugging"
    }
  ],
  "environment": [
    "BARE_OS_SSH_BIND_ALL=1 — listen on 0.0.0.0 when config says 127.0.0.1 (use with care)",
    "BARE_OS_SSH_HOSTKEY_DIR — override directory for generated host keys"
  ],
  "files": [
    "/etc/ssh/sshd_config",
    "~/.config/bare-os/ssh/host/ssh_host_ed25519_key",
    "~/.ssh/authorized_keys",
    "/var/log/bare-os/openssh.log"
  ],
  "keywords": [
    "ssh",
    "sshd",
    "bare-openssh",
    "remote",
    "shell"
  ],
  "aliases": ["bare-sshd"],
  "bareOsNotes": "/bin/sshd delegates to ctx.bareOsRunSshdCli. SFTP subsystem exposes a minimal VFS-backed subset.",
  "seeAlso": [
    { "name": "sshd_config", "section": 5 },
    { "name": "ssh-keygen", "section": 1 },
    { "name": "systemctl", "section": 1 }
  ]
}