SYSTEMD-SSH-GENERATOR(8) systemd-ssh-generator SYSTEMD-SSH-GENERATOR(8)
NAME
systemd-ssh-generator - Generator for binding a socket-activated SSH
server to local AF_VSOCK and AF_UNIX sockets
SYNOPSIS
/usr/lib/systemd/system-generators/systemd-ssh-generator
DESCRIPTION
systemd-ssh-generator binds a socket-activated SSH server to local
AF_VSOCK and AF_UNIX sockets under certain conditions. It only has an
effect if the sshd(8) binary is installed. Specifically, it does the
following:
• If invoked in a VM with AF_VSOCK support, a socket-activated SSH
per-connection service is bound to AF_VSOCK port 22.
• If invoked in a container environment with a writable directory
/run/host/unix-export/ pre-mounted it binds SSH to an AF_UNIX socket
/run/host/unix-export/ssh. The assumption is that this directory is
bind mounted to the host side as well, and can be used to connect to
the container from there. See Container Interface[1] for more
information about this interface.
• A local AF_UNIX socket /run/ssh-unix-local/socket is also bound,
unconditionally. This may be used for SSH communication from the
host to itself, without involving networking, for example to
traverse security boundaries safely and with secure authentication.
• Additional AF_UNIX and AF_VSOCK sockets are optionally bound, based
on the systemd.ssh_listen= kernel command line option or the
ssh.listen system credential (see below).
See systemd-ssh-proxy(1) for details on how to connect to these sockets
via the ssh client.
The ssh.authorized_keys.root credential can be used to allow specific
public keys to log in over SSH. See systemd.system-credentials(7) for
more information.
The generator will use a packaged sshd@.service service template file if
one exists, and otherwise generate a suitable service template file.
systemd-ssh-generator implements systemd.generator(7).
KERNEL COMMAND LINE
systemd-ssh-generator understands the following kernel-command-line(7)
parameters:
systemd.ssh_auto=
This option takes an optional boolean argument, and defaults to yes.
If enabled, the automatic binding to the AF_VSOCK and AF_UNIX
sockets listed above is done. If disable, this is not done, except
for those explicitly requested via systemd.ssh_listen= on the kernel
command line or via the ssh.listen system credential.
Added in version 256.
systemd.ssh_listen=
This option configures an additional socket to bind SSH to. It may
be used multiple times to bind multiple sockets. The syntax should
follow the one of ListenStream=, see systemd.socket(5) for details.
This functionality supports all socket families systemd(1) supports,
including AF_INET and AF_INET6.
Added in version 256.
CREDENTIALS
systemd-ssh-generator supports the system credentials logic. The
following credentials are used when passed in:
ssh.listen
This credential should be a text file, with each line referencing
one additional socket to bind SSH to. The syntax should follow the
one of ListenStream=, see systemd.socket(5) for details. This
functionality supports all socket families systemd supports,
including AF_INET and AF_INET6.
Added in version 256.
SEE ALSO
systemd(1), kernel-command-line(7), systemd.system-credentials(7),
vsock(7), unix(7), ssh(1), sshd(8)
NOTES
1. Container Interface
https://systemd.io/CONTAINER_INTERFACE
systemd 257.9 SYSTEMD-SSH-GENERATOR(8)
Generated by dwww version 1.16 on Tue Dec 16 04:54:38 CET 2025.