====== SSH ======

PBDispatch has its own SSH server. Callers log in with their **own BBS user name and password**; no Windows account, no OpenSSH and no helper program are needed. After the SSH login they go straight into the board on the next free node, already logged in.

This replaces the older SSH bridge, which relied on a Windows OpenSSH account. Do not run both on the same port.

===== Turn it on =====

The SSH server is opt-in. With no ''Configs\PBSSHD.CFG'' there is no SSH server. Open **Network > SSH Server** in PBConfig, set your options and click **Save**, then restart PBDispatch. The log should show //SSH server: listening on port 22//.

{{ :v4:images:config-ssh.png?900 |The SSH Server screen in PBConfig}}
//Figure 1. Network > SSH Server in PBConfig.//

The SSH server is on whenever ''PBSSHD.CFG'' exists and **Enable the SSH server** is checked. On the screen the settings below are labelled //Enable the SSH server//, //Port//, //Bind address//, //Allow the user name "new"//, //Wrong passwords allowed//, //Delay after a wrong password// and, under **Host key**, //Key file prefix// (empty means ''Configs\PBSSHD_HOSTKEY''). In the file they are:

^ Setting ^ Meaning ^
| enabled | ''yes'' or ''no''. |
| port | 1 to 65535. Default 22. |
| bindaddress | The IPv4 address to listen on. Default: all. |
| newuser | ''yes'' lets a caller use the user name ''new'', with no password, to start the new-user process. |
| maxauthtries | 1 to 10 wrong passwords per connection. Default 3. |
| faildelay | 0 to 30 seconds a connection is held after a wrong password. Default 3. |
| hostkey | The prefix for the host key files. Default ''Configs\PBSSHD_HOSTKEY''. |

**Port 22.** If Windows' OpenSSH Server is installed it already owns port 22. Stop and disable it (services.msc, //OpenSSH SSH Server//), or give the BBS another port. Open the port in Windows Firewall and your router.

If your PBDispatch was built without the SSH library, the log says //SSH server unavailable//. The packages from the ProBoard site include it.

===== Host keys =====

On first start PBDispatch creates an ed25519 key and an RSA-3072 key, saved as ''<hostkey>.ed25519'' and ''<hostkey>.rsa'', and logs their fingerprints. **Keep these files.** If they change, every caller gets a "host key changed" warning. Make the folder readable only by the account that runs PBDispatch.

===== Connecting =====

<code>
ssh "Hugo Asd"@bbs.example.com
ssh Hugo_Asd@bbs.example.com
ssh -p 2222 Hugo_Asd@bbs.example.com
ssh new@bbs.example.com
</code>

An underscore in the user name means a space. The password is the caller's BBS password; nothing is typed again at the board. PBTerm and any other SSH client work.

===== Login Guard =====

Banned addresses are refused before the SSH banner is sent. Each wrong password is logged to ''LOGS\LOGINGUARD.LOG'' with the caller's real address and counts toward a ban. See [[v4:connect:login_guard|Login Guard]].

===== Limits =====

  * Password login only: no public keys, no SFTP, no remote commands, no port forwarding.
  * The terminal's window size is not passed on to the board.
  * IPv4 only.
  * SSH sessions live inside PBDispatch. Stopping or restarting it disconnects SSH callers. Telnet and RLogin callers are unaffected.
  * Zmodem file transfers work.