# Shared test sshd config used by Linux / macOS / Windows CI runners.
# Generated per-platform by tests/sshd/setup-*.sh; the platform-specific
# setup script is responsible for substituting __SFTP_SERVER_PATH__ and
# any directives the host platform does not support.

Port 22222
# ListenAddress unset on purpose: sshd defaults to all loopback addresses
# (127.0.0.1 and ::1) on whatever ports Port applies. tests/15
# runs test_command_with_dest_ipv6 against [::1], so we must accept
# dual-stack loopback. Set AddressFamily any (already below) to also
# be safe on the Windows runner where sshd treats the v4 default
# literally.
AddressFamily any

# Authentication — passhrs e2e tests authenticate with
# --password PassTest1234! (meets Windows password complexity too).
PermitRootLogin yes
PasswordAuthentication yes
PubkeyAuthentication yes
PermitEmptyPasswords no
UsePAM yes

# Forwarding — required by -L / -R / -D tests, and by the locale-env
# forwarding tests that rely on sshd to negotiate env with the client.
AllowTcpForwarding yes
AllowAgentForwarding yes
AllowStreamLocalForwarding yes
GatewayPorts yes

# AcceptEnv — mirrors OpenSSH default SendEnv LANG LC_*. Without this,
# sshd silently drops client env requests and the locale_env_forwarded
# test will see an empty env on the remote side.
AcceptEnv LANG LC_*

# Speed up connection establishment during the test run. MaxStartups
# is generous (default 10:30:100 drops 30% of unauthenticated
# connections once 10 are queued) because the test suite hammers sshd
# with rapid back-to-back sessions; without headroom we see
# "Connection reset by peer" mid-handshake on a busy moment.
LoginGraceTime 60
MaxAuthTries 10
MaxStartups 50:100:200
MaxSessions 100

# Disable features we do not want in CI: DNS reverse lookups can stall the
# auth path on shared CI networks and produce flakes.
UseDNS no

# PerSourcePenalties disabled per Issue #9 investigation: OpenSSH 9.8+
# turns on a per-source-IP connection-rate penalty by default; after
# ~30 back-to-back test runs from 127.0.0.1 the cumulative penalty
# drops late-run connections mid-handshake with ECONNRESET (look for
# `srclimit_penalise: ipv4: new 127.0.0.1/32 deferred penalty of N
# seconds` and `drop connection #0 from [127.0.0.1]:N on [127.0.0.1]:
# 22222 penalty: ...` in sshd.log on a failing run). The directive is
# commented out here and re-introduced at setup time by the
# platform-specific setup-*.sh / setup-*.ps1 scripts via a runtime
# probe that DEFINITIVELY greps `sshd -T -f $cfg` output for a line
# matching `^persourcepenalties no\b` — exit-code-only probing is not
# reliable because some sshd builds accept the directive but print it
# as the default value. Probe deliberately writes the directive into
# a scratch config and only appends to the real config when sshd
# actually reports the override as effective.
#
# IMPORTANT: the directive name is `PerSourcePenalties` — OpenSSH has
# used `persourcepenalties` since the feature was introduced in 9.8
# (see openssh-portable/servconf.c keyword table for V_9_8, V_10_0,
# V_10_3p1). The earlier `srclimit no` was a misremembered name; that
# keyword has never existed, and writing it to a config is treated as
# an unknown directive (fatal at parse time on strict builds, silently
# ignored on lenient ones — either way the penalty stays ON).
# PerSourcePenalties no

# Quiet logging. Tests observe passhrs behavior, not sshd diagnostics.
LogLevel ERROR

# Subsystem line: the platform-specific setup script does `sed
# s|__SFTP_SERVER_PATH__|/path/to/sftp-server|` to inject the
# correct binary path for the host OS. The line must NOT be
# commented out — when it is, sshd silently drops every
# `subsystem request for sftp` (log line: 'subsystem request
# for sftp by user <u> failed, subsystem not found') and the
# SFTP tests hang in SftpSession::new waiting for an INIT
# packet that will never come. (The commented line in earlier
# revisions of this file was a documentation placeholder
# expecting the setup script to append an uncommented line;
# that approach was replaced by sed-in-place substitution
# without uncommenting, hence the SFTP subsystem being
# effectively disabled on every platform.)
Subsystem sftp __SFTP_SERVER_PATH__