SYSTEMD-SSH-GENERATOR(8)

💖 SYSTEMD-SSH-GENERATOR 💖

okay bestie, pull up a chair, because this is systemd-ssh-generator from the systemd-ssh-generator manual and it is so much cooler than it sounds. it's a generator. it makes SSH happen in places SSH doesn't normally happen. no cap. 🦋

---

✨ NAME ✨

systemd-ssh-generator — a generator that binds a socket-activated SSH server to local AF_VSOCK and AF_UNIX sockets. literally its whole personality. 💅

---

✨ SYNOPSIS ✨

/usr/lib/systemd/system-generators/systemd-ssh-generator

that's it. that's the whole invocation. she just runs. 👑

---

✨ DESCRIPTION ✨

okay so here's the tea. systemd-ssh-generator binds a socket-activated SSH server to local AF_VSOCK and AF_UNIX sockets — but only under certain conditions, bestie. and it only does anything at all if the sshd(8) binary is installed. no sshd, no vibes.

specifically, she does this:

• if she's invoked in a VM with AF_VSOCK support, a socket-activated SSH per-connection service gets bound to AF_VSOCK port 22. 🎀
• if she's invoked in a container environment with a writable directory /run/host/unix-export/ pre-mounted, she binds SSH to an AF_UNIX socket at /run/host/unix-export/ssh. the assumption (iykyk) is that this directory is bind mounted to the host side as well, so you can use it to connect to the container from there. check out Container Interface[1] for more about this interface. 🫶
• a local AF_UNIX socket at /run/ssh-unix-local/socket is also bound — unconditionally, like she's not asking permission. this one is for SSH communication from the host to itself, no networking involved, for example to traverse security boundaries safely and with secure authentication. iconic behavior honestly. ✨
• additional AF_UNIX and AF_VSOCK sockets are optionally bound, based on the systemd.ssh_listen= kernel command line option or the ssh.listen system credential (more on those below). 🌸

want to actually connect to these sockets with the ssh client? see systemd-ssh-proxy(1) for the deets.

also: the ssh.authorized_keys.root credential can be used to allow specific public keys to log in over SSH. see systemd.system-credentials(7) for more info. 🔥

and here's a cute implementation detail: the generator will use a packaged sshd@.service service template file if one exists, and otherwise she'll generate a suitable service template file herself. self-sufficient queen. 👑

last thing: systemd-ssh-generator implements systemd.generator(7). periodt.

---

✨ KERNEL COMMAND LINE ✨

systemd-ssh-generator understands the following kernel-command-line(7) parameters:

• systemd.ssh_auto= — this option takes an optional boolean argument, and defaults to yes. if enabled, the automatic binding to the AF_VSOCK and AF_UNIX sockets listed above happens. if disabled, it does not happen — except for those explicitly requested via systemd.ssh_listen= on the kernel command line or via the ssh.listen system credential. 💜

Added in version 256.

• systemd.ssh_listen= — this option configures an additional socket to bind SSH to. you can use it multiple times to bind multiple sockets, so go off. the syntax should follow the one of ListenStream=, see systemd.socket(5) for details. this functionality supports all socket families systemd(1) supports, including AF_INET and AF_INET6. 🌈

Added in version 256.

---

✨ CREDENTIALS ✨

systemd-ssh-generator supports the system credentials logic, bestie. the following credentials are used when passed in:

• ssh.listen — this credential should be a text file, with each line referencing one additional socket to bind SSH to. the syntax should follow the one of ListenStream=, see systemd.socket(5) for details. this functionality supports all socket families systemd supports, including AF_INET and AF_INET6. 💖

Added in version 256.

• ssh.ephemeral-authorized_keys-all — provides additional public keys, given in the customary authorized_keys format, for all users, for incoming connections via the generated AF_VSOCK and AF_UNIX socket units. 🔑

the intended use of this is for a host system (in either VM or container configurations) to generate a keypair and inject the public key into the guest, using the private key to connect to any user account on the guest via ssh, without further authentication. yes, that's a lot of power, she's aware.

Added in version 256.

---

✨ SEE ALSO ✨

systemd(1), kernel-command-line(7), systemd.system-credentials(7), vsock(7), unix(7), ssh(1), sshd(8)

---

✨ NOTES ✨

1. Container Interface https://systemd.io/CONTAINER_INTERFACE

---

quick vibe check: this page lives in systemd 262.1, and honestly? she ate. go bind some sockets bestie 💅🧚🌸