[{"_1":2,"_171":-5,"_172":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_146":147},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_135":-5,"_136":11,"_137":21,"_138":11,"_139":-5,"_140":11,"_141":-5,"_142":143,"_144":91,"_145":-7},"canonicalUrl","https://hub.docker.com/r/vtacquet/openssh/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","vtacquet","reponame","openssh","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2023-08-24T14:28:57.002512Z","description","lightweight openssh 9.3 on alpine 3.18.3 (with public key authentication and IP restrictions)","is_private","last_updated","2023-08-24T19:31:09.960981Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",1138,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","**Description:**\nCreates a basic openssh container with public key authentication and IP restrictions.\n\n**environment variables:**\n```\nSSHD_PUBLICKEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA26/RVDqaqrkapqrCG9MmYOY841zJ8G/Hx6diiMoMhV vince@tacquet.be\nSSHD_PUBLICKEY_URL=https://tacquet.be/m/vince_ed25519.pub\nSSHD_ALLOWUSERS=data@1.2.3.4 data@2.3.4.5\nGROUPID=101\nUSERID=100\nDATAPATH=/data\n```\n\nthe SSHD_PUBLICKEY and SSHD_PUBLICKEY_URL will use the environment variable and/or the url to put the key in the authorized_keys file, it will check if the key is already used, you can also skip these parameters and map the /config/authorized_keys file to a file outside of the container, it will be copied to the correct location and used when the container is restarted.\n\nthe SSHD_ALLOWUSERS environment variable allows you to block all non-listed IPs to the service, it defaults to data@* (user data from anywhere).\n\nthe GROUPID, USERID and DATAPATH environment variables allows you to change the groupid, userid and location of the storage files, it defaults to the ones in the example above.\n\n**docker-compose example:**\n```\n openssh:\n hostname: openssh\n container_name: openssh\n image: vtacquet/openssh:latest\n restart: unless-stopped\n ports:\n - \"2222:2222\"\n volumes:\n - /etc/localtime:/etc/localtime:ro\n - /opt/docker/openssh/config:/config\n - /opt/docker/openssh/log/auth.log:/var/log/auth.log\n - samba_data:/data\n environment:\n - TZ=Europe/Brussels\n - SSHD_PUBLICKEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA26/RVDqaqrkapqrCG9MmYOY841zJ8G/Hx6diiMoMhV vince@tacquet.be\n - SSHD_PUBLICKEY_URL=https://tacquet.be/m/vince_ed25519.pub\n - SSHD_ALLOWUSERS=data@1.2.3.4\n```\n\nmake sure you map the /config folder outside of the container otherwise it will regenerate its host keys everytime it is recreated\n\n - /opt/docker/openssh/config:/config\n\nif you want to use fail2ban to block all invalid logon attempts, make sure you map the /var/log/auth.log file outside of the container (change the jail file if you map the auth.log file elsewhere)\n\n - /opt/docker/openssh/log/auth.log:/var/log/auth.log\n\nuse the following fail2ban filter in /etc/fail2ban/filter.d/openssh-keys.conf\n``` \n[INCLUDES]\n\nbefore = common.conf\n\n[Definition]\n\nfailregex = crit sshd\\[\\d+\\]: fatal: Timeout before authentication for port \\d+.*$ \n err sshd\\[\\d+\\]: Disconnecting authenticating user \\S+ port \\d+: Too many authentication failures.*$\n err sshd\\[\\d+\\]: error: maximum authentication attempts exceeded for invalid user \\S+ from port \\d+.*$\n info sshd\\[\\d+\\]: banner exchange: Connection from port \\d+: invalid format.*$\n info sshd\\[\\d+\\]: Connection closed by \\S+ user \\S+ port \\d+ \\[preauth\\].*$\n info sshd\\[\\d+\\]: Connection reset by \\S+ user \\S+ port \\d+ \\[preauth\\].*$\n info sshd\\[\\d+\\]: Disconnected from invalid user \\S+ port \\d+.*$\n info sshd\\[\\d+\\]: Failed password for \\S+ from port \\d+.*$\n info sshd\\[\\d+\\]: Failed password for invalid user \\S+ from port \\d+.*$\n info sshd\\[\\d+\\]: Invalid user \\S+ from port \\d+.*$\n info sshd\\[\\d+\\]: Unable to negotiate with port \\d+.*$\n info sshd\\[\\d+\\]: User \\S+ from not allowed because not listed in AllowUsers.*$\n\nignoreregex = info sshd\\[\\d+\\]: Server listening on.*$\n info sshd\\[\\d+\\]: Accepted publickey for data from port \\d+.*$\n\n[Init]\n\nmaxlines = 1\n```\n\nuse the following fail2ban jail in /etc/fail2ban/jail.d/openssh.conf \n```\n[openssh]\nenabled = true\nfilter = openssh-keys\nlogpath = /opt/docker/openssh/log/auth.log\nmaxretry = 3\nbantime = 4h\n```","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",96006953,"orgData","recentTags",[91,129],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},"content_type","creator",2387137,"digest","sha256:41f273109bdbb007c23b2fe3f8ccb2414c1b71117f9a40fd3095cc23ab541ddf","full_size",48975171,"id",499778615,"images",[103],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},"architecture","amd64","features","","last_pulled","2026-10-09T08:33:18.710631553Z","last_pushed","2023-08-24T19:31:03Z","os","linux","os_features","os_version","size","variant","2023-08-24T19:31:02.320608Z","last_updater","last_updater_username","media_type","latest","repository",21681196,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_92":44,"_93":94,"_95":96,"_97":98,"_99":130,"_101":131,"_50":133,"_119":94,"_120":33,"_121":56,"_57":134,"_123":124,"_125":109,"_126":133,"_127":66,"_128":21},499778540,[132],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},"2023-08-24T19:31:09.818782Z","v1.00","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":148,"_155":156,"_142":169,"_170":11},{"_40":149,"_42":150,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":151,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":152,"_79":11,"_80":154,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":153},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_157":158,"_159":-5,"_160":-5,"_161":162},"count",2,"next","previous","results",[163,166],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":130,"_101":164,"_50":133,"_119":94,"_120":33,"_121":56,"_57":134,"_123":124,"_125":109,"_126":133,"_127":66,"_128":21},[165],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_101":167,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},[168],{"_104":105,"_95":96,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":98,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

vtacquet/openssh

Tags for vtacquet/openssh