---
name: "systemd-ssh-generator"
section: "8"
platform: "linux"
package: "systemd"
version: "262.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/systemd-ssh-generator"
---

# systemd-ssh-generator(8)

Generator for binding a socket-activated SSH server to local AF\_VSOCK and AF\_UNIX sockets

## NAME

systemd-ssh-generator - Generator for binding a socket-activated SSH server to local **AF\_VSOCK** and **AF\_UNIX** sockets

## SYNOPSIS

/usr/lib/systemd/system-generators/systemd-ssh-generator

## DESCRIPTION

**systemd-ssh-generator** binds a socket-activated SSH server to local **AF\_VSOCK** and **AF\_UNIX** sockets under certain conditions. It only has an effect if the [**sshd**(8)](/sshd/8.md) binary is installed. Specifically, it does the following:

• If invoked in a VM with **AF\_VSOCK** support, a socket-activated SSH per-connection service is bound to **AF\_VSOCK** port 22.

• If invoked in a container environment with a writable directory /run/host/unix-export/ pre-mounted it binds SSH to an **AF\_UNIX** socket /run/host/unix-export/ssh. The assumption is that this directory is bind mounted to the host side as well, and can be used to connect to the container from there. See **Container Interface**\[1\] for more information about this interface.

• A local **AF\_UNIX** socket /run/ssh-unix-local/socket is also bound, unconditionally. This may be used for SSH communication from the host to itself, without involving networking, for example to traverse security boundaries safely and with secure authentication.

• Additional **AF\_UNIX** and **AF\_VSOCK** sockets are optionally bound, based on the *systemd.ssh\_listen=* kernel command line option or the ssh.listen system credential (see below).

See [**systemd-ssh-proxy**(1)](/systemd-ssh-proxy/1.md) for details on how to connect to these sockets via the **ssh** client.

The *ssh.authorized\_keys.root* credential can be used to allow specific public keys to log in over SSH. See [**systemd.system-credentials**(7)](/systemd.system-credentials/7.md) for more information.

The generator will use a packaged sshd@.service service template file if one exists, and otherwise generate a suitable service template file.

**systemd-ssh-generator** implements [**systemd.generator**(7)](/systemd.generator/7.md).

## KERNEL COMMAND LINE

**systemd-ssh-generator** understands the following [**kernel-command-line**(7)](/kernel-command-line/7.md) parameters:

*systemd.ssh\_auto=*

This option takes an optional boolean argument, and defaults to yes. If enabled, the automatic binding to the **AF\_VSOCK** and **AF\_UNIX** sockets listed above is done. If disable, this is not done, except for those explicitly requested via *systemd.ssh\_listen=* on the kernel command line or via the *ssh.listen* system credential.

Added in version 256.

*systemd.ssh\_listen=*

This option configures an additional socket to bind SSH to. It may be used multiple times to bind multiple sockets. The syntax should follow the one of *ListenStream=*, see [**systemd.socket**(5)](/systemd.socket/5.md) for details. This functionality supports all socket families [**systemd**(1)](/systemd/1.md) supports, including **AF\_INET** and **AF\_INET6**.

Added in version 256.

## CREDENTIALS

**systemd-ssh-generator** supports the system credentials logic. The following credentials are used when passed in:

*ssh.listen*

This credential should be a text file, with each line referencing one additional socket to bind SSH to. The syntax should follow the one of *ListenStream=*, see [**systemd.socket**(5)](/systemd.socket/5.md) for details. This functionality supports all socket families systemd supports, including **AF\_INET** and **AF\_INET6**.

Added in version 256.

*ssh.ephemeral-authorized\_keys-all*

Provides additional public keys, given in the customary authorized\_keys format, for all users, for incoming connections via the generated **AF\_VSOCK** and **AF\_UNIX** socket units.

The intended use of this is for a host system (in either VM or container configurations) to generate a keypair and inject the public key into the guest, using the private key to connect to any user account on the guest via ssh, without further authentication.

Added in version 256.

## SEE ALSO

[**systemd**(1)](/systemd/1.md), [**kernel-command-line**(7)](/kernel-command-line/7.md), [**systemd.system-credentials**(7)](/systemd.system-credentials/7.md), [**vsock**(7)](/vsock/7.md), [**unix**(7)](/unix/7.md), [**ssh**(1)](/ssh/1.md), [**sshd**(8)](/sshd/8.md)

## NOTES

- 1\.

  Container Interface

  https://systemd.io/CONTAINER\_INTERFACE