SSH access
Who may sign in over SSH, from where, on which port, and what a session is allowed to do. This is the one page on this site where a wrong setting can lock you out of your own server, so it says what Dashmox refuses to let you do to yourself, and what it cannot protect you from.
Read this part first
SSH is the way back from everything else.
If you close the panel on yourself, a shell gets you back in. If you close the shell on yourself, what gets you back in is your provider’s console: the one that attaches a screen to the machine whether or not the network is co-operating. Before you change anything here, check you can reach that console and that you know the password for it. People discover they cannot at exactly the moment it is the only thing left.
Dashmox stops the two mistakes it can see coming. It cannot stop a key you have lost, a firewall your provider runs in front of the machine, or a laptop that is about to get a new address.
Who gets in
Passwords are two questions, not one.
Open Server, then SSH, and the first tab is Who gets in.
Password sign-in is for the server’s own accounts. Off means a key or nothing, which is where a server with one administrator should end up. Password sign-in for website accounts is asked separately because it is a different question with a different answer: the people using it are customers moving files with SFTP, and most of them are not going to manage a key.
Root sign-in has three answers rather than two. No refuses root entirely, which is the right answer when you have another account that can use sudo. Key only lets root in with a key and never with a password. Yes allows both, and is worth leaving behind.
Where it answers
Moving the port is two changes, and Dashmox makes the second one.
Changing the port on Where it answers moves SSH and opens the new port in the firewall. The order is deliberate: the new port is opened before SSH moves, so a connection is always possible, and the old one is closed after. If the firewall cannot be rewritten afterwards, Dashmox tells you in a sentence rather than reporting the move as having failed, because by then SSH has already moved and both ports are open. That is a thing to tidy up, not a thing to panic about.
Moving the port is not security on its own. It stops your log filling with automated attempts, which is worth something, and it stops nothing that is actually looking for you.
Who may reach it
The address list is the setting that locks people out.
Who may reach it names the addresses or ranges that may open the port at all. Empty means anywhere, which is what SSH has unless you say otherwise. For a private network such as Tailscale, the range is 100.64.0.0/10.
Dashmox refuses two things here. It refuses a list that leaves out the address you are connecting from, because saving it would end the session that saved it. And it refuses a list saved by something running on the server itself, because a request that came from the machine cannot tell where you connect from, so it cannot check the first rule. Set this from the address you actually use, never from a script on the server.
What it cannot check is tomorrow. A home connection whose address changes, or a laptop on a different network next week, is a list that was correct when you saved it and is not when you need it. A private network address is steadier than a home one for exactly this reason.
The inputs
What each box means, and what it refuses.
| Field | What it means |
|---|---|
| Port | Where SSH answers. Changing it moves SSH and opens the new port in the firewall first, then closes the old one. |
| Password sign-in | Passwords for the server’s own accounts. Off means a key or nothing. |
| Password sign-in for website accounts | The same question for website SFTP accounts, answered separately. Customers moving files are usually not managing keys. |
| Root sign-in | No, key only or yes. Prefer no, with another account that can use sudo. |
| Who may reach it | Addresses or ranges that may open the port. Empty means anywhere. A list without your own address is refused, and so is one saved from the server itself. |
| Attempts per connection | How many tries one connection gets before it is dropped. Low is fine: a person who typed it wrong simply connects again. |
| Grace period | How long a connection may sit there without signing in. It is what unauthenticated connections hold open, so shorter costs nothing. |
| Idle timeout | When a session with nobody at it is closed. Minutes, and zero leaves it open. |
| Forwarding, three switches | X11, TCP and agent forwarding. Each one is a way to reach something through the session rather than on it, and each is off unless somebody needs it. |
| Modern algorithms | Refuses the older ciphers and key exchanges. On unless something ancient has to connect, in which case fix the ancient thing. |
When the page and the machine disagree
Another file can win, and the page says so rather than hiding it.
SSH reads a directory of configuration files, not only the one Dashmox writes, and where two of them set the same thing the first value read wins. So a setting can be saved here and not be what the machine is doing, which is a confusing half hour if nothing tells you.
The page shows what was asked for beside what is in force. Where they differ, something else in /etc/ssh is setting it, and that file is the one to edit.
Port asked 30265 in force 30265 Password sign-in asked off in force off Root sign-in asked no in force prohibit-password
The third line is the shape of the problem: Dashmox asked for one thing, another file asked for something looser, and the looser one is what is running.
A sensible end state
Keys only, root refused, and a short list of addresses.
For a server one person administers: password sign-in off, root sign-in no, website passwords left on if customers use SFTP, forwarding off, modern algorithms on, and Who may reach it naming a private network range rather than a home address. Change one of these at a time and reconnect in a second window before you close the first.
The firewall itself, including what else the server exposes, is The server firewall. Moving a website in over SSH is Move a website over SSH.