Configuration reference
Every ssoosshd.yaml key, one page per top-level section. The pages are generated from the Go structs in server/config – the same source that produces the ssoosshd.yaml(5) man page and the annotated defaults file shipped to /etc/ssoossh/ssoosshd.yaml. A key in your file that none of these pages lists has no effect, and ssoosshd logs a warning naming it, with the closest real key when one is a slip away.
| Section | Configures |
|---|---|
| Top-level keys | |
| logging | the main application log |
| db | the database connection, pooling, retries, and query logging |
| http | the listener, TLS, sessions, and rate limiting |
| queue | the log destination for the internal message queue |
| authentication | OAuth/OIDC authentication for the server |
| ldap | optionally enriches the OIDC identity with directory attributes |
| nss | |
| admin | administrative and auditor access |
| audit | how long the database copy is kept and where the durable log is shipped |
| hsm | optionally sources the CA key from a PKCS#11 token instead of ssh_key |
| ssh_key_agent | |
| pubsub | the message broker behind the certificate pipeline |
| cert_options | the issuance policy for each certificate type |
| the relay, the sender, and the local template overrides | |
| branding | customizes the login page and web UI |
| version |