n ssh-server

Check & repair this machine's SSH server (sshd) — Windows gotchas included

Usage — n ssh-server

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — ssh-server (sshd, ssh-srv, sshserver) — Check & repair this machine's SSH server (sshd)
═══════════════════════════════════════════════════════════════════════════════

USAGE:
  n sshd .                             audit sshd, agent, shell, firewall (+ Windows token policy)
  n sshd . --fix                       repair the fixable items (asks)

OPTIONS:
  --elevate                        Windows: also set LocalAccountTokenFilterPolicy=1 (security trade-off)

Target: . = this machine · <host> = remote
Deeper: n sshd -h = the concept/theory behind this command  ·  n -h ssh-windows

The concept behind it — n ssh-server -h

═══════════════════════════════════════════════════════════════════════════════
  Netscrew ("n") — SSH Server (sshd) Readiness & Repair
═══════════════════════════════════════════════════════════════════════════════

COMMANDS:
  n ssh-server             Check whether THIS machine is set up to accept SSH
  n ssh-server --fix       Fix the fixable items (asks first)
  n ssh-server --fix --elevate  ...and set LocalAccountTokenFilterPolicy=1 (Windows; see below)

WHAT IT CHECKS (Windows):
  • OpenSSH Server installed, sshd running & Automatic, inbound firewall rule, listening port
  • ssh-agent service (disabled by default — needed to hold your keys)
  • Default shell (sshd defaults to cmd.exe; PowerShell is far nicer over SSH)
  • LocalAccountTokenFilterPolicy — whether a local admin gets a full or UAC-filtered token
    over SSH (the "I'm admin but can't do admin things" problem — see n -h ssh-windows)
  • Host keys present

THE --elevate FLAG (Windows, security trade-off):
  Setting LocalAccountTokenFilterPolicy = 1 gives local admin accounts a full elevated token
  over the network (SSH/WinRM/admin shares). It removes a lateral-movement (pass-the-hash)
  defence, so it's opt-in: --fix alone won't change it; add --elevate to.

WHAT IT CHECKS (Linux/macOS):
  • sshd installed & running • listening port • PermitRootLogin / PasswordAuthentication / PubkeyAuthentication

Back to main help: n -h | Windows SSH gotchas: n -h ssh-windows