# Configure SSH on TurboStack

Authorize keys and set the SSH options for a host so your team can open shell and
SSH File Transfer Protocol (SFTP) sessions securely.

![The SSH tab of a host, with the SSH key list, the Add SSH Key button and the option to allow SSH authentication by keys only|1000](../../assets/screenshots/platform/hosts/ssh_tab.png)

## Where to configure it

SSH is configured at the **host** level:

1. Open the host.
2. Go to the **SSH** tab.
3. Add authorized public keys and adjust the port and password-authentication
   options.

Keys set at the group level are inherited by member hosts.

## YAML configuration

### Required

| Key | Meaning |
|---|---|
| `ssh_keys` | List of authorized public keys allowed to open SSH/SFTP sessions on the host. |

### Optional

| Key | Meaning |
|---|---|
| `ssh_port` | The TCP port SSH listens on. |
| `ssh_passwords` | Whether to allow password authentication. Recommended: keep disabled (`false`). |

```yaml
# Host-level: authorized keys, custom port, key-only auth
ssh_keys:
  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... alice@example.com"
ssh_port: 22
ssh_passwords: false
```

> [!TIP]
> Keep `ssh_passwords` set to `false` and rely on `ssh_keys` for authentication.
> Shared keys can be defined once at the group level and inherited by every host.

## Related

- [What is SSH?](what-is.md)
- [Host SSH tab](../../platform/hosts/ssh.md)
- [Security hardening](../../concepts/security-hardening.md)