Re: My system is broken after upgrade to 14 tpo 15.0

From: Otto Fowler <ottobackwards_at_gmail.com>
Date: Sat, 06 Dec 2025 14:30:11 UTC 
 pkg bootstrap -f  is what fixed this for me.



On December 6, 2025 at 08:40:27, Xavier B. (somenxavier@posteo.net) wrote:

After freebsd-update.... I received the error:

ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"

Same with doas.


I put the full error log here. Any hints? I need to reinstall full system
from scratch?

Thanks in advance,
Xavier


Press Enter to edit this file in /usr/bin/vi and resolve the conflicts
manually...


# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

<<<<<<< current version
# Change to yes to enable built-in password authentication.
PasswordAuthentication no
AuthenticationMethods publickey
=======
# Change to "yes" to enable built-in password authentication.
# Note that passwords may also be accepted via
KbdInteractiveAuthentication.
#PasswordAuthentication no
#PermitEmptyPasswords no
>>>>>>> 15.0-RELEASE

# Change to "no" to disable keyboard-interactive authentication. Depending
on
# the system's configuration, this may involve passwords,
challenge-response,
# one-time passwords or some combination of these and other methods.
# Keyboard interactive authentication is also used for PAM authentication.
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'no' to disable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin prohibit-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
# and KbdInteractiveAuthentication to 'no'.

#AllowAgentForwarding yes
#AllowTcpForwarding yes
GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
TCPKeepAlive yes
PermitUserEnvironment no
Compression yes
ClientAliveInterval 30
ClientAliveCountMax 3
UseDNS no
#PidFile /var/run/sshd.pid
MaxStartups 10:30:100
PermitTunnel no
#ChrootDirectory none
#UseBlocklist no
#VersionAddendum FreeBSD-20250801

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
:q!

Merge conflict markers remain in: /etc/ssh/sshd_config
These must be resolved for the system to be functional.

Press Enter to return to editing this file, or type "ACCEPT" to carry on
with
these lines remaining in the file.


# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
:x

Merge conflict markers remain in: /etc/ssh/sshd_config
These must be resolved for the system to be functional.

Press Enter to return to editing this file, or type "ACCEPT" to carry on
with
these lines remaining in the file.


# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
:x

Merge conflict markers remain in: /etc/ssh/sshd_config
These must be resolved for the system to be functional.

Press Enter to return to editing this file, or type "ACCEPT" to carry on
with
these lines remaining in the file.


# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
:x

Merge conflict markers remain in: /etc/ssh/sshd_config
These must be resolved for the system to be functional.

Press Enter to return to editing this file, or type "ACCEPT" to carry on
with
these lines remaining in the file.
ACCEPT


The following changes, which occurred between FreeBSD 14.3-RELEASE and
FreeBSD 15.0-RELEASE have been merged into /etc/login.conf:
--- current version
+++ new version
@@ -44,11 +44,10 @@
:pseudoterminals=unlimited:\
:kqueues=unlimited:\
:umtxp=unlimited:\
:pipebuf=unlimited:\
:priority=0:\
- :ignoretime@:\
:umask=022:\
:charset=UTF-8:\
:lang=C.UTF-8:

#
@@ -147,11 +146,10 @@
# :maxproc=32:\
# :priority=0:\
# :requirehome:\
# :passwordtime=90d:\
# :umask=002:\
-# :ignoretime@:\
# :tc=default:
#
#
##
## users of X (needs more resources!)
@@ -172,11 +170,10 @@
##
## Staff users - few restrictions and allow login anytime
##
#staff:\
# :ignorenologin:\
-# :ignoretime:\
# :requirehome@:\
# :accounted@:\
# :path=~/bin /bin /sbin /usr/bin /usr/sbin /usr/local/bin
/usr/local/sbin:\
# :umask=022:\
# :tc=standard:
@@ -263,11 +260,10 @@
##
## Site full-time 24/7 PPP connection
## - no time accounting, restricted to access via dialin lines
##
#site:\
-# :ignoretime:\
# :passwordtime@:\
# :refreshtime@:\
# :refreshperiod@:\
# :sessionlimit@:\
# :autodelete@:\
Does this look reasonable (y/n)? y

The following changes, which occurred between FreeBSD 14.3-RELEASE and
FreeBSD 15.0-RELEASE have been merged into /etc/ssh/sshd_config:
--- current version
+++ new version
@@ -1,6 +1,6 @@
-# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
+# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
@@ -55,15 +55,25 @@
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

+<<<<<<< current version
# Change to yes to enable built-in password authentication.
PasswordAuthentication no
AuthenticationMethods publickey
+=======
+# Change to "yes" to enable built-in password authentication.
+# Note that passwords may also be accepted via
KbdInteractiveAuthentication.
+#PasswordAuthentication no
+#PermitEmptyPasswords no
+>>>>>>> 15.0-RELEASE

-# Change to no to disable PAM authentication
+# Change to "no" to disable keyboard-interactive authentication. Depending
on
+# the system's configuration, this may involve passwords,
challenge-response,
+# one-time passwords or some combination of these and other methods.
+# Keyboard interactive authentication is also used for PAM authentication.
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
@@ -103,12 +113,12 @@
UseDNS no
#PidFile /var/run/sshd.pid
MaxStartups 10:30:100
PermitTunnel no
#ChrootDirectory none
-#UseBlacklist no
-#VersionAddendum FreeBSD-20250219
+#UseBlocklist no
+#VersionAddendum FreeBSD-20250801

# no default banner path
#Banner none

# override default of no subsystems
Does this look reasonable (y/n)? y

The following changes, which occurred between FreeBSD 14.3-RELEASE and
FreeBSD 15.0-RELEASE have been merged into /etc/ttys:
--- current version
+++ new version
@@ -1,8 +1,5 @@
-#
-# @(#)ttys 5.1 (Berkeley) 4/17/89
-#
# This file specifies various information about terminals on the system.
# It is used by several different programs. Common entries for the
# various columns include:
#
# name The name of the terminal device.
Does this look reasonable (y/n)? y
The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem
The following files will be removed as part of updating to
15.0-RELEASE-p0:
/.cshrc
/.profile
/boot/kernel/callout_test.ko
/boot/kernel/geom_bde.ko
/boot/kernel/geom_vinum.ko
/boot/kernel/iwm3160fw.ko
/boot/kernel/iwm3168fw.ko
/boot/kernel/iwm7260fw.ko
/boot/kernel/iwm7265Dfw.ko
/boot/kernel/iwm7265fw.ko
/boot/kernel/iwm8000Cfw.ko
/boot/kernel/iwm8265fw.ko
/boot/kernel/iwm9000fw.ko
/boot/kernel/iwm9260fw.ko
/boot/kernel/rtw8723d_fw.bin.ko
/boot/kernel/rtw8821c_fw.bin.ko
/boot/kernel/rtw8822b_fw.bin.ko
/boot/kernel/rtw8822c_fw.bin.ko
/boot/kernel/rtw8822c_wow_fw.bin.ko
/boot/zfsboot
/etc/ftpusers
/etc/gss/qop
/etc/newsyslog.conf.d/ftp.conf
/etc/rc.d/ftpd
/etc/rc.d/gbde
/etc/rc.d/ipropd_master
/etc/rc.d/ipropd_slave
/etc/rc.d/keyserv
/etc/rc.d/kfd
/etc/rc.d/kpasswdd
/etc/rc.d/opensm
/etc/syslog.d/ftp.conf
/lib/libcrypto.so.30
/lib/libmd.so.6
/lib/libufs.so.7
/lib/libutil.so.9
/rescue/gbde
/sbin/gbde
/sbin/gvinum
/usr/bin/asn1_compile
/usr/bin/chkey
/usr/bin/dialog
/usr/bin/dpv
/usr/bin/hxtool
/usr/bin/kcc
/usr/bin/keylogin
/usr/bin/keylogout
/usr/bin/kf
The following files will be added as part of updating to
15.0-RELEASE-p0:
/boot/firmware/iwm3160fw
/boot/firmware/iwm3168fw
/boot/firmware/iwm7260fw
/boot/firmware/iwm7265Dfw
/boot/firmware/iwm7265fw
/boot/firmware/iwm8000C
/boot/firmware/iwm8265fw
/boot/firmware/iwm9000fw
/boot/firmware/iwm9260fw
/boot/fonts/32x64.fnt.gz
/boot/images/freebsd-install-brand-rev.png
/boot/kernel/accf_tls.ko
/boot/kernel/acpi_sbl_wmi.ko
/boot/kernel/amdsmu.ko
/boot/kernel/dummymbuf.ko
/boot/kernel/e6000sw.ko
/boot/kernel/etherswitch.ko
/boot/kernel/hwt.ko
/boot/kernel/i2ctinyusb.ko
/boot/kernel/if_iwx.ko
/boot/kernel/if_mtw.ko
/boot/kernel/miiproxy.ko
/boot/kernel/nvmf.ko
/boot/kernel/nvmf_tcp.ko
/boot/kernel/nvmf_transport.ko
/boot/kernel/nvmft.ko
/boot/kernel/p9fs.ko
/boot/kernel/pflow.ko
/boot/kernel/pt.ko
/boot/kernel/rdseed_rng.ko
/boot/kernel/snd_hdsp.ko
/boot/kernel/t7fw_cfg.ko
/boot/kernel/u2f.ko
/boot/kernel/udbc.ko
/boot/kernel/ufshci.ko
/boot/kernel/umb.ko
/boot/kernel/virtio_p9fs.ko
/boot/kernel/wlan_gcmp.ko
/boot/kernel/wtap.ko
/boot/loader.help.kboot
/boot/loader.kboot
/boot/lua/gfx-install.lua
/etc/blocklistd.conf
/etc/devd/nvmf.conf
/etc/devd/snd.conf
/etc/dma/auth.conf
/etc/moused.conf
/etc/rc.d/blocklistd
The following files will be updated as part of updating to
15.0-RELEASE-p0:
/COPYRIGHT
/bin/[
/bin/cat
/bin/chflags
/bin/chio
/bin/chmod
/bin/cp
/bin/cpuset
/bin/csh
/bin/date
/bin/dd
/bin/df
/bin/domainname
/bin/echo
/bin/ed
/bin/expr
/bin/freebsd-version
/bin/getfacl
/bin/hostname
/bin/kenv
/bin/kill
/bin/link
/bin/ln
/bin/ls
/bin/mkdir
/bin/mv
/bin/nproc
/bin/pax
/bin/pgrep
/bin/pkill
/bin/ps
/bin/pwait
/bin/pwd
/bin/realpath
/bin/red
/bin/rm
/bin/rmail
/bin/rmdir
/bin/setfacl
/bin/sh
/bin/sleep
/bin/stty
/bin/sync
/bin/tcsh
/bin/test
/bin/timeout
/bin/unlink
/bin/uuidgen
To install the downloaded upgrades, run 'freebsd-update [options] install'.
[root@hero /usr/home/xan]# freebsd-update install
src component not installed, skipped
Installing updates...
Kernel updates have been installed. Please reboot and run
'freebsd-update [options] install' again to finish installing updates.
[root@hero /usr/home/xan]# reboot
Connection to hero closed by remote host.
Connection to hero closed.
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: No route to host
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: No route to host
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: Connection refused
[xan@coronari ~]$ ssh hero
Last login: Fri Dec 5 10:01:06 2025 from 192.168.1.141
[xan@hero ~]$ doas -s
Password:
[root@hero /usr/home/xan]# freebsd-update install
src component not installed, skipped
Installing updates...
Restarting sshd after upgrade
Performing sanity check on sshd configuration.
/etc/ssh/sshd_config: line 60: Bad configuration option: <<<<<<<
/etc/ssh/sshd_config: line 69: Bad configuration option: >>>>>>>
/etc/ssh/sshd_config: terminating, 2 bad configuration options

Completing this upgrade requires removing old shared object files.
Please rebuild all installed 3rd party software (e.g., programs
installed from the ports tree) and then run
'freebsd-update [options] install' again to finish installing updates.
[root@hero /usr/home/xan]# freebsd-update install
pkg: Warning: Major OS version upgrade detected. Running "pkg bootstrap -f"
recommended
src component not installed, skipped
Installing updates... done.
[root@hero /usr/home/xan]# pkg bootstrap -f
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"
[root@hero /usr/home/xan]# pkg install ld-elf
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"
[root@hero /usr/home/xan]# pkg bootstrap -f
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"
[root@hero /usr/home/xan]# freebsd-update install
src component not installed, skipped
No updates are available to install.
Run 'freebsd-update [options] fetch' first.
[root@hero /usr/home/xan]# vim /etc/ssh/
moduli ssh_config ssh_host_ecdsa_key ssh_host_ecdsa_key.pub
ssh_host_ed25519_key ssh_host_ed25519_key.pub ssh_host_rsa_key
ssh_host_rsa_key.pub sshd_config
[root@hero /usr/home/xan]# vim /etc/ssh/sshd_config


# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

<<<<<<< current version
# Change to yes to enable built-in password authentication.
PasswordAuthentication no
AuthenticationMethods publickey
=======
# Change to "yes" to enable built-in password authentication.
# Note that passwords may also be accepted via
KbdInteractiveAuthentication.
#PasswordAuthentication no
#PermitEmptyPasswords no
>>>>>>> 15.0-RELEASE

# Change to "no" to disable keyboard-interactive authentication. Depending
on
# the system's configuration, this may involve passwords,
challenge-response,
# one-time passwords or some combination of these and other methods.
# Keyboard interactive authentication is also used for PAM authentication.
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
"/etc/ssh/sshd_config" 132L, 3788B 75,2 36%

# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

AllowUsers xan isabel
LoginGraceTime 1m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 3

PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and
.ssh/authorized_keys2
# but this is overridden so installations will only check
.ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# Change to yes to enable built-in password authentication.
PasswordAuthentication no
AuthenticationMethods publickey
# Change to "yes" to enable built-in password authentication.
# Note that passwords may also be accepted via
KbdInteractiveAuthentication.
#PasswordAuthentication no
#PermitEmptyPasswords no

# Change to "no" to disable keyboard-interactive authentication. Depending
on
# the system's configuration, this may involve passwords,
challenge-response,
# one-time passwords or some combination of these and other methods.
# Keyboard interactive authentication is also used for PAM authentication.
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'no' to disable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin prohibit-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
81,1 51%
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
# and KbdInteractiveAuthentication to 'no'.

#AllowAgentForwarding yes
#AllowTcpForwarding yes
GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
TCPKeepAlive yes
PermitUserEnvironment no
Compression yes
ClientAliveInterval 30
ClientAliveCountMax 3
UseDNS no
#PidFile /var/run/sshd.pid
MaxStartups 10:30:100
PermitTunnel no
#ChrootDirectory none
#UseBlocklist no
#VersionAddendum FreeBSD-20250801

# no default banner path
#Banner none

# override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
"/etc/ssh/sshd_config" 129L, 3735B written
[root@hero /usr/home/xan]# reboot
Read from remote host hero: Connection reset by peer
Connection to hero closed.
client_loop: send disconnect: Broken pipe
[xan@coronari ~]$ ssh hero
ssh: connect to host hero port 22: No route to host
[xan@coronari ~]$ ssh hero
Last login: Fri Dec 5 10:16:38 2025 from 192.168.1.141
[xan@hero ~]$ doas -s
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "doas"
[xan@hero ~]$