Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
OpenSSH daemon bound to all interfaces
Reported by helioryn · filed Aug 25, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
Intel(R) Core(TM) i3-10110U CPU @ 2.10GHz
What's wrong?
The sshd service is enabled and listening on all network interfaces
(0.0.0.0:22, [::]:22) rather than only on the loopback or a trusted management
interface. On a laptop that roams across untrusted networks, this exposes an SSH
login service to whatever network it is currently attached to. Even if it is
rate-limited and key-authenticated, the daemon is an attack surface reachable from
the network.
Observed
$ ss -tuln | grep ':22'
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 128 [::]:22 [::]:*
$ systemctl is-enabled sshd
enabled
Effective settings observed:
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
MaxAuthTries 3
LoginGraceTime 30
AllowTcpForwarding no
Impact
- The SSH service processes attacker-controlled network traffic on every network
the host joins.
- A misconfiguration, a key leaked to disk, or a daemon bug is remotely reachable.
- Exposing SSH on a roaming laptop conflicts with a minimal-attack-surface posture.
Expected behaviour
SSH should either be disabled by default, or bound only to loopback / a management
network, with a documented procedure (and firewall default-deny) for enabling
remote administration.
Steps to reproduce
1. Install Omarchy.
2. systemctl is-enabled sshd -> enabled
3. ss -tuln | grep ':22' -> bound to 0.0.0.0 and [::]
Environment
OS: Omarchy 4.0.1 (id=omarchy, id_like=arch)
Kernel: linux 7.1.9.arch1-2
Arch: x86_64
Host: HP ProBook 450 G7
Suggested fix
- Disable sshd by default on desktop/laptop builds, or bind it to a specific port
and interface: in sshd_config, ListenAddress 127.0.0.1 (and ::1), or restrict
via the firewall (default deny, allow only from trusted sources).
- Keep it key-only (already good) and disable forwarding (already good).
- Consider not enabling it at rest and starting it on demand.
View raw text
### System details
Intel(R) Core(TM) i3-10110U CPU @ 2.10GHz
### What's wrong?
The sshd service is enabled and listening on all network interfaces
(0.0.0.0:22, [::]:22) rather than only on the loopback or a trusted management
interface. On a laptop that roams across untrusted networks, this exposes an SSH
login service to whatever network it is currently attached to. Even if it is
rate-limited and key-authenticated, the daemon is an attack surface reachable from
the network.
Observed
$ ss -tuln | grep ':22'
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 128 [::]:22 [::]:*
$ systemctl is-enabled sshd
enabled
Effective settings observed:
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password
MaxAuthTries 3
LoginGraceTime 30
AllowTcpForwarding no
Impact
- The SSH service processes attacker-controlled network traffic on every network
the host joins.
- A misconfiguration, a key leaked to disk, or a daemon bug is remotely reachable.
- Exposing SSH on a roaming laptop conflicts with a minimal-attack-surface posture.
Expected behaviour
SSH should either be disabled by default, or bound only to loopback / a management
network, with a documented procedure (and firewall default-deny) for enabling
remote administration.
Steps to reproduce
1. Install Omarchy.
2. systemctl is-enabled sshd -> enabled
3. ss -tuln | grep ':22' -> bound to 0.0.0.0 and [::]
Environment
OS: Omarchy 4.0.1 (id=omarchy, id_like=arch)
Kernel: linux 7.1.9.arch1-2
Arch: x86_64
Host: HP ProBook 450 G7
Suggested fix
- Disable sshd by default on desktop/laptop builds, or bind it to a specific port
and interface: in sshd_config, ListenAddress 127.0.0.1 (and ::1), or restrict
via the firewall (default deny, allow only from trusted sources).
- Keep it key-only (already good) and disable forwarding (already good).
- Consider not enabling it at rest and starting it on demand.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 09:07 UTC