Wikibooks enwikibooks https://en.wikibooks.org/wiki/Main_Page MediaWiki 1.47.0-wmf.12 first-letter Media Special Talk User User talk Wikibooks Wikibooks talk File File talk MediaWiki MediaWiki talk Template Template talk Help Help talk Category Category talk Cookbook Cookbook talk Transwiki Transwiki talk Wikijunior Wikijunior talk Subject Subject talk TimedText TimedText talk Module Module talk Event Event talk 0 51866 4655464 4638348 2026-07-24T15:35:21Z Schweikhardt 1008853 /* Requiring Both Keys and a Password */ Insert [ to fix link display 4655464 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent Key-based Authentication Using an Agent] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys which will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''---dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be in within subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} j6nl6c6vn3o8imwy0z786k1s6wee5ra 4655465 4655464 2026-07-24T15:40:52Z Schweikhardt 1008853 /* Passwordless Login */ Fix link display and a grammo 4655465 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''---dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be in within subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} pyzmimlcumqhjsx991500qdhrymbyte 4655466 4655465 2026-07-24T15:43:51Z Schweikhardt 1008853 /* Single-purpose Keys to Avoid Remote Root Access */ Delete extra - in long option 4655466 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''--dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be in within subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} ss2px4d8aea4rwzdfy3pu8n1ufbaovd 4655467 4655466 2026-07-24T15:45:44Z Schweikhardt 1008853 /* Read-only Access to Keys */ Grammo corrected 4655467 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''--dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be in subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} qi9cl6wsp07rq38rc0fu8sr2rv2a4ww 4655469 4655467 2026-07-24T15:50:49Z Schweikhardt 1008853 /* Converting Between SSH Key Formats */ Delete empty line for consistency with other command sequences. 4655469 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''--dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be in subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} 3xh0l8u0fd4ymu156iwdq2u7qlm65f7 4655494 4655469 2026-07-25T10:13:07Z Larsnooden 430753 slight grammar adjustment in two phrases 4655494 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes that keys which will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''--dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be within subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} kxmgbv98ugp680ffj9tkrokg4wo7bzo 4655495 4655494 2026-07-25T10:15:20Z Larsnooden 430753 that -> those 4655495 wikitext text/x-wiki <noinclude>{{simple chapter navigation|previous=File Transfer with SFTP|next=Certificate-based Authentication}}</noinclude> &nbsp; Authentication keys can improve efficiency, if done properly. As a bonus advantage, the passphrase and private key never leave the client<ref name="RFC4252§7">{{cite web |url=https://tools.ietf.org/html/rfc4252#section-7 |title=The Secure Shell (SSH) Authentication Protocol |publisher=IETF |year=2006| accessdate=2015-05-06}}</ref>. Key-based authentication is generally recommended for outward facing systems so that password authentication can be turned off. ==Key-based authentication== OpenSSH can use public key cryptography for authentication. In public key cryptography, encryption and decryption are asymmetric. The keys are used in pairs, a public key to encrypt and a private key to decrypt. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility can make RSA, Ed25519, ECDSA, Ed25519-SK, or ECDSA-SK keys for authenticating. Even though DSA keys can still be made, being exactly 1024 bits in size, they are no longer recommended and should be avoided. RSA keys are allowed to vary from 1024 bits on up. The default is now 3072. However, there is only limited benefit after 2048 bits and that makes elliptic curve algorithms preferable. ECDSA can be 256, 384 or 521 bits in size. Ed25519, Ed25519-SK, and ECDSA-SK keys each have a fixed length of 256 bits. Shorter keys are faster, but less secure. Longer keys are much slower to work with but provide better protection, up to a point. Keys can be named to help remember what they are for. Because the key files can be named anything it is possible to have many keys each named for different services or tasks. The comment field at the end of the public key can also be useful in helping to keep the keys sorted, if you have many of them or use them infrequently. The process of key-based authentication uses these keys to make a couple of exchanges using the keys to encrypt and decrypt some short message. At the start, a copy of the client's public key is stored on the server and the client's private key is on the client, both stay where they are. The private key never leaves the client. As the client first contacts the server, the server responds by using the client's public key to encrypt a random number and return that encrypted random number as a challenge to the client. The client responds to the challenge by using the matching private key to decrypt the message and extract the random number. The client then makes an MD5 hash of the session ID along with the random number from the challenge and returns that hash to the server. The server then makes its own hash of the session ID and the random number and compares that to the hash returned by the client. If there is a match, the login is allowed. If there is not a match, then the next of any public keys on the server registered as belonging to the same account is tried until either a match is found or all the keys have been tried or the maximum number of failures has been reached. <ref name="How Key Challenges Work">{{cite web | url=http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#chal | title=An Illustrated Guide to SSH Agent Forwarding | author=Steve Friedl | date=2006-02-22 | accessdate=2013-04-27 | publisher=Unixwiz.net }}</ref> When an agent is used on the client side to manage authentication, the process is similar. The difference is that [http://man.openbsd.org/ssh.1 ssh(1)] passes the challenge off to the agent which then calculates the response and passes it back to [http://man.openbsd.org/ssh.1 ssh(1)] which then passes the agent's response back to the server. ===Basics of Public Key Authentication=== A matching pair of SSH keys, one public and one private, is needed for public key authentication. The [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] utility is used to make such a key pair. Out of that pair the public key must be properly stored on the remote host before using key-based authentication. The default location for it is the designated '''authorized_keys''' file, usually one such file resides inside each remote user account. The private key stays stored safely on the client. Once the keys have been prepared and the remote account configured, they can be used for login. Before starting, there must already be an account on the remote system. The details of doing that are outside of the scope of this book. However, once you have a remote account, there are four steps to set up key-based authentication for it: '''1''') Prepare a directory on the client (say a laptop or a desktop) where the keys will stay, if there isn't one already. For example, if the '''.ssh''' directory is not on the client machine, create it and set the permissions correctly. It is important that it not be writable by any account except its owner: <syntaxhighlight lang="shell-session"> $ mkdir ~/.ssh/ $ chmod 0700 ~/.ssh/ </syntaxhighlight> '''2''') Create a key pair inside the designated directory. The example here creates an Ed25519 key pair in the directory '''~/.ssh'''. The option '''-t''' decides the key type and the option '''-f''' assigns the key file a name. It is good to give key files descriptive names, especially if larger numbers of keys are managed. Below, the public key will be named '''fred_example_org_ed25519.pub''' and the private key will be called '''fred_example_org_ed25519'''. Lastly, the '''-C''' option is used to embed a descriptive comment inside the private key itself. The comment is useful for figuring out later what the key is for when one has many keys or a lot of time has passed or both. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Be sure to enter a solid passphrase so that the private key gets encrypted using 128-bit AES. That way the private key can only be read or used when the passphrase is given. Ed25519, Ed25519-SK, and ECDSA-SK keys have fixed lengths. For RSA and ECDSA keys, the '''-b''' option sets the number of bits used for those kinds of keys. <syntaxhighlight lang="shell-session"> $ ssh-keygen -o -b 4096 -t rsa -f ~/.ssh/fred_example_org_rsa \ -C "from fred's laptop to server.example.org" </syntaxhighlight> Since 6.5 a new private key format is available using a [http://man.openbsd.org/bcrypt.3 bcrypt(3)] key derivative function (KDF) to better protect keys at rest. This new format is always used for Ed25519 keys, and sometime in the future will be the default for all keys. But for right now it may be requested when generating or saving existing keys of other types via the '''-o''' option in [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Details of the new format are found in the source code in the file '''PROTOCOL.key'''. '''3''') Get the keys to the right places. Transfer only the public key to remote machine. The following assume the default locations for the authorized keys as specified in the server's configuration file by the '''AuthorizedKeysFile''' directive. '''3a''') If the utility <code>ssh-copy-id</code> exists, and if password authentication is allowed, then it can be used to put the public key into place on the remote system. The ''.pub'' is optional here, the script will figure it out if omitted. <syntaxhighlight lang="shell-session"> $ ssh-copy-id -i ~/.ssh/fred_example_org_ed25519 fred@server.example.org </syntaxhighlight> If that script was successful in transferring the public key, then go on to step 4 below and test the key. If not, then try transferring the public key manually as described in step 3b next. '''3b''') Or the public key can be put in place manually on the remote machine. For that the remote '''.ssh''' directory is needed, and within that a special file to store the public keys, the default file name is '''authorized_keys'''. If either the '''authorized_keys''' file or '''.ssh''' directory do not exist on the remote machine, they need to be created. <syntaxhighlight lang="shell-session"> $ mkdir -m 700 ~/.ssh/ $ touch ~/.ssh/authorized_keys $ chmod 0600 ~/.ssh/authorized_keys $ nano -w ~/.ssh/authorized_keys </syntaxhighlight> Then any editor which does not wrap long lines can be used to add the public key. However the '''authorized_keys''' file is edited to add the key, the key itself must be in the file whole and unbroken on a single line. For example, [http://linux.die.net/man/1/nano nano(1)] can be started with the '''-w''' option to prevent wrapping of long lines. (Another way to set line wrapping permanently in [http://linux.die.net/man/1/nano nano(1)] is by editing [http://linux.die.net/man/5/nanorc nanorc(5)].) If the key pair is not already on the client, transfer both the public and private keys there. It is usually best to keep both the public and private keys together in the directory '''~/.ssh/''', though the public key is not always needed on the client after this step and could even be regenerated if it is ever needed again. '''4''') Test the keys While remaining logged in via the first terminal, use the client system to open another window and in it start another SSH session and try authenticating to the remote machine from the client using the private key. <syntaxhighlight lang="shell-session"> $ ssh -i ~/.ssh/fred_example_org_ed25519 -l fred server.example.org </syntaxhighlight> The option '''-i''' tells [http://man.openbsd.org/ssh.1 ssh(1)] which private key to try. Only after verifying that the key-based authentication works should you close the original window. It is possible to make permanent shortcuts on the client using [http://man.openbsd.org/ssh_config.5 ssh_config(5)], explained further below, once key-based authentication is working. In particular, see the '''IdentityFile''', '''IdentitiesOnly''', and '''AddKeysToAgent''' configuration directives, to name three. It is also a good idea to turn off password authentication, if and only if key-based authentication is setup for all the necessary remote accounts. ➥ '''Troubleshooting of Key-based Authentication''': If the server refuses to accept the key and fails over to the next authentication method (e.g.: "Server refused our key"), then there are several possible mistakes to look for on the server side. One of the most common errors is that the file and directory permissions are wrong. The authorized keys file must be owned by the user in question and not be group writable. Nor may the key file's directory be group or world writable. <syntaxhighlight lang="shell-session"> $ chmod u=rwx,g=rx,o= ~/.ssh $ chmod u=rw,g=,o= ~/.ssh/authorized_keys </syntaxhighlight> Another mistake that can happen is if the key inside the '''authorized_keys''' file on the remote host is broken by line breaks or has other whitespace in the middle. That can be fixed by joining up the lines and removing the spaces or by recopying the key more carefully. And, though it should go without saying, the halves of the key pair need to match. The public key on the server needs to match the private key held on the client. If the public key is lost, then a new one can be generated with the '''-y''' option, but not the other way around. If the private key is lost, then the public key should be erased as it is no longer of any use. If many keys are in use for an account, it might be a good idea to add comments to them. On the client, it can be a good idea to know which server the key is for, either through the file name itself or through the comment field. A comment can be added using the '''-C''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519 -f ~/.ssh/fred_example_org_ed25519 -C "web server mirror" </syntaxhighlight> On the server, it can be important to annotate which client they key is from if there is more than one public key there in an account. There the comment can be added to the authorized keys file on the server in the last column if a comment does not already exist. Again, the format of the authorized keys file is given in the manual page for [http://man.openbsd.org/sshd.8 sshd(8)] in the section "AUTHORIZED_KEYS FILE FORMAT". If the keys are not labeled they can be hard to match, which might or might not be what you want. ====Associating Keys Permanently with a Server==== A key can be specified at run time, but to save retyping the same paths again and again, the '''Host''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] can apply specific settings to a target host. In this case, by changing '''~/.ssh/config''' it is possible to assign particular keys to be tried automatically whenever making a connection to that specific host. After adding the following lines to '''~/.ssh/config''', all that's needed is to type <code>ssh ''web1''</code> to connect with the key for that server. <syntaxhighlight lang="apache" line="1"> Host web1 Hostname 198.51.100.32 IdentitiesOnly yes IdentityFile /home/fred/.ssh/web_key_ed25519 </syntaxhighlight> The '''~/.ssh/config''' below uses different keys for ''server'' versus ''server.example.org'', regardless whether they resolve to the same machine. This is possible because the host name argument given to [http://man.openbsd.org/ssh.1 ssh(1)] is not converted to a canonicalized host name before matching. <syntaxhighlight lang="apache" line="1"> Host server IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_a_rsa Host server.example.org IdentitiesOnly yes IdentityFile /home/fred/.ssh/key_b_rsa </syntaxhighlight> In this example the shorter name is tried first, but of course less ambiguous shortcuts can be made instead. The configuration file gets parsed on a first-match basis. So the most specific rules go at the beginning and the most general rules go at the end. ====Encrypted Home Directories==== When using encrypted home directories the keys must be stored in an unencrypted directory. That means somewhere outside the actual home directory which means [http://man.openbsd.org/sshd.8 sshd(8)] needs to be configured appropriately to find the keys in that special location. Here is one method for solving the access problem. Each user is given a subdirectory under '''/etc/ssh/keys/''' which they can then use for storing their '''authorized_keys''' file. This is set in the server's configuration file '''/etc/ssh/sshd_config''' <syntaxhighlight lang="apache" line="1"> AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys </syntaxhighlight> Setting a special location for the keys opens up more possibilities as to how the keys can be managed and multiple key file locations can be specified if they are separated by whitespace. The user does not have to have write permissions for the '''authorized_keys''' file. Only read permission is needed to be able to log in. But if the user is allowed to add, remove, or change their keys, then they will need write access to the file to do that. One symptom of having an encrypted home directory is that key-based authentication only works when you are already logged into the same account, but fails when trying to make the first connection and log in for the first time. Sometimes it is also necessary to add a script or call a program from '''/etc/ssh/sshrc''' immediately after authentication to decrypt the home directory. ====Passwordless Login==== One solution for passwordless logins is to still have a passphrase and work with an authentication agent in conjunction with a single-purpose key. Most desktop environments launch an SSH agent automatically these days. It will be visible in the '''SSH_AUTH_SOCK''' environment variable if it is. On accounts with an agent, [http://man.openbsd.org/ssh-add.1 ssh-add(1)] can load private keys into an available agent. <syntaxhighlight lang="shell-session"> $ ssh-add ~/.ssh/fred_example_org_ed25519 </syntaxhighlight> Thereafter, the client will automatically check the agent for the key when appropriate. If there are many keys in the agent, it will become necessary to set '''IdentitiesOnly'''. See the above section on using '''~/.ssh/config''' for that. See [[OpenSSH/Cookbook/Public_Key_Authentication#Key-based_Authentication_Using_an_Agent|Key-based Authentication Using an Agent]] below. Another, riskier, way of allowing passwordless logins is to follow the steps above, but simply do not enter a passphrase when asked for one while creating the key. Note that using keys that lack a passphrase is very risky, so the key files should be very well protected and kept track of, and ideally locked down with a '''command=''' option or '''ForceCommand''' directive on the server. That includes those keys which will only be used as single-purpose keys as described below. Timely key rotation becomes especially important. In general, it is not a good idea to make a key without a passphrase. ====Requiring Both Keys and a Password==== While users should have strong passphrases for their keys, there is no way to enforce or verify that. Indeed, since neither the private key nor its the passphrase ever leave the client machine there is nothing that the server can do to have any influence over that. Instead, it is possible to require both a key and a password. Starting with OpenSSH 6.2, it is possible for the server to require multiple authentication methods for login using the '''AuthenticationMethods''' directive. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,password </syntaxhighlight> This example from [http://man.openbsd.org/sshd_config.5 sshd_config(5)] requires that users first authenticate using a key and it only queries for a password if the key succeeds. Thus with that configuration it is not possible to get to the system password prompt without first authenticating with a valid key. Changing the order of the arguments changes the order of the authentication methods. ====Requiring Two or More Keys==== Since OpenSSH 6.8, the server now remembers which public keys have been used for authentication and refuses to accept previously-used keys. This allows a set up requiring that users authenticate using two different public keys, maybe one in the file system and the other in a hardware token. <syntaxhighlight lang="apache" line="1"> AuthenticationMethods publickey,publickey </syntaxhighlight> The '''AuthenticationMethods''' directive, whether for keys or passwords, can also be set on the server under a '''Match''' directive to apply only to certain groups or situations. ====Requiring Certain Key Types For Authentication==== Also since OpenSSH 6.8, the '''PubkeyAcceptedKeyTypes''' directive, later changed to '''PubkeyAcceptedAlgorithms''', can specify which key algorithms are accepted for authentication. Those not in the comma-separated pattern list are not allowed. <syntaxhighlight lang="apache" line="1"> PubkeyAcceptedAlgorithms ssh-ed25519*,ssh-rsa*,ecdsa-sha2*,sk-ssh-ed25519*,sk-ecdsa-sha2* </syntaxhighlight> Either the actual key types or a pattern can be in the list. Spaces are not allowed in the pattern list. The exact list of key types supported for authentication can be found by the '''-Q''' option using the client. The following two lines are equivalent. <syntaxhighlight lang="shell-session"> $ ssh -Q key-sig | sort $ ssh -Q PubkeyAcceptedAlgorithms | sort </syntaxhighlight> For host-based authentication, it is the '''HostbasedAcceptedAlgorithms''' directive which determines the key types which are allowed for authentication. ===Key-based Authentication Using the AuthorizedKeysCommand Directive=== It is possible to use a program or script to look up public keys rather than keeping them in a static file or files. Any command called by the '''AuthorizedKeysCommand''' directive needs to either produce a syntactically correct public key while returning the exit code for a successful run or else return the exit code for failure. The string sent to '''stdout''' will then be processed as part of the authentication work flow. Here is a shell script<ref name="janpietmens">{{cite web |url=https://jpmens.net/2025/03/25/authorizedkeyscommand-in-sshd/ |title=SSH keys from a command: sshd's AuthorizedKeysCommand directive |accessdate=2025-04-04 |date=2025-03-25 | author=Jan-Piet Mens }}</ref> at its simplest, without constraints, demonstrating a public key lookup: <syntaxhighlight lang="shell"> #!/bin/sh echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKs/UouletvojgB1YeRZ4MY6iRblQ2ERDuNhQO4tOvdL" exit 0 </syntaxhighlight> For authentication to succeed, the script must return exit code 0 (success) after sending the syntactically correct matching public key to '''stdout'''. For the SSH daemon to even run the script in the first place, the script must have the correct file and directory permissions. Both the '''AuthorizedKeysCommandUser''' directive and '''AuthorizedKeysCommand''' must be used together. The former designates which account the script or program use when run. If set to ''none'' or if it does not refer to a valid account then [http://man.openbsd.org/sshd sshd(8)] will just ignore the command. If '''AuthorizedKeysCommand''' is set, and '''AuthorizedKeysCommandUser''' is left empty or missing, then [http://man.openbsd.org/sshd sshd(8)] won't even run when invoked. The error will be: <syntaxhighlight lang="text"> AuthorizedKeysCommand set without AuthorizedKeysCommandUser </syntaxhighlight> The '''AuthorizedKeysFile''' is always tried first when it is present in the server configuration. The '''AuthorizedKeysCommand''' directive will not even be tried when the authorized keys file can provide a relevant key first. ====A More Detailed Example Using the AuthorizedKeysCommand Directive==== By default the user name trying to log in is passed to the script when no tokens or arguments are provided. Whether or how that information is used is up to the script. The SSH daemon can also pass any combination of the tokens described in the TOKENS section of [http://man.openbsd.org/sshd_config sshd_config(5)] into the program or script being called. Furthermore, the program or script can even be a front end for a database, such as OpenLDAP, or any similar system, as long as '''stdout''' produces a public key. Below is a more detailed example which uses a local script named '''keyfinder''' run with the account '''keys''' to look up the a public key for certain accounts. First in [http://man.openbsd.org/sshd_config sshd_config(5)] the two directives: <syntaxhighlight lang="apache" line="1"> AuthorizedKeysCommand /usr/local/sbin/keyfinder %U AuthorizedKeysCommandUser keys </syntaxhighlight> The script below is only a demonstration and a more complex program can call databases or do advanced lookups or heuristics: <syntaxhighlight lang="shell"> #!/bin/sh set -e case $1 in "1000") echo "ssh-ed25519 AAAAC3NzaC1lZDIE5AAAAIK89...UT9hz" ;; "1001") echo "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTAAIBvGx...Y0zxV" ;; "1002") echo "command=\"/usr/libexec/sftp-server\" ssh-ed25519 AAAAC3NzaC1lZDI1TE5AIPSyY...cPTg3" ;; *) exit 1 ;; esac exit 0 </syntaxhighlight> The '''AuthorizedKeysCommand''' scripts or programs can return any correctly formatted public key to '''stdout''' for consideration in the authentication process. That includes adding constraints to the keys. Above, the account with the UID 1000 has no constraints, while the account with UID 1001 is quite constrained. Finally, the account with the UID 1002 can only access the SFTP service. See the section "AUTHORIZED_KEYS FILE FORMAT" in [http://man.openbsd.org/sshd sshd(8)] for the full set of possibilities. ===Key-based Authentication Using an Agent=== When an authentication agent, such as [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], is going to be used, it should generally be started at the beginning of a session and used to launch the login session or X-session so that the environment variables pointing to the agent and its UNIX-domain socket are passed to each subsequent shell and process. Many desktop distros do this automatically upon login or startup. Starting an agent entails setting a pair of environment variables: * SSH_AGENT_PID : the process id of the agent * SSH_AUTH_SOCK : the filename and full path to the UNIX-domain socket The various SSH and SFTP clients find these variables automatically and use them to contact the agent and try when authentication is needed. However, it is mainly SSH_AUTH_SOCK which is ever used. If the shell or desktop session was launched using [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)], then these variables are already set and available. If they are not available, then it is necessary to either set the variables manually inside each shell or for each application in order to use the agent or else to point to the agent's socket using the directive '''IdentityAgent''' in the client's configuration file. Once an agent is available, a relevant private key needs to be loaded before the agent can be used. Once in the agent the private key can then be used many times. Private keys are loaded into an agent with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. <syntaxhighlight lang="shell-session"> $ ssh-add /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) </syntaxhighlight> Keys stay in the agent for as long as it is running unless specified otherwise. A timeout can be set either with the '''-t''' option when starting the agent itself or when actually loading the key using [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. In either case, the '''-t''' option will set a timeout interval, after which the key will be purged from the agent. <syntaxhighlight lang="shell-session"> $ ssh-add -t 1h30m /home/fred/.ssh/mykey_ed25519 Identity added: /home/fred/.ssh/mykey_ed25519 (/home/fred/.ssh/mykey_ed25519) Lifetime set to 5400 seconds </syntaxhighlight> The option '''-l''' will list the fingerprints of all of the identities in the agent. <syntaxhighlight lang="bash"> $ ssh-add -l 256 SHA256:77mfUupj364g1WQ+O8NM1ELj0G1QRx/pHtvzvDvDlOk mykey for task x (ED25519) 3072 SHA256:7unq90B/XjrRbucm/fqTOJu0I1vPygVkN9FgzsJdXbk myotherkey rsa for task y (RSA) </syntaxhighlight> It is also possible to remove individual identities from the agent using '''-d''' which will remove them one at a time if identified by file name, but only if the file name is given and without the file name of the private key to be remove, '''-d''' will fail silently. Using '''-D''' instead will remove all of them at once without needing to specify any by name. By default [http://man.openbsd.org/ssh-add.1 ssh-add(1)] uses the agent connected via the socket named in the environment variable '''SSH_AUTH_SOCK''', if it is set. Currently, that is its only option. However, for [http://man.openbsd.org/ssh.1 ssh(1)] an alternative to using the environment variable is the client configuration directive '''IdentityAgent''' which tells the SSH clients which socket to use to communicate with the agent. If both the environment variable and the configuration directive are available at the same time, then the value in '''IdentityAgent''' takes precedence over what's in the environment variable. '''IdentityAgent''' can also be set to ''none'' to prevent the connection from trying to use any agent at all. The client configuration directive '''AddKeysToAgent''' can also be useful in getting keys into an agent as needed. When set, it automatically loads a key into a running agent the first time the key is called for if it is not already loaded. Likewise the '''IdentitiesOnly''' directive can ensure that the relevant key is offered on the first try. Rather than typing these out whenever the client is run, they can be added to '''~/.ssh/config''' and thereby added automatically for designated host connections. ====Agent Forwarding==== Agent forwarding is one means of passing through one or more intermediate hosts. However, the '''-J''' option for '''ProxyJump''' would be a safer option. See [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about that. With agent forwarding, intermediate machines forward challenges and responses back and forth between the client and the final destination. This comes with some risks but eliminates the need for using passwords or holding keys on any of these intermediate machines. A main advantage of agent forwarding is that the private key itself is not needed on any remote machine, thus hindering unwanted file system access to it. <ref name="OpenSSH key management, Part 3">{{cite web | url=http://www.ibm.com/developerworks/library/l-keyc3/ | title=Common threads: OpenSSH key management, Part 3 | author=Daniel Robbins | publisher=IBM | date=2002-02-01 | accessdate=2013-04-27}}</ref> Another advantage is that the actual agent to which the user has authenticated does not go anywhere and is thus less susceptible to analysis. One risk with agents is that they can be re-used to tailgate in if the permissions allow it. Keys cannot be copied this way, but authentication is possible when there are incorrect permissions. Note that disabling agent forwarding does not improve security unless users are also denied shell access, as they can always install their own forwarders. The risks of agent forwarding can be mitigated by confirming each use of a key by adding the '''-c''' option when adding the key to the agent. This requires the SSH_ASKPASS variable be set and available to the agent process, but will generate a prompt on the host running the agent upon each use of the key by a remote system. So if passing through one or more intermediate hosts, it is usually better to instead have the SSH client use stdio forwarding with '''-W''' or '''-J'''. On the client side agent forwarding is disabled by default and so if it is to be used it must be enabled explicitly. Put the following line in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to enable agent forwarding for a particular server: <syntaxhighlight lang="apache" line="1"> Host gateway.example.org ForwardAgent yes </syntaxhighlight> On the server side the default configuration files allow authentication agent forwarding, so to use it, nothing needs to be done there, just on the client side. However, again, it would be preferable to take a look at '''ProxyJump''' instead. =====Old Style, Somewhat Safer SSH Agent Forwarding===== The best way to pass through one or more intermediate hosts is to use the '''ProxyJump''' option instead of authentication agent forwarding and thereby not risk exposing any private keys. If authentication agent forwarding must be used, then it would be advisable in the interest of following the principle of least privilege to forward an agent containing the minimum necessary number of keys. There are several ways to solve that. In version 8.8 and earlier a partial solution is to make a one-off, ephemeral agent to hold just the one key or keys needed for the task at hand. Another partial solution would be to set up a user-accessible service at the operating system level and then use [http://man.openbsd.org/ssh_config.5 ssh_config] for the rest. Automatically launching an ephemeral agent unique to each session can be done by crafting either a special shell alias or function to launch a single-use agent. Either the function or the alias can be written to require confirmation for each requested signature. The following example is an alias is based on an updated blog post by Vincent Bernat<ref name="safer-agent-forwarding">{{cite web |url=https://vincent.bernat.ch/en/blog/2020-safer-ssh-agent-forwarding |title=Safer SSH agent forwarding |author=Vincent Bernat|date=2020-04-05 |accessdate=2020-10-04}}</ref> on SSH agent forwarding: <syntaxhighlight lang="shell-session"> $ alias assh="ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes" </syntaxhighlight> Note the use of [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)]. When invoking that alias, the SSH client will be launched with a unique, ephemeral supporting key agent. The alias sets up a new agent, including setting the two environment variables, and then sets two client options while calling the client. This arrangement still checks with [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for other options and settings. When the SSH session is finished the agent which launched it ends and goes away, thus cleaning up after itself automatically. Another way is to rely on the client's configuration file for some of the settings. Such methods rely mostly on [http://man.openbsd.org/ssh_config.5 ssh_config(5)] but still require an independent method to launch an ephemeral agent because the OpenSSH client is already running by the time it reads the configuration file and is thus not affected by any changes to environment variables caused by the configuration file and it is through the environment variables that contain information about the agent. However, when the path to the UNIX-domain socket used to communicate with the authentication agent is decided in advance then the '''IdentityAgent''' option can point to it once the one-off agent<ref name="wikimedia_ssh_agents">{{cite web |url=https://wikitech.wikimedia.org/wiki/Managing_multiple_SSH_agents#Linux_solutions |title=Managing multiple SSH agents |publisher=Wikimedia|accessdate=2020-04-07}}</ref> is actually launched. The following uses a specific agent's pre-defined socket whenever connecting to either of two particular domains: <syntaxhighlight lang="apache" line="1"> Host *.wikimedia.org *.wmflabs.org User fred IdentitiesOnly yes IdentityFile %d/.ssh/id_cloud_01 IdentityAgent /run/user/%i/ssh-cloud-01.socket ForwardAgent yes AddKeysToAgent yes </syntaxhighlight> The '''%d''' stands for the path to the home directory and the '''%i''' stands for the user id (UID) for the current account. In some cases the '''%i''' token might also come in handy when setting the '''IdentityAgent''' option inside the configuration file. Again, be careful when forwarding agents with which keys are in the forwarded agent. See the section "TOKENS" in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] for more such abbreviations. With those configuration settings, the authentication agent must already be up and running and point to the designated socket prior to starting the SSH client for that configuration to work. Additionally, it should place the socket in a directory which is inaccessible to any other accounts. [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] must use the '''-a''' option to name the socket: <syntaxhighlight lang="shell-session"> $ ssh-agent -a /run/user/${UID}/ssh-cloud-01.socket </syntaxhighlight> That agent configuration can be launched manually or via a script or service manager. However, in the interests of privacy and security in general, agent forwarding is to be avoided. The configuration directive '''ProxyJump''' is the best alternative and, on older systems, host traversal using '''ProxyCommand''' with [http://man.openbsd.org/nc.1 netcat] are preferable. Again, see the section on [[OpenSSH/Cookbook/Proxies and Jump Hosts|Proxies and Jump Hosts]] for how those methods are used. =====New Style SSH Agent Destination Constraints===== From 8.9 onward, [http://man.openbsd.org/ssh-agent.1 ssh-agent(1)] will allow the agent to limit which hosts they will use for authentication as specified by [http://man.openbsd.org/ssh-add.1 ssh-add(1)] using the '''-h''' option. These constraints have been added through two agent protocol extensions and a modification to the public key authentication protocol. This feature may evolve, but for now the result is such that keys for account authentication can be loaded into the agent in four ways: * no limits on forwarding (not recommended) * local use only, these will not get forwarded * forwarding, but only to specific remote hosts * forwarding to specific remote hosts via specified routes The intent is that the restrictions fail safely so that they do not allow authentication when one or more hosts in the route lack the needed protocol features. The destinations and routes cannot be modified once the keys are loaded, but multiple routes to the same destination can be loaded and the routes can be any number of hops. If the routes need changing, then the key must be reloaded into the agent with the new route or routes. The general default for the client is to keep keys in the agent for local use only. However, that can be enforced explicitly by adding the '''-a''' option when starting the client or else setting the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'no' in the relevant configuration block. In order to load keys for unlimited forwarding, which is not the best idea, just add them using [http://man.openbsd.org/ssh-add.1 ssh-add(1)] as normal. Then use the '''-A''' option with the client or set the '''ForwardAgent''' directive in [http://man.openbsd.org/ssh_config.5 ssh_config(5)] to 'yes' in the relevant configuration block. In order to limit keys for connection only to a specific remote host, or to load keys for connection to a specific remote host with forwarding via one or more intermediate hosts, use he '''-h''' option when loading keys into the agent. Here the one key may be used only to connect to the specific destination: <syntaxhighlight lang="shell-session"> $ ssh-agent -h server.example.org server.key.ed25519 </syntaxhighlight> If an intermediate system is passed through, the best way is to use '''ProxyJump''' which is the '''-J''' option for the SSH Client. If agent forwarding must be allowed then the tightest way is to constrain which systems may use the keys, again using the '''-h''' option. <syntaxhighlight lang="shell-session"> $ ssh-agent -h middle.example.org -h "middle.example.org>server.example.org" server.key.ed25519 </syntaxhighlight> Multiple steps can be included, even multiple routes. They just have to be enumerated explicitly, though patterns may still be used for the destination hosts as well as specific names. Each host in the chain must support these protocol extensions for the connection to complete. Any keys designated for forwarding are unusable for authentication on any other hosts than those which have been explicitly identified for forwarding. These permitted hosts are identified by host key or host certificate from the '''known_hosts''' file or another file designated by the '''-H''' option when loading the key with [http://man.openbsd.org/ssh-add.1 ssh-add(1)]. If '''-H''' is not used at the time the keys are loaded into the agent, then the default known hosts file(s) will be used: '''~/.ssh/known_hosts''', '''/etc/ssh/ssh_known_hosts''', '''~/.ssh/known_hosts2''', and '''/etc/ssh/ssh_known_hosts2'''. In the case of keys, the '''known_hosts''' list must be maintained conscientiously <ref name="ssh-agent-restrictions">{{ cite web | author=Damien Miller|url=https://www.openssh.org/agent-restrict.html | title=SSH agent restriction | publisher=OpenSSH | date=2021-12-16|accessdate=2022-03-06}}</ref>, perhaps with the help of the '''UpdateHostkeys''' and '''CanonicalizeHostname''' client configuration directives. Use of certificates requires the agent to only need to be aware of the Certificate Authority (CA). Again, see [[OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two | Passing Through a Gateway or Two]] in the section on jump hosts about a way to pass through one or more intermediate machines without needing to forward an SSH agent. ====Checking the Agent for Specific Keys==== The [http://man.openbsd.org/ssh_add ssh_add(1)] utility's '''-T''' option can test whether a specific private key is available in the agent or not by looking up the matching public key. That can be useful in a shell script. <syntaxhighlight lang="shell"> #!/bin/sh key=/home/fred/.ssh/some.key.ed25519.pub if ssh-add -T ${key}; then echo "Key ${key} Found" else echo "Key ${key} missing" fi </syntaxhighlight> Or it could be done with an alternate syntax just as well either in a script or in an interactive shell sessions, <syntaxhighlight lang="shell-session"> $ key=/home/fred/.ssh/some.key.ed25519.pub $ ssh-add -T ${key} && echo "Key found" || echo "Key missing" </syntaxhighlight> However, if the desired result would be to add key to the agent then the '''AddKeysToAgent''' client configuration option can ensure that a specific key is added to the SSH agent upon first use during any given login session. That can be done using '''-o AddKeysToAgent=yes''' as a run-time argument, or by modifying [http://man.openbsd.org/ssh_config ssh_config(5)] as appropriate: <syntaxhighlight lang="apache" line="1"> Host www HostName www.example.com IdentityFile %d/.ssh/www.ed25519 IdentitiesOnly yes AddKeysToAgent yes </syntaxhighlight> With those options in the configuration file, the first time <code>ssh www</code> is run the specified key will get added to the agent and remain available. ===Key-based Authentication Using A Hardware Security Token=== While stand-alone keys have been around for a long time, it has been possible since version 8.2 to use keys backed by hardware security tokens, such as OnlyKey, Yubikey, or many others, though the FIDO2 protocol. The Universal 2nd Factor (U2F) authentication is supported directly in OpenSSH through FIDO2 and does not need third party software. At the moment there are two types of hardware backed keys, ECDSA-SK and Ed25519-SK, but only the latest hardware tokens support the latter. If the key Ed25519-SK format is not supported by the token's firmware, then the following error message will be presented when attempts to use that key type are made: <syntaxhighlight lang="text"> Key enrollment failed: invalid format </syntaxhighlight> If supported, either key type can be created with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The steps are almost identical to creating normal keys but the token must be available to the system (plugged in) first. Then if called for, the token's PIN must be entered and the token touched or otherwise activated. After that, the key creation proceeds as normal. Mind the key type as specified by the '''-t''' option. <syntaxhighlight lang="shell-session"> $ ssh-keygen -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" Generating public/private ed25519-sk key pair. You may need to touch your authenticator to authorize key generation. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/fred/.ssh/server.ed25519-sk Your public key has been saved in /home/fred/.ssh/server.ed25519-sk.pub The key fingerprint is: SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo web server The key's randomart image is: +[ED25519-SK 256]-+ | .o... | | .o | | +.. . | | = . . ..= . | |+ + * + So.. o | |o+.EoO *+oo | |.o oBo+++o | | o .=.+. | | . .=== | +----[SHA256]-----+ </syntaxhighlight> Once created, the public and private key files get handled like with any other type of key. But when authenticating, the hardware token must be present and activated when called for. <syntaxhighlight lang="shell-session"> $ ssh -i /home/fred/.ssh/server.ed25519-sk server.example.org Enter passphrase for key '/home/fred/.ssh/server.ed25519-sk': Confirm user presence for key ED25519-SK SHA256:41wVVDnKJ9gKr2Sj4CFuYMhcNvYebZ6zq0PWyP4rRDo </syntaxhighlight> The resulting private key file is not actually the key itself but instead a "key handle" which is used by the hardware security token to derive the real private key on demand at the time it is actually used<ref name="OpenBSD_tech_U2F_FIDO">{{cite web |url=https://marc.info/?l=openbsd-tech&m=157376801917387&w=2 |title=OpenSSH U2F/FIDO support in base |publisher=OpenBSD-Tech Mailing List | date=2019-11-14 |accessdate=2021-03-24}}</ref>. As a result, the hardware-backed private key file is useless without the accompanying hardware token. This also means that these key files are not portable across hardware tokens, say when having multiple tokens in reserve or as backup, even when used by the same account. So when multiple hardware tokens are in use, different key pairs must be generated for each token. ====Hardware Security Token Resident Private Key==== It is possible to store the private key within the token itself, but for the moment it cannot be used directly from inside the token and must first be saved as a file. Also, the key can only be loaded into the FIDO authenticator at the time of creation using the '''-O resident''' option with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. Otherwise, the process is the same as above. <syntaxhighlight lang="shell-session"> $ ssh-keygen -O resident -t ed25519-sk -f /home/fred/.ssh/server.ed25519-sk -C "web server for fred" . . . </syntaxhighlight> When needed, the resident key can be extracted from the FIDO2 hardware token and saved into a file using the '''-K''' option. At this stage a passphrase can be added to the file, but no passphrase is kept within the token itself, only an optional PIN protects the key there. <syntaxhighlight lang="shell-session"> $ ssh-keygen -K Enter PIN for authenticator: Enter passphrase (empty for no passphrase): Enter same passphrase again: Saved ED25519-SK key to id_ed25519_sk_rk $ mv -i id_ed25519_sk_rk /home/fred/.ssh/server.ed25519-sk </syntaxhighlight> Since the output file name is fixed, any pre-existing file with that name can get overwritten but there will be a warning first. However, it is not recommended to keep the key on the hardware token because it provides more protection when kept separately. ==Single-purpose Keys== Tailored single-purpose keys can eliminate use of remote root logins for many administrative activities. A finely tailored '''sudoers''' is needed along with an unprivileged account. When done right, it gives just enough access to get the job done, following the security principle of Least Privilege. Single-purpose keys are accompanied by use of either the '''ForceCommand''' directive in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] or the '''command="..."''' directive inside the '''authorized_keys''' file. The method is to generate a new key pair, transfer the public key to '''authorized-keys''' on the remote system, and then prepend the appropriate command or script there to the line with the key. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/local/bin/somescript.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H </syntaxhighlight> The '''command="..."''' directive inserted there overrides everything else and ensures that when logging in with just that key only the script '''/usr/local/bin/somescript.sh''' is run. If it is necessary to pass parameters to the script, have a look at the contents of the '''SSH_ORIGINAL_COMMAND''' environment variable and use it in a case statement. Do not ever trust the contents of that variable nor use the contents directly, always indirectly. Single-purpose keys are useful for allowing only a tunnel and nothing more. The following key will only echo some text and then exit, unless used non-interactively with the '''-N''' option. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/bin/echo do-not-send-commands" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzTIWCaILN3tHx5WW+PMVDc7DfPM9xYNY61JgFmBGrA </syntaxhighlight> No matter what the user tries while logging in with that key, the session will only echo the given text and then exits. Using the '''-N''' option disables running the remote program, allowing the connection to stay open, allowing a tunnel. <syntaxhighlight lang="shell-session"> $ ssh -L 3306:localhost:3306 \ -i ~/.ssh/tunnel_ed25519 \ -N \ -l fred \ server.example.com </syntaxhighlight> That creates a tunnel and stays connected despite a key configuration which would close an interactive session. See also the '''-n''' or '''-f''' option for [http://man.openbsd.org/ssh.1 ssh(1)]. ===Single-purpose Keys to Avoid Remote Root Access=== The easy way is to write a short shell script, place it '''/usr/local/bin/''', and then configure '''sudoers''' to allow the otherwise unprivileged account to run just that script and only that script. <syntaxhighlight lang="apache" line="1"> %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd stop %wheel ALL=(root:root) NOPASSWD: /usr/sbin/service httpd start </syntaxhighlight> Then the key calls the script using '''command="..."''' inside '''authorized_keys'''. Here the one key starts the web server, the other stops the web server. <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/sudo /usr/sbin/service httpd stop" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcgdzDvSebOEjuegEx4W1I/aA7MM3owHfMr9yg2WH8H command="/usr/bin/sudo /usr/sbin/service httpd start" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMidyqZ6OCvbWqA8Zn+FjhpYE6NoWSxVjFnFUk6MrNZ4 </syntaxhighlight> Complicated programs like [http://linux.die.net/man/1/rsync rsync(1)], [http://man.openbsd.org/tar.1 tar(1)], [http://linux.die.net/man/1/mysqldump mysqldump(1)], and so on require an advanced approach when building a single-purpose key. For them, the '''-v''' option can show exactly what is being passed to the server so that '''sudoers''' can be set up correctly. That way they can be restricted to only access designated parts of the file system. For example, here is what <code>ssh -v</code> shows from one particular usage of [http://linux.die.net/man/1/rsync rsync(1)], note the "Sending command" line: <syntaxhighlight lang="shell-session"> $ rsync -e 'ssh -v' fred@server.example.org:/etc/ ./backup/etc/ . . . debug1: Sending command: rsync --server --sender -e.LsfxC . /etc/ . . . </syntaxhighlight> That output can then be added to '''sudoers''' so that the key can do only that function. <syntaxhighlight lang="shell-session"> %backup ALL=(root:root) NOPASSWD: /usr/bin/rsync --server --sender -e.LsfxC . /etc/ </syntaxhighlight> Then to tie it all together, the account "backup" needs a key: <syntaxhighlight lang="shell-session"> $ grep '^command' ~/.ssh/authorized_keys command="/usr/bin/rsync --server --sender -e.LsfxC . /etc/" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMm0rs4eY8djqBb3dIEgbQ8lmdlxb9IAEuX/qFCTxFgb </syntaxhighlight> Many of these programs have a '''--dry-run''' or equivalent option. Remember to use it when figuring out the right settings. ===Read-only Access to Keys=== In some cases it is necessary to prevent accounts from being able to changing their own authentication keys. However, such situations may be a better case for using certificates. However, if done with keys it is accomplished by putting the key file in an external directory where the user has read-only access, both to the directory and to the key file. Then the '''AuthorizedKeysFile''' directive assigns where [http://man.openbsd.org/sshd.8 sshd(8)] looks for the keys and can point to a secured location for the keys instead of the default location. A good alternate location could be a new directory '''/etc/ssh/authorized_keys''' which could store the selected accounts' key files there. The change can be made to apply to only a group of accounts by putting the settings under a '''Match''' directive. The default location for keys on most systems is usually '''~/.ssh/authorized_keys'''. <syntaxhighlight lang="apache" line="1"> Match Group sftpusers AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Then the permissions there would allow the keys to be read but not written: <syntaxhighlight lang="shell-session"> $ ls -dhln /etc/ssh/ drwxr-x--x 3 0 0 4.0K Mar 30 22:16 /etc/ssh/authorized_keys/ $ ls -dhln /etc/ssh/*.pub -rw-r--r-- 1 0 0 173 Mar 23 13:34 /etc/ssh/fred -rw-r--r-- 1 0 0 93 Mar 23 13:34 /etc/ssh/user1 -rw-r--r-- 1 0 0 565 Mar 23 13:34 /etc/ssh/user2 . . . </syntaxhighlight> The keys could even be within subdirectories, though the same restrictions apply regarding permissions and ownership. For chrooted SFTP, the method is the same to keep the key files out of reach of the accounts: <syntaxhighlight lang="apache" line="1"> Match Group sftpusers ChrootDirectory /home ForceCommand internal-sftp -d %u AuthorizedKeysFile /etc/ssh/authorized_keys/%u </syntaxhighlight> Of course a '''Match''' directive is not essential. The settings could be made to apply to all accounts by putting the directive in the main part of the server configuration file instead. ==Mark Public Keys as Revoked== Keys can be revoked. Keys that have been revoked can be stored in '''/etc/ssh/revoked_keys''', a file specified in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] using the directive '''RevokedKeys''', so that [http://man.openbsd.org/sshd.8 sshd(8)] will prevent attempts to log in with them. No warning or error on the client side will be given if a revoked key is tried. Authentication will simply progress to the next key or method. The revoked keys file should contain a list of public keys, one per line, that have been revoked and can no longer be used to connect to the server. The key cannot contain any extras, such as [[OpenSSH/Client_Configuration_Files#Available_key_login_options | login options]] or it will be ignored. If one of the revoked keys is tried during a login attempt, the server will simply ignore it and move on to the next authentication method. An entry will be made in the logs of the attempt, including the key's fingerprint. See the section on [[OpenSSH/Logging_and_Troubleshooting | logging]] for a little more on that. <syntaxhighlight lang="apache" line="1"> RevokedKeys /etc/ssh/revoked_keys </syntaxhighlight> The '''RevokedKeys''' configuration directive is not set in [http://man.openbsd.org/ssh_config.5 sshd_config(5)] by default. It must be set explicitly if it is to be used. This is another situation that might be better fulfilled through using certificate since a validity interval can be set in any combination of seconds, minutes, hours, days, or weeks can be set for certificates while keys are valid indefinitely. ===Key Revocation Lists=== A Key Revocation List (KRL) is a compact, binary form of representing revoked keys and certificates. In order to use a KRL, the server's configuration file must point to a valid list using the '''RevokedKeys''' directive. KRLs themselves are generated with [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] and can be created from scratch or edited in place. Here a new one is made, populated with a single public key: <syntaxhighlight lang="shell-session"> $ ssh-keygen -kf /etc/ssh/revoked_keys -z 1 ~/.ssh/old_key_rsa.pub </syntaxhighlight> Here an existing KRL is updated by adding the '''-u''' option: <syntaxhighlight lang="shell-session"> $ ssh-keygen -ukf /etc/ssh/revoked_keys -z 2 ~/.ssh/old_key_dsa.pub </syntaxhighlight> Once a KRL is in place, it is possible to test if a specific key or certificate is in the revocation list. <syntaxhighlight lang="shell-session"> $ ssh-keygen -Qf /etc/ssh/revoked_keys ~/.ssh/old_key_rsa.pub </syntaxhighlight> Only public keys and certificates will be loaded into the KRL. Corrupt or broken keys will not be loaded and will produce an error message if tried. Like with the regular '''RevokedKeys''' list, the public key destined for the KRL cannot contain any extras like login options or it will produce an error when an attempt is made to load it into the KRL or search the KRL for it. ==Verify a Host Key by Fingerprint== The above examples have been about using keys to authenticate the client to the server. A different context in which keys are used is when the server identifies itself to the client, which happens automatically at the beginning of each non-multiplexed session. In order for that identification to happen the client acquires a public key from the server, usually on or prior to first contact, which it can subsequently use to ensure that it is connecting to the same server again and not an impostor. The default locations for storing these acquired host keys on the client are in '''/etc/ssh/ssh_known_hosts''', if managed by the system administrator, or in '''~/.ssh/known_hosts''' if managed by the client's own account. The format of the contents is a line with a host address and its matching public key. The file is described in detail in the [http://man.openbsd.org/sshd.8 sshd(8)] manual page in the section "SSH_KNOWN_HOSTS FILE FORMAT". When connecting for the first time to a remote host, the server's host key should be verified in order to ensure that the client is connecting to the right machine and not an impostor or anything else. Usually this verification is done by comparing the fingerprint of the server's host key rather than trying to compare the whole key itself. By default the client will show the fingerprint if the key is not already found in the '''known_hosts''' register. <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. ECDSA key fingerprint is SHA256:LPFiMYrrCYQVsVUPzjOHv+ZjyxCHlVYJMBVFerVCP7k. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> That can be compared to a fingerprint received out of band, say by post, e-mail, SMS, courier, and so on. Specifically, the example represents the key's fingerprint as a base64 encoded SHA256 checksum. That is the default style. The fingerprint can also be displayed as an MD5 hash in hexadecimal instead by passing the client's '''FingerprintHash''' configuration directive as a runtime argument or setting it in [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. <syntaxhighlight lang="shell-session"> $ ssh -o FingerprintHash=md5 host.example.org The authenticity of host 'host.example.org (192.0.32.203)' can't be established. RSA key fingerprint is MD5:10:4a:ec:d2:f1:38:f7:ea:0a:a0:0f:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> But the default in new versions is SHA256 in base64 has a lower chance of collision. In OpenSSH 6.7 and earlier, the client showed fingerprints as a hexadecimal MD5 checksum instead a of the base64-encoded SHA256 checksum currently used: <syntaxhighlight lang="shell-session"> $ ssh -l fred server.example.org The authenticity of host 'server.example.org (192.0.32.10)' can't be established. RSA key fingerprint is 4a:11:ef:d3:f2:48:f8:ea:1a:a2:0d:17:57:ea:a6:16. Are you sure you want to continue connecting (yes/no)? </syntaxhighlight> Another way of comparing keys is to use the ASCII art visual host key. See further below about that. ===Downloading keys=== Even though a host’s key is usually displayed for review the first time the SSH client tries to connect, it can also be fetched on demand at any time using [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)]: <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLC2PpBnFrbXh2YoK030Y5JdglqCWfozNiSMjsbWQt1QS09TcINqWK1aLOsNLByBE2WBymtLJEppiUVOFFPze+I= # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9iViojCZkcpdLju7/3+OaxKs/11TAU4SuvIPTvVYvQO32o4KOdw54fQmd8f4qUWU59EUks9VQNdqf1uT1LXZN+3zXU51mCwzMzIsJuEH0nXECtUrlpEOMlhqYh5UVkOvm0pqx1jbBV0QaTyDBOhvZsNmzp2o8ZKRSLCt9kMsEgzJmexM0Ho7v3/zHeHSD7elP7TKOJOATwqi4f6R5nNWaR6v/oNdGDtFYJnQfKUn2pdD30VtOKgUl2Wz9xDNMKrIkiM8Vsg8ly35WEuFQ1xLKjVlWSS6Frl5wLqmU1oIgowwWv+3kJS2/CRlopECy726oBgKzNoYfDOBAAbahSK8R # host.example.org SSH-2.0-OpenSSH_8.2 host.example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDDOmBOknpyJ61Qnaeq2s+pHOH6rdMn09iREz2A/yO2m </syntaxhighlight> Once a key is acquired, its fingerprint can be shown using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. This can be done directly with a pipe. <syntaxhighlight lang="shell-session"> $ ssh-keyscan host.example.org | ssh-keygen -lf - # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 # host.example.org SSH-2.0-OpenSSH_8.2 256 SHA256:sxh5i6KjXZd8c34mVTBfWk6/q5cC6BzR6Qxep5nBMVo host.example.org (ECDSA) 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 host.example.org (RSA) 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> If there is more than one public key type is available from the server on the port polled, then [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] will fetch each of them. If there is more than one key fed via '''stdin''' or a file, then [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)] will process them in order. Prior to OpenSSH 7.2 manual fingerprinting was a two step process, the key was read to a file and then processed for its fingerprint. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t ed25519 host.example.org > key.pub # host.example.org SSH-2.0-OpenSSH_6.8 $ ssh-keygen -lf key.pub 256 SHA256:ZmS+IoHh31CmQZ4NJjv3z58Pfa0zMaOgxu8yAcpuwuw host.example.org (ED25519) </syntaxhighlight> Note that some output from [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] is sent to '''stderr''' instead of '''stdout'''. A hash, or fingerprint, can be generated manually with [http://linux.die.net/man/1/awk awk(1)], [http://linux.die.net/man/1/sed sed(1)] and [http://linux.die.net/man/1/xxd xxd(1)], on systems where they are found. <syntaxhighlight lang="shell-session"> $ awk '{print $2}' key.pub | base64 -d | md5sum -b | sed 's/../&:/g; s/: .*$//' $ awk '{print $2}' key.pub | base64 -d | sha256sum -b | sed 's/ .*$//' | xxd -r -p | base64 </syntaxhighlight> It is possible to find all hosts from a file which have new or different keys from those in '''known_hosts''', if the host names are in clear text and not stored as hashes. <syntaxhighlight lang="shell-session"> $ ssh-keyscan -t rsa,ecdsa -f ssh_hosts | \ sort -u - ~/.ssh/known_hosts | \ diff ~/.ssh/known_hosts - </syntaxhighlight> ====Using ssh-keyscan(1) with ssh_config(5)==== The utility [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] does not parse [http://man.openbsd.org/ssh_config.5 ssh_config(5)]. That is in part to keep the code base simple. There are a lot of configuration options which would be complicated to implement, including but not limited to '''ProxyJump''', '''ProxyCommand''', '''Match''', '''BindInterface''', and '''CanonicalizeHostname'''<ref name="keyscan">{{cite mailing list |url=https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-March/040605.html | title=Why does ssh-keyscan not use .ssh/config? |publisher=mindrot.org | access-date=2023-03-01 | date=2023-03-01 | mailing-list=OpenSSH UNIX-dev | first=Damien | last=Miller }}</ref> . Resolving host names via the client configuration file can be done by wrapping the utility in a short shell function: <syntaxhighlight lang="shell"> my-ssh-keyscan() { for host in "$@" ; do ssh-keyscan $(ssh -G "$host" | awk '/^hostname/ {print $2}') done } </syntaxhighlight> That shell function uses the '''-G''' option of [http://man.openbsd.org/ssh.1 ssh(1)] to resolve each host name using [http://man.openbsd.org/ssh_config.5 ssh_config(5)] and then check the resulting host name for SSH keys. ===ASCII Art Visual Host Key=== An ASCII art representation of the key can be displayed along with the SHA256 base64 fingerprint: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 256 SHA256:BClQBFAGuz55+tgHM1aazI8FUo8eJiwmMcqg2U3UgWU www.example.org (ED25519) +--[ED25519 256]--+ |o+=*++Eo | |+o .+.o. | |B=.oo. . | |*B.=.o . | |= B * S | |. .@ . | | +..B | | *. o | | o.o. | +----[SHA256]-----+ </syntaxhighlight> In OpenSSH 6.7 and earlier the fingerprint is in MD5 hexadecimal form. <syntaxhighlight lang="shell-session"> $ ssh-keygen -lvf key 2048 37:af:05:99:e7:fb:86:6c:98:ee:14:a6:30:06:bc:f0 www.example.net (RSA) +--[ RSA 2048]----+ | o | | o . | | o o | | o + | | . . S | | E .. | | .o.* .. | | .*=.+o | | ..==+. | +-----------------+ </syntaxhighlight> ==More on Verifying SSH Keys== Keys on the client or the server can be verified against known good keys by comparing the base64-encoded SHA256 fingerprints. ===Verifying Stray Client Keys=== Sometimes is is necessary to compare two uncertain key files to check if they are part of the same key pair. However, public keys are more or less disposable. So the easy way in such situations on the client machine is to just rename or erase the old, problematic, public key and replace it with a new one generated from the existing private key. <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f ~/.ssh/my_key_rsa </syntaxhighlight> But if the two parts must really be compared, it is done in two steps using [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. First, a new public key is re-generated from the known private key and used to make a fingerprint to '''stdout'''. Next, the fingerprint of the unknown public key is generated for comparison. In this example, the private key '''my_key_a_rsa''' and the public key '''my_key_b_rsa.pub''' are compared: <syntaxhighlight lang="shell-session"> $ ssh-keygen -y -f my_key_a_rsa | ssh-keygen -l -f - $ ssh-keygen -l -f my_key_b_rsa.pub </syntaxhighlight> The result is a base64-encoded SHA256 checksum for each key with the one fingerprint displayed right below the other for easy visual comparison. Older versions don't support reading from '''stdin''' so an intermediate file will be needed then. Even older versions will only show an MD5 checksum for each key. Either way, automation with a shell script is simple enough to accomplish but outside the scope of this book. ===Verifying Server Keys=== Reliable verification of a server's host key must be done when first connecting. It can be necessary to contact the system administrator who can provide it out of band so as to know the fingerprint in advance and have it ready to verify the first connection. Here is an example of the server's RSA key being read and its fingerprint shown as SHA256 base64: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 3072 SHA256:hlPei3IXhkZmo+GBLamiiIaWbeGZMqeTXg15R42yCC0 root@server.example.net (RSA) </syntaxhighlight> And here the corresponding ECDSA key is read, but shown as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub 256 MD5:ed:d2:34:b4:93:fd:0e:eb:08:ee:b3:c4:b3:4f:28:e4 root@server.example.net (ECDSA) </syntaxhighlight> Prior to 6.8, the fingerprint was expressed as an MD5 hexadecimal hash: <syntaxhighlight lang="shell-session"> $ ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 MD5:e4:a0:f4:19:46:d7:a4:cc:be:ea:9b:65:a7:62:db:2c root@server.example.net (RSA) </syntaxhighlight> It is also possible to use [http://man.openbsd.org/ssh-keyscan.1 ssh-keyscan(1)] to get keys from an active SSH server. However, the fingerprints still needs to be verified out of band. ====Warning: Remote Host Identification Has Changed!==== If a server's key does not match what the client finds has been recorded in either the system's or the local account's '''authorized_keys''' files, then the client will issue a warning along with the fingerprint of the suspicious key. <pre> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is SHA256:GkoIDP/d0I6KA9IQyOB9iqL+Rzpxx9LhlSJPCEfjVQ4. Please contact your system administrator. Add correct host key in /home/fred/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/fred/.ssh/known_hosts:19 remove with: ssh-keygen -f "/home/fred/.ssh/known_hosts" -R "server.example.com" RSA host key for server.example.com has changed and you have requested strict checking. Host key verification failed. </pre> Three reasons for the warning are common. One reason is that the server's keys were replaced, often because the server's operating system was reinstalled without backing up the old keys. Another reason can be when the system administrator has phased out deprecated or compromised keys. However that can be planned better and if there is time to plan the migration, new keys can just be added to the server and have the clients use the '''UpdateHostKeys''' option so that the new keys are accepted if the old keys match. A third situation is when the connection is made to the wrong machine, such as when the remote system changes IP addresses because of dynamic address allocation. In all three cases where the key has changed there is only one thing to do: contact the system administrator and verify the key. Ask if the OpenSSH-server was recently reinstalled, or was the machine restored from an old backup? Keep in mind that the system administrator may be you yourself in some cases. The case which is rather rare but serious enough that it should be ruled out for sure is that the wrong machine is part of a man-in-the-middle attack. In all four cases, an authentic key fingerprint can be acquired by any method where it is possible to verify the integrity and origin of the message, for example via PGP-signed e-mail. If physical access is possible, then use the console to get the right fingerprint. Once the authentic key fingerprint is available, return to the client machine where you got the error and remove the old key from '''~/.ssh/known_hosts''' <syntaxhighlight lang="shell-session"> $ ssh-keygen -R server.example.org </syntaxhighlight> Then try logging in, but compare the key fingerprints first and proceed if and '''only''' if the key fingerprint matches what you received out of band. If the key fingerprint matches, then go through with the login process and the key will be automatically added. If the key fingerprint does not match, stop immediately and figure out what you are connecting to. It would be a good idea to get on the phone, a real phone not a computer phone, to the remote machine's system administrator or the network administrator. ===Multiple Keys for a Host, Multiple Hosts for a Key in known_hosts=== Multiple host names or IP addresses can use the same key in the '''known_hosts''' file by using pattern matching or simply by listing multiple systems for the same key. That can be done in either the global list of keys in '''/etc/ssh/ssh_known_hosts''' and the local, account-specific lists of keys in each account's '''~/.ssh/known_hosts''' file. Labs, computational clusters, and similar pools of machines can make use of keys in that way. Here is a key shared by three specific hosts, identified by name: <pre> server1,server2,server3 ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Or a range can be specified by using globbing to a limited extent in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts'''. <pre> 172.19.40.* ssh-rsa AAAAB097y0yiblo97gvl...jhvlhjgluibp7y807t08mmniKjug...== </pre> Conversely, for multiple keys for the same address, it is necessary to make multiple entries in either '''/etc/ssh/ssh_known_hosts''' or '''~/.ssh/known_hosts''' for each key. <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...vlhjgluibp7y807t08mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerf1dcw16twc61c6cw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rdfcvbhu865rfgbvcfrt65...== </pre> Thus in order to get a pool of servers to share a pool of keys, each server-key combination must be added manually to the '''known_hosts''' file: <pre> server1 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server1 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server1 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== server2 ssh-rsa AAAAB097y0yiblo97gvljh...07t8mmniKjug...== server2 ssh-rsa AAAAB0liuouibl kuhlhlu...qerfw1ryer4t...== server2 ssh-rsa AAAAB568ijh68uhg63wedx...aq14rvcfrt65...== </pre> Though upgrading to certificates might be a more appropriate approach that manually updating lots of keys. ===Another way of Dealing with Dynamic (roaming) IP Addresses=== It is possible to manually point to the right key using '''HostKeyAlias''' either as part of [http://man.openbsd.org/ssh_config.5 ssh_config(5)] or as a runtime parameter. Here the key for machine ''Foobar'' is used to connect to host 192.168.11.15 <syntaxhighlight lang="shell-session"> $ ssh -o StrictHostKeyChecking=accept-new \ -o HostKeyAlias=foobar \ 192.168.11.15 </syntaxhighlight> This is useful when DHCP is not configured to try to keep the same addresses for the same machines over time or when using certain stdio forwarding methods to pass through intermediate hosts. ===Host Key Update and Rotation in known_hosts=== A protocol extension to rotate weak public keys out of '''known_hosts''' has been in OpenSSH from version 6.8<ref name="djm_rotation"> {{cite web | title=Key rotation in OpenSSH 6.8+ | author=Damien Miller | url=http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html | date=2015-02-01 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> and later. With it the server is able to inform the client of all its host keys and update '''known_hosts''' with new ones when at least one trusted key already known. This method still requires the private keys be available to the server <ref name="djm_rotation_redux"> {{cite web | title=Hostkey rotation, redux | author=Damien Miller | url=http://blog.djm.net.au/2015/02/hostkey-rotation-redux.html | date=2015-02-17 | publisher=DJM's Personal Weblog | accessdate=2016-03-05 }} </ref> so that proofs can be completed. In [http://man.openbsd.org/ssh_config.5 ssh_config(5)], the directive '''UpdateHostKeys''' specifies whether the client should accept updates of additional host keys from the server after authentication is completed and add them to '''known_hosts'''. A server can offer multiple keys of the same type for a period before removing the deprecated key from those offered, thus allowing an automated option for rotating keys as well as for upgrading from weaker algorithms to stronger ones. See also [https://datatracker.ietf.org/doc/html/rfc4819 RFC 4819: Secure Shell Public Key Subsystem] about key management standards. ==Converting Between SSH Key Formats== OpenSSH has its own format for keys which it uses by default when new keys are made. However, other SSH clients and servers may use other formats such as [https://www.rfc-editor.org/rfc/rfc4716 RFC4716], [https://www.rfc-editor.org/rfc/rfc5958 PKCS8], or [https://www.rfc-editor.org/rfc/rfc1421 PEM]. Any of these can be converted to the default OpenSSH format by [http://man.openbsd.org/ssh-keygen.1 ssh-keygen(1)]. The default to format to try to convert from is RFC4716. The utility [https://linux.die.net/man/1/puttygen puttygen(1)] makes keys in that format for [https://linux.die.net/man/1/putty putty(1)] and they need conversion when used with OpenSSH's server. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -f /var/tmp/key_public.ppk </syntaxhighlight> However, you can use the '''-m''' option to specify either that format explicitly or else choose another one to convert from. <syntaxhighlight lang="shell-session"> $ ssh-keygen -i -m RFC4716 -f /var/tmp/key_public.ppk $ ssh-keygen -i -m PKCS8 -f /var/tmp/key_public.ppk </syntaxhighlight> Both examples above are for importing public keys into OpenSSH's own format. By default OpenSSH will write newly-generated keys in its own format, so the '''-m''' option is obligatory to produce public keys in another format. <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m PKCS8 -f ~/.ssh/key.pub </syntaxhighlight> It is not yet possible to export private keys from the OpenSSH format to one of the other formats using the '''-e''' option. Even if a private key is specified as input, a public key is produced: <syntaxhighlight lang="shell-session"> $ ssh-keygen -e -m RFC4716 -f ~/.ssh/key </syntaxhighlight> Not all key types are supported by all key formats. <noinclude> == References == {{reflist}} {{OpenSSH/TOC|mini}} </noinclude> {{BookCat}} {{status|100%}} 2qc7vsvglgfxd121hufq1p96n7v623f 4 112405 4655460 4655209 2026-07-24T12:24:24Z MediaWiki message delivery 1188004 /* Request for comment (the future of Abstract Wikipedia) */ new section 4655460 wikitext text/x-wiki __NEWSECTIONLINK__ {{Discussion Rooms}} {{Shortcut|WB:CHAT|WB:RR/G|WB:GENERAL}} {{TOC left|limit=3}} {{User:MiszaBot/config |archive = Wikibooks:Reading room/Archives/%(year)d/%(monthname)s |algo = old(60d) |counter = 1 |minthreadstoarchive = 1 |minthreadsleft = 1 |key = 7a0ac23cf8049e4d9ff70cabb5649d1a }} Welcome to the '''General reading room'''. On this page, Wikibookians are free to talk about the Wikibooks project in general. For proposals for improving Wikibooks, see the [[../Proposals/]] reading room. {{clear}} [[Category:Reading room]] == Vote now in the 2026 U4C election == <section begin="announcement-content" /> Eligible voters are asked to participate in the 2026 [[m:Special:MyLanguage/Universal_Code_of_Conduct/Coordinating_Committee|Universal Code of Conduct Coordinating Committee]] election. More information–including an eligibility check, voting process information, candidate information, and a link to the vote–are available on Meta at the [[m:Special:MyLanguage/Universal_Code_of_Conduct/Coordinating_Committee/Election/2026|2026 Election information page]]. The vote closes on 2 June 2026 at [https://zonestamp.toolforge.org/1780358400 00:00 UTC]. Please vote if your account is eligible. Results will be available by 14 June 2026. -- In cooperation with the U4C,<section end="announcement-content" /> [[m:User:Keegan (WMF)|Keegan (WMF)]] ([[m:User talk:Keegan (WMF)|talk]]) 17:14, 27 May 2026 (UTC) <!-- Message sent by User:Keegan (WMF)@metawiki using the list at https://meta.wikimedia.org/w/index.php?title=Distribution_list/Global_message_delivery&oldid=30513860 --> == Discussion at WB:TECH == I started a discussion whether we should keep the FlaggedRevs comment box hidden at [[Wikibooks:Reading room/Technical Assistance#Is this CSS code necessary?]], but I am notifying here due to a lack of participation over there. Thank you. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 22:41, 30 May 2026 (UTC) == Template:Printable testing == Is there any way to use Template:Printable so that it creates a printable version of a ''different'' page? I've been wanting to see what it looks like without having to create a subpage. <span style="color:#FF0000">[[User:User97104|User]]</span><span style="color:#FF0000">[[User talk:User97104|97104]] </span><span style="color:#FF0000">[[Special:Contributions/User97104|(fixes)]]</span> 23:59, 8 June 2026 (UTC) == June 2026 Wikimedia Café meetups regarding the English Wikipedia Editor Reflections project == <div class="border-box" style="background-color: var(--background-color-warning-subtle, #f8eaba); max-width: 875px; padding: 5px; border: 1px solid black; margin: 5px; color: var(--clr-dark)"> <div class="box" style="float:left; padding-top: 10px; padding-right: 10px; padding-left: 10px; padding-bottom: 10px;">[[File:Wikimedia Café logo in plain SVG format.svg|60px|alt=The logo for the Wikimedia Café]]</div> Hello! There will be two '''[https://meta.wikimedia.org/wiki/Wikimedia_Caf%C3%A9 Wikimedia Café]''' discussion opportunities during the last weekend of June. Both sessions will focus on the [https://en.wikipedia.org/wiki/Wikipedia:Editor_reflections English Wikipedia Editor Reflections project]. The featured guest in the Café will be [https://en.wikipedia.org/wiki/User:Clovermoss User:Clovermoss]. Participants may attend either or both sessions. #'''27 June 2026 15:00 UTC''' ([https://zonestamp.toolforge.org/1782572400 timestamp converter]), at a time friendly to the Americas, Africa, and Europe #'''28 June 2026 03:00 UTC''' ([https://zonestamp.toolforge.org/1782615600 timestamp converter]), at a time friendly to Asia and the Pacific Please see the Café page for more information, including [https://meta.wikimedia.org/wiki/Wikimedia_Caf%C3%A9#How_to_attend_the_session how to register]! <br /> [[File:Buntstifte Eberhard Faber crop 64h.jpg|860px|alt=cropped image of colored pencils]]</div> <span style="white-space:nowrap;">[[User:Pine|<span style="color:#01796f; text-shadow:#00BFFF 0 0 1.0em">↠Pine</span>]] [[User talk:Pine|<span style="color:DeepSkyBlue">(<b style="color:#FFDF00;text-shadow:#FFDF00 0 0 1.0em">✉</b>)</span>]]</span> 04:09, 15 June 2026 (UTC) == Images lost in Engineering Acoustics == Hello, I just made an updated PDF version of the wiki book on Engineering Acoustics. During this processes I realized that 19 Images are missing. I left the respective chapters out of the PDF version. You can find the missing files by opening https://en.wikibooks.org/wiki/Engineering_Acoustics/Print_version in your web browser and search for the text File: . I am not sure why they were deleted. But possibly they were moved to Wikimedia Commons first and deleted after that. I could try to restore the from the 16 years old PDF version but I lack any authorship information so I think we need to redraw all of them. Furthermore I realized that some of the rest of the images in the wiki book have got a very poor resolution Yours 18:22, 18 June 2026 (UTC) [[User:Dirk Hünniger|Dirk Hünniger]] ([[User talk:Dirk Hünniger|discuss]] • [[Special:Contributions/Dirk Hünniger|contribs]]) 18:22, 18 June 2026 (UTC) : {{re|Dirk Hünniger}} All media ([[:File: Acousticplanewave1.gif|A]][[:File: Acousticcontrolsurface.gif|B]][[:File: Acousticcontrolsurface.gif|C]][[:File: Acousticpressure1.gif|D]][[:File: Ra analogs.png|E]][[:File: Acoustic gen.png|F]][[:File: Enclosed Piston.png|G]][[:File: Equ1.jpg|H]][[:File: Equ3.gif|I]][[:File: Equ4.gif|K]][[:File: Comp.gif|L]][[:File: Example2holm1sol.JPG|M]][[:File: Exam2prob.JPG|N]][[:File: Exam2sol.JPG|O]][[:File: 1Dwave graph1.png|P]][[:File: String dwg.jpg|Q]][[:File: Equations1.jpg|R]][[:File: Equations2.jpg|S]]) except [[:File: Inductive law pass filter.jpg|Inductive law pass filter.jpg]] and [[:File: Open-twister.gif|Open-twister.gif]] were once deleted by [[User: Jguk|Jguk]] and [[User: Darklama|Darklame]] because after a grace period they still lacked copyright information. ‑‑[[User:Kai Burghardt|Kai Burghardt]] ([[User talk:Kai Burghardt|discuss]] • [[Special:Contributions/Kai Burghardt|contribs]]) 14:51, 10 July 2026 (UTC) ::@[[User:Kai Burghardt|Kai Burghardt]] ::Do we also need to delete the PDF then? It contains theses images. ::Yours [[User:Dirk Hünniger|Dirk Hünniger]] ([[User talk:Dirk Hünniger|discuss]] • [[Special:Contributions/Dirk Hünniger|contribs]]) 07:49, 11 July 2026 (UTC) ::: {{re|Dirk Hünniger}} It depends on the images’ contents, whether they’re copyrightable. ‑‑[[User:Kai Burghardt|Kai Burghardt]] ([[User talk:Kai Burghardt|discuss]] • [[Special:Contributions/Kai Burghardt|contribs]]) 08:40, 11 July 2026 (UTC) ::::@[[User:Kai Burghardt|Kai Burghardt]] Well to me the look copyrightable. And further more its just the same images that were deleted from the wiki due to copyright issues [[User:Dirk Hünniger|Dirk Hünniger]] ([[User talk:Dirk Hünniger|discuss]] • [[Special:Contributions/Dirk Hünniger|contribs]]) 13:33, 11 July 2026 (UTC) ::::: {{re|Dirk Hünniger}} As far as I understand the issue was a formality. All files must bear license info, regardless whether they’re copyrightable or not. It is quite possible all deleted images don’t meet the threshold of originality, but still were deleted because of this formality. Images like [[:File: Equ1.jpg|File: Equ1.jpg]] ''presumably'' contain ''just'' some rasterized text formula and as such are not copyrightable. I have not had a look at them, so I can’t tell. ‑‑[[User:Kai Burghardt|Kai Burghardt]] ([[User talk:Kai Burghardt|discuss]] • [[Special:Contributions/Kai Burghardt|contribs]]) 14:30, 11 July 2026 (UTC) :::::: @[[User:Kai Burghardt|Kai Burghardt]] If its just a formality and the images don't meet the threshold to be copyrightable we could just restore the deleted images from the PDF. But keeping the PDF and not restoring the images surely is a contradiction. Furthermore there are quite a lot of books with the same problem. [[User:Dirk Hünniger|Dirk Hünniger]] ([[User talk:Dirk Hünniger|discuss]] • [[Special:Contributions/Dirk Hünniger|contribs]]) 17:25, 11 July 2026 (UTC) == Citing WikiBooks? == Wikipedia has a page for Citing Wikipedia, but I haven't found one here, so I have a few questions: # How would I cite Wikibooks in an essay? # Do I need to cite sources on Wikibooks? If so, how? [[User:BlazeFlames|BlazeFlames]] ([[User talk:BlazeFlames|discuss]] • [[Special:Contributions/BlazeFlames|contribs]]) 22:48, 18 June 2026 (UTC) :# This should give you a good method: https://www.scribbr.com/citing-sources/how-to-cite-wikipedia/ :# Generally, no. We have [[Wikibooks:Policies and guidelines|no policy that requires or prohibits citing sources]] and we have a [[Help:Editing#References|help page on how to do it]], with a [[Wikibooks:Templates/Sources|number of templates]] to standardize the process. There is definitely value in citing sources, so I don't want to discourage it. :―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 09:10, 19 June 2026 (UTC) :: {{re|BlazeFlames}} As you can see in [[Special: Version#mw-version-ext|Special: Version § Installed Extensions]] this MediaWiki has the [[mw: Special: MyLanguage/Extension: CiteThisPage|CiteThisPage extension]] installed. On the English‑language edition of Wikibooks you can navigate to [[Special: CiteThisPage/Typewriting|Special: CiteThisPage/…]] even though it is not listed in the [[MediaWiki: Sidebar]] (but it’s listed in [[Special: SpecialPages#mw-specialpagesgroup-pagetools|Special: SpecialPages]]). However, on {{abbr|WB|Wikibooks}} I would link via the [[mw: Special: MyLanguage/Help: Page ID|page ID]] rather than the page title; replace <syntaxhighlight lang='text' inline>title=Booktitle</syntaxhighlight> with <syntaxhighlight lang='text' inline>curid=123456</syntaxhighlight>. ‑‑[[User:Kai Burghardt|Kai Burghardt]] ([[User talk:Kai Burghardt|discuss]] • [[Special:Contributions/Kai Burghardt|contribs]]) 15:09, 10 July 2026 (UTC) == Unhide the FlaggedRevs comment box? == :''Reposted from [[Wikibooks:Reading room/Archives/2026/April#Is this CSS code necessary?]] as the former link had no participation.'' I propose unhiding the FlaggedRevs comment box (via MediaWiki:Common.css) because it might be useful to add in a comment when reverting with the FlaggedRevs reversion, unlike rollback. It might also be useful in cases to add a comment on what the user edited when accepting a revision. Thoughts? [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 21:17, 20 June 2026 (UTC) == RFC about AI-generated content in Wikimedia Commons == <bdi lang="en" dir="ltr"> You are invited to participate in a [[c:Commons:Requests for comment/Policy update for AI content|request for comment on Wikimedia Commons about a policy update for AI content]]. This may affect files that are uploaded to Wikimedia Commons for use on this project. Thank you. [[m:User:Codename Noreste|Codename Noreste]] ([[m:User talk:Codename Noreste|discuss]])</bdi> 17:11, 23 June 2026 (UTC) <!-- Message sent by User:Codename Noreste@metawiki using the list at https://meta.wikimedia.org/w/index.php?title=Distribution_list/Global_message_delivery&oldid=30513860 --> == Deployment of Legal and Safety Contacts Link in the Footer of Your Wiki == <section begin="Message"/> '''Legal & Safety Contacts''' Hello community, the Wikimedia Foundation has provided a [[wmf:Special:MyLanguage/Legal:Wikimedia Foundation Legal and Safety Contact Information|single legal and safety contact page]], to be linked in the footer of your wiki, to ensure access to accurate legal information. This is a regulatory requirement. We have already rolled out links to English, German, Italian, Spanish and other wikis and we will deploy to your wiki soon. [[m:Special:MyLanguage/Wikimedia_Foundation_Legal_and_Safety_Contacts_FAQ|Please read more on the project page]] and leave any comments in this thread or on the [[m:Special:MyLanguage/Talk:Wikimedia Foundation Legal and Safety Contacts FAQ|talk page]]. <section end="Message"/> -- [[User:Sannita (WMF)|User:Sannita (WMF)]] ([[User talk:Sannita (WMF)|talk]]) 13:30, 25 June 2026 (UTC) <!-- Message sent by User:Sannita (WMF)@metawiki using the list at https://meta.wikimedia.org/w/index.php?title=User:Sannita_(WMF)/Mass_sending_test&oldid=30731267 --> == A question about the user right move-subpages == Even though reviewers have the ability to move 100 pages per minute (per InitialiseSettings.php), they do not have <code>move-subpages</code>, which allows moving a book (with all its subpages) in one single action. Is this user right considered sensitive (hence it is restricted to administrators by default)? [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 04:23, 9 July 2026 (UTC) :I'm not 100% sure what the problem is as long as mass moving is limited to admins in the first place, as this can really cause problems (I recently encountered this mass-moving 100 out of c. 260 pages on a wiki). I support filing a ticket at [[:phab:]] to extend [[:mw:Manual:$wgMaximumMovedPages|$wgMaximumMovedPages]] to 1,000. ―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 05:33, 9 July 2026 (UTC) == July 2026 Wikimedia Café meetups regarding Wikimedia governance and options for reform == <div class="border-box" style="background-color: var(--background-color-warning-subtle, #f8eaba); max-width: 875px; padding: 5px; border: 1px solid black; margin: 5px; color: var(--clr-dark)"> <div class="box" style="float:left; padding-top: 10px; padding-right: 10px; padding-left: 10px; padding-bottom: 10px;">[[File:Wikimedia Café logo in plain SVG format.svg|60px|alt=The logo for the Wikimedia Café]]</div> Hello! There will be two '''[https://meta.wikimedia.org/wiki/Wikimedia_Caf%C3%A9 Wikimedia Café]''' discussion opportunities in July. Both sessions will focus on Wikimedia governance, including possible follow-ups to the [https://meta.wikimedia.org/wiki/Movement_Charter Movement Charter] and options for reform. Participants may attend either or both Café sessions. This month, to deconflict the Café meetups from Wikimania, the meetups will be held one day later than usual. #'''26 July 2026 15:00 UTC''' ([https://zonestamp.toolforge.org/1785078000 timestamp converter]), at a time friendly to the Americas, Africa, and Europe #'''27 July 2026 03:00 UTC''' ([https://zonestamp.toolforge.org/1785121200 timestamp converter]), at a time friendly to Asia and the Pacific Please see the Café page for more information, including [https://meta.wikimedia.org/wiki/Wikimedia_Caf%C3%A9#How_to_attend_the_session how to register]! <br /> [[File:Buntstifte Eberhard Faber crop 64h.jpg|860px|alt=cropped image of colored pencils]]</div> <span style="white-space:nowrap;">[[User:Pine|<span style="color:#01796f; text-shadow:#00BFFF 0 0 1.0em">↠Pine</span>]] [[User talk:Pine|<span style="color:DeepSkyBlue">(<b style="color:#FFDF00;text-shadow:#FFDF00 0 0 1.0em">✉</b>)</span>]]</span> 03:53, 13 July 2026 (UTC) == Request for comment (the future of Abstract Wikipedia) == <bdi lang="en" dir="ltr" class="mw-content-ltr"> You are invited to voice your opinions in a [[:m:Requests for comment/The future of Abstract Wikipedia|request for comment about the future of Abstract Wikipedia]]. {{Int:Feedback-thanks-title}} [[:m:User:Kowal2701|Kowal2701]] ([[:m:User talk:Kowal2701|talk]]) 12:24, 24 July 2026 (UTC) </bdi> <!-- Message sent by User:DreamRimmer@metawiki using the list at https://meta.wikimedia.org/w/index.php?title=Distribution_list/Global_message_delivery&oldid=30513860 --> k3cec67ol8e46iugc4f7hroqb1k61om 4 140081 4655490 4655396 2026-07-25T08:10:25Z ArchiverBot 1227662 Bot: Archiving 2 threads (older than 14 days) to [[Wikibooks:Reading room/Administrative Assistance/Archives/2026/July]] 4655490 wikitext text/x-wiki __NEWSECTIONLINK__ {{Discussion Rooms}} {{shortcut|WB:AN|WB:AA}} {{TOC left}} {{User:MiszaBot/config |archive = Wikibooks:Reading room/Administrative Assistance/Archives/%(year)d/%(monthname)s |algo = old(14d) |counter = 1 |minthreadstoarchive = 1 |minthreadsleft = 1 }} {{ombox|type=content|text='''To request a rename or usurpation''', go to the global request page at Meta [[meta:SRUC|here]].<br />''Please do not post those requests here!''}} {{Clear}} Welcome to the '''Administrative Assistance reading room'''. You can request assistance from [[WB:ADMIN|administrators]] for handling a variety of problems here and alert them about problems which may require special actions not normally used during regular content editing. Please be patient as administrators are often quite busy with either their own projects or trying to perform general maintenance and cleanup. You can deal with most vandalism yourself: [[Wikibooks:Dealing with vandalism|fix it]], then [[Wikibooks:Templates/User_notices|warn the user]]. If there is repeated vandalism by one user, lots of vandalism on a single page, or vandalism from many users, tell an admin here, or in [irc://irc.freenode.net/wikibooks #wikibooks] (say <code>!admin</code> to get attention). For more general questions and assistance that doesn't require an administrator, please use the [[WB:HELP|Assistance Reading Room]]. {{clear}} [[Category:Reading room]] == Emirati yahzota reported by MathXplore == * {{userlinks|Emirati yahzota}} Long-term abuse, [[:w:Wikipedia:Sockpuppet investigations/Muhammad Ali Rajab]] <!-- USERREPORTED:/Emirati yahzota/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:18, 2 July 2026 (UTC) :I deleted their page addition. @[[User:MarcGarver|MarcGarver]] could we get a CU here? Thanks! —[[User:Kittycataclysm|Kittycataclysm]] ([[User talk:Kittycataclysm|discuss]] • [[Special:Contributions/Kittycataclysm|contribs]]) 01:28, 3 July 2026 (UTC) ::Nothing to see on CU. [[User:MarcGarver|MarcGarver]] ([[User talk:MarcGarver|discuss]] • [[Special:Contributions/MarcGarver|contribs]]) 11:07, 13 July 2026 (UTC) == Unprotection/edit request == Hi, would an admin please temporarily unprotect the non-MediaWiki pages at [[User:TenshiBot/Errors]]? As for the MediaWiki pages, would an admin go through them and replace the <nowiki><center></nowiki> tags and replace it with <nowiki><div style="text-align: center"></nowiki>? [[User:Tenshi Hinanawi|Tenshi Hinanawi]] ([[User talk:Tenshi Hinanawi|discuss]] • [[Special:Contributions/Tenshi Hinanawi|contribs]]) 23:10, 11 July 2026 (UTC) : Unprotecting, fixing, and protecting back would take too long—I know just the thing, which is using JWB. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 02:35, 12 July 2026 (UTC) : [[User:Tenshi Hinanawi|Tenshi Hinanawi]], I've done what JWB could process; should there be way more in your bot's error log, let me know. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 03:02, 12 July 2026 (UTC) ::There's still a lot of the <nowiki><font></nowiki> tags which need replacing in the talk page archives. [[User:Tenshi Hinanawi|Tenshi Hinanawi]] ([[User talk:Tenshi Hinanawi|discuss]] • [[Special:Contributions/Tenshi Hinanawi|contribs]]) 10:11, 12 July 2026 (UTC) ::: I can replace those, but should it be <code>div</code> or <code>span</code>? [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 14:35, 12 July 2026 (UTC) ::::Span, though the font tag's parameters need to be converted as well, see [https://github.com/TenshiSWR/TenshiBot/blob/958b59d1a5e14a31ab8b46f66db54ebdba63e101/tasks/linterrors/obsolete_HTML_tags.py#L15-L52 the code] and the [https://html.spec.whatwg.org/multipage/rendering.html#:~:text=When%20a%20font%20element%20has%20a%20color,%27color%27%20property%20to%20the%20resulting%20color. HTML spec] for this. [[User:Tenshi Hinanawi|Tenshi Hinanawi]] ([[User talk:Tenshi Hinanawi|discuss]] • [[Special:Contributions/Tenshi Hinanawi|contribs]]) 14:56, 12 July 2026 (UTC) == NSSGGuarding reported by MathXplore == * {{userlinks|NSSGGuarding}} Spam <!-- USERREPORTED:/NSSGGuarding/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:17, 13 July 2026 (UTC) :{{done}} ―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 16:45, 13 July 2026 (UTC) == Tanzeemdigital reported by MathXplore == * {{userlinks|Tanzeemdigital}} Spam, [[Special:AbuseLog/314706]] <!-- USERREPORTED:/Tanzeemdigital/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:08, 15 July 2026 (UTC) == Faisalorakzaii reported by MathXplore == * {{userlinks|Faisalorakzaii}} cross-wiki abuse, [[:w:WP:AB]]. <!-- USERREPORTED:/Faisalorakzaii/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:13, 15 July 2026 (UTC) :{{done|Page deleted}} —[[User:Kittycataclysm|Kittycataclysm]] ([[User talk:Kittycataclysm|discuss]] • [[Special:Contributions/Kittycataclysm|contribs]]) 12:56, 15 July 2026 (UTC) == Drpriyajaganathan reported by MathXplore == * {{userlinks|Drpriyajaganathan}} Spam <!-- USERREPORTED:/Drpriyajaganathan/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 10:46, 18 July 2026 (UTC) :What do you find as spam ? [[Special:Contributions/&#126;2026-40412-29|&#126;2026-40412-29]] ([[User talk:&#126;2026-40412-29|talk]]) 12:20, 18 July 2026 (UTC) == WinniJoy reported by MathXplore == * {{userlinks|WinniJoy}} Spam <!-- USERREPORTED:/WinniJoy/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 10:48, 18 July 2026 (UTC) : {{done}}. [[User:Codename Noreste|Codename Noreste]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 19:00, 19 July 2026 (UTC) == ~2026-40144-05 reported by MathXplore == * {{userlinks|~2026-40144-05}} Spam <!-- USERREPORTED:/~2026-40144-05/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 11:17, 19 July 2026 (UTC) : I blocked them for creating out of scope pages. [[User:Codename Noreste|Codename Noreste]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 18:59, 19 July 2026 (UTC) == Tkdesigner34 reported by MathXplore == * {{userlinks|Tkdesigner34}} Spam <!-- USERREPORTED:/Tkdesigner34/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:08, 20 July 2026 (UTC) :{{done}} ―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 19:37, 20 July 2026 (UTC) == Samanthajagan reported by MathXplore == * {{userlinks|Samanthajagan}} Spam, [[Special:AbuseLog/314786]] <!-- USERREPORTED:/Samanthajagan/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:30, 21 July 2026 (UTC) :{{done}} —[[User:Atcovi|Atcovi]] [[User talk:Atcovi|(Talk]] - [[Special:Contributions/Atcovi|Contribs)]] 12:47, 21 July 2026 (UTC) mcju59pv3tpqyaxc6yhy33yeya1p1bv 0 158506 4655468 4634687 2026-07-24T15:47:18Z DavidTheJohnson 3616687 /* */ Capitalized Huxley. 4655468 wikitext text/x-wiki In Aldous Huxley's BRAVE NEW WORLD, Each caste is split into "plus" and "minus" members. ===Alphas and Betas=== Alphas and Betas are at the top of the caste system, and perform the more intellectual jobs. Unlike the lower castes, Alphas and Betas are not clones, allowing for more individual personalities. Alphas wear gray, and Betas wear mulberry. Examples of Alphas include Thomas, Henry Foster, Mustapha Mond, Bernard Marx, Benito Hoover, and Helmholtz Watson. Some Betas included Lenina Crowne, Fanny Crowne, and Linda, ect. ===Gammas, Deltas, and Epsilons=== The lower three castes do more menial and standardized work. As a result, they are usually clones. When being decanted, processes such as oxygen deprivation are used to ensure predictable mental and physical traits in each caste (with Epsilons having the greatest degree of oxygen deprivation, resulting in the greatest degree of brain damage). Gammas wear green, Deltas wear khakis, and Epsilons wear black. Gammas, Deltas, and Epsilons are conditioned to serve the higher ranking castes (Alpha and Beta). In Chapter 5, it states that "Everyone works for everyone else. We can't do this without anyone. Even Epsilons are useful. We couldn't do without Epsilons. Every one works for every one else. We can't do this without anyone..." all Deltas are trained to not like flowers or books at a very young age. {{BookCat}} t8v7zmqde05x5jizwkzdotvbzw4vy06 0 174831 4655492 4654476 2026-07-25T09:55:38Z Д.Ильин 688474 img 4655492 wikitext text/x-wiki Back to Previous Chapter: [[Metabolomics/Databases| Databases]]<br> Next chapter:[[Metabolomics/Contributors| Contributors ]]<br> First Category: [[Metabolomics/Applications/Disease Research| Disease Research]]<br> Go to:[[Metabolomics/Applications/Nutrition/Lifestyle| Lifestyle]]<br> Go back to:[[Metabolomics/Applications/Nutrition/Nutrigenomics| Nutrigenomics]]<br> #[[Metabolomics/Applications/Nutrition/Personal_Metabolomics/Phenotypes|Phenotypes]]<br> #[[Metabolomics/Applications/Nutrition/Personal_Metabolomics/Genotypes|Genotypes]]<br> =Personal Metabolomics= :As technology progress and new algorithms for computer programs are discovered, we will see the ability for medical researchers to detect changes in the concentrations of a person's metabolites. This could lead to the discovery of new bio-markers for diseases such as schizophrenia. These ideas were shared between the articles about schizophrenia bio-markers and potentials of personal metabolomics by Elain Holmes and Leroy Hood and colleagues. :Personal metabolomics will be an easy method in the future to diagnose and treat metabolic disorders on an individual basis. Metabolites in urine or blood can be analyzed and through the data collected, illnesses that the individual may have can be examined. Our review focus was mostly on diabetes, as it is one of the most studied and well known metabolic disorders. :In the paper “Correlative and quantitativate (1)H NMR-based metabolomics reveals specific metabolic pathway disturbances in diabetic rats”, rats were induced to develop diabetes by utilizing streptozotocin. Afterwards, urine and plasma were analyzed to discover metabolites that may indicate diabetes. Seventeen different metabolites where found, many in excess. By taking this information to a further level, in the future, it could be used to easily diagnose or treat diabetes in humans. :Similarly, in the article “Comprehensive two-dimensional gas chromatography/time of flight mass spectrometry for metabonomics: Biomarker discovery for diabetes mellitus”, five potential biomarkers were found in human patients. However, in contrast to the first paper, instead of NMR, two dimensional gas chromatography was used. Potential biomarkers found included glucose and linoleic acid. Again, these discoveries are useful for further diagnoses and treatments. [[File:Blue circle for diabetes.svg|thumb|Universal blue symbol for diabetes]] :The third article, “Nitric Oxide Synthesis and Isoprostane Production in Subjects With Type 1 Diabetes and Normal Urinary Albumin Excretion” showed that in type 1 diabetic patients, nitric oxide (NO) levels are higher than in normal healthy individuals. However, this increase in NO has no effect on renal function, as the diabetic patients had normal albumin excretion in their urine. NO is a metabolite that could be used further for diagnosis and study of diabetes. :The article "Personal Metabolics as a Next Generation Nutritional Assessment" discusses how current and future technologies as well as collaborating laboratories and databases on aspects of metabolism such as lipids will be the key to assessing metabolic disease as well as personalizing health and diet in humans in the very near future. :The article "Prospective health care: the second transformation of medicine" describes how current databases and standards for predicting disease are inadequate. Instead predictive modeling, such as using the Gail model with breast cancer, should be used to not only assess risk of disease or adverse effects of a disease but to also help work towards an appropriate treatment based upon an individual's personalized assessment and predictive model. :Websites found were mostly resource websites directed towards researchers and professionals rather than normal consumers. Chenomx Inc is a life sciences company offering metabolomics researchers for pharmaceutical companies chemistry software, and data analysis solutions among other things. They have a patented NMR suite 5.1, which is comprised of five different functional tools like Chenomx Profiler, and Chenomx Compound Builder. The software they provide is very reliable and accurate, capable of quickly identifying and quantifying metabolites. Currently, there are over 250 metabolites in their database, which provides a wealth of information to metabolomic researchers. :The PreDX was the only website directed towards consumers or the average Joe, rather than research facilities or large companies. The website offers a new type of blood test assesses different metabolites that have been found present in individuals at risk for diabetes. This is extremely important because some cases of diabetes can be prevented through diet and exercise change. Knowing the risks of developing diabetes can greatly aid individuals in the prevention process. The technology provided is easily accessible through phone, online or fax. :The last website belongs to The Society of Metabolomics, which is a group of well known metabolomic scientists that are trying to expand their field further. They offer tutorials and workshops on new technologies and methods in the field of metabolomics in addition to, providing resources. The website has links to various types of software used for metabolomics. Although though this is not useful for the general public, it is a good resource for metabolomic researchers or medical doctors hoping to use metabolomics to help diagnose their patients. = Website Sources = ==Chenomx.com== http://www.chenomx.com === General Overview === :Chenomx NMR Suite helps scientists correlate metabolic responses with pathology, toxicity, drug efficacy, and genetics. Main Focus: :To provide access to technology for analysis of metabolites found in various biological samples through the use of NMR spectroscopy and by unique, innovative software. Summary: :Chenomx Inc is a life sciences company that has much to offer metabolomics researchers for pharmaceutical companies and institutions all over the world. Through partnership with some of the leading providers in specific areas of expertise, including chemistry software and data analysis solutions in systems biology, Chenomx grants access to a bevy of efficient, cost-effective, and timely services through their website. These services consist of nuclear magnetic resonance (NMR) spectroscopy data acquisition, targeted profiling of metabolite analysis and statistical analysis of numerous biological samples. This is all obtained through the their one-of-a-kind, patented Chenomx NMR suite 5.1; a suite compiled of five different functional tools such as the Chenomx Profiler, Chenomx Compound Builder, Chenomx Spin Simulator, Chenomx Library Manager, and Chenomx Processor. :Chenomx employ highly trained and skilled scientists to carry out all their services. Over the years, Chenomx has gained experience in the handling and analysis of a variety of biological samples. Standard protocols for urine, plasma, serum, saliva and cell extracts exist at the Chenomx labs. Chenomx continues to improve and expand their knowledge in working with new samples that may be analyzed for specific metabolite detection from NMR spectroscopy. The NMR spectroscopy at Chenomx is a powerful tool in quick detection of the contents of biofluids. The NMR spectrometer utilized at Chenomx has field strengths of 400 to 800 MHz. Coupling NMR spectroscopy with their software provides efficient one-step biofluid analysis. The Chenomx software accurately, reliably, and quickly identifies and quantifies metabolites giving researchers complete and thorough analysis presented in various formats or databases: delimited text, Microsoft Excel, XML, SIMCA-P, Mat lab, and much more. :Currently Chenomx provides sample preparation services for alcohols, fatty acids, amino acids, sugars, organic acids, and nucleic acid components to name a few. With over 250 compounds in the Chenomx database, metabolomic researchers in need of interpretation of compounds or pathways they study are just a few clicks away from accessing an advantageous tool provided at www.chenomx.com. === New Terms === ;NMR : a family of scientific methods that exploit nuclear magnetic resonance to study molecules ("NMR spectroscopy") ( http://en.wikipedia.org/wiki/NMR ) ;chemometric : The use of mathematical statistics in the design of experiments, and the evaluation of the resulting data (http://en.wiktionary.org/wiki/chemometrics) ;metabolite : Any substance produced by, or taking part in, a metabolic reaction (http://en.wiktionary.org/wiki/metabolite) ;field strength : the vector sum of all the forces exerted by an electrical or magnetic field (on a unit mass or unit charge or unit magnetic pole) at a given point in the field (http://wordnetweb.princeton.edu/perl/webwn?s=field%20strength) ;serum : The clear yellowish fluid obtained upon separating whole blood into its solid and liquid components after it has been allowed to clot (http://en.wiktionary.org/wiki/serum) === Course Relevance === :This website offers technology to analyze various metabolites, some of which we have discussed in this course. ==PredictMyRisk.com== http://predictmyrisk.com/about.html ===General Overview=== Identifies patients in danger of contracting diabetes within five years. Main Focus: :The main focus is to use metabolite blood testing to find patients at risk for diabetes, and to do so using metabolic indicators other then glucose. Summary: :Diabetes is a major health concern for many. It can lead to other health problems such as high blood pressure, blood clots, loss of vision, stroke, and many other maladies. Today doctors have some ability to test for diabetes risk factors in an effort to prevents this condition before it happens. Doctors use a blood test that tests for the level of glucose in the blood during a period of fasting. Unfortunately this test has been found to be not as accurate as previously assumed. :PreDX is a website offering a new type of blood test that will test for the appearance of many different metabolites that have been found to be present in persons at risk for diabetes. This new test could be extremely helpful to doctors because it analyzes the blood for metabolites, which gives a much more accurate measure of diabetes risk then the traditional fasting blood glucose test. The website claims that its blood test is capable of identifying patients at risk for diabetes as much as five years before they would contract it. PreDX claims to be a simple to run and sensitive test that gives an easy to interpret readout of the patients risk and the reasons for that risk. This test could also be used on current diabetic patients to more fully test how well their diabetes is being controlled. :The test is preformed on a fasting blood sample. An algorithm analyzes a number of proteins and blood born biomarkers. This algorithm then compiles this data into a single numerical score that can be converted into a percentage of risk. This technology can be be obtained by phone, on line, or by faxing information to a number on the website. ===New Terms=== ;Biomarkers : a substance used as an indicator of a biologic state. (http://en.wikipedia.org/wiki/Biomarkers) ;Protein : organic compounds made of amino acids arranged in a linear chain and joined together by peptide bonds between the carboxyl and amino groups of adjacent amino acid residues. (http://en.wikipedia.org/wiki/Protein) ;Stroke : the rapidly developing loss of brain functions due to a disturbance in the blood vessels supplying blood to the brain. (http://en.wikipedia.org/wiki/Stroke) ;Macrovascular: referring to the large blood vessels. (http://diabetes.org.au/glossary.htm) ;Fasting blood glucose: a method for learning how much glucose there is in a blood sample taken after an overnight fast. (http://www.medterms.com/script/main/art.asp?articlekey=3393) ;Genetic marker: a specific gene that produces a recognizable trait and can be used in family or population studies. (http://wordnetweb.princeton.edu/perl/webwn?s=genetic%20marker) ;Retinopathy: is a general term that refers to some form of non-inflammatory damage to the retina of the eye. Most commonly it is a problem with the blood supply that is the cause for this condition. (http://en.wikipedia.org/wiki/Retinopathy) ===Course Relevance=== :This website offers a test to analyze metabolites pertaining to diabetes. This is relevant because it shows the complex interactions of metabolism and how they affect the body. ==Metabolomics Society== http://www.metabolomicssociety.org ===General Overview=== :The Metabolomics Society is a website commited to the growth of the metabolomics field. It is a non-profit organization containing more than 500 members in 20 countries. The society also publishes its very own journal titled Metabolomics, which is a peer-reviewed journal published by Springer that is released every 3-4months. This site provides multiple metabolomics resources, including numerous software and databases. However, these sources are more for research users rather than “everyday” individuals. In other words, it is NOT the WebMD of metabolomics, but still provides information that could be used by doctors or researchers to aid the “everyday” person with personal metabolomics. :Almost all software listed on the site uses either NMR or various types of mass spectrometry. Using this, they are able to detect certain metabolites by comparing to a large database, and sometimes even structuralize new metabolites found. XCMS(2) is capable of using a “similarity search” which can take an unknown metabolite and come up with possible structural motifs, allowing for possible identification of an unknown metabolite. MetaboMiner is a program capable of “identifying metabolites in complex biofluids”, which would be useful in a medical setting. HORA is probably the most relevant, because it’s a database made of up metabolites specifically in human blood. It allows you to tell which metabolites are abnormal, and conveniently also provides graphs to manage data. Although there is more software available, these last two were the most relevant to Personal Metabolomics. The website also provides databases for metabolites, including some related to diseases such as the OMIM. Aside from software, the Metabolomics Society also offers a variety of tutorial workshops, including “The NIH Roadmap to Understanding Biological Pathways and Networks with Metabolomics” and “PubChem: A Public Repository for Chemical Biology Screening Results”. The most important part of this website are the software resources, although there are other useful aspects of the site. ===New Terms=== ;NIH : National Institutes of Health (http://en.wikipedia.org/wiki/NIH) ;Metabolic profiling: Metabolic profiling employs a range of analytical approaches (e.g., mass spectrometry and high- resolution 1H nuclear magnetic resonance spectroscopy) suited to the chemical properties of the metabolite class(es) of interest. (http://www.genomicglossaries.com/content/metabolic_engineering.asp) ;Metabolic fingerprinting: a rapid classification of samples according to their origin or their biological relevance. (http://www.genomicglossaries.com/content/metabolic_engineering.asp) ;Footprinting: is a technique for identifying the site on DNA bound by some protein by virtue of the protection of bonds in this region against attack by nucleases. (http://www.hgsc.bcm.tmc.edu/docs/HGSC_glossary.html) ;Transcriptome analysis: Analysis of the global gene expression of a cell by identification of all the messenger RNA present in the cell. (http://www.nature.com/nrmicro/journal/v2/n12/glossary/nrmicro1046_glossary.html) ;Metabolic flux analysis: an analysis technique similar to Flux Base Analysis used to determine the rate at which a metabolite is produced during a bioprocess. (http://en.wikipedia.org/wiki/Metabolic_flux_analysis) ;Metabolome: refers to the complete set of small-molecule metabolites (such as metabolic intermediates, hormones and other signalling molecules, and secondary metabolites) to be found within a biological sample, such as a single organism. (http://en.wikipedia.org/wiki/Metabolome) = Article Sources = ==Systems Medicine: The Future of Medical Genomics and Healthcare== :Auffray, Charles; Chen, Zhu; Hood, Leroy. Systems medicine: the Future of medical genomics and healthcare. Genome Medicine 2009, I:2. http://genomemedicine.com/content.I/I/2. ==General Overview:== :Systems biology can be used in the determination and early warnings of certain diseases, made possible through the advances in computation and technology. ==Main Focus:== :By making robust hypothesis, a biological system can be monitored by taking samples of certain metabolites and using well thought out mathematical methodologies to make informative decisions about data. The data can then be shared with other scientist through a series of networks. ==Summary== :Through well thought out hypothesis-driven methods synthetic biology and dynamic processes can be created that allow the user to change the parameters of the metabolites to predict effects of different concentrations. Using these well-thought out methods, the personal genome project would be able to determine the differences between normal and diseased phenotypes. Without high quality design and assessment the usefulness of the resulting biomarkers would be compromised. However, recent advances in micro array and PCR technology along with advances in proteomic tools allow for accurate readings and high quality data. Using robust computer programs, network processes can be produced that show protein to protein interactions. Some limitations on computing are the variations in annotated data. Different languages of programming, along with the fact that a cell's system is continuously changing is what makes it difficult to write an ideal program that will encompasses all changes in a cel. As technologies progress new computational methods will allow for the modeling of entire cell systems and organs. This project is very dependent on annotated information so all organizations should use a standard for annotation and pay close attention to the quality of their experiments. ==Terms:== Systems biology - using complex biological systems knowledge can be determined by the behavior and differing conditions. Synthetic biology - using modular processes biological systems can be designed and modeled. Stratification - appearance www.dictionary.com allometric - measure of growth www.dictionary.com elucidate - make clear www.dictionary.com systematic - having a plan www.dictionary.com cytometry - cell counting www.dictionary.com ==Metabolic Profiling of Patients with Schizophrenia == Kaddurah-Daouk, Rima. Metabolic Profiling of Patients with Schizophrenia. PLoS Medicine. August 2006, V.3, I.8; pg 1222-1223. ==General Overview:== :Metabolomics can be used to monitor and develop biomarkers in different human diseases. ==Main Focus:== :This article provides the idea that with proper measurement tools, environmental factors can be used to discovery new bio-markers for diseases, such as schizophrenia. ==Summary:== :In this time of developing medicine, new ideas for discovering and preventing diseases are proposed. Mental illnesses, more specifically schizophrenia, hinders the daily activity of many people around the world. This disease has a treatment course, but many Schizophrenics find it hard to continue on the course. Often stopping their treatments, only to relapse and make symptoms worse. Elaine Holmes and her colleagues presented the fact that schizophrenia has no known biomarkers. They focus their work on identifying biomarkers for schizophrenia, by identifying changes in samples of cerebrospinal fluid. To do this Nuclear Magnetic Resonance (NMR) was used to record several resonance coefficients. They tracked the metabolites for two different groups of schizophrenics and treated one group with anti psychotics. What they found was that once the treatment was given, the subset of the metabolom being tested stabilized to normal levels. Elaine Holmes and her colleagues believe that by studying metabolomics, scientists can figure impairments in energy and lipid biosynthesized metabolism. In further testing of this study, it should include a larger sample population as well as the ability to replicate and validate results. This would reduce confounding effects and allow for more meaningful biological hypothesis. ==Terms:== aberrant - deviations from normal. leading coefficients - constant factor in multiplication Cerebrospinal fluid(CSF)- clear fluid by the spine around the brain nuclear magnetic resonance(NMR)- physical resonance using quantum magnetics Type 2 diabetes mellitus - non insulin dependent diabetes ==Correlative and quantitative 1H NMR-based metabolomics reveals specific metabolic pathway disturbances in diabetic rats== Zhang, Shucha. Nagana Gowda,GA. Asiago, V. Shanaiah, N. Barbas, C. "Correlative and quantitative (1)H NMR-based metabolomics reveals specific metabolic pathway disturbances in diabetic rats". Analytical Biochemistry 383. May 2008. 76-84. 11 Feb 2009 http://www.ncbi.nlm.nih.gov/pubmed/18775407?ordinalpos=1&itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_DefaultReportPanel.Pubmed_RVDocSum === General Overview === [[File:Streptozocin.svg|thumb|200px|Streptozotocin - a glucosamine-nitrosourea compound that is toxic to the insulin-producing beta cells of the mammalian pancreas. It is use to treat cancers cells in the Islet of Langerhans and has been experimentally use in animal models to treat Type 1 diabetes.]] :Type 1 diabetes is an autoimmune illness caused by the body’s destruction of beta cells in the pancreas. Even though diabetes is a well studied topic, the causes and preventions of it are still not well understood. In this study, researchers used the metabolomic approach to study Type 1 diabetes. Specifically, researchers combined nuclear magnetic resonance (NMR) and mass spectroscopy with multivariate statistical analysis (MSA). These techniques enable the researchers to screen large samples of metabolites and collect data that pertains to the normal individuals as well as diabetic patients in a relatively cost-effective and time-efficient fashion. The use of metabolomics as a way to study diseases is very common. For instance, it has been employed to study cancer, Type 2 diabetes, inborn errors of metabolism, and even diet and nutrition. :In this study, researchers injected rats with streptozotocin (STZ) to induce Type 1 diabetes. They were then examined for glucose level increases of more than 200 mg/dl after 4 days to confirm that they are diabetic. The controls chosen were both equivalent in age and gender. Both groups of rats were kept in proper condition with appropriate food and water supply. Urine samples were collected every 8 h after seven days after the initial injection. Blood samples were collected by cardiac puncture before sacrificing the rats. Data were collected from urine and blood samples and analyzed using NMR spectrometer supplied with HCN 1H inverse detection probe. After analysis, 17 metabolites were identified and quantified. :In diabetic rats, glucose, alpha-tocopherol, urea, triglycerides, TBARS, and liver alpha-tocopherol were all higher than the control. In addition, the diabetic rats consumed and secreted 10 times more urine volume than the control in the 24 h time frame. :The diabetic rats had high-intensity peaks from glucose along with a variety of other smaller molecules. Specific quantities of glucose averaged to about 7500-fold higher than in control rats. Lactate was observed to be the second highest increase with about 40-fold. :In order to confirm that the data compiled was accurate, researchers carried out a multivariate analysis: principal component analysis (PCA). The PCA results showed that the controls and the diabetic rats were well distinguished due to the large quantities of metabolites. The removal of glucose did not affect the analysis distinguishing diabetic rats from control rats. :Using the metabolomics approach to studying Type 1 diabetes, researchers found that even after the removal of the most significant marker (glucose) from the samples, there was still a significant difference in metabolites that separate the control rats from the diabetic rats. Furthermore, the researchers developed a network showing the metabolite changes and its correlation with each other. === New Terms === ;Autoimmune : the failure of an organism to recognize its own constituent parts as self, which results in an immune response against its own cells and tissues (http://en.wikipedia.org/wiki/Autoimmune) ;Glucose : a monosaccharide (or simple sugar) also known as grape sugar, blood sugar, or corn sugar, is a very important carbohydrate in biology (http://en.wikipedia.org/wiki/Glucose) ;Inborn errors of metabolism : comprise a large class of genetic diseases involving disorders of metabolism (http://en.wikipedia.org/wiki/Inborn_errors_of_metabolism) ;Mass spectroscopy : a charged particle passing through a magnetic field is deflected along a circular path on a radius that is proportional to the mass to charge ratio, m/e (http://www.chem.ucalgary.ca/courses/351/Carey/Ch13/ch13-ms.html) ;Metabolites : is the "systematic study of the unique chemical fingerprints that specific cellular processes leave behind" : specifically, the study of their small-molecule metabolite profiles (http://en.wikipedia.org/wiki/Metabolites) ;Nuclear magnetic resonance (NMR) : is a physical phenomenon based upon the quantum mechanical magnetic properties of an atom's nucleus (http://en.wikipedia.org/wiki/Nuclear_magnetic_resonance) ;Principal components analysis : determining a smaller set of synthetic variables that could explain the original set (http://en.wikipedia.org/wiki/Principal_components_analysis) ;Streptozotocin : a naturally occurring chemical that is particularly toxic to the insulin-producing beta cells of the pancreas in mammals(http://en.wikipedia.org/wiki/Streptozotocin) ;Triglyceride : chemical form in which most fat exists in food as well as in the body (http://www.americanheart.org/presenter.jhtml?identifier=4778) ;Type 1 diabetes : Type 1 diabetes is an autoimmune disease that results in destruction of insulin-producing beta cells of the pancreas (http://en.wikipedia.org/wiki/Type_1_diabetes) ===Course Relevance=== :This pertains to the overall study of metabolism. ==Comprehensive two-dimensional gas chromatography/time-of-flight mass spectrometry for metabonomics: Biomarker discovery for diabetes mellitus == Li, Xiang. Xu,Z. Lu, X. Yang, X. Yin, P. Kong, H. Xu, G. "Comprehensive two-dimensional gas chromatography/time-of-flight mass spectrometry for metabonomics: Biomarker discovery for diabetes mellitus." Analytica Chimica Acta 663. Nov. 2008. 257-262. 11 Feb 2009 <http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TF4-4V2NKGK-2&_user=47004&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_acct=C000005018&_version=1&_urlVersion=0&_userid=47004&md5=bc0216cfd9f5107aa5fd79797ede270b>. ===General Overview=== :Metabolomics can be utilized to diagnose disease and help with mechanism research. Researchers have used linear chromatography – mass spectroscopy (LC-MS) and gas chromatography-mass spectroscopy (GC-MS) to examine metabolite contents that required high sensitivity, selectivity, and that had a large linear range. In this study, researchers investigated levels of plasma phospholipids in Type 2 diabetes mellitus (T2DB) patients by LC-MS and multivariate statistical analysis (MSA). Some standard methods were modified to examine the metabolite profile differences between healthy and diabetic patients. For example, researchers combined GC X GC-MS with ultra performance liquid chromatography mass spectroscopy (UPLC-MS) to acquire global metabolite profiles in rats. GC X GC has been used in a variety of ways. However, when it is coupled with MS, metabolic profiles can be contrasted among samples. :Metabolites were extracted from blood plasma and analyzed by GC X GC-TOFMS. The data was submitted to data processing software. Peak alignment adjustments and pattern recognition were performed. Potential biomarker metabolites were obtained according to their variable importance in the projection (VIP). They were identified by ChromaTOF and NIST MS search 2.0 software. :Forty-eight diabetes mellitus patients and thirty-one healthy control volunteers participated in this study. Blood samples were collected and plasma proteins were obtained. The plasma samples were then analyzed by LECO Pegasus 4D GC X GC-TOFMS device. After that, differences between the healthy and diabetic patients were revealed using the partial least-square discriminant analysis (PLSDA). Orthogonal signal correction (OSC) was used to exclude the variations between the two sample types. :As mentioned above, VIP values of greater than 1.0 were chosen as potential biomarkers. After further analysis and exclusion of unrelated data, the researchers concluded that if similarity were greater than 750, then it would be a positive match with the published data. They found that 4/9 of potential biomarkers had a positive match. Palmitic acid, phosphate, 2-hydroxyisobutyric acid, and linoleic acid were all identified as positive matches. :It is known that glucose and lipids are key features of Type 2 diabetes mellitus. In T2DM’s, an increase level of free fatty acids (FFA) is detected circulating the blood. This could be a cause of T2DM development or it could just be the result of T2DM. In addition, FFAs could compete with glucose for substrate level oxidation, thus interfering with the activities of pyruvate dehydrogenase. This leads to elevated levels of glucose intracellularly. The increased levels of FFA could also lead to hyperinsulinemia. Hyperinsulinemia could be the beginning of insulin resistance in T2DM patients. Since the biomarkers found were either associated with hyperglycemia or problems with beta-oxidation. They may be utilized to help with diagnosis or for further research. ===New Terms=== ;Gas chromatography : specifically gas-liquid chromatography - involves a sample being vaporized and injected onto the head of the chromatographic column (http://teaching.shu.ac.uk/hwb/chemistry/tutorials/chrom/gaschrm.htm) ;Multivariate statistical analysis : describes a collection of procedures which involve observation and analysis of more than one statistical variable at a time (http://en.wikipedia.org/wiki/Multivariate_statistical_analysis) ;Time of flight mass spectroscopy (TOFMS) : ions are accelerated by an electrical field to the same kinetic energy with the velocity of the ion depending on the mass-to-charge ratio (http://en.wikipedia.org/wiki/Time-of-flight_mass_spectrometry) ;Type 2 Diabetes : a metabolic disorder that is characterized by high blood glucose in the context of insulin resistance and relative insulin deficiency. (http://en.wikipedia.org/wiki/Diabetes_mellitus_type_2) ;Hyperinsulinemia : present in people with diabetes mellitus type 2 or insulin resistance where excess levels of circulating insulin are in the blood. (http://en.wikipedia.org/wiki/Hyperinsulinemia) ;Ultra performance liquid chromatography : a column that holds chromatographic packing material (stationary phase), a pump that moves the mobile phase(s) through the column, and a detector that shows the retention times of the molecules (http://en.wikipedia.org/wiki/Ultra_performance_liquid_chromatography) ===Course Relevance=== :This pertains to the overall study of metabolism. ==Nitric Oxide Synthesis and Isoprostane Production in Subjects With Type 1 Diabetes and Normal Urinary Albumin Excretion== O'Byrne, Sharon, P Forte, LJ Roberts II, JD Morrow, A Johnston, E Anggard, RDG Leslie, and Nigel Benjamin. "Nitric Oxide Synthesis and Isoprostane Production in Subjects With Type 1 Diabetes and Normal Urinary Albumin Excretion." Diabetes. 49. 5, 857-862. May 2000. http://diabetes.diabetesjournals.org/cgi/reprint/49/5/857 ===General Overview=== [[Image: Nitric-oxide-2D.svg|thumb|right]] [[Image: Peroxynitrite-ion-2D.png|thumb|right]] :People with type 1 diabetes are at a high risk of developing serious microvascular complications. Investigations into these complications have been conducted with considerable emphasis on endothelium and nitric oxide (NO) production. NO plays an important role in everyday normal functioning of the body’s microvasculature. NO action is tightly regulated by the balance between its own production and the production of the free radical, superoxide (O2-). When NO and O2- interact, a highly reactive peroxynitrite (ONOO-) forms, which catalyzes isoprostane formation in LDL cholesterol. Isoprostanes serve as markers for hyperglycemia; a disorder associated with diabetes that can induce proliferation of tissues vital for maintaining vasculature, thus causing complications. In this study, researchers designed a method to accurately quantify NO synthesis in order to delve into the relationship between NO and free radical production in type 1 diabetics with normal urinary albumin excretion (UAER) and matching healthy diabetic-free individuals. :The methodology required injection of the stable isotope L-[15N]2-arginine, which converts into 15N-nitrate, into each subject with their urine collected every 12 hours over a 36 hour period. Subjects followed strict guidelines, such as refraining from physical exercise for 3 days prior to and during the study. The major metabolite of a certain isoprostane, 2,3-dinor-5,6-dihydro-F2-IsoP, was used to quantify free radical production for the first 12h period through isotope dilution mass spectrometric assay. Measuring whole-body NO production was detected through levels of 15N-nitrate, excreted in urine, using isotope ratio mass spectrometry. Careful considerations and actions were taken in order to limit factors of variability between diabetic and healthy subjects that could possibly alter results, including age, BMI, blood pressure, and cholesterol. :According to results, in comparison to the control group, a significant increase in whole-body NO synthesis was exhibited by type 1 diabetics, particularly those individuals with a history of diabetes greater than 20 years. All variables pertaining to individual characteristics, creatinine clearance and rate of elimination were negligible. Only differences in sex had an effect on 15N-nitrate levels regardless of diabetes, with females showing the highest production of NO overall. Levels of the F2-isoprostanes, which determined oxidative stress in vivo, revealed an inverse relationship between NO synthesis and free radicals. This was consistent with earlier hypotheses stating that presence of oxidative species, free radicals, inactivates NO synthesis. Isoprostrane concentration was similar in both diabetic and control groups, therefore one explanation for higher NO production in the diabetic group could possibly be due to the antioxidant and protective activity of NO. NO inhibits free radicals, which are built up during hyperglycemic conditions developed by diabetic patients. This study’s results show promising new insights into the role of NO in people with type 1 diabetes. ===New Terms=== ;Microvascular : referring to small blood vessels (http://diabetes.org.au/glossary.htm) ;Anigiopathy : any disease of the blood vessels or lymph ducts (http://wordnetweb.princeton.edu/perl/webwn?s=angiopathy) ;Microalbuminuria : leakage of small amounts of protein (albumin) into the urine; an early warning of kidney damage (http://diabetes.org.au/glossary.htm) ;Mitogenesis : induction of mitosis in a cell (http://medical-dictionary.thefreedictionary.com/mitogenesis) ;Euglycemic : of or pertaining to euglycemia; having the standard blood glucose level in the body (http://en.wiktionary.org/wiki/euglycemic) ===Course Relevance=== :To further understand the relationship between NO, from the metabolism of arginine to praline, production and free radicals and the emergence of microvascular diseases in individuals with type 1 diabetes. ==Personal Metabolomics as a Next Generation Nutritional Assessment== German, J. Bruce. Roberts, Matthew-Alan. and Watkins, Steven M. “Personal Metabolomics as a Next Generation Nutritional Assessment” The American Society for Nutritional Sciences. J. Nutr. May 2009. 133:4260-4266, December 2003. http://jn.nutrition.org/cgi/content/full/133/12/4260 ===General Overview=== [[:Image:FAB_MS.jpg]] :Every human differs in their metabolic regulation and because of this there is not necessarily an optimum diet that each person must follow. Personalized assessment of a person’s unique metabolism will be necessary in the future. The ultimate goal will be to individualize each person’s health in order to better predict and manage disease. Now, with the challenges of understanding metabolic health within individuals, it is necessary to take a more precise and more general approach. It is important to define both the input variables of foods as parts of complete diets and the outcome variables of integrated metabolism in order to judge a person’s health. To date, nutrition researchers have not addressed the acquisition of metabolism-wide data sets as output variables in nutrition clinical trials. The goal of metabolomics is to prepare a comprehensive dataset of every metabolite within a given biological sample. This is not yet possible because of the wide dynamic and chemical range of small metabolites within biological samples. However, it is possible to divide metabolites into specific classes, analyze these and then reassemble the data electronically. All lipid classes in blood, for example, can be quantified according to the mass of each fatty acid constituent. The technologies such as mass spectrometry provide a very efficient and relatively cheap way to implement systems to collect such data. The technologies that are available to address most of the metabolite classes are equally as available as those for fatty acids and complex lipids. Thus, no significant technological hurdle stands in the way of using these technologies to assemble metabolite databases of humans and experimental animals for amino acids and small peptides, sterols, organic acids, sugars and alcohols, vitamins, nucleotides, etc. So long as the data are qualitative and quantitative, such data from various human and animal investigations are directly comparable. Studies conducted in separate laboratories, using entirely different analytical technologies years apart, will produce directly comparable data if the data are both qualitative and quantitative. The primary causative factors in disease are often the altered biochemical composition of cells and tissues. Thus, the link between the gene regulatory control and the primary causative factors will be crucial for application in drug development, medicine, nutrition and other therapeutic courses of action. The identification of relationships between genes, transcripts, proteins and metabolites are essential components to understand integrative metabolism. Software is now available to superimpose analytical data onto said pathways, providing a powerful means to identify biological regulation of metabolism through the coexpression of gene data obtained from microarrays. GenMAPP is a particularly useful tool for such purpose, allowing the user to link pathway information to gene expression data. Overall the goal is to collaborate with various laboratories to interpret differences in blood lipids and thus provide predictive knowledge of potential interventions using food, drugs and lifestyle to improve lipid metabolism. ===New Terms=== ;Environment The sum of all external variables, including diet, lifestyle and not to be forgotten, coexisting organisms. ;Lipomics Study and research of lipids ;Lipids Broadly defined as any fat-soluble (lipophilic), naturally-occurring molecule, such as fats, oils, waxes, cholesterol, sterols, fat-soluble vitamins (such as vitamins A, D, E and K), monoglycerides, diglycerides, phospholipids, and others. The main biological functions of lipids include energy storage, as structural components of cell membranes, and as important signaling molecules. (http://en.wikipedia.org/wiki/Lipid) ;Nutrigenetics refers to the specific gene sequence differences between humans and how these affect the differences in responses to diet and particular needs for nutrients. ;Nutrigenomics is the study of the effects of diet on the expression of all genes and their functions. ===Course Relevance=== :Can be related to every human being as the study and research of lipids and personalized diets according to one’s own metabolic construct could impact our personal health. Could revolutionize how we think about health and diet. ==Prospective health care: the second transformation of medicine== Snyderman, Ralph and Langheier, Jason. “Prospective health care: the second transformation of medicine” Genome Biology 2006. May 2009. 7:104. 27 March 2006. http://genomebiology.com/2006/7/2/104 ===General Overview=== [[:Image:Breast Cancer Awareness (263497131).jpg]] :The term “Prospective health care” refers to the personalized risk prediction and strategic health-care planning which will facilitate a new form of care. The current approach to health care is based upon the reductionist method which simplifies causal reasons for infectious disease as well as chronic disease. Instead of disease being caused by one microbe (as this is far too simplistic) diseases develop as a consequence of inherited susceptibilities and environmental exposure. Over time, pathology increases, reversibility decreases and costs of care increases. Earlier intervention could clearly reduce the costs and the disease burden. Thus, it appears as though current research is on curing chronic illness and not preventing it. With modern science and technology including rapid evolving fields such as genomics, proteomics, and metabolomics, the ability to predict events and interfere before damage occurs is possible. Prospective health care is a new approach that incorporates all the power of current disease-oriented medicine but is based on the concept of strategic health planning, a proactive, prospective approach to care. In this system, individuals will be evaluated to determine their baseline risk for various diseases, their current health status, and the likelihood of their developing specific clinical problems given their risks. In order for this to be possible one must acquire the tools necessary such as predictive biomarkers, such as low-density lipoprotein (LDL) for cardiovascular disease. These biomarkers need to be identified and tracked over time to determine whether the individual’s likelihood of developing any particular disease is increasing or decreasing. A model of prediction is thus needed to accomplish this task. Predictive modeling encompasses various procedures for creating models that distinguish predictors from many other factors that are not as valuable for anticipating the outcome. Mathematical models can serve as guidelines to raise the overall standard of care, but not to determine the final diagnosis or treatment plan as humans are sensitive to appreciating outlying issues that the model might not be able to account for. The best course of action would be for healthcare to use these math models as a guideline to help standardize care which is not currently being done. To be the most useful, clinical medicine requires predictive models that can predict events accurately over far shorter timeframes, rather than the likelihood of recurrence in 10 years. To achieve this, more relevant and specific data will need to be collected for analysis as shown in Figure 5 which states that clinical data and the results of biomarker analyses (such as gene expression, protein array, and EKG) be collected from a cohort of people and stored in disease model libraries and then models are developed from them. The models can then be used to identify risk prediction factors for particular diseases or events and can thus be compared against a specific person’s profile to determine their risk, or to diagnose disease progression. Biomarkers such as SNPs that are highly associated with causal genes will serve as much better predictors of adverse outcomes, as well as provide for better predictive models, than much of the current data being collected. For individuals that are identified to be high risk they will undergo extensive surveillance to track the disease as much as possible and to provide therapeutic support, such as with breast cancer. With any disease, and specifically breast cancer, for personalized prevention and early intervention, it is necessary to predict baseline risks, provide surveillance for early detection, and facilitate optimal individualized therapy if disease develops. In order to do this with breast cancer there are specific models called the Gail and the Claus models, as well as BRCAPRO, which are used to predict risk and also used to facilitate appropriate treatment. The application of these new technologies to health care will not only provide a far more detailed understanding of health and its evolution toward disease, but will also support the ability to predict events and anticipate appropriate interventions. ===New Terms=== ;Reductionist Method: Simplifies the concept of pathogenesis to the smallest number of causal factors ;Biomarkers: Measurable biological factors that predict disease development ;BRCA1/BRCA2: Human genes that with specific mutations can increase a person’s risk of breast and ovarian cancers in women (up to 86% in breast cancer) as well as breast and prostate cancers in men. ;Claus Model: A computer program that uses statistics to predict a person’s risk for developing breast cancer based on family history (http://www.cancer.gov/Templates/db_alpha.aspx?CdrID=446553) ;Gail Model: A computer program that uses personal and family history to estimate a woman’s chance of developing breast cancer. Also called Gail risk model. (http://www.cancer.gov/Templates/db_alpha.aspx?searchTxt=gail&sgroup=Starts+with&lang=) ;SNP: Single nucleotide Polymorphism -- DNA sequence variation occurring when a single nucleotide — A, T, C, or G — in the genome (or other shared sequence) differs between members of a species (or between paired chromosomes in an individual). (http://en.wikipedia.org/wiki/Single_nucleotide_polymorphism) ==Course Relevance== :Prospective health care if put into effect could influence how modern health care works. We could be the guinea pigs to see if this type of intervention is possible, and we could ultimately benefit from it if successful. Overall relates to how metabolism and body regulations affects health. =Resources= :O'Byrne, Sharon, P Forte, LJ Roberts II, JD Morrow, A Johnston, E Anggard, RDG Leslie, and Nigel Benjamin. "Nitric Oxide Synthesis and Isoprostane Production in Subjects With Type 1 Diabetes and Normal Urinary Albumin Excretion." Diabetes. 49. 5, 857-862. May 2000. :Li, Xiang. Xu,Z. Lu, X. Yang, X. Yin, P. Kong, H. Xu, G. "Comprehensive two-dimensional gas chromatography/time-of-flight mass spectrometry for metabonomics: Biomarker discovery for diabetes mellitus." Analytica Chimica Acta 663. Nov. 2008. 257-262. 11 Feb 2009 <http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TF4-4V2NKGK-2&_user=47004&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_acct=C000005018&_version=1&_urlVersion=0&_userid=47004&md5=bc0216cfd9f5107aa5fd79797ede270b>. :Zhang, Shucha. Nagana Gowda,GA. Asiago, V. Shanaiah, N. Barbas, C. "Correlative and quantitative (1)H NMR-based metabolomics reveals specific metabolic pathway disturbances in diabetic rats". Analytical Biochemistry 383. May 2008. 76-84. 11 Feb 2009 <http://www.ncbi.nlm.nih.gov/pubmed/18775407?ordinalpos=1&itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_DefaultReportPanel.Pubmed_RVDocSum>. :"Diabetes Risk Test". PreDX. 2008. Tethys Bioscience, Inc.. 15 Feb 2009 <http://predictmyrisk.com/about.html>. :"Home". Metabolomics Society. Dec. 2008. Thermo Scientific. 13 Feb 2009 <129.128.185.121/metabolomics_society> :German, J. Bruce. Roberts, Matthew-Alan. and Watkins, Steven M. “Personal Metabolomics as a Next Generation Nutritional Assessment” The American Society for Nutritional Sciences. J. Nutr. May 2009. 133:4260-4266, December 2003. http://jn.nutrition.org/cgi/content/full/133/12/4260 :Snyderman, Ralph and Langheier, Jason. “Prospective health care: the second transformation of medicine” Genome Biology 2006. May 2009. 7:104. 27 March 2006. http://genomebiology.com/2006/7/2/104 ==Articles for future review as Metabolism class assignments== #[http://www.pubmedcentral.nih.gov/articlerender.fcgi?artid=1257643&tool=pmcentrez Personalized Exposure Assessment: Promising Approaches for Human Environmental Health Research] ====Main Focus==== ;:Identify the main focus of the resource. Possible answers include specific organisms, database design, intergration of information, but there are many more possibilities as well. ====New Terms==== ;New Term 1: Definition. (source: http://) ;New Term 2: Definition. (source: http://) ;New Term 3: Definition. (source: http://) ;New Term 4: Definition. (source: http://) ;New Term 5: Definition. (source: http://) ;New Term 6: Definition. (source: http://) ;New Term 7: Definition. (source: http://) ;New Term 8: Definition. (source: http://) ;New Term 9: Definition. (source: http://) ;New Term 10: Definition. (source: http://) ====Summary==== ;:Enter your article summary here. Please note that the punctuation is critical at the start (and sometimes at the end) of each entry. It should be 300-500 words. What are the main points of the article? What questions were they trying to answer? Did they find a clear answer? If so, what was it? If not, what did they find or what ideas are in tension in their findings? ====Relevance to a Traditional Metabolism Course==== ;:Enter a 100-150 word description of how the material in this article connects to a traditional metabolism course. Does the article relate to particular pathways (e.g., glycolysis, the citric acid cycle, steroid synthesis, etc.) or to regulatory mechanisms, energetics, location, integration of pathways? Does it talk about new analytical approaches or ideas? Does the article show connections to the human genome project (or other genome projects)? #[http://www.pubmedcentral.nih.gov/articlerender.fcgi?artid=1570061&tool=pmcentrez Monitoring Environmental Exposures: Now It’s Personal] ====Main Focus==== ;:Identify the main focus of the resource. Possible answers include specific organisms, database design, intergration of information, but there are many more possibilities as well. ====New Terms==== ;New Term 1: Definition. (source: http://) ;New Term 2: Definition. (source: http://) ;New Term 3: Definition. (source: http://) ;New Term 4: Definition. (source: http://) ;New Term 5: Definition. (source: http://) ;New Term 6: Definition. (source: http://) ;New Term 7: Definition. (source: http://) ;New Term 8: Definition. (source: http://) ;New Term 9: Definition. (source: http://) ;New Term 10: Definition. (source: http://) ====Summary==== ;:Enter your article summary here. Please note that the punctuation is critical at the start (and sometimes at the end) of each entry. It should be 300-500 words. What are the main points of the article? What questions were they trying to answer? Did they find a clear answer? If so, what was it? If not, what did they find or what ideas are in tension in their findings? ====Relevance to a Traditional Metabolism Course==== ;:Enter a 100-150 word description of how the material in this article connects to a traditional metabolism course. Does the article relate to particular pathways (e.g., glycolysis, the citric acid cycle, steroid synthesis, etc.) or to regulatory mechanisms, energetics, location, integration of pathways? Does it talk about new analytical approaches or ideas? Does the article show connections to the human genome project (or other genome projects)? #[http://www.pubmedcentral.nih.gov/articlerender.fcgi?artid=2651587&tool=pmcentrez Systems medicine: the future of medical genomics and healthcare] ====Main Focus==== ;:Identify the main focus of the resource. Possible answers include specific organisms, database design, intergration of information, but there are many more possibilities as well. ====New Terms==== ;New Term 1: Definition. (source: http://) ;New Term 2: Definition. (source: http://) ;New Term 3: Definition. (source: http://) ;New Term 4: Definition. (source: http://) ;New Term 5: Definition. (source: http://) ;New Term 6: Definition. (source: http://) ;New Term 7: Definition. (source: http://) ;New Term 8: Definition. (source: http://) ;New Term 9: Definition. (source: http://) ;New Term 10: Definition. (source: http://) ====Summary==== ;:Enter your article summary here. Please note that the punctuation is critical at the start (and sometimes at the end) of each entry. It should be 300-500 words. What are the main points of the article? What questions were they trying to answer? Did they find a clear answer? If so, what was it? If not, what did they find or what ideas are in tension in their findings? ====Relevance to a Traditional Metabolism Course==== ;:Enter a 100-150 word description of how the material in this article connects to a traditional metabolism course. Does the article relate to particular pathways (e.g., glycolysis, the citric acid cycle, steroid synthesis, etc.) or to regulatory mechanisms, energetics, location, integration of pathways? Does it talk about new analytical approaches or ideas? Does the article show connections to the human genome project (or other genome projects)? #[http://www.pubmedcentral.nih.gov/articlerender.fcgi?artid=1551921&tool=pmcentrez Metabolic Profiling of Patients with Schizophrenia] ====Main Focus==== ;:Identify the main focus of the resource. Possible answers include specific organisms, database design, intergration of information, but there are many more possibilities as well. ====New Terms==== ;New Term 1: Definition. (source: http://) ;New Term 2: Definition. (source: http://) ;New Term 3: Definition. (source: http://) ;New Term 4: Definition. (source: http://) ;New Term 5: Definition. (source: http://) ;New Term 6: Definition. (source: http://) ;New Term 7: Definition. (source: http://) ;New Term 8: Definition. (source: http://) ;New Term 9: Definition. (source: http://) ;New Term 10: Definition. (source: http://) ====Summary==== ;:Enter your article summary here. Please note that the punctuation is critical at the start (and sometimes at the end) of each entry. It should be 300-500 words. What are the main points of the article? What questions were they trying to answer? Did they find a clear answer? If so, what was it? If not, what did they find or what ideas are in tension in their findings? ====Relevance to a Traditional Metabolism Course==== ;:Enter a 100-150 word description of how the material in this article connects to a traditional metabolism course. Does the article relate to particular pathways (e.g., glycolysis, the citric acid cycle, steroid synthesis, etc.) or to regulatory mechanisms, energetics, location, integration of pathways? Does it talk about new analytical approaches or ideas? Does the article show connections to the human genome project (or other genome projects)? =Websites for future review as Metabolism class assignments= {{BookCat}} rgsgt8ufifqwzrt8uu8h4ifh9wjnt3x 1 189199 4655461 3354581 2026-07-24T12:40:52Z ~2026-41182-70 3616652 /* This looks like AI to me. */ new section 4655461 wikitext text/x-wiki {{ChessProject|importance=Low|class=Start}} Who was the chess.com user who invented it? How did it get widely known? :Lenny_Bongcloud, hence the name. The original discussion is [https://www.chess.com/forum/view/general/the-life-and-times-of-lennybongcloud---and-ratings here]. [[Special:Contributions/82.4.185.182|82.4.185.182]] ([[User talk:82.4.185.182|discuss]]) 15:21, 27 December 2017 (UTC) == This looks like AI to me. == The huge edit suddenly late last year screams AI to me. Hit's many of the hallmarks listed here https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing I was just going through some moves on Wikipedia and saw this funny name and went to check it out. Also I think it's kinda BS that the person who generated the AI revision of this page was able to then approve their own revision. Gotta be community rules against that. Shame. [[Special:Contributions/&#126;2026-41182-70|&#126;2026-41182-70]] ([[User talk:&#126;2026-41182-70|talk]]) 12:40, 24 July 2026 (UTC) dc0kw5k5dg1bcnswja6ns3v8fxw34cv 0 237398 4655496 4655233 2026-07-25T10:23:24Z Jeff1138 301139 4655496 wikitext text/x-wiki {{ArosNav}} ==Introduction== This a list of computer hardware tested with mostly native AROS installs and, in the recommended sections, of virtual machines With 64bit support it is recommended 8Gb ram is needed and that SSE 4.1 and AVX are supported in the CPU i.e. from year 2012 for Intel CPUs and 2013 for AMD CPUs. They are x86-64 instruction sets designed to perform the same operations on multiple data items simultaneously, a technique known as Single Instruction, Multiple Data (SIMD). This allows for increased performance in tasks involving parallel computation. SSE 4.1 is a 128-bit SIMD instruction set, while AVX introduced 256-bit SIMD, further enhancing performance. Some apps require these features to run well, like 3D, multimedia decoding or JIT (javascript) in Odyssey web browser. If not the apps may work slower or might fail. If you have encountered differently (i.e. problems, incompatibilities, faults, annoyances, environment, errors, review of setup etc) please update this information. Please bear in mind that AROS has only a few hardware driver developers, whilst Linux counts in the tens and Windows in the hundreds. [[#Laptops]] [[#Netbook]] [[#Desktop Systems]] [[#AMD Sockets]] [[#Intel Sockets]] [[#Recommended hardware (32-bit)]] [[#Recommended hardware (64-bit)]] === Laptops === [[#top|...to the top]] * 2006/2007 Dell Latitude D-series laptops - business class machines, good support in Aros, easy to replace wifi card * 2006 some [https://www.techradar.com/reviews/pc-mac/laptops-portable-pcs/laptops-and-netbooks/toshiba-satellite-pro-a200-28550/review Satellite Pro A200] * 2008 For the tiny carry anywhere, the early run of Acer Aspire netbooks Rough estimate from taking a random laptop notebook what you can expect from a Native install of AROS {| class="wikitable sortable" width="100%" ! width="10%" |Date ! width="5%" |Overall ! width="5%" |Gfx VESA ! width="5%" |Gfx 2D Acceleration ! width="10%" |Gfx 3D Acceleration ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="10%" |Wireless ! width="20%" |Comments |- | Before 2002 || Poor to OK || VESA 90% || 2D 10% || {{N/A}} || Audio 10% || 40% || Wired 70% || 2% || Max RAM 512MB |- | 2002-2005 || OK || VESA 95% || 2D 10% || 3D 0% || Audio 30% || 70% || Wired 50% || 10% || Max RAM 2GB (for 32bit) |- | 2005-2012 || Good || VESA 98% || 2D 60% || 3D 30% || Audio 40% || 80% || Wired 30% || 10% || Max RAM 3Gb (32bit) to 8GB (64bit) |- | 2013-2017 || OK || VESA 98% || 2D 30% || 3D 0% || Audio 30% || 60% once usb3 completed || Wired 20% || 0% || Max RAM 8GB / 16GB better to go Intel / AMD Ryzen over AMD A series |- | 2018-2024 || OK || VESA 98% || 2D 20% || 3D 0% || Audio 40% || 40% once usb3 completed || Wired 30% || 0% || Max RAM 32GB better 64bit options if has an internal dvd drive and working ethernet |- | 2025-202x || Poor || VESA 95% || 2D 0% || 3D 0% || Audio 0% || 0% || Wired 10% || 0% || Max RAM 64GB AI disruption of previous hardware |- |} 3D tests now conducted with apps found in Demos/AROS/Mesa and run at default size (may need to View As -> Show All to see them. Any laptop with Windows 7(TM) 64bit or higher install, the bios and hard drive set in uefi/gpt mode (install of AROS incompatible) Most vendor suppliers get OEM (original equipment manufacturers) to make their laptops. These brand name companies purchase their laptops from *80% ODM (Original Design Manufacturer) such as Quanta, Compal, Wistron, Inventec, Foxconn (Hon Hai), Flextronics and Asus (now Pegatron) *20% MiTAC, FIC, Arima, Uniwill, ECS, Tonfang Origin and Clevo {| class="wikitable sortable" width="100%" | <!--OK-->{{Yes|'''Works well'''}} || <!--May work-->{{Maybe|'''Works a little'''}} || <!--Not working-->{{No|'''Does not work'''}} || <!--Not applicable-->{{N/A|'''N/A not applicable'''}} |- |} ====Acer/Gateway/Emachines==== Company founded under the name of Multitech in Taiwan in 1976, renamed to Acer or Acer Group in 1987 Order of build quality (Lowest to highest) <pre > Packard Bell Aspire Extensa TimeLine Travelmate </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="2%" |Ethernet ! width="5%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Travelmate 505 506 507 508 Series || <!--Chipset-->P2 Celeron 466Mhz || <!--IDE-->{{Yes|boots}} || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA Neo Magic Magic Graph 128XD (NM2160)}} || <!--Audio-->{{No|AC97 Crystal CS}} || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->1998 minimal support but no audio etc - 506T, 506DX, 507T, 507DX, 508T |- | <!--Name-->TravelMate 340 342 343 345 347 || <!--Chipset-->ALi M1621 with piii || <!--IDE--> || <!--SATA--> || <!--Gfx-->Trident Cyber 9525 || <!--Audio-->{{No|ESS ES1969 Solo-1}} || <!--USB-->2 ALi OHCI USB 1.1 || <!--Ethernet-->a few have Intel e100 || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->2000 32bit - 340T, 341T, 342T, 342TV, 343TV, 345T, 347TV |- | <!--Name-->TravelMate 350 351 352 353 || <!--Chipset-->Ali with piii || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->Trident Cyber Blade DSTN/Ai1 || <!--Audio-->{{No|ali5451}} || <!--USB-->2 USB 1.1 Ali M5237 OHCI || <!--Ethernet-->e100 || <!--Wireless-->Acer InviLink IEEE 802.11b || <!--Test Distro--> || <!--Comments-->2001 32bit very limited support but no support for PCMCIA O2 Micro OZ6933 - 350T, 351TEV, 352TEV, 353TEV |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->TravelMate 610 series 611 612 613 614 || <!--Chipset-->815 P3 || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->Intel 82815 cgc || <!--Audio-->AC97 || <!--USB-->USB 1.1 || <!--Ethernet-->Intel e100 pro || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->2001 32bit - 610TXVi 610T 611TXV 612TX 613TXC |- | Aspire 3003LM || SIS AMD 3000 1.8GHz || {{yes}} || {{N/A}} || {{maybe|SIS AGP M760GX (VESA only)}} || {{yes|AC97 SIS codec}} || 3 USB 2.0 || {{yes|SIS900}} || {{no|Broadcom BCM4318 AirForce One 54g}} || Icaros 1.2.4 || 2003 sempron |- | Travelmate 2310 Series ZL6 || Intel Celeron M 360 1.4GHz with SiS 661MX || {{yes}} || {{N/A}} || {{maybe|SiS Mirage M661MX (VESA only)}} || {{yes|SIS SI7012 AC97 with realtek ALC203 codec speakers only}} || || {{yes|SIS900}} || {{N/A|LM version has pci card slot but no antenna}} || 2017 Icaros 2.1.1 || 2004 32bit - No USB boot option but boot from DVD - reports of wifi losing connection (isolate/remove the metallic grounding foil ends of the antennas) - 2312LM_L - |- | <!--Name-->Aspire 3000 3002LMi 3500 5000 || <!--Chipset-->AMD CPU W-with SIS M760 || <!--IDE--> || <!--SATA--> || <!--Gfx-->SIS 760 || <!--Audio-->SIS || <!--USB--> || <!--Ethernet-->SIS 900 || <!--Wireless-->{{No|Broadcom BCM4318 swap for Atheros}} || <!--Test Distro--> || <!--Comments-->2005 32bit |- | <!--Name-->Aspire 3050 5020 5050 || <!--Chipset-->AMD Single and Turion MK-36 Dual and RS480 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Use VESA - RS482M Xpress 1100 or RS485M Xpress 1150 || <!--Audio-->HD Audio Realtek ALC883 || <!--USB--> || <!--Ethernet-->8139 || <!--Wireless-->Atheros 5006G or Broadcom BCM 4318 || <!--Test Distro--> || <!--Comments-->2005 32bit MK36 gets very hot |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->TravelMate 2410 2420 2430 series || <!--Chipset-->915GM || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel Mobile 915GMS 910GML || <!--Audio-->Intel AC97 ICH6 with ALC203 codec || <!--USB-->4 USB2.0 || <!--Ethernet-->Realtek RTL-8139 || <!--Wireless-->Atheros 5005GS || <!--Test Distro--> || <!--Comments-->2005 32bit 2428AWXMi - |- | <!--Name-->Acer Aspire 3610 - WISTRON MORAR 3614WLMI || <!--Chipset-->Intel 915 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|Intel GMA 2D and 3D}} || <!--Audio-->{{yes|[http://www.amiga.org/forums/showpost.php?p=644066&postcount=13 AC97]}} || <!--USB--> || <!--Ethernet-->{{yes|RTL 8139 8139C+}} || <!--Wireless-->{{Maybe|Atheros AR5001X+, AR5BMB5 or Broadcom 4318}} || <!--Test Distro--> Icaros 1.2.4 || <!--Comments-->2005 32bit with good support [http://ubuntuforums.org/showthread.php?p=6205188#post6205188 wifi issues] |- | <!--Name-->TravelMate 2480 series 2483 WXMi (HannStar J MV4 94V) 2483NWXCi Aspire 3680, 3690 || <!--Chipset-->940GML i943 with Celeron 430 1.77GHz - 14.1" || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes| }} || <!--Gfx-->{{Yes|2D and 3D openGL 1.x - Tunnel 181 gearbox 104 scores}} || <!--Audio-->{{Yes|HD Audio with ALC883 codec playback}} || <!--USB-->{{Yes|3 USB 2.0}} || <!--Ethernet-->{{No|Marvell 88E8038 yukon sky2}} || <!--Wireless-->{{No|Atheros 5k AR5005G AR5BMB5 mini pci}} suspect laptop hardware issues || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2006 Works well shame about the internet options - noisy fan - poor battery life - no boot option for TI based mass storage sd card - Max 2GB memory - LCD Inverter Board IV12090/T-LF - |- | <!--Name-->TravelMate 2490 series 2492WXMi || <!--Chipset-->940GML || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|Intel 945 2D and 3D tunnel 164 gearbox 105}} || <!--Audio-->{{Yes|HD Audio}} || <!--USB--> || <!--Ethernet-->{{Maybe|Broadcom BCM4401}} || <!--Wireless-->{{No|Atheros AR5005GS suspect hardware issue}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2006 32bit - 15inch screen - strange curved up at ends keyboard style - overall plastic construction - Atheros AR5005G(s) - |- | <!--Name-->Gateway ML6227B MA7 || <!--Chipset-->Celeron M 520 1.6Ghz with 945GM || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Yes|945GM 2D and 3D tunnel 169 gearbox 132}} || <!--Audio-->{{No|HDA Intel with STAC9250 codec}} || <!--USB--> || <!--Ethernet-->{{No|Marvell 88E8038}} || <!--Wireless-->{{No|8187L but swap ath5k mini pcie}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2006 15.4 ultrabrite widescreen - Wifi Switch on side Fn/F2 - |- | <!--Name-->Acer Aspire 5630-6796 6288 BL50 || <!--Chipset-->T5200 T5500 Intel® Core™2 Duo T7200 T7400 T7600 || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|Intel® GMA 950 with S-Video out with 2D and 3D}} || <!--Audio-->{{Yes|HDAudio with ALC883? codec}} || <!--USB-->{{Yes|4 USB}} || <!--Ethernet-->{{yes|Broadcom BCM4401}} || <!--Wireless-->{{No|Intel 3945abg swap for Atheros 5K}} || <!--Test Distro-->Tiny AROS || <!--Comments-->2006 - 64bit 39.1 cm (15.4" 1280 x 800) - 2 DDR2-SDRAM slots max 4GB - green mobo?? - |- | <!--Name-->Acer Aspire 5633WMLI BL51 || <!--Chipset-->T5500 with Intel® 945PM/GM Express || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE mode}} || <!--Gfx-->{{Yes|Nvidia Go 7300 with 2D and 3D}} || <!--Audio-->{{Yes|HD Audio with Realtek codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{yes|Broadcom 440x}} || <!--Wireless-->{{No|Intel 3945 swap for Atheros 5k}} || <!--Test Distro-->Tiny Aros || <!--Comments-->2007 64 bit dual core2 - 15.4 WXGA screen - ddr2 max 4gb - OrbiCam no support - ENE chipset SD card - blue mobo?? - |- | <!--Name-->Acer Aspire 9410 9420 || <!--Chipset-->Intel Core Duo with 945PM Express || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes| }} || <!--Gfx-->{{Yes|2D NVIDIA GeForce Go 7300 - 128 MB VRAM G72M}} || <!--Audio-->{{Yes|Intel HD audio with codec}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{Yes|rtl8169 8111 }} || <!--Wireless-->{{No|Intel 3945ABG but could swap with atheros 5k}} || <!--Test Distro-->Icaros 2.3 || <!--Comments-->2007 32bit - 17in TFT 1,440 x 900 WXGA+ - 2 ddr2 sodimm slots max 4gb - |- | <!--Name-->eMachines E510 series KAL10 || <!--Chipset-->Intel Celeron M 560 2.13Ghz with PM965 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel x3100 || <!--Audio-->{{Yes|Intel with codec}} || <!--USB-->Intel || <!--Ethernet-->{{No|Broadcom BCM5906M}} || <!--Wireless-->{{No|Atheros G AR5BXB63 bios issue??}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2007 32bit very budget machine with InsydeH20 bios and F10 boot menu |- | <!--Name-->ACER Aspire 5920 [http://tim.id.au/laptops/acer/aspire%205920g.pdf 5920G] || <!--Chipset-->Santa Rosa Core 2 Duo T7300 T7500 later T9300 with GM965 and PM965(G) Express || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|use VESA for X3100M or 8600M GS (rev a1) 9500M GT 256MB vram (G) but some AMD/ATI RV635 M86 HD 3650}} || <!--Audio-->{{No|HD Audio with realtek alc268, [https://forums.opensuse.org/t/no-sound-on-acer-aspire-5920g/32392 ALC883] or Realtek ALC1200 / alc888s codec ICH8}} || <!--USB-->{{Yes|USB2 }} || <!--Ethernet-->{{No|Broadcom BCM5787M}} || <!--Wireless-->{{unk|Intel 3945ABG 4965 or Atheros 9k AR9285}} || <!--Test Distro-->Deadwood test iso 2023-01 2023-11 || <!--Comments-->2008 64bit boot with 'noacpi' or 'noioapic' - 15.4in 1280 x 800 pixels 16:10 - BMW Designworks ‘Gemstone’ design - over 3.0kg with options for 8-cell or 6-cell batteries - 2 SODIMM DDR2 667MT/s max 4GB - synaptics touchpad - |- | <!--Name-->Acer A0521 Ao721 || Athlon II Neo K125 + AMD M880G || {{N/A}} || {{maybe| }} || {{maybe|ATI Radeon HD 4225 (VESA only)}} || {{No|Conexant}} || {{Maybe| }} || {{no|AR8152 l1c}} || {{unk|AR9285 ath9k}} || AspireOS 1.7 || 2006 64bit possible |- | <!--Name--> Extensa 5630Z || <!--Chipset-->T6600 with Intel GL40 Express || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe|IDE mode}} || <!--Gfx--> {{Yes|Intel GMA 4500M HD (2D)}} || <!--Audio--> {{Yes|HD Audio}} || <!--USB--> {{Yes|USB 2.0}} || <!--Ethernet--> {{No|Broadcom BCM 5764M}} || <!--Wireless--> {{No|RaLink RT2860}} || <!--Test Distro--> || <!--Comments-->2008 64bit |- |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Aspire 5250 series 5253 BZ400 BZ602 || <!--Chipset-->E350 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{no|VESA 2D for AMD HD6310}} || <!--Audio-->{{yes|HDaudio for codec Conexant CX20584}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no|Atheros AR8151}} || <!--Wireless-->{{no|Atheros 9k AR5B97}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name-->Aspire V5 V5-121 V5121 AO725 One 725 || <!--Chipset-->AMD C-70 C70 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{no|VESA for AMD 6290G}} || <!--Audio-->{{no|Realtek ALC269 codec}} || <!--USB-->{{yes|2 x USB2}} || <!--Ethernet-->{{no|Broadcom}} || <!--Wireless-->{{no|Broadcom}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - |- | <!--Name-->Aspire V5-122P MS2377 || <!--Chipset-->C-70 C70 with M55, AMD A4-1250 or A6 1450 up to 1.4Ghz || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->AMD 8210 || <!--Audio-->{{unk|HDaudio with codec}} || <!--USB-->{{maybe|FCH USB EHCI OHCI}} || <!--Ethernet-->{{Maybe|rtl8169 but LAN/VGA Combo Port Cable (AK.LAVGCA 001) or MiniCP port to Acer Converter Cable (Mini CP to VGA/LAN/USB) (NP.OTH11 00C) needed}} || <!--Wireless-->{{unk|Atheros 9k AR9565}} || <!--Test Distro-->Aros One || <!--Comments-->2012 64bit but no sse4 or avx - 26w battery internal, extension possible - 11.6in 1366 x 768 ips touchscreen - 7mm hd ssd - 2gb ddr3l soldered with 1 slot free max 4GB - bios hacking needed for virtualisation - |- | <!--Name-->Packard Bell EasyNote TE69 TE69KB 522 || <!--Chipset-->slow E1-2500, E2-3800 2c2t Dual or A4-5000 4c4t Quad both soldered BGA769 (FT3) on Hudson-2 FCH || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe|Use IDE mode}} setting AHCI to IDE mode - boots if UEFI set to Legacy || <!--Gfx-->{{Maybe|VESA 2D for ATI Radeon 8120 8240, 8320, 8330 or 8280 islands}} || <!--Audio-->{{Yes|HDAudio with ALC282 0x10ec, 0x0282 codec but not HDMI}} || <!--USB-->{{Yes|Bios, Boot, set Boot mode to Legacy, nothing from USB3}} || <!--Ethernet-->{{No|Atheros AR8171 AR8175 or Broadcom BCM57780}} || <!--Wireless-->{{unk|Atheros AR9565 0x1969 0x10a1}} || <!--Test Distro-->Aspire OS Xenon and AROS One 1.6 usb || <!--Comments-->2013 64bit with sse4.1 and AVX - 15.6in washed out screen big netbook - Boots with noacpi after using F2 to enter EFI firmware and f12 boot device - 2 ddr3 sodimm slots max 16Gb - |- | <!--Name-->ASPIRE Acer Aspire ES1-520 521 522 Series N15C4 ES1-523 || <!--Chipset-->AMD AMD E1-7010, A8-7410 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{partial|VESA for RADEON R5}} || <!--Audio-->{{no|Realtek ALC 233 or CX20752 HD AUDIO CODEC}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{no|Atheros AR8151 Gigabit or Broadcom 590x}} || <!--Wireless-->{{no|Realtek RTL8187 or 8812BU}} || <!--Test Distro-->Aros One || <!--Comments-->2015 64bit with sse4.1 and AVX - 2 ddr3l slots - keyboard connected to top case - |- | <!--Name-->Acer Aspire V15 NITRO Black edition || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->GTX 860M || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2015 64bit |- | <!--Name-->Predator 15 (G9-591-) (G9-593-72VT) || <!--Chipset-->Intel i7-6700HQ || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->GTX 960M to 980M, GTX 1060 || <!--Audio-->{{unk|HDAudio with Realtek ALC255 @ Intel Sunrise Point PCH High Definition Audio Controller}} || <!--USB-->USB3 || <!--Ethernet-->{{no| }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Nitro 5 an515-42 || <!--Chipset-->Ryzen 2500u || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->AMD rx560x || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - |- | <!--Name-->aspire 3 A315-41 || <!--Chipset-->Ryzen 2500u || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->AMD Vega || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - |- | <!--Name-->swift 3 sf315-41 || <!--Chipset-->Ryzen 2500u || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->AMD Vega || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - |- | <!--Name-->Acer Aspire 3 A315-23 || <!--Chipset-->AMD Ryzen 3020e, r3 3200u || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD || <!--Audio-->{{unk|HDAudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe| }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2019 64bit - |- | <!--Name-->Aspire 3, 5 A515-44-R0ZN || <!--Chipset-->AMD Ryzen 5 4500u || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk|HDAudio with ALC codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2020 64bit - 14in or 15.6" 1080p - 19v round charging - [https://www.youtube.com/watch?v=vr0tC3QJWxk repair], 4gb soldered with 1 ddr4 sodimm slot - |- | <!--Name-->Swift 3 SF314-42 series N19C4 , Swift SF315-4 || <!--Chipset-->Ryzen 5 4500U, 7 4700U|| <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD || <!--Audio-->{{unk|HDAudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2020 64bit 1080p - small round ac 19v 3.42A or usb-c - mobo FH4FR LA-J731P - |- | <!--Name-->Acer Swift 3 SF314-43, Swift SF315-41 || <!--Chipset-->Ryzen 7 5700U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD || <!--Audio-->{{unk|HDAudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit 1080p - small round ac or usb-c - |- | <!--Name-->Aspire 5 A515-45 || <!--Chipset-->r7 5700U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->AMD || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 15.6in 1080p - asus round ac - |- | <!--Name-->Aspire 5 A515-47 || <!--Chipset-->ryzen 5 5625U, || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->AMD || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 15.6in 1080p - asus round ac - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Asus==== [[#top|...to the top]] {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Asus L8400-K Medion MD9467 || <!--Chipset-->Intel desktop 850MHz || <!--IDE--> || <!--SATA--> || <!--Gfx-->S3 Savage MX || <!--Audio-->{{No|ESS allegro 1988}} || <!--USB--> || <!--Ethernet-->Realtek 8139 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2001 32bit |- | <!--Name-->Asus L2000 L2400 L2D Series Medion 9675 || <!--Chipset-->Athlon 4 mobile || <!--IDE--> || <!--SATA--> || <!--Gfx-->use vesa sis630 || <!--Audio-->{{No|sis7018}} || <!--USB--> || <!--Ethernet-->sis900 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2002 32bit |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->x51R X51RL || <!--Chipset-->Duo T2250 T2330 with RS480 || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|use VESA RC410 [Radeon Xpress 200M]}} || <!--Audio-->{{Yes|HD with codec}} || <!--USB-->{{Maybe|boots and detects}} || <!--Ethernet-->{{Yes|RTL-8139}} || <!--Wireless-->{{No|Atheros AR5006EG AR5111 ath5k AzureWave AW-GE780 - could be ATI Chipset}} || <!--Test Distro-->Icaros 2.2, deadwood 2021, || <!--Comments-->2003 32bit 15.4 WXGA - 19v barrel - ESC boot select - F2 bios - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Asus R2H Ultra Mobile PC UMPC || <!--Chipset-->Celeron 900Mhz 910GML || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA900 || <!--Audio-->Ac97 ALC880 || <!--USB--> || <!--Ethernet-->realtek 8169 8101e || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2004 32bit [https://www.youtube.com/watch?v=Jm4fOrqyj3g boots] |- | <!--Name-->Asus A3 series A3F Ergo Ensis 211 RM || <!--Chipset-->P-M 1.6GHz to Core Duo with 950 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 945 || <!--Audio-->Ac97 ALC655 || <!--USB--> || <!--Ethernet-->Realtek 8100CL 10/100 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2004 32bit only |- | <!--Name-->Z33 || <!--Chipset-->915 || <!--IDE--> || <!--SATA--> || <!--Gfx-->915GM || <!--Audio-->HD Audio ALC880 || <!--USB--> || <!--Ethernet-->Realtek 8139 || <!--Wireless-->Intel 2915ABG || <!--Test Distro--> || <!--Comments-->2005 32bit Z33A Z33AE N5M N5A |- | Z70A Z70V Z70Va M6A z7000 z7000a || i915 + ICH6 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{yes|mobile 915GML}} || <!--Audio-->{{no|ICH6 HD Audio}} || <!--USB-->{{yes|USB2.0}} || <!--Ethernet-->{{no|Marvell 88E8001}} || {{no|Intel PRO 2200BG Fn / F2}} || Icaros 1.3 || 2005 32bit |- | [http://www.progweb.com/en/2010/09/linux-sur-un-portable-asus-a6jm/ A6jm] A6JC || 945GM || IDE || SATA || {{yes|nVidia GeForce Go 7600 G70}} || {{no|HD Audio}} || {{yes|USB}} || {{yes|RTL8111 8168B}} || {{no|Intel 3945 ABG}} || Icaros 1.2.4 || 2006 32bit only |- | <!--Name-->F3Jc || <!--Chipset-->945PM || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->G72M Quadro NVS 110M, GeForce Go 7300 || <!--Audio-->D audio || <!--USB--> || <!--Ethernet-->realtek 8169 8111 || <!--Wireless-->Intel 3945 || <!--Test Distro--> || <!--Comments-->2007 32bit - |- | <!--Name-->X50GL F5GL || <!--Chipset-->T5800 with 965 || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe}} || <!--Gfx-->{{Maybe|use VESA 2d - Nvidia 8200M G84 runs hot}} || <!--Audio-->{{No|HD Audio MCP79 with codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|MCP79}} || <!--Wireless-->{{No|Atheros AR5B91 AW-NE77}} || <!--Test Distro-->Icaros 2.2 || <!--Comments-->2008 64bit not much support no display with nouveau - 19v barrel - ddr2 max 4gb - |- | <!--Name-->ASUS G50 & G51 series G50V G50Vt G51V G51VX G51J G51Jx G50VT X1 X5 ROG || <!--Chipset-->AMD64 with MCP71 || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes}} || <!--Gfx-->nVidia GeForce 9800M GS (G94M) up to GT200 [GeForce GTX 260M] (G92M) || <!--Audio-->Nvidia HD Audio with codec || <!--USB--> || <!--Ethernet-->{{No|Atheros L1C atl1c}} || <!--Wireless-->Atheros G or Intel || <!--Test Distro-->Icaros 2.3 || <!--Comments-->2009 64bit not all GPUs are failing but a much higher % failing early, 8x00 and 9x00 G84, G86, G92, G94, and G96 series chips dying - ddr2 max 4gb - |- | <!--Name-->M50V M50 series || <!--Chipset-->Intel Core 2 Duo P8400 or T9400 with Intel PM45 ICH9 || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|BIOS set to compatibility IDE mode}} || <!--Gfx-->NVIDIA GeForce 9600M GS or 9650M GT || <!--Audio-->HDAudio with Realtek ALC663 || <!--USB-->USB2 || <!--Ethernet-->{{Yes|rtl8169 realtek 8169 8111C}} || <!--Wireless-->{{unk|Intel 5100 or Atheros AR928X}}|| <!--Test Distro-->AROS One 2.0 USB || <!--Comments-->2009 64bit - 15.40 inch 16:10, 1680 x 1050 glossy - the "Infusion" design - heavy 3kg - ddr2 ram max 4gb - |- | <!--Name-->Series F9 F9E F9dc F9f F9j F9s || <!--Chipset-->965GM || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{maybe|Vesa}} || <!--Audio-->{{yes|HD Audio ALC660 playback}} || <!--USB-->{{yes|works}} || <!--Ethernet-->{{yes|RTL8169 }} || <!--Wireless-->{{no|intel 3495 not working}} || <!--Test Distro-->Icaros 1.41 || <!--Comments-->2009 64bit - ddr2 max 4gb - |- | P52F SO006X || i3-370M || IDE || SATA || {{yes|nVidia G92 [GeForce 9800 GT] (2D)}} || {{no|Intel HD Audio}} || {{yes|2 USB2.0}} || {{no|Atheros AR8121 AR8113 AR8114 (l1e)}} || {{dunno}} || Icaros 1.3 || 2010 64bit - ddr3 slot - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Asus * X53U MB Ver K53U or K52U Asus K53U MB Ver K53U * A53U XT2 X53B MB ver: K53BY (compal) || <!--Chipset-->Slow atom like speed E-350 (2011), E-450 (2011) on AMD M780G, much slower C-50 C50 (2012), C-60 C60 on the AMD A50M dark brown plastic build || <!--IDE-->{{N/A|}} || <!--SATA-->{{yes|Set IN Bios IDE MODE}} || <!--Gfx-->{{Maybe|use VESA ATi 6310M, 6320M later 6250M or 6290M}} || <!--Audio-->{{Yes|HD audio with alc269 codec Altec Lansing® Speakers}} || <!--USB-->{{Yes|3 x USB2}} || <!--Ethernet-->{{Unk|rtl8169 with RTL8111 phy}} || <!--Wireless-->{{unk|Atheros half height ar9285}} || <!--Test Distro-->2016 Icaros 2.1.2 and 2018 AROS One 1.6 USB || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - 15.6in 1368 x 768 dull 50% srgb screen - f2 bios setup, esc boot drive - 5200 or 7800 mAh battery covers ASUS K53S K53E X54C X53S K84L X53SV X54HR K53F X53U laptops - 2 DDR3L slots max 8Gb - 19v barrel 5.5 / 2.5 mm - |- | <!--Name-->Asus K53T, Asus A53Z X53Z || <!--Chipset-->AMD A4-3305M on AMD M780G, A6-3420M dark brown plastic build || <!--IDE-->{{N/A|}} || <!--SATA-->{{yes|Set IN Bios IDE MODE}} || <!--Gfx-->{{Maybe|VESA 2D for AMD 6520G, 7670M}} || <!--Audio-->{{Yes|HD audio with codec}} || <!--USB-->{{Yes|3 x USB2}} || <!--Ethernet-->{{Yes|rtl8169 with RTL8111 phy}} || <!--Wireless-->{{No|Atheros half height}} || <!--Test Distro-->AROS One USB || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 15.6in 1368 x 768 dull 50% srgb screen - f2 bios setup, esc boot drive - 2 DDR3L slots max 8Gb - 19v barrel 5.5 / 2.5 mm - Altec Lansing® Speakers - |- | <!--Name-->X55U X401U X501U 1225B || <!--Chipset-->slow C-60 C60, C-70 C70 or E1 1200 E2 1800 || <!--IDE--> || <!--SATA--> || <!--Gfx-->6290G || <!--Audio-->{{No| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->Realtek 8111 8169 || <!--Wireless-->{{unk| Atheros AR9485}} || <!--Test Distro--> || <!--Comments-->2013 64bit does not support AVX or SSE 4.1 - 11.6" display - ram soldered - |- | <!--Name-->Asus A43TA A53TA K53TA XE2 A73T || <!--Chipset-->AMD A4-3300M, A6 3400M (laptop chip) || <!--IDE-->{{N/A|}} || <!--SATA-->{{yes|Set IN Bios IDE MODE}} || <!--Gfx-->{{Maybe|use VESA AMD Radeon HD 6520G Integrated + HD 6470M (1GB GDDR3)}} || <!--Audio-->{{yes| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Unk|}} || <!--Wireless-->{{No|Atheros}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - f2 bios setup, esc boot drive - |- | <!--Name-->X102BA || <!--Chipset-->Llano E1 1200 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes|ide bios setting}} || <!--Gfx-->Radeon HD 8180 || <!--Audio-->{{No| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->RTL8101E RTL8102E || <!--Wireless-->{{unk| Qualcomm Atheros AR9485}} || <!--Test Distro--> || <!--Comments-->2013 64bit does not support AVX or SSE 4.1 - 10.1” Touchscreen - special asus 45w ac adapter - |- | <!--Name-->K55N, K75DE || <!--Chipset-->AMD a6 4400M A8 4500M || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->AMD 7640G || <!--Audio-->HD Audio with ALC codec none through ATi Trinity HDMI || <!--USB-->{{maybe| }} || <!--Ethernet-->rtl8169 || <!--Wireless-->{{unk| Atheros AR9485}} || <!--Test Distro--> || <!--Comments-->2013 64bit does support AVX or SSE 4.1 - 17.3-inch - |- | <!--Name-->X452EA X552EA F552E || <!--Chipset-->AMD E1 2100 or A4 5000M A8 4500M A10 4600M with A || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA for AMD ATI Sun XT Radeon HD 8330 8670A 8670M 8690M}} || <!--Audio-->{{Yes|AMD FCH Azalia rev 02 with ALC898 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{{Yes|Realtek RTL8111 8168 8411}} || <!--Wireless-->{{unk|Atheros AR9485}} || <!--Test Distro-->2016 Icaros 2.1 || <!--Comments-->2013 64bit may support avx kabini trinity - |- | <!--Name-->Asus ROG G751GY || <!--Chipset-->Intel i7-4720HQ || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->GTX 980M || <!--Audio-->HDAudio || <!--USB-->USB3 || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2014 64bit - |- | <!--Name-->Asus ROG G752VY || <!--Chipset-->Intel i7-6700HQ || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->GTX 980M || <!--Audio-->HDAudio || <!--USB-->USB3 || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name-->Asus X555Y || <!--Chipset-->AMD A6-7210 A8-7410 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|2.5" and mSATA form factors using SATA Rev 3.0 interface }} || <!--Gfx-->{{Maybe|VESA 2D for AMD R5}} || <!--Audio-->{{unk|HD Audio codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{Maybe|rtl8169 Realtek}} || <!--Wireless-->{{no| }}Realtek || <!--Test Distro--> || <!--Comments-->2015 64bit does support AVX or SSE 4.1 - 4gb soldered with 1 ddr3 slot - silver-colored plastic - internal battery - |- | <!--Name-->Asus X555B X555DG X555S X555U X555YI X555LAB || <!--Chipset-->Intel Core i5-4210U to || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|2.5" and mSATA form factors using SATA Rev 3.0 interface }} || <!--Gfx-->{{Maybe|VESA 2D for Intel}} || <!--Audio-->{{No|HDAudio with coxenant and realtek alc codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{Maybe|Realtek}} || <!--Wireless-->{{no| }}Realtek || <!--Test Distro--> || <!--Comments-->2015 64bit does support AVX or SSE 4.1 - 4gb soldered with 1 ddr3 slot - silver-colored plastic - internal battery - |- | <!--Name-->Asus X555D || <!--Chipset-->AMD A10-8700P || <!--IDE-->{{N/A}} || <!--SATA-->{{unk|2.5" and mSATA form factors using SATA Rev 3.0 interface }} || <!--Gfx-->{{Maybe|VESA 2D for AMD R6}} || <!--Audio-->{{unk|HD Audio codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek}} || <!--Wireless-->{{No|Realtek}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 15.6in 1366 x 768 - 4gb soldered with 1 ddr3 slot - silver-coloured plastic - internal battery - keyboard swap problematic - |- | <!--Name-->ASUS X555Q || <!--Chipset-->AMD® Bristol Ridge A10-9600P 7th Gen, A12-9720p || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|2.5" and mSATA form factors using SATA Rev 3.0 interface}} || <!--Gfx-->{{Maybe|R5 + Radeon™ R6 M435DX Dual Graphics with VRAM GCN 3}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no|Realtek 8821AE}} || <!--Test Distro--> || <!--Comments-->2017 64bit - FHD 15.6 1920x1080 - 37W battery internal - 4gb soldered with 1 ddr3 slot - internal battery - |- | <!--Name-->ASUS M509ba || <!--Chipset-->AMD A9-9425 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|2.5" and mSATA form factors using SATA Rev 3.0 interface}} || <!--Gfx-->{{Maybe|Vesa 2d for RADEON R5}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2020 64bit - 15.6in 1366 x 768 - 1 ddr4 sodimm slot max 16Gb - 19VDC 2.37A Max 45W 4.0mm x 1.35mm - keyboard swap problematic - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->ExpertBook P1410, ASUS ExpertBook P1 P1510CD, Expertbook Y1511CD || <!--Chipset-->Ryzen 3 3200U, Ryzen 5 3500U || <!--IDE-->{{N/A}} || <!--SATA-->Nvme || <!--Gfx-->{{Maybe|Vesa 2d for AMD}} || <!--Audio-->{{unk|HDaudio with codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2019 64bit 14in or 15.6in 768p to 1080p - keyboard swap problematic - 19V 3.42A asus barrel connector 4.0MM X 1.35MM 4phi - |- | <!--Name-->ASUSTeK ASUS EXPERTBOOK L1 L1400CDA, L1500CDA - 19v 3.42a 4.5phi Barrel with centre pin Outer 4.5mm Inner 3mm asus special untested EXA1203XH, EXA1203YH, EXA1208UH, PA-1650-30, PA-1650-78, PA-1650-93, ADP-65GD B, ADP-65DW B (Euro) || <!--Chipset-->'''tested''' Ryzen 5 3500U - '''untested''' Ryzen 3 3200U, 3250U || <!--IDE-->{{N/A}} || <!--SATA-->{{no|1 Nvme m.2 slot will not boot with sata3 m.2, optional 1 sata hdd with ribbon cable, no dvd drive}} || <!--Gfx-->{{Maybe|Vesa 2d for AMD vega 3, 8}} || <!--Audio-->{{unk|HDaudio 0x15de 0x15e3 with ALC256 codec 0x10ec 0x0256}} || <!--USB-->{{maybe|USB3 1 usb-c and 3 usb-a }} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111HSH-CG }} || <!--Wireless-->{{No| }} || <!--Test Distro-->3500U with AROS One 64bit 1.2 usb installed to m.2 sata on another machine || <!--Comments-->2019 64bit 14in or 15.6in 1080p - keyboard swap problematic - up to 8Gb ddr4 sodimm soldered on board and 1 slot - micro sd card slot on some models - 42Whr B31N1915 C31N1915 C31N2204 - hold down F2 and press power for bios setup - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ==== Dell ==== [[#top|...to the top]] Order of build quality (Lowest to highest) <pre > Studio Inspiron Vostro XPS Alienware Precision Latitude </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="10%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="5%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Latitude CP 233GT, CPi d233xt d266xt D300XT a366xt, CPt S400GT S500GT S550GT S600GT S700ST, CPt C333GT C400GT || <!--Chipset-->Neo Magic || <!--IDE--> || <!--SATA--> || <!--Gfx-->Use VESA - Neo magic Magic Media 2160 2360 256ZX || <!--Audio-->{{No|crystal pnp 4237b or magic media 256zx sound nm2360}} || <!--USB-->USB 1.1 || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->1998 32bit Low-Density 16-chip 144p 144-pin 32Mx64 3.3V SODIMM - |- | <!--Name-->Dell Latitude CPx H450GT H500GT H Series, CPt V433GT V466GT V600, Inspiron 5000 || <!--Chipset-->Intel 440BX with Pentium 3M (CPx) or Celeron (CPt) || <!--IDE-->{{{Yes| }} || <!--SATA-->{{N/A| }} || <!--Gfx-->{{Maybe|Use Vesa - ATi Rage Pro Mobility M1}} || <!--Audio-->{{No|ESS ES1978 Maestro 2E Canyon 3D}} || <!--USB-->{{Yes|1 slot 1.1 only}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A| }} || <!--Test Distro-->NB May 2013 || <!--Comments-->1998 32bit - 3 pin PA-6 PA6 power adapter plug - CDROM DVD Cxxx family media bay accessories untested |- | <!--Name-->Latitude C500 C600 (Quanta TM6) Inspiron 4000 7500, CPx J Series || <!--Chipset-->440BX ZX/DX || <!--IDE-->{{yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{partial|ATI Rage 128Pro Mobility M3 (VESA only)}} || <!--Audio-->{{no|ES1983S Maestro 3i}} || <!--USB-->{{yes|USB 1.1 only}} || <!--Ethernet-->{{N/A|some models had mini pci e100}}|| <!--Wireless-->{{N/A|a few came with internal antenna wiring}} || <!--Test Distro--> || <!--Opinion-->1999 square 3 pin charger PA9 PA-9 - C/Dock II untested - C/Port untested - Parallel to Floppy cable untested - CPx J600GT J650GT J700GT J750GT J800GT J850GT |- | <!--Name-->Latitude C510 C610 Insprion 4100 PP01L 2600 || <!--Chipset-->i830 and 1GHz+ P3-M || <!--IDE-->{{yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{partial|use VESA - ATI Radeon Mobility M6}} || <!--Audio-->{{No|AC97 CS4205}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{yes|3Com Etherlink}} || <!--Wireless-->{{Maybe|internal antenna wiring for an Atheros mini pci card}} || <!--Test Distro--> || <!--Opinion-->2000 poor build quality - hard to find in good working order |- | <!--Name-->Latitude C400 || <!--Chipset-->Intel 830 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA Intel 830 CGC}} || <!--Audio-->{{No|ac97 Crystal 4205}} || <!--USB--> || <!--Ethernet-->{{Yes|3Com 3c905C TX/TX-M}} || <!--Wireless-->{{N/A| }} || <!--Test Distro--> || <!--Comments-->2000 Slim for the time - no media bays |- | <!--Name-->Latitude C640 (Quanta TM8) C840 Inspiron 8k2 8200 i8200 precision m50 || <!--Chipset-->P4M with 845EP || <!--IDE--> || <!--SATA--> || <!--Gfx-->use VESA if ATi - use nouveau if 64mb Nvidia Gforce 4 440 Go || <!--Audio-->AC97 CS4205 || <!--USB--> || <!--Ethernet-->3com 905c || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2001 C640 had one fan so was noisy and hot - C840 had 2 fans and ran slightly cooler but fan noise louder |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | Latitude D400 || P-M 82845 || {{yes|82801 ide}} || {{N/A}} || {{partial|VESA only}} || {{yes|AC97 Audio playback only}} || {{maybe|USB 2.0}} || {{maybe|PRO 100 VM (KM)}} || {{no|BCM4318 AirForce one 54g replace with atheros 5k mini pci}} || <!--Test Distro--> Icaros 1.2.4 || 2003 32bit might boot from USB stick but won't boot from USB-DVD - no sd card slot - power plug style - |- | Latitude D500 / D505 PP10L, Inspiron 510m || 855GME * revA00 * revA03 * revA06 | {{yes|IDE but needs the Dell adapter}} || {{N/A}} || {{partial|855GM Gfx (VESA only)}} || {{Yes|Intel AC97 with IDT STAC 9750 codec playback head phones only}} || {{maybe| }} || {{yes|Intel PRO 100 VE}} || {{no|Broadcom BCM4306 but exchange with atheros g in panel on laptop bottom}} || <!--Test Distro-->2016 Icaros 2.1.1 || 2003 - 14 / 15 inch XGA 4:3 screen - plastic build - no sd card slot - boots from bay optical drive - not powering on/off with ac adapter is a [http://www.geekzone.co.nz/forums.asp?forumid=37&topicid=30585 mobo fault of PC13 SMT 1206 ceramic cap hot] suggest [http://www.die4laser.com/D505fix/ 0.1uF 50V instead] - pc2700 333Mhz ram 1Gb max - |- | Latitude D505 (some) || VIA VT8237 VX700 || {{yes|IDE}} || || {{partial|VESA 2d on ATI RV350 Radeon 9550}} || {{no|VIA AC97 with codec}} || {{maybe|VIA USB glitchy}} || {{yes|VIA VT6102 Rhine-II}} || {{no|Intel 2200g Calexico2}} || <!--Test Distro--> || 2003 32bit little support - diagnostics pressing holding the Fn key, press the Power ON button (battery removed). Check the LEDs pattern - cmos battery behind flap in laptop battery slot - |- | <!--Name-->Inspiron 1000 || <!--Chipset-->SIS || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->{{maybe|use VESA SIS}} || <!--Audio-->{{Yes|AC97 SIS with AD1981B codec playback}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Yes|SIS 900 but}} || <!--Wireless-->{{N/A}} || <!--Test Distro-->2016 Icaros 2.1 || <!--Comments-->2004 32bit [https://forum.level1techs.com/t/my-time-with-icaros-desktop-and-what-i-am-doing-as-a-dev-contributor-also-some-other-shit/113358 aremis using it] |- | <!--Name-->Inspiron 1100 PP07L || <!--Chipset-->845 || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|use VESA Intel 845G}} || <!--Audio-->{{Yes|AC'97 playback}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Maybe|Broadcom 4401}} || <!--Wireless--> || <!--Test Distro-->Icaros 1.5 || <!--Comments-->2004 |- | <!--Name-->Inspiron 8500 5150 || <!--Chipset-->P4 855GM || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|Nvidia 5200 Go - VESA if intel gfx}} || <!--Audio-->{{Yes|MCP AC97 with SigmaTel 9750}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Yes|Broadcom 440x}} || <!--Wireless-->{{No|Broadcom 4306 rev 02 use Atheros Mini PCI}} || <!--Test Distro-->Icaros 2.3 || <!--Comments-->2004 32bit P4 runs well but hot |- | Latitude X300 PP04S small, slim and light case || 855GME * revA00 Intel ULV 1.2 Ghz * revA01 Intel ULV 1.4Ghz | {{yes|IDE internal and will boot cd/dvd through dock PR04S}} || {{N/A}} || {{partial|855GM Gfx (VESA only)}} || {{Yes|Intel AC97 with STAC 97xx codec but no audio out of the dock}} || {{maybe|works but dock usb ports and usb DVD PD01S not detected}} || {{No|Broadcom BCM5705M gigabit}} || {{no|Broadcom BCM4306 later intel - replace with atheros in the underside}} || <!--Test Distro-->2016 Icaros 2.1.1, 2020 AROS One 1.6 usb, || 2003 12.1" 1024 x 768 - 19.5v PA-10 or PA-12 dell - ACPI works but bad s3 ram suspend sleep - no sd card boot - 1Gb max sodimm ddr 2700 |- | <!--Name-->Latitude D600 (Quanta JM2) PP05L - 600m || <!--Chipset-->82855 PM i855 * reva00 * revA01 * revA02 * revA03 * revA04 | <!--IDE--> {{yes}} || <!--SATA--> {{N/A}} || <!--Gfx-->{{Maybe|Use VESA - ATI Radeon RV250 Mobility FireGL 9000}} || <!--Audio-->{{Yes|AC97 - STAC 9750}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|Broadcom BCM5705}} || <!--Wireless-->{{no|Intel 2100 or Broadcom BCM4306 - swap for Atheros panel in base}} || <!--Test Distro-->2011 Icaros 1.3 and [http://www.amiga.org/forums/archive/index.php/t-62187.html 1.4.1 and 2016 2.1.1] || <!--Opinion-->2003 32bit 14inch using pc2100 memory with Caps light blinking is usually a memory error - Dell D505 D600 power up pressing the case docking port - |- | <!--Name-->Latitude D600 (Quanta JM2) || <!--Chipset-->82855 PM i855 || <!--IDE--> {{yes}} || <!--SATA--> {{N/A}} || <!--Gfx-->{{Yes|2D only vidia NV28 GeForce4 Ti 4200 Go 5200 Go 5650 Go}} || <!--Audio-->{{Yes|AC97 - STAC 9750}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|Broadcom BCM5705}} || <!--Wireless-->{{no|Broadcom BCM4306 mini pci - swap for Atheros}} || <!--Test Distro--> Icaros 1.3 and [http://www.amiga.org/forums/archive/index.php/t-62187.html 1.4.1] || <!--Opinion-->2003 32bit 14" - solder joints on the bios chip (press down f7/f8 keys) - RAM clean with eraser - memory cover plate maybe apply some pressure - |- | <!--Name-->D800 (Compal LA-1901) || <!--Chipset-->Intel 855 || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio-->AC97 || <!--USB-->{{maybe| }} || <!--Ethernet-->Broadcom 570x || <!--Wireless-->Broadcom 4309 || <!--Test Distro--> || <!--Comments-->2004 32bit - trackpoint type pointing device - |- | <!--Name-->D800 || <!--Chipset-->Intel 855 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{No|Nvidia }} || <!--Audio-->AC97 || <!--USB-->{{maybe| }} || <!--Ethernet-->Broadcom 570x || <!--Wireless-->Broadcom 4309 || <!--Test Distro--> || <!--Comments-->2004 32bit 15inch 39cm |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Inspiron 1200 2200 PP10S Latitude 110L m350 1.3Ghz || <!--Chipset-->Intel 915GM || <!--IDE--> {{yes|UDMA boots cd or DVD and installs to HDisk}} || <!--SATA--> {{N/A}}|| <!--Gfx-->{{yes|Intel GMA900 (2D and 3D openGL 1.x) Gearbox 56}} || <!--Audio-->{{yes|Intel AC97 playback only}} || <!--USB-->{{maybe|USB 2.0}} || <!--Ethernet-->{{yes|Intel PRO 100 VE}} || <!--Wireless-->{{no|BroadCom BCM4318 - swap for Atheros mini PCI in base panel}} || <!--Test Distro-->Icaros 1.4.5 || <!--Comments-->2005 single core 32bit 14" 4:3 1024 768 XGA screen - heavy 6 lbs - PA16 barrel 19V 3.16A AC adapter - battery life 4cell 29WHr lasts 2 hours - 256mb soldered with 1 ddr pc2100 sodimm 1gb max - |- | <!--Name-->Inspiron 1300 business B130 home PP21L Latitude 120L B120 by Compal - Inspiron 630m || <!--Chipset-->Intel Celeron M360 1.4GHz, M370 1.50 GHz, M380 1.73GHz || <!--IDE-->{{Yes|boots cd or DVD and installs to HDisk}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|GMA 915 2D and 3D openGL 1.x tunnel 172 gearbox 70}} || <!--Audio-->{{Yes|HD Audio playback ear phones only}} || <!--USB-->{{maybe|works but waiting boot fail with AROS One usb version}} || <!--Ethernet-->{{Yes|Broadcom 440x}} || <!--Wireless-->{{No|intel 2200 or BCM4318 swap for Atheros mini pci underside - one antenna lead for main wifi}} || <!--Test Distro-->2016 Icaros 2.1.2, 2020 AROS One 1.6 usb, || <!--Comments-->2005 32bit single core - 14.1″ XGA 4:3 or 15.4" WXGA wide 1280 x 800 matte - ddr2 sodimm ram 2gb max - PA-16 19v psu tip 7.4mm * 5mm - f10 boot select f1 f2 bios |- | Latitude X1 PP05S || PP-M GMA915 rev A00 1.1GHz non-pae || {{yes|ide 1.8in zif/ce under keyboard}} || {{N/A}} || {{Maybe|Vesa for Intel 915GM}} || {{yes|AC97 6.6 playback only with STAC codec}} || {{maybe|USB 2.0 but partial boot to blank screen}} || {{No|Broadcom 5751}} || {{no|Intel 2200BG - swap for Atheros mini pci under keyboard palm rest - disassembly of all laptop}} || <!--Test Distro-->Icaros 2.3 dvd iso image virtualbox'd onto usb, Aros One 1.5 and 1.8 usb (2022) || 2005 32bit 12.1" 4:3 1024 x 768 - sd slot not bootable - 256mb soldered to board and 1 sodimm max 1GB ddr2 under keyboard - F12 bios boot F2 - pa-17 pa17 19v octagonal psu port |- | Latitude D410 PP06S *rev A00 *A01, A02 *A03 || GMA915 1.6GHz Pentium® M 730, 1.7GHz, 750 1.86GHz & 760 2.0GHz, 770 2.13GHz || {{yes|caddy and adapter needed 2.5" - remove hdd and write}} || {{N/A}} || {{Yes|Intel 915GM 2D and 3D OpenGL 1.3 tunnel 170 and gearbox 75}} || {{yes|AC97 playback only with STAC 9751 codec}} || {{maybe|works but will not boot from USB-DVD or AROS One 1.5 usb version}} || {{No|Broadcom 5751}} || {{no|Intel 2915ABG or later 2200BG - swap for Atheros mini pci under keyboard}} || <!--Test Distro-->2015 Icaros 1.4, 2016 2.1.1 and AROS One 1.5 usb, || 2005 32bit 12.1" 4:3 1024 x 768 - no sd card slot - PR06S dock base |- | <!--Name-->Latitude D510 (Quanta DM1) || <!--Chipset-->915GM socket 479 || <!--IDE--> {{N/A}} || <!--SATA--> {{partial|IDE mode}}|| <!--Gfx-->{{yes|Intel GMA 915 2D and 3D}} || <!--Audio-->{{Yes|AC97 STAC 975x}} || <!--USB--> {{maybe|USB 2.0}} || <!--Ethernet-->{{no|Broadcom BCM5751}} || <!--Wireless-->{{no|Intel PRO Wireless 2200BG swap Atheros mini pci in base}} || <!--Test Distro--> || <!--Comments-->2005 14.1" 32bit single core Intel Celeron M 1.6GHz Pentium M 730 1.73Ghz - squarish 3:2 - issues with 3rd party battery 4 quick flashes of red led with 1 final green |- | <!--Name-->Latitude D610 (Quanta JM5B) PP11L || <!--Chipset-->910GML 915GM with mobile 1.6 to 2.26ghz * Rev A0x * Rev A0x * Rev A07 1.73Ghz | <!--IDE--> {{N/A}} || <!--SATA--> {{partial|IDE mode}}|| <!--Gfx-->{{yes|Intel GMA 915 2D and 3D tunnel 174 gearbox 74}} || <!--Audio-->{{yes|Intel AC97 speaker head phones playback only with stac codec}} || <!--USB--> {{maybe|USB 2.0}} || <!--Ethernet-->{{no|Broadcom BCM5751}} || <!--Wireless-->{{no|Intel 2200BG or Broadcom mini pci under keyboard, swap wifi card for atheros 5k}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2005 32bit 14" 1024 x 768 - very noisy clicky trackpad buttons - one dimm slot under keyboard and other in underside 2GB 533Mhz 667Mhz DDR2 max - |- | <!--Name-->Latitude D610 (Quanta JM5B) 0C4717 REV A05, 0K3879 REV.A00 || <!--Chipset-->915GM || <!--IDE--> {{N/A}} || <!--SATA--> {{partial|IDE mode}}|| <!--Gfx-->{{Maybe|Use VESA 2d - Ati X300 no radeon 2d}} || <!--Audio-->{{yes|Intel AC97}} || <!--USB--> {{maybe|USB 2.0}} || <!--Ethernet-->{{no|Broadcom NetXtreme 57xx Gigabit replace with Atheros 5k}} || <!--Wireless-->{{no|Intel PRO Wireless 2200BG mini pci use Atheros 5k}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2005 32bit 14" 1024 x 768 - very noisy clicky trackpad buttons - 19.5v psu |- | <!--Name-->Latitude D810 (Quanta ) || <!--Chipset-->915GM || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|Use VESA 2d - Ati X300 RV370 M22 later x600}} || <!--Audio-->{{yes|Intel AC97 stereo playback only idt 9751 codec}} || <!--USB--> {{maybe|USB 2.0 but no boot from usb on 1.5}} || <!--Ethernet-->{{no|Broadcom NetXtreme 57xx Gigabit}} || <!--Wireless-->{{no|Intel PRO Wireless 2200BG mini pci replace with Atheros 5k}} || <!--Test Distro-->2017 Icaros 2.1.1, aros one 1.5 || <!--Comments-->2005 32bit 15.4" F12 one time boot menu - 19.5v 90w psu ideal - battery not same as later dx20 ones - |- | <!--Name-->Inspiron 6000 6400, E1505 PP20L *A00 Pentium M *A0? Core Duo || <!--Chipset-->GM945 with PM 1.73Ghz, T2050 or T2060 || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe|}} || <!--Gfx-->{{Maybe|vesa 2d - Ati 9700, x1300 RV515 M52, x1400 or nvidia go 7300 on mxm board}} || <!--Audio-->{{yes|HD Audio IDT 9200}} || <!--USB-->{{Yes|usb boot }} || <!--Ethernet-->{{Yes|Broadcom BCM4401 B0}} || <!--Wireless-->{{No|Intel 2200 3945 - swap for Atheros 5k}} || <!--Test Distro-->2016 Icaros 2.1, AROS One 1.6 || <!--Comments-->2006 mostly 32bit - 15.4 inch glossy - 2 ddr2 sodimm slots - broadcom bcm92045 bluetooth detected but no support - 19.5v dell psu socket - f2 bios setup, f12 boot order - |- | <!--Name-->Inspirion E1705 9200 9300 9400 PP12L PP14L || <!--Chipset-->945GM || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->proprietary Dell card/socket format Nvidia 6800, ati X300 or nVidia 7900GS gpu 3d corrupt || <!--Audio-->{{Maybe| }} || <!--USB-->{{Maybe| }} || <!--Ethernet-->{{Maybe|Broadcom BCM4401}} || <!--Wireless-->Intel 3945 swap with Atheros 5k mini pcie || <!--Test Distro--> || <!--Comments-->2006 [http://amigaworld.net/modules/news/article.php?mode=flat&order=0&item_id=6481 increasing vertical lines issues] 32bit - |- | <!--Name-->Studio XPS M1210 || <!--Chipset-->GM945 with Core Duo to intel C2D T5500, T7400 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->nVidia G72M 7300 7400m || <!--Audio-->HD Audio IDT 92xx || <!--USB-->{{Maybe| }} || <!--Ethernet-->{{Maybe|Broadcom BCM4401 B0}} || <!--Wireless-->{{No|Broadcom BCM4311 - swap for Atheros 5k mini pci-e}} || <!--Test Distro--> || <!--Comments-->2006 64bit - 2 ddr2 slots max 4Gb - |- | <!--Name-->Inspiron 1501 PP23LA Latitude 131L || <!--Chipset-->AMD Sempron 1.8GHz Turion MK-36 or X2 1.6Ghz TL-50 or TL-56 on ATI RS480 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|Use VESA 2d - ATI 1150 (x300) RS482M Mobility Radeon Xpress 200}} || <!--Audio-->{{Yes|HD audio with stac 92xx codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Maybe|Broadcom bcm 4401}} || <!--Wireless-->{{No|Broadcom bcm4311 replace with Atheros 5k}} || <!--Test Distro-->Icaros 1.5 || <!--Comments-->2006 64bit 15.4 inch matt 16:10 1280x800 WXGA - |- | <!--Name-->Inspiron 6400 (Quanta FM1) *A00 Pentium M *A0? Core Duo *A08 Core2 Duo || <!--Chipset-->GM945 with BGA479 (socket M) T2050 1.6Ghz, T2060 1.60Ghz, T2080 1.73Ghz much later T5500 1.66Ghz || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Yes|GMA 2D and 3D}} || <!--Audio-->{{Yes|HD Audio with IDT 92xx codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Yes|Broadcom BCM4401 B0}} || <!--Wireless-->{{No|Broadcom BCM4311 swap for Atheros 5k mini pci-e under keyboard}} || <!--Test Distro-->deadwood 2019-04-16 iso || <!--Comments-->2006 mostly 32bit - 15.4" glossy - sd card - front multimedia keys - dvd rw - generic dell keyboard - coin cr2032 bios battery under keyboard - |- | <!--Name-->Inspiron 640m PP19L XPS M140 e1405 || <!--Chipset-->Core Solo T2050, T2300 Duo 1.83GHz T2400 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel GMA 950 || <!--Audio-->HD Audio IDT || <!--USB--> || <!--Ethernet-->Broadcom BCM4401-B0 100Base || <!--Wireless-->{{No|Intel 3945 or Broadcom 43xx, swap for Atheros 5k - Wireless Internet ON or OFF press the Function key + F2}} || <!--Test Distro--> || <!--Comments-->2006 32 bit - 12.1 LCD CCFL WXGA 1280x800 up to 14.1 inch 16:10 1440x900 pixel, WXGA+ UltraSharp - supports also SSE3 on duos - |- | <!--Name-->Latitude D420 (Compal LA-3071P) PP09S || <!--Chipset-->945 * revA00 Solo 1.2Ghz ULV U1400 * revA01 Duo 1.06Ghz u2500 * revA02 Duo 1.2Ghz | <!--IDE-->{{yes|ZIF/CE 1.8" slow under battery, ribbon cable}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{yes|Intel GMA950 - 2D and 3D opengl tunnel 138 gearbox 103}} || <!--Audio-->{{yes|HD Audio with STAC 92xx playback speakers head phones only)}} || <!--USB-->{{yes|2 and external usb optical drive works}} || <!--Ethernet-->{{no|Broadcom BCM5752}} || <!--Wireless-->{{No|Intel 3945 mini pcie - swap Atheros 5k in base panel}} || <!--Test Distro-->Icaros Desktop 1.4 || <!--Opinion-->2006 32bit only - 12.1" 1280x800 - PR09S dock base rev02 DVD-RW usb boots - 1GB DDR2 2Rx16 max in base panel - f2 setup f5 diagnostics f12 boot list - |- | <!--Name-->Latitude D520 PP17L || <!--Chipset--> * 64bit rev A01, A02 945GM Core2 Duo 1.83Ghz to 2.3Ghz * 32bit rev A00, A01 940GML Solo later Duo T2400 | <!--IDE-->{{yes| Philips SDR089, Philips CDD5263, TEAC DW224EV, Optiarc AD-5540A, HL-DL-ST GSAT21N, TSSTcorp TS-L632D}} || {{Yes|bios sata set to ide mode}} || {{Yes|Intel GMA 900 series 2D and OpenGL1 3D tunnel 210 gearbox 153 teapot 27}} || {{Yes|HD audio with STAC 9200 codec}} || {{Yes|Boots and detects USB2.0}} || {{Yes|Broadcom 4400}} || {{No|Broadcom BCM4312 BCM4321 Dell 1390 / 1490 mini pcie - easy to replace with atheros 5k in base panel}} || <!--Test Distro-->Icaros 1.4 and 2.2 and both AROS One 1.8 and AROS One x64 1.1 USB boot || 2006 mostly 64bit 4:3 aspect ratio 14.1 (XGA 1024x768) or later 15 inches (XGA+ 1400 by 1050) - F2 enter bios F12 choose boot - 19.5v dell tip pa-12 charger - bios coin cell cr2032 battery socketed in base panel - |- | <!--Name-->Latitude D620 (Compal LA-2792) PP18L || <!--Chipset-->945GMS * rev A00 all Core Duo's 32 bit * rev A0x all Core 2 Duo's 64 bit | <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Intel GMA 950 (2D and 3D tunnel gearbox opengl1 || <!--Audio-->{{yes|HD Audio playback}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no|Broadcom BCM5752}} || <!--Wireless-->{{no|Intel 3945 mini pcie swap with Atheros 5k}} || <!--Test Distro-->AspireOS Xenon || <!--Opinion-->2006 64bit AROS capable with later revisions - 14" 1280 x 800 |- | <!--Name-->Latitude D620 || <!--Chipset-->Intel i945 * revA00 all Core Duo's 32 bit * revA01 all Core 2 Duo's 64 bit | <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Nvidia 7300, 7600 NVS 110M G72 || <!--Audio-->{{dunno|HD Audio with STAC 9200 codec}} || <!--USB--> || <!--Ethernet-->{{No|Broadcom BCM5752}} || <!--Wireless--> {{dunno}} || <!--Test Distro--> || <!--Opinion-->2007 1440x900 screen - LA-2792P Rev.2.0 - DT785 UC218 Fan/ Heatsink (64bit) - |- | <!--Name-->Latitude D820 (Quanta JM6) || <!--Chipset-->945GMS 940GML * rev A00 * rev A01 | <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Yes|Intel GMA 2D and 3D tunnel 195 - 100? gearbox 156}} || <!--Audio-->{{Yes|HD Audio with STAC 9200 playback}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Broadcom BCM5752}} || <!--Wireless-->{{No|BCM4310 replace with mini pcie atheros 5k}} || <!--Test Distro-->2016 Icaros 2.1.2 || <!--Opinion-->2007 widescreen 15 inch 1280 x 800 matte - - |- | <!--Name-->Latitude D820 (Quanta JM) || <!--Chipset-->945GMS 940GML * revA00 * revA01 | <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|Nvidia NVS 110M 120M G72}} || <!--Audio-->{{Yes|HD Audio STAC 9200}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Broadcom BCM5752}} || <!--Wireless-->{{No|BCM4310 swap with Atheros 5k mini pcie}} || <!--Test Distro--> || <!--Opinion-->2007 64bit 15.4 1650x1050 WXGA or WSXGA+ or 1920x1200 WUXGA - |- | <!--Name-->Dell Latitude D531 15" || <!--Chipset-->AMD Turion X2 TL56 or TL60 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Maybe|Use VESA - ATi xpress X1270}} || <!--Audio-->HD Audio with IDT codec || <!--USB-->{{Maybe| }} || <!--Ethernet-->{{No|Broadcom 57xx}} || <!--Wireless-->Intel 3945 or Dell Wireless 1390, 1505 or BCM4311 mini pcie || <!--Test Distro--> || <!--Comments-->2007 64bit possible - no trackpoint - fails and goes wrong often - |- | <!--Name-->Latitude D430 PP09S || <!--Chipset-->945 with Core2 Duo C2D U7500 1.06GHz U7600 1.2GHz U7700 1.33GHz * rev A00 * rev A01 * rev A02 | <!--IDE-->ZIF PATA IDE 1.8inch under battery and ribbon cable - slow use USB instead || <!--SATA-->{{N/A}} || <!--Gfx-->{{yes|945GML 2D and 3D opengl 1.x 171 tunnel 105 gearbox}} || <!--Audio-->{{yes|STAC 92xx HD Audio speaker and ear phone - mono speaker}} || <!--USB-->{{yes|3 }} || <!--Ethernet-->{{no|Broadcom BCM5752}} || <!--Wireless-->{{no|Intel 4965 AGN or 3945 ABG mini pci-e underside with Atheros 5k mini pci-e}} || <!--Test Distro-->Aspire 1.8 || <!--Comments-->2007 64bit capable - sd card not supported - 19.5v PA12 power adapter - 12.1" 1280x800 matte - f2 setup f5 diagnostics f12 boot list - |- | <!--Name-->Latitude D530 || <!--Chipset-->GM965 + ICH8 || <!--IDE-->{{N/A}} || <!--SATA-->{{partial|IDE mode}}|| <!--Gfx-->{{partial|nVidia Quadro NVS 135M 2D 3d glitches G86}} || <!--Audio-->{{partial|HD Audio with STAC 9205 head phones only}} || <!--USB-->{{yes|USB 2.0}}|| <!--Ethernet-->{{no|Broadcom BCM5755M}} || <!--Wireless-->{{no|Intel PRO Wireless 3945ABG swap with Atheros 5k}} || <!--Test Distro-->Icaros 1.4.5 || <!--Comments-->2007 [http://amigaworld.net/modules/news/article.php?mode=flat&order=0&item_id=6481 ] cool air intake from underneath needed with pa-10 or pa-3e 90w psu required - standard 4:3 ratio aspect screen - |- | <!--Name-->Latitude D630 (Compal LA-3301P) PP18L || <!--Chipset-->GM965 + ICH8 T7250 2.0Ghz T7300 * revA00 * revA01 | <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{yes|Intel GMA X3100 (2D only, no external monitor)}} || <!--Audio-->{{yes|HD Audio STAC 9205 but speaker and head phones}} || <!--USB-->{{yes|4 USB 2.0}}|| <!--Ethernet-->{{no|Broadcom BCM5755M}} || <!--Wireless-->{{no|Broadcom BCM4312 swap with pci-e Atheros 5k under keyboard}} || <!--Test Distro--> || <!--Comments-->2007 64bit possible - F12 to choose boot option - 2 ddr2 sodimm max 4G - 4400mah 48Wh battery lasts 2 hours - 6600mah 73Wh lasts 3 hours - two wire cr2032 cmos - |- | <!--Name-->Latitude D630 || <!--Chipset-->GM965 + ICH8 * revA00 [http://amigaworld.net/modules/news/article.php?mode=flat&order=0&item_id=6481 ] GPU heatpad, no copper * revA01 0DT785 heatsink | <!--IDE-->{{N/A}} || <!--SATA-->{{partial|IDE mode}}|| <!--Gfx-->{{partial|use VESA as nVidia NVS 135M 3d corrupts 0.7 tunnel 0.25 gearbox G86}} || <!--Audio-->{{partial|HD Audio with STAC 9205 head phones only}} || <!--USB-->{{yes|USB 2.0}}|| <!--Ethernet-->{{no|Broadcom BCM5755M}} || <!--Wireless-->{{no|Intel PRO Wireless 3945ABG swap with Atheros 5k mini pcie}} || <!--Test Distro-->Icaros 1.4.5 || <!--Comments-->2007 64bit |- | <!--Name-->Latitude D830 || <!--Chipset-->965GM with Core2 * revA00 * revA01 | <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Yes|GM965 crestline 2d and 3d tunnel 115}} || <!--Audio-->{{Yes| }} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No| }} || <!--Wireless-->{{Maybe|replace with Atheros 5k mini pcie}} || <!--Test Distro-->Icaros || <!--Comments-->2007 15 inch 1280 x 900 but updating the LCD to WXGA or WSXGA+ could be better - 2 ddr2 sodimm - |- | <!--Name-->Latitude D830 || <!--Chipset-->ICH8, Core2 DUO T7800 @ 2.60GHz || <!--IDE-->{{N/A}} || <!--SATA-->Intel ICH8M Serial ATA || <!--Gfx-->nVidia Quadro NVS 140M G86 || <!--Audio-->{{yes|HD Audio with STAC 92XX codec}} || <!--USB-->{{yes|USB 2.0}} || <!--Ethernet-->Broadcom NetXtreme 57xx Gigabit || <!--Wireless-->Intel Wireless 4965AGN swap with Atheros 5k || <!--Test Distro-->Icaros 2.03 || <!--Comments-->2007 64bit 15." - FN,F2 or FN,F8 or FN,F12 |- | <!--Name-->XPS M1710 || <!--Chipset-->945PM with T2400 T2600 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->proprietary Dell card socket format GTX 7950 || <!--Audio-->HD Audio with STAC 92XX codec || <!--USB--> || <!--Ethernet-->Intel 1000 or Broadcom BCM5752 || <!--Wireless-->Intel swap with Atheros 5k || <!--Test Distro-->Aros One 64bit || <!--Comments-->2007 64bit 17.3" workstation type WXGA+ screen 1920x1200 - 2 ddr-2 667Mhz sodimm slots, |- | <!--Name-->XPS M1730 || <!--Chipset-->965 with T7200 T7600 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->GTX 7950 || <!--Audio-->HD Audio with STAC 92XX codec || <!--USB--> || <!--Ethernet-->Intel 1000 || <!--Wireless-->Intel swap with Atheros 5k || <!--Test Distro--> || <!--Comments-->2008 64bit 17" workstation type WXGA+ screen manufactured by AU Optronics poor viewing angles, unevenly lit, light leakage, 2 ddr-2 800Mhz slots, |- | <!--Name-->Latitude E6410 P27LA, E6510 PP30LA, E6310 || <!--Chipset-->Intel Core i5-520M to i7-620M i7 820QM but no sse4.1 or AVX || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|NVidia NVS 3100M GT218 2D but 3D through external monitor}} || <!--Audio-->{{Maybe|HD Audio IDT 92HD81}} || <!--USB-->{{Yes|USB2 }} || <!--Ethernet-->{{No|Intel}} || <!--Wireless-->{{No|Broadcom or Intel 6200AGN or Link 6300}} || <!--Test Distro-->Icaros 1.3 || <!--Comments-->2010 64 bit - 14.1” WXGA+ up to 15.6in 15.6” FHD 1080p - 2 ddr3l 1333Mhz max 8Gb - 90w dell charger - 3pin cmos - |- | <!--Name-->Inspiron M5030 || <!--Chipset-->rev A01 AMD V120, V140 rev A0? V160 M880G || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE}} || <!--Gfx-->{{Maybe|VESA RS880M Radeon HD 4225, 4250}} || <!--Audio-->{{Yes|HD audio with ALC269q codec}} || <!--USB--> || <!--Ethernet-->{{No|Atheros AR8152 v2}} || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - DDR3 sodimm - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->E6420 E6520 ATG semi ruggized XFR || <!--Chipset-->sandy bridge i5 2520M 2540M or duo I7 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|set to Bios UEFI mode AHCI}} || <!--Gfx-->{{Maybe|Intel HD 3000 with optional fermi Nvidia NVS 4200M GF119}} || <!--Audio-->{{Maybe|HD Audio with IDT 92HD90 BXX codec but not HDMI codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Intel}} || <!--Wireless-->{{No|Intel 6205}} || <!--Test Distro-->Icaros 2.03 || <!--Comments-->2011 64bit 15.6in - fan exhausts a lot of hot air when cpu taxed - VGA if Bios ATA set and Vesa only with Bios ACHI set - |- | <!--Name-->Inspiron M5040 || <!--Chipset-->slow amd E450, later C-50 C50 or C-60 C60 with A50M chipset || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|non efi sata in IDE mode but base plastic difficult to remove for access}} || <!--Gfx-->{{Maybe|use VESA AMD Radeon 6320, 6250 or 6290}} || <!--Audio-->{{Yes|HD Audio IDT}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{Yes|rtl8169 Realtek RTL8105E VB 10/100}} || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro-->2016 icaros 2.1.1 and AROS USB 1.6 || <!--Comments-->2012 64bit 15INCH 1388 X 768 - f2 bios setup, f12 boot order - under removable keyboard via 4 top spring loaded catches is 1 ddr3l sodimm max 8gb and wifi - |- | Latitude e6230 E6330 E6430 || i3 3320M 3350M 2.8 GHz i5 3360M i7 3520M || {{N/A}} || {{partial|non RAID mode}} || {{partial|Intel HD 4000 (VESA only)}} || {{no|HD Audio}} || {{partial|Intel USB 3.0 (USB 1.1 2.0 only)}} || {{No|Intel 82579LM Gigabit}} || {{No|Broadcom BCM4313}} || <!--Test Distro-->Nightly Build 2014 09-27 || 2013 64bit Ivy Bridge - 12.5-inch 13.3-inch 14-inch screen - not great support, better under hosted - |- | <!--Name-->Dell Latitude 3330 || <!--Chipset-->Core i3 – 2375M to i5 – 3337U, Intel® Core i3 – 3227U, Celeron 1007U on HM77 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{maybe|VESA 2d for intel Hd 2000 3000 vga hdmi}} || <!--Audio-->{{maybe|HDAudio with IDT 92HD93 Controller codec }} || <!--USB-->{{maybe|USB 3.0 (2), USB 2.0 PowerShare capable }} || <!--Ethernet-->{{no|Intel }} || <!--Wireless-->{{no|Intel }} || <!--Test Distro-->Deadwood usb3 test iso || <!--Comments-->2013 64bit, 13.3” HD 1366X768 16:9, 2 ddr3l slots max 8Gb, 720p HD video webcam, |- | <!--Name-->Inspiron 15 5565 5567 AMD versions, Inspiron 3595 || <!--Chipset-->AMD A6-9200u A9-9400 9425 A12-9700P Bristol Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->Radeon R5 R8 GCN 3 || <!--Audio-->{{No| }} || <!--USB-->{{partial| }} || <!--Ethernet-->{{maybe|Realtek 1GbE}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2017 64bit AVX2 - 15.6in 768p or 900p - there are intel versions avoid - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Latitude 5495, Inspiron 15 3585 || <!--Chipset-->Ryzen 2300U 2500U 2700U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|NVMe or optional 2.5in sata if caddy and ribbon cable}} || <!--Gfx-->Radeon Vega 3 or 7 || <!--Audio-->{{No|HDAudio with Realtek ALC3246 aka ALC295 0x10ec, 0x0295 or ALC3263 aka ALC 0x10ec, 0x0 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - 14.0" FHD WVA 1080p (16:9) 220 nits or HD 768p - 2 ddr4 sodimm slots max 32gb - 68whr battery with 2pin cmos bios coin - DC 19.5V 4.62A (90W) or 19.5V 3.34W (65W) 5.0mm x 7.4mm PA12 charging adapter - |- | <!--Name-->Inspiron 3505, Vostro 3515 || <!--Chipset-->athlon 300u, Ryzen 3250u (2c4t) 3450u 3500u 3700u (4c8t), Athlon Silver (2c2t) Gold (2c4t) || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|up to 2 nvme with optional 2.5in sata ribbon connector}} || <!--Gfx-->{{Maybe|VESA 2D for Vega 8, 10}} || <!--Audio-->{{No|Realtek ALC3204, Cirrus Logic CS8409 (CS42L42 and SN005825)}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{No|RTL 8106E}} || <!--Wireless-->{{No|Realtek RTL8723DE}} || <!--Test Distro--> || <!--Comments-->2019 64-bit - 15.6inch - 2 ddr4 sodimm max 16G - avoid knocking usb-c charging whilst in use - |- | <!--Name-->Inspiron 5485 2-in-1 || <!--Chipset-->athlon 300u, Ryzen 3250u (2c4t) 3450u 3500u 3700u (4c8t), Athlon Silver (2c2t) Gold (2c4t) || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|nvme}} || <!--Gfx-->{{Maybe|VESA 2D for Vega 8, 10}} || <!--Audio-->{{No|Realtek ALC3204}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No|Realtek RTL8723DE}} || <!--Test Distro--> || <!--Comments-->2019 64-bit - 14inch - 2 ddr4 sodimm max 16G - avoid knocking usb-c charging whilst in use - |- | <!--Name-->Latitude 3500, 3310, 3410, 3510, || <!--Chipset-->Intel Celeron-4205U, Pentium-5405U, Core i5 (8th Gen) i3-8145U, 8265U, i5-8365U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|nvme}} || <!--Gfx-->{{Maybe|Vesa 2D for Intel UHD Graphics 610 or 620 hdmi}} || <!--Audio-->{{no|HDAudio with Realtek ALC}} || <!--USB-->{{maybe|USB3 usb-c usb-a}} || <!--Ethernet-->{{Maybe|rtl8169 RTL8111H}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2019 64bit - 14in or 15.6in 768p to 1080p 220nits - 65w - 2 ddr4 sodimm slots - rtc cr2032 cmos 2 pin - |- | <!--Name-->Inspiron 5405 || <!--Chipset-->AMD Ryzen 5 4500U || <!--IDE-->{{N/A}} || <!--SATA-->One M.2 2230/2280 nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{No|HDAudio with Realtek ALC3204 codec}} || <!--USB-->{{maybe|USB3 }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2020 64bit - 14" 1080p - dell round ac 19.50 VDC 4.50 mm x 2.90 mm 65W(19.5V-3.34A) round 4.5mm tip - |- | <!--Name-->Inspiron 5415, Inspiron 5515 || <!--Chipset-->AMD Ryzen 3 5300U, Ryzen 5 5500U, Ryzen 7 5700U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|nvme}} || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{No|HDaudio with realtek ALC3254 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit 14" or 15.6in - avoid knocking usb-c charging whilst in use or use dell round ac 65W 4.5MM x 3.0MM - replacing keyboard not easy - 1 ddr4 sodimm - |- | <!--Name-->Vostro 3425, Vostro 3525, Vostro 5625 || <!--Chipset-->AMD Ryzen 3 5425U, Ryzen 5 5625U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{no|HDAudio with codec}} || <!--USB-->{{maybe|USB4}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 14in 15.6" to 16" FHD 1080p - dell round ac 65w 4.5MM x 3.0MM or avoid knocking usb-c charging whilst in use - |- | <!--Name-->Dell Inspiron 15 Model 3535, Inspiron 14 7435 || <!--Chipset-->AMD Ryzen 5 7520U, AMD Ryzen 5 7530U, 7 7730U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->{{No| hdmi 1.4 but no gpmi}} || <!--Audio-->{{No|HDaudio with codec }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2024 64bit - 14.0" or 15.6" 1080p - dell round ac 65w 4.5MM x 3.0MM or usb-c charging - full sd card slot - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |} ====Fujitsu-Siemens==== [[#top|...to the top]] Order of build quality (Lowest to highest) <pre > Amilo Esprimo Lifebook </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="5%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Fujitsu [http://www.labri.fr/perso/fleury/index.php?page=bug_transmeta FMV-Biblo Loox S73A (Japan P1100) LifeBook P1120 Biblo Loox T93C (Japan P2120) P2020] || <!--Chipset-->Transmeta Crusoe CPU TM5600 633MHz with Ali M1535 chipset || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->ATI Rage Mobility M with 4MB SDRAM || <!--Audio-->{{No|AC97 Ali M1535 + STAC9723 Codec}} || <!--USB-->USB 1.1 only || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->1999 32bit 10" 1280 x 600 matte LCD - QuickPoint IV mouse - metal chassis with palm rest plastic - 15GB 2.5 inch drive and SR 8175 8X DVD-ROM drive - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Lifebook S7000 S7010 S7010D S2020 || <!--Chipset-->Pentium M 1.6 or 1.7GHz || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|use VESA - Intel 855}} || <!--Audio-->{{maybe|AC97 with STAC 9751T or 9767 codec}} || <!--USB--> || <!--Ethernet-->{{No|Broadcom}} || <!--Wireless-->{{No|Atheros, Broadcom or Intel 2200BG - FN,F10}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2002 32bit 14.1 inch with minimal support |- | <!--Name-->Lifebook e8010 || <!--Chipset--> || <!--IDE-->{{Yes| }} || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA Intel 855GM}} || <!--Audio-->AC97 STAC9767 or ALC203 codec || <!--USB--> || <!--Ethernet-->{{No|Broadcom NetXtreme BCM5705M}} || <!--Wireless-->Intel PRO Wireless 2200BG || <!--Test Distro-->Icaros 1.3.1 || <!--Comments-->2002 32bit 15.1 inch |- | <!--Name-->Stylistic ST5000 ST5010 ST5011 ST5012 ST5020 ST5021 ST5022 || <!--Chipset-->1.0GHz P-M and later 1.1GHz on Intel 855GME || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->Intel 800 use VESA || <!--Audio-->Intel AC97 || <!--USB--> || <!--Ethernet-->Broadcom BCM5788 tg3 || <!--Wireless-->{{No|Intel 2200BG}} || <!--Test Distro--> || <!--Comments-->2003 32bit charged via a proprietary port power connector 16V 3.75A with wacom serial pen interface - indoor Screen transmissive 10.1 and later 12.1 XGA TFT - |- | <!--Name-->Amilo Pro V2010 || <!--Chipset-->VIA CN400 PM880 || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->{{No|S3 unichrome use VESA}} || <!--Audio-->{{No|VIA AC97 VT8237 with codec}} || <!--USB--> || <!--Ethernet-->Rhine 6102 6103 || <!--Wireless-->RaLink RT2500 || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments-->2003 32bit boot mount - unknown bootstrap error then crashes |- | <!--Name-->Amilo Li 1705 CN896 || <!--Chipset--> with VIA P4M900 || <!--IDE--> || <!--SATA-->{{Maybe|IDE}} || <!--Gfx-->ATi || <!--Audio-->{{No|VIA VT8237 HD Audio with codec}} || <!--USB-->VT82xx 62xx || <!--Ethernet-->{{Yes|VIA Rhine}} || <!--Wireless-->{{No|Atheros G}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2005 32bit random freezes |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> Esprimo Mobile V5535 Skt mPGA 478MN | <!--Chipset--> | <!--IDE--> {{yes|IDE and EIDE}} | <!--SATA--> {{maybe|IDE mode with SIS 5513}} | <!--Gfx--> {{maybe|SiS 771 / 671 (VESA only)}} | <!--Audio--> {{yes|HD Audio SIS968 SIS966 SI7012 with ALC268 codec}} | <!--USB--> {{no|USB 1.1 and 2.0 issues}} | <!--Ethernet--> {{no|SiS 191 gigabit}} | <!--Wireless--> {{yes|Atheros AR5001 mini pci express}} | <!--Test Distro-->aros one 1.5 usb | <!--Comments-->2005 32bit 20v barrel - f2 setup f12 multi boot - random freezing short time after booting - chipset SIS 671MX - |- | <!--Name-->Amilo SI 1520 1521p || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|GMA 2D}} || <!--Audio-->{{No|HD Audio Conexant codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Yes|Intel Pro 100}} || <!--Wireless--> || <!--Test Distro-->Icaros 1.4.2 || <!--Comments-->2005 32bit - Set Bios option ATA Control Mode to Compatible |- | <!--Name-->Lifebook S7020 S7020D || <!--Chipset--> Pentium M 740 1.73MHz || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 915 || <!--Audio-->HD Audio ALC260 codec || <!--USB-->{{Yes| }} || <!--Ethernet-->Broadcom BCM5751M Gigabit || <!--Wireless-->Intel PRO Wireless 2200BG or Atheros 5k || <!--Test Distro--> || <!--Comments-->2006 32bit |- | <!--Name-->Stylistic ST5030 ST5031 ST5032 || <!--Chipset-->1 to 1.2GHx Pentium M with 915GM || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->Intel 900 || <!--Audio--> || <!--USB-->{{Yes| }} || <!--Ethernet-->Marvell || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2006 32bit charged via a proprietary port power connector 6.0 x 4.4 mm round - 200 pin ddr2 ram |- | <!--Name-->Stylistic ST5110 ST5111 ST5112 || <!--Chipset-->945GM with 1.2GHz Core Duo and Core2 Duo || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Intel 900 || <!--Audio-->HD audio with STAC9228 codec || <!--USB-->{{No| }} || <!--Ethernet--> || <!--Wireless-->Intel 3945 ABG or optional atheros || <!--Test Distro--> || <!--Comments-->2006 either 32 or 64 bit - charged via a proprietary port power connector 6.0 x 4.4 mm round - SigmaTel® touchscreen - |- | <!--Name-->E8110 S7110 E8210 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|945GM}} || <!--Audio-->{{Yes|HD Audio with ALC262 codec playback}} || <!--USB-->{{Yes}} || <!--Ethernet-->{{No|Marvell 88E8055 Gigabit}} || <!--Wireless-->{{No|Intel PRO Wireless 3945ABG}} || <!--Test Distro-->Icaros 2.0 || <!--Comments-->2006 32bit Core Duo |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || CHIPSET || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Lifebook PH521 || <!--Chipset-->AMD E-350 E-450 1.65GHz || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->HD 6310M 6320M || <!--Audio-->Realtek ALC269 || <!--USB-->{{No| }} || <!--Ethernet-->Realtek || <!--Wireless-->{{No|Atheros 802.11 bgn}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - 11.6 inch 1366x768 pixels - DDR3 1066MHz - |- | <!--Name-->LIFEBOOK E752/E782/S752/S782 || <!--Chipset--> with Intel Core i3-2328M to i3-3110M || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{Maybe| }} || <!--Audio-->{{yes| }} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no|Intel 82579V 1000 }} || <!--Wireless-->{{no|Intel Wireless 6205 may be able to swap for Atheros 5k }} || <!--Test Distro-->Aros One 64bit || <!--Comments-->2012 64bit |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====HP Compaq==== [[#top|...to the top]] Build quality (Lowest to highest) <pre > Presario Pavilion Omnibook ProBook Armada Elitebook </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->1c00 series Compaq Presario [http://users.utu.fi/sjsepp/linuxcompaqarmada100s.html Armada 100S made by Mitac], 1247 || <!--Chipset-->K6-II with PE133 MVP-4 || <!--IDE--> || <!--SATA--> || <!--Gfx-->use VESA - Trident Blade3D AGP sp16953 || <!--Audio-->VIA ac'97 audio [rev20] with AD1881A codec || <!--USB-->{{Maybe|usual VIA issues [rev10]}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->1998 32bit 192MB max - PCcard Texas PC1211 no support - 1200 XL1 1200-XL1xx, XL101, XL103 XL105 XL106 XL109 XL110 XL111 XL116 XL118 XL119 XL125 |- | <!--Name-->1c01 series Armada 110, Evo N150 || <!--Chipset-->Intel with VIA PLE133 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Use VESA - Trident Cyber Blade i1 chipset || <!--Audio-->VIA 686 rev20 82xxx 686a || <!--USB--> || <!--Ethernet-->Intel 82557 Pro 100 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->1998 32bit max 192mb sodimm 100Mhz 133Mhz ram memory - 1200-XL405A 12XL405A XL502A 12XL502A 1600XL |- | Armada M300 M700 E500 || 440BX || {{Yes| }} || {{N/A}} || {{maybe|ATI Rage LT M1 Mobility (VESA only)}} || {{no|AC97 ESS Maestro 2E M2E ES1987 sound}} || {{yes|USB1.1 only}} || {{No|[http://perho.org/stuff/m300/index_en.html Intel PRO 100+ Mini PCI]}} || {{N/A}} || Aspire OS 2012, Nightly 30-01 2013 and 04-05 2013 || 1999 32bit - F10 bios options and Fn+F11 reset CMOS with 64mb ram already on board |- | <!--Name-->HP Omnibook XE3 || <!--Chipset-->Intel BX 600Mhz GC model 256mb or AMD GD 500Mhz || <!--IDE--> || <!--SATA--> || <!--Gfx-->Use VESA - S3 Inc. 86C270 294 Savage IX-MV (rev 11) || <!--Audio-->{{No|ESS ES1988 Allegro 1 (rev 12)}} || <!--USB-->Intel 82371AB PIIX4 USB (rev 01) || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->2002 32bit no cardbus pcmcia support - no audio from Polk Audio Speakers - |- | <!--Name-->HP Omnibook XE3 || <!--Chipset-->82830 ICH3 P3-M 750MHz 800Mhz 900MHz || <!--IDE-->{{Yes| }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|use VESA - CGC 830MG}} || <!--Audio-->{{No|ESS ES1988 Maestro 3i}} || <!--USB-->{{Yes|only one 1.1 port}} || <!--Ethernet-->{{Yes|e100 82557}} || <!--Wireless-->{{N/A|}} || <!--Test Distro-->Icaros 1.51 || <!--Comments-->2002 32bit Boots USB Stick via Plop boot floppy - Memory for GF 256-512mb, GS up 1GB |- | <!--Name-->TC1000 TC-1000 Tablet PC || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->NVIDIA NV11 [GeForce2 Go] (rev b2) || <!--Audio-->VIA AC97 Audio (rev 50) || <!--USB-->OHCI NEC USB 2.0 (rev 02) || <!--Ethernet-->Intel 82551 QM (rev 10) || <!--Wireless-->Atmel at76c506 802.11b || <!--Test Distro--> || <!--Comments-->2002 32bit Transmeta LongRun (rev 03) with VT82C686 - Texas Instruments TI PCI1520 PC card Cardbus |- | <!--Name-->HP Compaq R3000 ZV5000 (Compal LA-1851) || <!--Chipset-->Nvidia nForce 3 with AMD CPU || <!--IDE--> || <!--SATA--> || <!--Gfx-->Nvidia NV17 [GeForce4 420 Go 32M] || <!--Audio-->Nvidia || <!--USB--> || <!--Ethernet-->Broadcom or Realtek RTL8139 || <!--Wireless-->{{Maybe|Broadcom BCM4303 BCM4306 or Atheros bios locked}} || <!--Test Distro--> || <!--Comments-->2003 32bit - HPs have a setting to automatically disable wireless if a wired connection is detected |- | <!--Name-->Compaq [http://www.walterswebsite.us/drivers.htm Presario 700 series] || <!--Chipset-->VT8363 VT8365 [Apollo Pro KT133 KM133] || <!--IDE-->{{yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{maybe|VT8636A (S3 Savage TwisterK) (VESA only)}} || <!--Audio-->{{Maybe|VIA AC97 [rev50] with AD1886 codec}} || <!--USB-->{{maybe|VIA UHCI USB 1.1 [rev1a]}} || <!--Ethernet-->{{yes|RealTek RTL8139}} || <!--Wireless-->{{no|Broadcom BCM4306}} || <!--Test Distro--> || <!--Comments-->2003 32bit poor consumer grade level construction - jbl audio pro speakers - no support for cardbus pcmcia TI PCI1410 - 700A EA LA UK US Z 701AP EA BR FR 701Z 702US 703US AP JP audio sp18895 Sp19472 |- |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | N400c || P3-M 82845 || {{yes|82801 CAM IDE U100}} || {{N/A}} || {{maybe|Rage Mobility 128 (VESA only)}} || {{No|Maestro 3 allegro 1}} || {{yes|USB1.1}} || {{yes|Intel PRO 100 VM (KM)}} || {{N/A}} || Icaros 1.2.4 || 2003 32bit Has no optical disc drive |- | N410c || P3-M 82845 || {{yes|82801 CAM IDE U100}} || {{N/A}} || {{maybe|Radeon Mobility M7 LW 7500 (VESA only)}} || {{yes|Intel AC97 with AD1886 codec}} || {{yes|USB1.1}} || {{yes|Intel PRO 100 VM (KM)}} || {{N/A}} || Icaros 1.2.4 || 2003 32bit Has no optical disc drive |- | Evo N600c || Pentium 4 || {{yes|IDE}} || {{N/A}} || {{partial|ATI Radeon Mobility M7 (VESA only)}} || {{No|ESS ES1968 Maestro 2}} || {{yes|USB}} || {{yes|Intel PRO 100}} || {{dunno}} || Icaros 1.3 || 2003 32bit |- | Evo N610c || Pentium 4 || {{yes|IDE}} || {{N/A}} || {{partial|ATI Radeon Mobility M7 (VESA only)}} || {{yes|Intel ICH AC97 with AD1886 codec}} || {{yes|USB}} || {{yes|Intel PRO 100}} || {{dunno}} || Icaros 1.2.4 || |- | N800c || P4 || {{Yes|IDE}} || {{N/A}} || {{partial|ATI Radeon Mobility 7500 (VESA only)}} || {{yes|AC97}} || {{yes|USB}} || {{yes|Intel PRO 100}} || {{N/A}} || Icaros 1.2.4 || 2003 32bit P4M CPU can get very warm |- | <!--Name-->NX7010 || <!--Chipset-->Intel || <!--IDE-->{{yes|IDE}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{partial|ATI mobility 7500 or 9000 Radeon 9200 64MB (VESA only)}} || <!--Audio-->{{yes|AC97 ADI codec}} || <!--USB-->{{yes|uhci (1.1) and ehci (2.0)}} || <!--Ethernet-->{{yes|Realtek 8139}} || <!--Wireless-->{{No|Intel 2200b bios locked}} || <!--Test Distro--> || <!--Comments-->2003 32bit |- | <!--Name-->Compaq Preasrio V5000 (Compal LA-2771) || <!--Chipset-->AMD Sempron 3000+ or Turion ML with SB400 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA - Ati RS480M Xpress 200}} || <!--Audio-->{{No|AC97 ATI with Conexant CX 20468 codec}} || <!--USB--> || <!--Ethernet-->{{Yes|Realtek 8100 8101L 8139}} || <!--Wireless-->{{No|bcm4318 bios locked}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2004 64bit single core machine V5001 V5002 V5002EA V5003 |- | <!--Name-->TC1100 TC-1100 Tablet PC || <!--Chipset-->855PM || <!--IDE--> || <!--SATA--> || <!--Gfx-->Nvidia Geforce4 Go || <!--Audio-->AC97 || <!--USB--> || <!--Ethernet-->{{Maybe|BCM 4400}} || <!--Wireless-->{{Maybe|Atheros wlan W400 W500 or ? bios locked}} || <!--Test Distro--> || <!--Comments-->2004 32bit |- | <!--Name-->NC6000 NC8000 NW8000 || <!--Chipset-->855PM with Pentium M 1.5 1.6 1.8GHz 2.0GHz || <!--IDE-->max 160 GB for NW 8000 || <!--SATA--> || <!--Gfx-->{{Maybe|Ati RV350 mobility 9600 M10 Fire GL T2 ISV use VESA 2D as no laptop display}} || <!--Audio-->{{Yes|Intel AC97 with ADI codec playback only}} || <!--USB-->{{Yes|2 ports}} || <!--Ethernet-->{{No|Broadcom BCM 5705M}} || <!--Wireless-->{{Maybe|mini pci Atheros 5212 BG W400 W500 or Intel - all bios locked}} || <!--Test Distro--> || <!--Comments-->2005 based [http://amigaworld.net/modules/newbb/viewtopic.php?topic_id=41916&forum=47 works] - Firewire TI TSB43AB22/A - 8 pound 2.5 kg travel weight - an SD slot as well as two PC Card slots - 15-inch UXGA screen (1,600 x 1,200) or 15" SXGA+ (1400 x 1050) (4:3 ratio) |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Compaq NC6110 NX6110 NC6120 NC6220 NC4200 NC8200 TC4200 || <!--Chipset-->GMA 915GML || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|2D GMA 900}} || <!--Audio-->{{Yes|AC97 with ADI AD1981B playback}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Unk|440x or BCM 5705M or 5751M}} || <!--Wireless-->{{No|Intel IPW 2200 bios locked}} || <!--Test Distro-->Icaros 1.5.2 || <!--Comments-->2005 32bit Sonoma based - Wifi with Atheros AR5007eg if apply hacked bios RISKY else use USB one - (INVENTEC ASPEN UMA MV) (INVENTEC ASPEN DIS PV) - |- | <!--Name-->Compaq C500 CTO aka HP G7000 || <!--Chipset-->Intel 945GM || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA 950 || <!--Audio-->HD Audio with realtek ALC262 codec || <!--USB--> || <!--Ethernet-->Realtek 8139 || <!--Wireless-->Broadcom BCM 4311 bios locked || <!--Test Distro--> || <!--Comments-->2005 32bit |- | <!--Name-->HP DV6000 || <!--Chipset-->945GMS || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA 950 || <!--Audio-->HD Audio IDT 92HD 91B || <!--USB--> || <!--Ethernet-->Intel PRO 100 VE || <!--Wireless-->{{No|Intel 3945 bios locked}} || <!--Test Distro--> || <!--Comments-->2006 32 bit only - Mosfet FDS6679 common cause of shorts giving no power to the tip. To reset adapter, unplug from AC (mains) and wait 15-30 sec. Then plug in again - |- | Presario F700 series, HP G6000 f730us F750 F750us F755US F756NR F765em || AMD Turion Mono MK-36 2.0Ghz NForce 560m or Twin X2 TK-55 with nForce 610m MCP67 || {{N/A| }} || {{Yes|but needs special sata adapt bit and caddy}} || {{Yes|GF Go 7000m 2D and 3D 640x350 to 1280x800 - ball solder issues due to poor cooling}} || {{Maybe| }} || {{Maybe|uhci and ehci boots}} || {{No|Nvidia }} || {{Yes|Atheros AR5007 bios locked}} || Icaros 1.3.1 and Aros One 1.6 USB || 2006 64bit - f9 boot device f10 bios setup - random freezes after a minutes use means internal ventilation maintenance needed each year essential - No sd card and overall limited phoenix bios options - |- | <!--Name-->Presario v6604au v6608au V3500 || <!--Chipset-->NVIDIA MCP67M with AMD Athlon64 X2 TK 55 amd 1.8ghz || <!--IDE--> || <!--SATA-->{{Yes|SATA 150}} || <!--Gfx-->NVIDIA GeForce Go 7150M 630i or C67 630M MCP67 || <!--Audio-->conexant codec || <!--USB--> || <!--Ethernet-->Nvidia or Realtek 10/100 || <!--Wireless-->{{No|Broadcom 4311 bios locked}} || <!--Test Distro--> || <!--Comments-->2006 64bit Altec Lansing Stereo Speakers - ball solder issues - |- | <!--Name-->Compaq presario v6610 v6615eo v6620us || <!--Chipset-->Turion 64 X2 mobile TK-55 / 1.8 GHz to athlon 64x2 @ 2.4ghz || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|SATA 150}} || <!--Gfx-->{{Yes|geforce 7150 or 7300m 2d and 3d}} || <!--Audio-->{{Yes|AMD HD Audio with IDT codec stereo playback only}} || <!--USB-->3 OHCI EHCI || <!--Ethernet-->{{Maybe| }} || <!--Wireless-->{{No|Broadcom bios locked}} || <!--Test Distro-->Icaros 1.3 - || <!--Comments-->2007 [http://amigaworld.net/modules/newbb/viewtopic.php?topic_id=40956&forum=48 works well] - 1 x ExpressCard/54 - SD Card slot - AO4407 test voltage of the Drain side (pins 5-8) with AC adapter and no battery, see 0 volts, connect the battery you should have 10-14v - |- | <!--Name-->v6630em v6642em || <!--Chipset-->nForce 630M with AMD Turion 64 X2 Mobile TL-58 || <!--IDE--> || <!--SATA--> || <!--Gfx-->NVIDIA GeForce 6150M or 7150M || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless-->{{No|Broadcom bios locked}} || <!--Test Distro--> || <!--Comments-->2007 64bit 15.4 in 1280 x 800 ( WXGA ) - |- | <!--Name-->HP Compaq NC6400 || <!--Chipset-->945GM Core Duo || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|GMA 950 2D issues and no 3d}} || <!--Audio-->{{No|HD Audio AD1981HD}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|BCM }} || <!--Wireless-->{{No|Broadcom locked}} || <!--Test Distro-->Icaros || <!--Comments-->2007 - replaced with Atheros AR5007eg if apply hacked bios RISKY else use USB g - * 32bit Core Duo T2400 * 64bit Core 2 Duo T5600 T7600 |- | <!--Name-->HP Compaq NV NC6400 || <!--Chipset-->Core Duo + 945PM || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|use VESA Radeon x1300M (2D)}} || <!--Audio-->{{Maybe|HD Audio with ADI1981 low volume}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|BCM 5753M}} || <!--Wireless-->{{No|Intel 3945 ABG bios locked}} || <!--Test Distro--> Icaros 1.4.2 || <!--Opinion-->2007 Harmon Kardon speakers |- | <!--Name-->HP Compaq NC6320 || <!--Chipset-->945GM with * 32bit Core Duo 1.83GHz T2400 * 64bit Core2 Duo 1.83GHz T5600 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|GMA 950 2D with a little 3D tunnel 213}} || <!--Audio-->{{Maybe|Intel HD Audio with AD1981HD codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|BCM 5788}} || <!--Wireless-->{{No|Intel 3945 bios locked}} || <!--Test Distro-->Icaros 2 || <!--Comments-->2007 replaced with Atheros AR5007eg if applying hacked wifi bios RISKY!! else use USB - 14.1" or 15 inch XGA 1024x768 - noisy cpu fan for core2 - trackpad rhs acts as window scroller - |- | <!--Name-->HP NC4400 TC4400 Tablet || <!--Chipset-->Core Duo with 82945 chipset || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|bios F.07 limits to 100GB 120GB}} || <!--Gfx-->{{yes|2D and 3D 282 tunnel and gearbox 150}} || <!--Audio-->{{Yes|HD Audio with ADI 1981HD codec via ear phones}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{No|BCM 5753M}} || <!--Wireless-->{{No|Intel 3945 or BCM 4306 - Whitelist BIOS F.0C needed but risky}} || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments-->2008 64 bit possible with Core2 - TI SD card reader non bootable - wacom serial digitiser pen not working - * 32bit 1.86GHz core duo * 64bit 2Ghz T7200, 2.16Ghz Core 2 Duo T7600 2.33GHz |- | <!--Name-->HP Pavilion DV2000 CTO || <!--Chipset-->945GMS || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA 950, X3100, Nvidia 8400M || <!--Audio-->HD Audio Conexant CX 20549 Venice || <!--USB--> || <!--Ethernet-->Nvidia MCP51 || <!--Wireless-->{{No|Broadcom BCM 4311 or Intel 3945 4965 ABG bios locked}} || <!--Test Distro--> || <!--Comments-->2008 Atheros AR5007eg if apply hacked bios RISKY |- | <!--Name-->Compaq Presario C700 || <!--Chipset-->GMA960 || <!--IDE--> || <!--SATA--> || <!--Gfx-->X3100 || <!--Audio-->HD Audio || <!--USB--> || <!--Ethernet-->RTL 8139 || <!--Wireless-->{{Maybe|Atheros AR5007 AR5001 AR242x}} || <!--Test Distro--> || <!--Comments-->2008 |- | <!--Name-->Compaq 2510p 6510b 6710b 6910b || <!--Chipset-->GMA 965GM GL960 || <!--IDE-->{{yes| }} || <!--SATA--> || <!--Gfx-->{{yes|X3100 some 2d but slow software 3d only}} || <!--Audio-->{{maybe|HD Audio ADI AD1981 HD low volume on head phones}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no|Intel 82566 or Broadcom BCM 5787M}} || <!--Wireless-->{{No|Intel 3945ABG or 4965ABG bios locked}} || <!--Test Distro-->Aspire OS Xenon 2014 || <!--Comments-->2008 no sd card boot support - F9 to choose boot option - [http://forums.mydigitallife.info/threads/7681-This-is-no-request-thread!-HP-COMPAQ-bioses-how-to-modify-the-bios/page111?p=333358#post333358 whitelist removal (risky) bios block for wifi card swap] |- | <!--Name-->CQ40 CQ41 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|VESA Intel}} || <!--Audio-->HD Audio || <!--USB--> || <!--Ethernet-->Realtek RTL8101E || <!--Wireless-->{{No|Broadcom BC4310 bios locked}} || <!--Test Distro--> || <!--Comments-->2008 |- | <!--Name-->Compaq Presario CQ35 CQ36 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|VESA }} || <!--Audio--> || <!--USB--> || <!--Ethernet-->Realtek RTL8101E RTL8102E || <!--Wireless-->{{No|Broadcom BCM4312 bios locked}} || <!--Test Distro--> || <!--Comments-->2008 Compal LA-4743P - |- | <!--Name-->HP Compaq CQ42 CQ43 CQ45 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->HD Audio with Coxenant codec || <!--USB--> || <!--Ethernet-->Realtek || <!--Wireless-->{{No|Realtek RTL8191SE, Realtek 8188CE}} || <!--Test Distro--> || <!--Comments-->2008 (Quanta AX1) |- | <!--Name-->Compaq Presario CQ50 CQ56 || <!--Chipset-->Nvidia MCP78S || <!--IDE--> || <!--SATA--> || <!--Gfx-->Geforce 8200M || <!--Audio-->nVidia HD Audio with codec || <!--USB--> || <!--Ethernet-->nvidia MCP77 || <!--Wireless-->{{unk|Atheros AR928X bios locked}} || <!--Test Distro--> || <!--Comments-->2008 [http://donovan6000.blogspot.co.uk/2013/06/insyde-bios-modding-wifi-and-wwan-whitelists.html bios modding risky] MCP72XE MCP72P MCP78U MCP78S |- | <!--Name-->CQ60 || <!--Chipset-->Single core Sempron to dual turion || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|VESA for Nvidia 8200M}} || <!--Audio-->{{yes|HD Audio}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{No| bios locked}} || <!--Test Distro--> || <!--Comments-->2008 |- | <!--Name-->HP DV6700 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{no|Vesa for Nvidia 8400M}} || <!--Audio-->{{no| }} || <!--USB-->{{no| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{No|Intel }} || <!--Test Distro--> || <!--Comments-->2008 64bit - |- | <!--Name-->CQ60 || <!--Chipset-->Intel C2D || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|VESA for Nvidia 9200M}} || <!--Audio-->{{yes|HD Audio}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{No| bios locked}} || <!--Test Distro--> || <!--Comments-->2009 64bit - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->CQ57z || <!--Chipset-->AMD slow E-300 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{Maybe|VESA ATi HD 6310 wrestler}} || <!--Audio-->{{unk| }} || <!--USB-->{{yes| }} || <!--Ethernet-->{{maybe|Realtek RTL8101 RTL8102}} || <!--Wireless-->{{No|RaLink RT5390}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name-->HP CQ58z 103SA E5K15EA || <!--Chipset-->AMD slow Dual-Core E1-1500 APU with A68M FCH || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{Maybe|VESA 2D for Radeon HD 7310}} || <!--Audio-->Realtek idt codec || <!--USB-->{{yes| }} || <!--Ethernet-->{{yes|Realtek 10/100 BASE-T}} || <!--Wireless-->{{No|Broadcom}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - 39.6 cm (15.6") HD BrightView LED-backlit (1366 x 768) |- | <!--Name-->HP 635 DM1 || <!--Chipset-->AMD slow E-300, E-450 later E2-1800 on SB7x0 SB8x0 SB9x0 || <!--IDE-->{{N/A}} || <!--SATA-->ATI non efi SATA AHCI - IDE mode || <!--Gfx-->{{Maybe|use VESA 2D - AMD HD6310, 6320 to HD7340}} || <!--Audio-->{{Yes|Realtek ALC270A GR but not Wrestler HDMI Audio}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{Yes|rtl8169 driver covers Realtek RTL8101E RTL8102E}} || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 14" 1366 x 768 - f9 f10 - external battery - 2 stacked ddr3l sodimm slots max 16Gb under one base plate - removable keyboard - |- | <!--Name-->HP G6 2000-2b10NR 2000-2d10SX 2000-2d80NR || <!--Chipset-->AMD very slow E1-2000 E2-3000M on A50M (soldered) A4-3305A on A60M (socket) || <!--IDE-->{{N/A}} || <!--SATA-->2.5in || <!--Gfx-->{{Maybe|VESA AMD Radeon 6320, 6620G, 6520G, 6480G, 6380G}} || <!--Audio-->{{No| }} || <!--USB-->{{No| }} || <!--Ethernet-->{{maybe|Realtek 100 1000}} || <!--Wireless-->{{No|Realtek}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 39.6-cm (15.6-in) HD LED BrightView (1366×768) - 1 or 2 ddr3l max 8G - 19VDC 3.42A Max 65W Tip 7.4mm x 5.0mm - |- | <!--Name-->HP ProBook 6465B || <!--Chipset-->AMD massively slow A6-3310MX or A6-3410MX with A60M || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA AMD 6480G or 6520G}} || <!--Audio-->{{No|IDT 92HD81B1X}} || <!--USB-->{{No| }} || <!--Ethernet-->{{maybe|rtl8169 Realtek 8111}} || <!--Wireless-->{{No|Intel AC 6205 or broadcom 4313 bios locked}} || <!--Test Distro--> || <!--Comments-->2013 64bit does not support AVX or SSE 4.1 - 13-inch or 14-inch runs hot - |- | <!--Name-->HP Elitebook 8470p 8570p || <!--Chipset-->Intel Quad i7-3840QM, i7-3610QM, i7-3520M, i5-3210M, i3-3130M, i3-2370M on Intel QM77 chipset || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|set the bios boot options to not fastboot and drive mode IDE rather than AHCI }} || <!--Gfx-->{{Maybe|Vesa 2d for HD4000 with some having switchable Radeon M2000 or 7570M}} || <!--Audio-->{{yes|HDAudio for IDT codec}} || <!--USB-->{{yes|USB2}} || <!--Ethernet-->{{No|Intel 82579LM }} || <!--Wireless-->{{No|Intel, Broadcom, Atheros}} || <!--Test Distro-->64 bit boots from CD* if safe mode 2 is used, although it is possible to remove the 'nodma' and 'debug' entries and boot || <!--Comments-->2013 64bit with SSE4.1 and AVX - 14in 1600 x 900 to 1366 x 768 - 2 DDR3L sodimm slots max 16Gb - TPM 1.2 - dual boot 32/64 bit is working fine - |- | <!--Name-->HP ProBook 6475b, Probook 4445s 4545s, HP Pavilion 15-b115sa, [https://support.hp.com/gb-en/document/c04015674#AbT6 HP mt41 Mobile Thin Client PC] || <!--Chipset-->AMD very slow A4 4300M, A6 4400M 4455M or A8 4500M with AMD A70M A76M FCH || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA 7420 7520G 7640G 7660G}} || <!--Audio-->{{no|HD Audio with idt or realtek codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{No|Realtek RTL8151FH-CG}} || <!--Wireless-->{{No|Intel 6205 or Broadcom BCM 43228 bios locked}} || <!--Test Distro--> || <!--Comments-->2014 64bit does support AVX or SSE 4.1 - 15.6-inch - |- | <!--Name--> || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->HP ENVY 15-k112nl K1Y78EA || <!--Chipset-->Intel® Core™ i7 i7-4510U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->Intel HD4400 and/without NVIDIA® GeForce® GTX 850M || <!--Audio-->{{maybe| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{no| }} || <!--Test Distro-->Deadwood usb3 test iso || <!--Comments-->2014 64bit - 15.6" 768p to 1080p - 19.5V 3.33A/4.62A/6.15A 65W/90W/120W AC - |- | <!--Name-->HP Pavilion Gaming Laptop 15-ak002na || <!--Chipset-->Intel 4 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->GTX 950 || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name-->HP ProBook 255 G1, 455 G1 F2P93UT#ABA, 645 G1, Envy 15-j151ea G7V80EA, Envy m6-1310sa (E4R01EA#ABU) || <!--Chipset-->AMD very slow Dual-Core E1-1500, or AMD Quad A4-4300M A8-4500M A10-4600M A4-5150M A6-5350M 2.9Ghz A10-5750M || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA 2D for 7310, 7420G 7520G 7640G 7660G 8350G 8450G or 8550G, 8650G, 8750G }} || <!--Audio-->{{No|HD Audio IDT 92HD91 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|realtek}} || <!--Wireless-->{{No|Atheros}} || <!--Test Distro--> || <!--Comments-->2015 64bit does support AVX or SSE 4.1 - 14in and 15in 1366 x 768 - external battery - 2 ddr3l sodimm slots - 19.5v / 4.62A psu runs hot - |- | <!--Name-->HP ProBook 245 G4, 255 G2, 455 G2, 255 G3, 455 G3, 255 G4 80CB, 255 G5 82F6, 355 G2, HP Pavilion 15-p038na 15-g092sa 15-p091sa 15-G094S 15-p144na 15-p142na, 15-Af156sa || <!--Chipset-->AMD very slow A4-5000 A6-5200, E2-6110, E1-6010 E2-2000, E1-2100 E2-3800, A4-6210 A6-6310 A8-6410, E2-7110, A6-7310 A8-7410 APU on A68M || <!--IDE-->{{N/A}} || <!--SATA-->sata some with cdrw dvdrw || <!--Gfx-->{{Maybe|VESA Radeon R2 R4 R5}} || <!--Audio-->{{no|HD Audio ALC3201-GR}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8102E or Atheros 1GbE}} || <!--Wireless-->{{unk|Qualcomm Atheros AR9565}} || <!--Test Distro--> || <!--Comments-->2015 64bit most have SSE4 AVX but E2-2000 does not - 15.6-inch (1366 x 768) - 2 ddr3l sodimm slots - small 31Whr or 41Whr external battery covers 240 G4, 245 G4, 250 G4, 255 G4, 256 G4, 14G, 15G - keyboard repair swap requires removal of all components - |- | <!--Name-->HP Elitebook 725 G2, 745 G2, 755 G2 || <!--Chipset-->Amd Quad very slow A6-7050B A8-7150B 1.9GHz A10-7350B || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA on AMD R4 R5 Radeon R6 with DP and vga}} || <!--Audio-->{{No|HD audio with IDT 92HD91}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 PCIe GBE}} || <!--Wireless-->{{no|Broadcom or Atheros}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 12.5-inch, 14" or 15.6in (all 1366 x 768) - 19.5V 65w 45W AC adapter - internal pull up tab battery under base which slides off - 2 ddr3l sodimm slots - keyboard swap requires removal of all components - |- | <!--Name-->HP ProBook 645 g2, Probook 445 G2, Probook 245 G2 most have cmos rtc battery || <!--Chipset-->AMD very slow A6-8600 A8-8700 a10- || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA 2D for Radeon R5 R6}} || <!--Audio-->{{No|HD Audio }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{No|Intel I219V 100/1000}} || <!--Wireless-->{{No|Intel or Qualcomm Atheros}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 14in and 15.6-inch HD (1366 x 768) or FHD 1080p - 2 ddr3l sodimm slots max 16GB - internal battery - hp ac psu tip - |- | <!--Name-->HP Probook 455 G3 should have a cmos battery || <!--Chipset-->AMD slow A10-8700P || <!--IDE-->{{N/A}} || <!--SATA-->1 2.5in sata and most should have 9.5mm dvd-rw || <!--Gfx-->{{Maybe|VESA 2D for Radeon R5}} || <!--Audio-->{{No|HDAudio with Conexant CX7501 codec }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111HSH-CG}} || <!--Wireless-->{{no|RTL8188EE }} || <!--Test Distro--> || <!--Comments-->2016 64bit - 2 ddr3l sodimm slots - keyboard swap problematic - |- | <!--Name-->HP Elitebook 725 G3, 745 G3, 755 G3, 725 G4, 745 G4, 755 G4, HP mt43 || <!--Chipset-->Amd slow A8-8600B, A10-8700B, A12-8800B to Quad A8 Pro 9600B to A10 9800 || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA on AMD R5 R6 R7 with DP and vga but screen is low res, dull colours, and blurry}} || <!--Audio-->{{No|HD audio with IDT codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{No|Broadcom 5762 PCIe GBE}} || <!--Wireless-->{{no|Realtek RTL8723BE-VB}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 12.5-inch (1366 x 768) to 14" and 15.6in - 2 sodimm ddr3 - 19.5V 45W AC slim 4.5mm hp adapter - randomly shuts down and the noisy fans constantly on - keyboard swap problematic - |- | <!--Name-->HP ProBook 645 G3, 655 G3 should have a cmos rtc battery underside of mb || <!--Chipset-->AMD 8th Gen slow A10-8730B, A8-9600B (4c4t) A6-8530B (2c2t) || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA 2d for AMD R5}} || <!--Audio-->{{No|HD Audio}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111HSH}} || <!--Wireless-->{{No|Intel or Realtek}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 15.6in - 2 ddr4 sodimm slots - keyboard repair swap requires removal of all components - |- | <!--Name-->HP ProBook 250 G5 easy cmos and external main battery || <!--Chipset-->Intel i7-6500U, i5-6200U, i3-6100U to slow i3-6006U, N3710 all sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|VESA 2D for iGPU Intel HD405 to HD520 dGPU or AMD Radeon R5 430M}} || <!--Audio-->{{unk|HDAudio with Realtek ALC3227 (or ALC282) codec 0x0282 }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 rtl8111HSH}} || <!--Wireless-->{{no| }} || <!--Test Distro-->Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2016 64bit - 15.6 inch 768p - HP ac psu - 2 ddr4 sodimm slots - |- | <!--Name-->HP ProBook 250 G6 SL52 LA-E801P - easy cmos battery and external battery || <!--Chipset-->Intel tested '''7200U''' untested 7500U to slow N3060 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|ahci on M.2 sata or 2.5in whichever installed with 1 m.2 permanent and internal dvdrw}} || <!--Gfx-->{{Maybe|VESA 2D for Intel Intel HD Graphics 620 or AMD Radeon 520}} || <!--Audio-->{{yes|HDAudio 0x8086, 0xa170 or 0x8086, 0x9dc8 with ALC3227 aka ALC282 codec 0x10EC, x0282}} || <!--USB-->{{maybe|intel sunrise point-lp USB3.0 xHCI}} || <!--Ethernet-->{{yes|rtl8169 Realtek RTL8111}} || <!--Wireless-->{{No|RTL8821CE or Intel wifi}} || <!--Test Distro-->Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2017 64bit 768p or 1080p - 19.5V 65W - 2 DDR4 sodimm slots max 16Gb - keyboard swap problematic - synaptics touchpad - poor hinges - |- | <!--Name-->HP Pavilion 14-BS, HP 15-BS LA-E802P cmos battery and external battery || <!--Chipset-->Intel i3-7200U to slow Celeron || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in (possibly requires the drive cable and M.2 sata3, most have no cdrw dvdrw}} || <!--Gfx-->{{Maybe|VESA 2d for Intel}} || <!--Audio-->{{No|HDAudio 0x8086, 0x9d70 with ALC codec 0x10EC, x0}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek rtl8169}} || <!--Wireless-->{{No|RTL8188CTV, RTL8821CE or Intel Dual Band Wireless-AC 3168}} || <!--Test Distro-->Deadwoods' latest usb3 test iso || <!--Comments-->2017 64bit 768p all - 19.5V 65W - DDR4 slot max 8Gb - keyboard swap problematic - synaptics touchpad - |- | <!--Name-->HP 14-bw022na - cmos coin battery and external battery || <!--Chipset-->AMD very slow A6-9120 APU || <!--IDE-->{{N/A}} || <!--SATA-->m.2 sata || <!--Gfx-->{{Maybe|VESA 2D for R3}} || <!--Audio-->{{no|HDAudio VOID with conexant CX7501 codec}} || <!--USB-->{{maybe|USB3 not working but port on the right works}} || <!--Ethernet-->{{yes|Realtek GbE}} || <!--Wireless-->{{No|Realtek}} || <!--Test Distro-->Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2017 64bit 768p to 900p - keyboard swap problematic - |- | <!--Name-->HP Probook 455 G4, Probook 455 G5, cmos battery on underside of mb take off back cover and below wifi card || <!--Chipset-->AMD very slow A10-9600P APU, A9-9410, A6-9210 APU || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->{{Maybe|VESA Radeon R4, R5 or R6}} || <!--Audio-->{{No|HD }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|realtek 1GbE}} || <!--Wireless-->{{no|realtek or intel Wireless-AC 7265}} || <!--Test Distro--> || <!--Comments-->2017 64bit 15.6in 768p - 2 ddr4 sodimm slots - keyboard swap problematic - rr03xl battery - |- | <!--Name-->HP ProBook 255 G6 (), easy cmos and external battery || <!--Chipset-->AMD very slow E2-9000e, A9-9420, 9220P, A4-9125 (all 2c) AMD A6-9225 AMD A9-9425 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in (possibly requires the drive cable and M.2 sata3 and internal cdrw dvdrw}} || <!--Gfx-->{{Maybe|VESA 2d for R2 R3 R4}} || <!--Audio-->{{No|HDAudio 0x1022, 0x157a or 0x1002, 0x15b3 with ALC codec 0x10EC, x0}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek rtl8169}} || <!--Wireless-->{{No|RTL8188CTV, RTL8821CE or Intel Dual Band Wireless-AC 3168}} || <!--Test Distro--> || <!--Comments-->2017 64bit 768p all - 19.5V 65W - DDR4 slot max 8Gb - keyboard swap problematic - synaptics touchpad - |- | <!--Name-->HP ProBook 255 G7 (la-g078p) - no cmos battery so needs internal battery || <!--Chipset-->AMD very slow E2-9000e, A9-9420, 9220P, A4-9125 (all 2c) AMD A6-9225 AMD A9-9425 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in (possibly requires the drive cable and M.2 sata3, most have no internal cdrw dvdrw}} || <!--Gfx-->{{Maybe|VESA 2d for R2 R3 R4}} || <!--Audio-->{{No|HDAudio 0x1022, 0x157a or 0x1002, 0x15b3 with ALC codec 0x10EC, x0}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek rtl8169}} || <!--Wireless-->{{No|RTL8188CTV, RTL8821CE or Intel Dual Band Wireless-AC 3168}} || <!--Test Distro--> || <!--Comments-->2017 64bit 768p all - 19.5V 65W - DDR4 slot max 8Gb - keyboard swap problematic - synaptics touchpad - |- | <!--Name-->ProBook 245 g8 - no cmos rtc coin battery but uses internal battery || <!--Chipset-->AMD very slow A6-9225, A4-9125, A6-8350B, A4-5350B APU || <!--IDE-->{{N/A}} || <!--SATA-->m.2 sata || <!--Gfx-->{{Maybe|VESA R4 R6}} || <!--Audio-->{{no|HDAudio}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek GbE}} || <!--Wireless-->{{No|Realtek}} || <!--Test Distro-->Deadwoods' latest usb3 test iso || <!--Comments-->2017 64bit 768p - many later variants - keyboard swap problematic - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Probook 255 G7 84AE 7DE72EA 7DE73EA (epv51 la-g076p) - CMOS Error (502) replace main internal battery HT03XL to have bios remember settings || <!--Chipset-->Ryzen 3 2200U 2300U (2c4t), R5 2500U, R7 2700U (4c8t) Raven Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{no|M.2 (Sata or NVMe) and very optional 2.5in sata, most have mini sata port}} || <!--Gfx-->{{Maybe|VESA 2d 640p to 768p for AMD Vega 3, 6, or 8}} || <!--Audio-->{{unk|HDAudio 0x1022, 0x15e3 with ALC236 0x10ec, 0x0236 codec}} || <!--USB-->{{maybe|USB3 }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no|Realtek RTL8821CE, 8822BE or Intel AC 8265}} || <!--Test Distro-->AROS x64 deadwoods' iso does not boot with cd/dvd and installed to 2.5in ssd, boots to grub choice, select but no further and reboots || <!--Comments-->2017 64bit - 12.5 to 15.6in 768p mostly to 1080p - 1 on smaller laptops or 2 ddr4 2400mhz sodimm slots on larger laptops max 16Gb - hp 4.5mm blue tip charging - keyboard swap problematic - esc boot options f9 boot order f10 bios - synaptics touchpad - |- | <!--Name-->HP EliteBook 725 G5, 735 G5, 745 G5, 755 G5, Probook 455 G6, ProBook 645 G6 || <!--Chipset-->Ryzen 3 2200U 2300U (2c4t), R5 2500U, R7 2700U (4c8t) Raven Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{no|M.2 (Sata or NVMe) and very optional 2.5in sata, some have mini sata port but no cdrw dvdrw}} || <!--Gfx-->{{Maybe|VESA 2d 640p to 768p for AMD Vega 3, 6, or 8}} || <!--Audio-->{{No|HDAudio 0x1022, 0x15e3 with ALC 0x10ec, 0x0 codec}} || <!--USB-->{{maybe|USB3 }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no|Realtek RTL8821CE, 8822BE or Intel AC 8265}} || <!--Test Distro-->Deadwoods' latest usb3 test iso does not boot software error || <!--Comments-->2017 64bit - 12.5 to 15.6in 768p mostly to 1080p - 1 on smaller laptops or 2 ddr4 2400mhz sodimm slots on larger laptops max 16Gb - hp 4.5mm blue tip charging - keyboard swap problematic - esc boot options f9 boot order f10 bios - synaptics touchpad - |- | <!--Name-->HP 14-cm, 15-bw0, HP 15-db0043na, HP 15-db0996na, HP 15-db0997na, 17-ca0007na, 17-ca1, ProBook 645 G4 - no cmos battery || <!--Chipset-->Ryzen 2200U (2c 4t) 2500U (4c 8t) with AMD Carrizo FCH 51 || <!--IDE-->{{N/A}} || <!--SATA-->{{no|1 M.2 and 1 2.5in on some larger models and hdd port }} || <!--Gfx-->{{Maybe|VESA Radeon R5 and later Vega 3 or 7}} || <!--Audio-->{{No|HDaudio 0x1002, 0x103c or 0x1022, 0x157a with Realtek ALC3227 0x10ec, 0x0282 but ATI HDMI}} || <!--USB-->{{Maybe|USB3 USB boot drive stuck on kitty's eyes}} || <!--Ethernet-->rtl8169 RTL8111E || <!--Wireless-->{{No|RTL 8723DE 8821 bios locked}} || <!--Test Distro-->2020 Icaros 2.3 USB, Deadwoods' latest usb3 test iso does not boot software error || <!--Comments-->2018 64bit 2kg - screen is dim 14in, 15.6in or 17.3" 768p or 1080p - 65W 19.5V ac adapter - internal 3-cell 41 Wh Li-ion battery does not last long - 2 ddr4 sodimm slots - no DVD-Writer - keyboard swap problematic - |- | <!--Name-->HP ProBook 250 G7, 250 G8 - no cmos battery so needs internal battery and needs usb3 boot due to garbage bios boot options || <!--Chipset-->Intel 8235U 8265U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|M.2 nvme not working, optional sata 2.5in requires LS-G072P and ribbon cable, if internal cdrw dvdrw partial boot}} || <!--Gfx-->{{Maybe|VESA 2D for Intel WhiskeyLake-U 620 GT2 UHD}} || <!--Audio-->{{No|HDAudio 0x8086, 0xa170 or 0x8086, 0x9dc8 with ALC236 codec 0x10EC, x0236}} || <!--USB-->{{maybe|Cannon Point-LP USB3.1 xHCI}} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111}} || <!--Wireless-->{{No|RTL8821CE or Intel Dual Band Wireless-AC 3168}} || <!--Test Distro-->Deadwoods' latest usb3 test iso does not boot stuck on kittys eyes || <!--Comments-->2018 64bit 1080p all - 19.5V 65W - DDR4 slot max 16Gb - keyboard swap problematic - synaptics touchpad - |- | <!--Name-->HP 255 G7 7DC73EA 2D200EA 87CE (fpp55 la-g07jp), - CMOS Error (502) replace 41.04Wh ht03xl hto3xl dynapack suzhou main battery to have bios remember settings || <!--Chipset-->'''tested''' R5 3500U (4c8t) '''untested''' mostly dual cores - AMD Athlon Gold 3150U (2c2t), Silver 3050U APU (2c2t), Ryzen 3 Pro 3145U APU, 3200U (2c4t) || <!--IDE-->{{N/A}} || <!--SATA-->{{no|1 m.2 NVMe or sata3 up to 2280, optional 2.5in sata, many have mini-sata slimline 6+7 internal port but no physical 9mm drive}} || <!--Gfx-->{{Maybe|VESA 2D from 640p to 1080p for AMD Vega 3, 6 or 8 with up to 2gb ram taken}} || <!--Audio-->{{unk|HDAudio 0x1022, 0x15e3 with realtek ALC236 codec 0x10ec, 0x0236}} || <!--USB-->{{maybe|USB3 but no usb-c}} || <!--Ethernet-->{{maybe|rtl8169 Realtek GbE RTL8111HSH}} || <!--Wireless-->{{No|Realtek 8822BE}} || <!--Test Distro-->2025 Aros One 32bit and 64bit burnt iso does not fully boot (stuck on kitty's eyes) and installed onto 2.5in on another compatible computer, sometimes has dosboot bootstrap error -6 || <!--Comments-->2018 64bit - 14in / 15.6in dim tn panel 768p or 1080p - 2 ddr4 sodimm slots max 16gb - hp 19.5V 45W 65W AC blue tip round 4.5 mm - keyboard swap problematic - synaptics touchpad - caps lock blinking 3 times then 2 quick pulses means ram or bios issue - f9 boot order f10 uefi - laptop needs usb3 to boot and use so avoid until usb3 arrives |- | <!--Name-->HP ProBook 450 G5 needs main battery for bios settings saved || <!--Chipset-->Intel i7-8550U, i5-8250U, i3-8130U, i7-7500U, i5-7200U, i3-7100U, i3-7020, i3-6006U all sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|VESA 2D for Intel UHD}} || <!--Audio-->{{unk|HDAudio with codec }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 rtl8111HSH}} || <!--Wireless-->{{no| }} || <!--Test Distro-->Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2018 64bit - 15.6 inch 768p or 1080p - HP ac psu, 1 ddr4 sodimm slot - |- | <!--Name-->[https://support.hp.com/gb-en/document/c06955717 ProBook 245 g8], Probook 445R G6, 455R G6, HP14-dk0599sa, pavilion 15-cw1511na 15-cw1507sa, HP 15s-eq1516sa no cmos battery || <!--Chipset-->AMD Athlon Gold 3150U (2c2t), Silver 3050U APU (2c2t), Ryzen 3 Pro 3145U APU, 3200U (2c4t) and 3500U (4c8t) || <!--IDE-->{{N/A}} || <!--SATA-->{{no|1 m.2 (NVMe or sata3 up to 2280), optional 2.5in sata but resets}} || <!--Gfx-->{{Maybe|VESA 2D from 640p to 1080p for AMD Vega 3, 6 or 8 with up to 2gb ram taken}} || <!--Audio-->{{unk|HDAudio 0x1022, 0x15e3 with realtek ALC codec 0x10ec, 0x0}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 Realtek GbE RTL8111HSH}} || <!--Wireless-->{{No|Realtek 8822BE}} || <!--Test Distro-->Aros || <!--Comments-->2018 64bit - 14in / 15.6in dim tn panel 768p or 1080p - 2 ddr4 sodimm slots max 16gb - hp 19.5V 45W 65W AC blue tip round 4.5 mm - keyboard swap problematic - synaptics touchpad - f9 boot order f10 uefi |- | <!--Name-->HP ProBook 450 G6 needs main battery for bios settings saved || <!--Chipset-->Intel i7-8565U, i5-8265U, i3-8165U all sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|VESA 2D for Intel UHD 620}} || <!--Audio-->{{unk|HDAudio with Realtek ALC3246 aka ALC295 codec }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 rtl8111HSH}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2019 64bit - 15.6 inch 768p or 1080p - 45W 19.5V HP ac psu - 2 ddr4 sodimm slots - |- | <!--Name-->Elitebook 735 G6 5VA23AV, Elitebook 745 G6, 255 g8, HP 15s-dy - no cmos battery || <!--Chipset-->AMD® Ryzen™ 5-3500U Ryzen 3-3300U AMD Ryzen 3-3250U AMD Athlon® Gold 3150U AMD Athlon Silver 3050U AMD 3020e || <!--IDE-->{{N/A}} || <!--SATA-->{{no|m.2 2280 nvme in legacy - hp sure start and secure boot disabled but still issues with gpt installs - LS-H323P LS-K201P}} || <!--Gfx-->{{Maybe|VESA for Vega 8, 5 or 3}} || <!--Audio-->{{No|HDAudio 6.34 ahi with realtek ALC codec 0x10EC, 0x0295}} || <!--USB-->{{maybe|USB3 type-A port boots stick partially to kitty eyes}} || <!--Ethernet-->{{Maybe|rtl8169 realtek RTL8111E or 8111H}} || <!--Wireless-->{{No|realtek or intel}} || <!--Test Distro-->2020 Icaros 2.3 onto USB and AROS One 1.8 USB, Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2019 64bit - 15.6in 1366x768 to 1920x1080 - 2 3200MHz DDR4 sodimms - 19.5V 2.31A or 20V 2.25 45W 4.5X3.0MM hp - esc bios setup, f9 boot device select - low travel keyboard - poor hw03xl or battery life - plastic hooked base with retained screws - touchpad? - |- | <!--Name-->HP ProBook 445 G7, 455 G7 || <!--Chipset-->Ryzen 3 4300U 5 4500U 4700U || <!--IDE-->{{N/A}} || <!--SATA-->1 sata and 1 nvme || <!--Gfx-->{{Maybe|VESA Vega 3}} || <!--Audio-->{{unk|HDAudio with realtek alc236 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|realtek rtl8111ep}} || <!--Wireless-->{{No|realtek RTL8822CE or intel AC 9260 or Wi-Fi 6 AX200}} || <!--Test Distro-->Deadwoods' latest usb3 test iso || <!--Comments-->2020 64bit - 14 inch 768p or 1080p - 2 ddr4 sodimm slots - smart 45w 65w hp or usb-c charging - keyboard swap problematic - RE03XL battery - |- | <!--Name-->HP ProBook 450 G7 || <!--Chipset-->Intel || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|VESA 2D for Intel UHD}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 rtl8111EP}} || <!--Wireless-->{{no| }} || <!--Test Distro-->Deadwoods' latest usb3 test iso with noacpi || <!--Comments-->2020 15.6 inch 768p or 1080p - 1 ddr4 sodimm slot - |- | <!--Name-->HP EliteBook 745 G7, 845 G7, HP 15-EH0006NA || <!--Chipset-->AMD Ryzen 3 4300U, 5 4500U, PRO 4650U || <!--IDE-->{{N/A}} || <!--SATA-->SSD M.2 || <!--Gfx-->{{Maybe|VESA AMD Radeon Vega 8}} || <!--Audio-->{{unk|Hdaudio with codec 0x10EC, 0x0257}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2020 64bit - 15.6in 1080p - 1 ddr4 sodimm slot - Bang & Olufsen speakers - keyboard swap problematic - |- | <!--Name-->HP ProBook 255 G8, HP 245 G9, ProBook 255 G9 816C2EA#ABE, - no cmos battery only internal battery || <!--Chipset-->AMD RYZEN 3 5300u, 5425U, 5 5500U 5625U, 7 5700u || <!--IDE-->{{N/A}} || <!--SATA-->{{no|NVMe}} || <!--Gfx-->{{Maybe|VESA AMD Vega 6 or 8 hdmi 1.4B}} || <!--Audio-->{{unk|HDAudio}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111HSH-CG GbE}} || <!--Wireless-->{{No|Realtek RTL8822CE or Intel}} || <!--Test Distro--> || <!--Comments-->2021 64bit - 14" to 15.6in 768p to 1080p poor gamut - 45 or 65w hp psu - 2 ddr4 sodimm slots max 16GB - keyboard swap problematic - |- | <!--Name-->HP ProBook 450 G9 || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|VESA 2D for Intel Iris Xe}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 rtl8111H}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2020 15.6 inch - 1 ddr4 sodimm slot - |- | <!--Name-->HP EliteBook 645 g7, 835 G8, 845 g8, HP ENVY x360 13 15, HP 17-cp0021na || <!--Chipset-->AMD Ryzen 5 5650U, 7 5800U, R7 Pro 5850U || <!--IDE-->{{N/A}} || <!--SATA-->NVMe || <!--Gfx-->{{Maybe|VESA 2D for AMD Radeon}} || <!--Audio-->{{unk|HDAudio 0x, 0x with ALC3247 aka ALC236 codec 0x10ec, 0x0236}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{Maybe|Realtek 1Gbe on 645 only}} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 13.3" or 14" 1080p - poor screens low nits and srgb score - 845 gets hot ue to poor cooling - slim round hp ac - keyboard swap problematic - |- | <!--Name-->HP Dev One, HP ProBook 455 G8 || <!--Chipset-->AMD Ryzen 7 5800U, R7 5850U || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit 15.6" 1080p - 2 internal sodimm slots - hp barrel charging - |- | <!--Name-->Elitebook 655 g9 669y1ut#aba, || <!--Chipset-->AMD Ryzen 5 PRO 5675U || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2021 64bit 15.6" 1080p - 1 or 2 internal sodimm slots - usb-c charging - |- | <!--Name-->HP probook 635 Aero G8 || <!--Chipset-->AMD Ryzen 5 5600U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2921 64bit - 14in 1080p - 2 ddr4 slots - ec chip nuvoton NPCX797HA1B - bios winbond 250256JYEN - |- | <!--Name-->HP PROBOOK X360 435 G8 cmos battery || <!--Chipset-->RYZEN 5 5600U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe| }} || <!--Gfx-->{{maybe|Vesa 2D }} || <!--Audio-->{{maybe|HDaudio with ALC236 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|RTL8822CE or Intel AX200}} || <!--Test Distro--> || <!--Comments-->2021 64bit - hp round ac plug - |- | <!--Name-->HP Elitebook 845 g9 || <!--Chipset-->AMD 6000 series 6850u || <!--IDE-->{{N/A}} || <!--SATA-->M.2 NVMe || <!--Gfx-->{{Maybe|VESA 2D for Vega 8}} || <!--Audio-->{{unk|HDaudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }}Qualcomm Atheros || <!--Test Distro--> || <!--Comments-->2022 64bit aluminum case - 14in 1080p to 2140p 16:10 poor screen again - 2 internal ddr5 sodimm slots - usb-c ac charging avoid any knocks - keyboard swap problematic - |- | <!--Name-->HP ProBook 445 G10, 455 G10 || <!--Chipset-->AMD Ryzen 5 7530U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Vega 7 || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2023 64bit - 15.6in - hp round ac - |- | <!--Name-->Hp 455 G11 || <!--Chipset-->AMD Ryzen 3 7335U (4c8t), 5 7535U (6c12t), 7 7735U (8c16t) || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Vega 7 || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 RTL8111HSH}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2023 64bit - 35.6 cm (14.0 in) 1920x1200 or 2560x1600 - usb-c 45w or 65w ac - 2 ddr5 sodimm slots max 32gb - |- | <!--Name--> || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |} ====IBM/Lenovo==== [[#top|...to the top]] Build quality (Lowest to highest) <pre > iSeries Edge Ideapad Thinkpad - good cases and construction but electronic internals same as anyone else </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Thinkpad 390X 390E (2626) || <!--Chipset-->Neo Magic MM2200 with C400 P2-266 to P3 500MHz || <!--IDE--> || <!--SATA--> || <!--Gfx-->use VESA || <!--Audio-->{{No|256AV or ESS Solo-1}} || <!--USB--> || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->1998 32bit |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Thinkpad 600x || <!--Chipset-->Intel 440BX || <!--IDE-->{{Maybe| }} || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA Neomagic NM2360 MagicMedia 256ZX}} || <!--Audio-->{{No|Crystal CS4297A codec}} || <!--USB--> || <!--Ethernet-->{{N/A| }} || <!--Wireless-->{{N/A| }} || <!--Test Distro-->Icaros 1.3.1 || <!--Comments-->1998 32bit a little support - earlier 600 and 600e were Pentium 2 based |- | <!--Name-->Thinkpad X20 (2662-32U) X21 || <!--Chipset-->Intel 440 BX ZX DX || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio-->{{no|AC97 with Cirrus Logic Crystal cs4281}} || <!--USB-->1.1 || <!--Ethernet-->no mini pci intel e100 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2002 32bit |- | Thinkpad T20 (2647) T21 (26) T22 || 440BX || {{Maybe| }} || {{N/A}} || {{partial|Savage IX-MV (VESA only)}} || {{no|Cirrus Logic CS 4614/22/ 24/30}} || {{yes|USB 1.1}} || {{yes|Intel PRO 100}} || {{N/A}} || Icaros 1.2.4 || 2002 32bit |- | <!--Name-->A21e (2628, 2655) A22e || <!--Chipset-->440MX || <!--IDE--> || <!--SATA--> || <!--Gfx-->Ati rage mobility || <!--Audio-->{{no|AC97 Cs4299 CS4229}} || <!--USB--> || <!--Ethernet-->intel e100 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2002 |- | Thinkpad T23 (2647) || i810 || {{yes|IDE}} || {{N/A}} || {{maybe|S3 Super Savage IX/C SDR (VESA only)}} || {{maybe|AC'97 CS4299}} || {{yes|USB 1.1}} || {{yes|Intel ICH3 PRO 100 VE}} || {{no|Realtek RTL8180L others with bios hacking risky}} || || 2003 32bit with some support |- | <!--Name-->Thinkpad X22 X23 X24 || <!--Chipset-->830 || <!--IDE--> || <!--SATA--> || <!--Gfx-->ATi Mobility M6 LY || <!--Audio-->Ac97 CS4299 || <!--USB-->2 x 1.1 || <!--Ethernet-->Intel Pro 100 || <!--Wireless-->Actiontec Harris Semi Intersil Prism 2.5 (X23 and X24 only) || <!--Test Distro--> || <!--Comments-->2003 32bit with slice Ultrabase X2 - |- | <!--Name-->A30 A30p || <!--Chipset-->830 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Ati Radeon M6 || <!--Audio-->AC97 CS 4299 || <!--USB--> || <!--Ethernet-->Intel Pro 100 ve || <!--Wireless-->{{No|Intel 2200 bios locked}} || <!--Test Distro--> || <!--Comments-->2003 32bit |- | <!--Name-->A31 A31p R31 R32 T30 || <!--Chipset-->830 || <!--IDE-->{{yes| }} || <!--SATA-->{{N/A| }} || <!--Gfx-->Ati Radeon 7500 or FireGL || <!--Audio-->{{yes|AC97 Intel with AD1881A codec}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{yes| Intel Pro 100 ve}} || <!--Wireless-->{{No|Intel bios locked}} || <!--Test Distro-->[https://forums.lenovo.com/t5/Android-Ecosystem-Developers/AROS-An-operation-system-inside-Android/td-p/1441741 Icaros 1.5.2] || <!--Comments-->2003 32bit Also tested with Icaros 2.0.3. |- | Thinkpad X30 (2673) X31 (2884-xx2) X31t || i830 || {{yes}} || {{N/A}} || {{maybe|VESA only Radeon M6 Mobility}} || {{yes|AC97 - AD1981B codec}} || {{yes|USB 1.1}} || {{yes|Intel PRO 100}} || {{no|Cisco Aironet or Intel 2915 but atheros with bios hacking}} || Icaros 1.4 || 2004 32bit sound bit distorted |- | <!--Name-->R50e R51 || <!--Chipset-->855M || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|Intel 855M use VESA}} || <!--Audio-->intel AC97 with AD1981B codec || <!--USB--> || <!--Ethernet-->{{Yes|Intel 100 VE}} || <!--Wireless-->{{No|Intel PRO Wireless 2200BG bios locked}} || <!--Test Distro--> || <!--Comments-->2004 32bit - |- | IBM Thinkpad T40 (2373) T41 T41p (2379) T42 T42p T43 T43p || Intel 8xx || {{partial|PIO}} || {{N/A}} || {{partial|ATI mobility 7500 9000 (VESA only)}} || {{yes|AC97 playback}} || {{yes|uhci 1.1 and ehci 2.0}} || {{no|e1000}} || {{Maybe|Intel 2200bg bios locked but possible AR5BMB-44 AR5212 FRU 39T0081 mini PCI}} || Icaros 1.2.4 || 2004 32bit 16v IBM plug - Centrino Needs ATA=nodma option - issues with the inner chip of the SMT BGA graphics chip |- | Thinkpad X32 || i855 || {{yes|40, 60 or 80GB 2.5" PATA HDD}} || {{N/A}} || {{maybe|VESA only ATI Mobility Radeon 7000 with 16MB}} || {{maybe| Intel AC'97 Audio with a AD1981B codec}} || {{yes|USB}} || {{no|Intel 1000}} || {{no|Intel 2200 but atheros with bios hacking}} || 2016 Icaros 2.1 || 2004 32bit - 12.1" TFT display with 1024x768 resolution; 256 or 512MB PC2700 memory standard (2GB max) |- | <!--Name-->Thinkpad X40 X40t by Quanta || <!--Chipset--> || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->{{maybe|Intel 800 (VESA only)}} || <!--Audio-->{{yes|AC97 AD1981B}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|Intel e1000}} || <!--Wireless-->{{Maybe|Intel but most atheros with bios hacking - difficult though}} || <!--Test Distro--> || <!--Comments-->2004 32bit last IBM design |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Thinkpad X41 (IBM) MT 1864 1865 2525 2526 2527 2528 x41t (Lenovo) MT 1866 1867 || <!--Chipset-->Intel with single core 1.5 1.6 and tablet 1.2GHz || <!--IDE-->{{yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|Intel 915GML 2D}} || <!--Audio-->{{yes|AC97 AD1981B}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|Broadcom BCM5751M tg3}} || <!--Wireless-->{{Maybe|Intel or MiniPCI Wi-Fi Atheros AR5BMB FRU 39T0081 but ordinary atheros 54meg needs risky bios hacking}} || <!--Test Distro--> || <!--Comments-->2005 32bit - amongst first Lenovo design - 3pin cmos - |- | <!--Name-->R52 (most 18xx) || <!--Chipset-->Intel 915 || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|Intel 915GML 2D}} || <!--Audio-->{{yes|AC97 AD1981B}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|Broadcom}} || <!--Wireless-->{{no|Broadcom bios locked}} || <!--Test Distro--> || <!--Comments-->2005 32bit |- | <!--Name-->R52 1846, 1847, 1848, 1849, 1850, 1870 || <!--Chipset-->ATi 200m || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{No|ATI}} || <!--Audio-->{{yes|AC97 AD1981B}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|Broadcom BCM5751M tg3}} || <!--Wireless-->{{no|Broadcom bios locked}} || <!--Test Distro--> || <!--Comments-->2005 32bit |- | <!--Name-->Thinkpad T60 T60P * 64bit - 6 or 8 is 16:10 on T60/p, eg. 8742-CTO 15.4" * 32bit - 1 and 2 are 14", 15" 4:3, like 2007-YM3 or 1952-CTO || <!--Chipset-->*any* T60/p will take a Core 2 Duo CPU with newer BIOS || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->Intel GMA (2D) with "p" graphics card (ATi V5200 or V5250) || <!--Audio-->{{no|HD Audio}} || <!--USB-->{{yes}} || {{no|e1000e 82573L}} || <!--Wireless-->{{No|Intel ipw3945 ABG but atheros with Middleton's or Zender BIOS hacking risky}} || Icaros 1.4 || <!--Comments-->2006 - |- | <!--Name-->X60 x60s x60t tablet || <!--Chipset-->945GMS 940GML || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{yes|Intel GMA (2D)}} || <!--Audio-->{{no|AD1981 HD Audio}} || <!--USB-->{{yes}} || <!--Ethernet-->{{no|Intel}} || <!--Wireless-->{{no|Intel 3945 ABG or fru 39T5578 Atheros 5K AR5BXB6 ar5007eg with bios hacking}} || <!--Comments-->Icaros 1.4 || 2006 32bit - perhaps needs a zendered bios update but risky |- | <!--Name-->R60 R60e || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->intel 950 with optional radeon x1300 x1400 || <!--Audio-->HD Audio with 1981HD codec || <!--USB--> || <!--Ethernet-->Intel or Broadcom || <!--Wireless-->{{Maybe|Intel 3945 or atheros fru 39T5578 bios locked}} || <!--Test Distro--> || <!--Comments-->2006 32bit |- | Thinkpad T61 T61p without Middleton's or Zender BIOS || Core 2 Duo CPU T7300 T8300 || {{N/A}} || <!--SATA-->{{yes| }} || Intel GMA (2D), NVS 140m or Quadro FX 570M () || {{maybe|HD Audio with Analog Devices AD1984 or AD1984A HD Audio Codec routed to the line output}} || <!--USB-->{{yes}} || {{no|intel e1000e 82573L}} || {{No|Intel but atheros with bios hacking risky}} || Icaros 1.6, AROS One || 2007 64bit |- | <!--Name-->X61 x61s X61T Tablet || <!--Chipset-->Core Duo T8100 on i965 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{yes|Intel GMA 3100 (2D) slow 3D}} || <!--Audio-->{{no|AD1984 HD Audio}} || <!--USB-->{{yes|USB 2.0}} || <!--Ethernet-->{{no|Intel 82566DM}} || <!--Wireless-->{{maybe|Atheros AR5212 (some revisions use Intel WLAN runs very hot) bios locked}} || <!--Test Distro--> || <!--Opinion-->2007 64bit ultrabook running very hot - ddr2 max 4gb - 3pin cmos - |- | <!--Name-->R61 R61i || <!--Chipset-->Intel 965 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->intel 965 || <!--Audio-->HD Audio with conexant codec || <!--USB--> || <!--Ethernet-->Broadcom BCM5787M || <!--Wireless-->{{No|Intel 3945 bios locked}} || <!--Test Distro--> || <!--Comments-->2008 64bit |- | Lenovo 3000 N200 || <!--Chipset-->Santa Rosa || {{N/A}} || <!--SATA-->{{maybe| }} || {{yes|Geforce 7300 (2D)}} || {{yes|ALC262 HD Audio}} || <!--USB-->{{yes}} || {{no|Broadcom}} || {{no|Intel 3945 bios locked}} || Icaros 1.4 || 2007 64bit 3D graphics parts are supported but buggy. |- | Lenovo 3000 N200 / V200 || GM965 ICH9-M with Intel Mobile Core 2 Duo T5450 || {{N/A}} || <!--SATA-->{{maybe| }} || {{yes|X3100 (2D)}} || {{Maybe|HD Audio ALC269VB or CX20549}} || {{yes| }} || {{no|BCM5906M}} || {{no|Intel 3965 / 4965AGN bios locked}} || Icaros 1.4.1 2.1 || 2007 64bits of laptop works |- | <!--Name-->X300 || <!--Chipset-->Core 2 Duo Merom SL7100 1.2GHz || <!--IDE-->{{N/A}} || <!--SATA-->1.8 inch || <!--Gfx-->{{maybe|Intel X3100}} || <!--Audio-->HD Audio AD1984A || <!--USB--> || <!--Ethernet-->Intel || <!--Wireless-->{{No|Intel 4965 bios locked}} || <!--Test Distro--> || <!--Comments-->2007 64bit 13.3" TFT 1440x900 (WXGA+) with LED backlight |- | <!--Name-->Thinkpad Edge 11″ AMD K325 || <!--Chipset-->M880G || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{maybe|VESA for ATI HD4200}} || <!--Audio-->{{maybe| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 8111}} || <!--Wireless-->{{no|8192CE (Realtek 8176) bios locked}} || <!--Test Distro--> || <!--Comments-->2007 little support |- | <!--Name-->Thinkpad X301 || <!--Chipset-->Core 2 Duo Penryn SU9400 Su9600 with GM45 chipset || <!--IDE-->{{N/A}} || <!--SATA-->1.8 inch micro SATA (uSATA) || <!--Gfx-->{{maybe|Intel X4500}} || <!--Audio-->AD1984A || <!--USB--> || <!--Ethernet-->Intel || <!--Wireless-->{{No|Intel 5xxx WiFi link 5100, 5150, 5300 and 5350 (WiMAX) bios locked}} || <!--Test Distro--> || <!--Comments-->2009 WXGA+ (1440×900) LED backlight display - 2774 or 4057 Alps and 2776 Synaptics touchpad - optical bay interface is Legacy IDE (PATA) - Addonics ADMS18SA, Lycom ST-170m |- | <!--Name-->X100e || <!--Chipset-->AMD Athlon Neo Single-Core (MV-40) and dual cores || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|2.5in tray in ide mode in bios}} || <!--Gfx-->{{Maybe|Vesa ATI HD3200}} || <!--Audio-->{{yes|HD Audio with CX20582 codec playback}} || <!--USB-->{{Maybe| }} || <!--Ethernet-->{{Yes|Realtek 8111}} || <!--Wireless-->{{no|Realtek r8192se bios locked}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2009 64bit 11.6in 1366 x 768 - 20v 65W round barrel - enter f1 setup f11 diagnostics f12 boot list - runs very warm - |- | <!--Name-->SL400 SL500 || Intel || {{N/A}} || {{Yes|IDE mode}} || {{Maybe|Nvidia 9400M}} || {{Maybe|ALC269}} || {{yes|USB 2.0}} || {{Maybe|RTL8169}} || {{Maybe| bios locked}} || || |- | <!--Name-->SL410 SL510 || 965 || {{N/A}} || {{maybe|IDE mode}} || {{maybe|Intel GMA X4500M (some 2D)}} || {{yes|HD Audio with ALC269 codec - speaker and ear phones}} || {{yes|USB 2.0}} || {{yes|RTL8169}} || {{Maybe| bios locked}} || [http://www.amiga.org/forums/showpost.php?p=645774&postcount=28 Icaros 1.3] || 2009 64bit SL-410 |- | <!--Name-->T400 ODM Wistron || <!--Chipset-->i || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{Maybe|Intel 4500MHD works limited 2d no 3d - optional switchable Nvidia or ATi HD3470 untested}} || <!--Audio-->{{Yes|HD Audio with Codec CX20561 (T400)}} || <!--USB--> || <!--Ethernet-->{{no|Intel e1000e}} || <!--Wireless-->{{No|Intel Wifi Link 5100 (AGN) half height card with FRU 43Y6493 or 5300 bios locked}} || <!--Test Distro--> || <!--Comments-->2009 64bit 20v lenovo plug - non-free firmware required iwlwifi |- | <!--Name-->T400s || <!--Chipset-->i || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{Maybe|VSEA for Intel 4500MHD works limited 2d no 3d}} || <!--Audio-->{{Maybe|HD Audio with CX20585}} || <!--USB--> || <!--Ethernet-->{{no|Intel e1000e}} || <!--Wireless-->{{No|Intel Wifi Link 5100 (AGN) half height card with FRU 43Y6493 or 5300 bios locked}} || <!--Test Distro--> || <!--Comments-->2009 64bit non-free firmware required iwlwifi |- | <!--Name-->Lenovo T500 T510 || <!--Chipset-->i || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{maybe|VESA for switchable Intel / AMD HD 3640}} || <!--Audio-->{{maybe|Intel HD Audio with a CX20561 (t500) and CX20585 (T510) codec}} || <!--USB--> || <!--Ethernet-->{{no|Intel }} || <!--Wireless-->{{no|Intel or Lenovo branded unit Atheros AR5007EG AR5BHB63 bios locked}} || <!--Test Distro--> || <!--Comments-->2009 64bit |- | <!--Name-->X200 ODM Wistron [http://itgen.blogspot.co.uk/2008/12/installing-arch-linux-on-lenovo.html X200s] and x200t tablet model without [http://fsfe.soup.io/post/590865884/the-unconventionals-blog-English-Flashing-Libreboot-on Risky flash of the Libreboot BIOS] || <!--Chipset-->GM45 GS45 with slow Celeron, SU or faster SL Core 2 Duos CPUs || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{maybe||Intel GMA 4500 MHD 2D but slow software 3D tunnel 10 gearbox 8 tests}} || <!--Audio-->{{yes|Intel HD Audio with Conexant CX20561 codec playback}} || <!--USB-->{{{Yes|USB 2.0 USB SD card reads and writes}} || <!--Ethernet-->{{no|Intel 82567LM Gigabit}} || <!--Wireless-->{{no|Intel Pro 5100 5150 5300 5350 AGN due to whitelist prevention bios locked}} || <!--Test Distro-->Icaros 2.0.1 || <!--Comments-->2009 64bit 12.1" CCFL (webcam version) or LED backlit (no webcam). no support for 54mm express cards or Authentec 2810 fingerprint reader - thinkpoint only no trackpad - 3pin cmos - |- | <!--Name-->Lenovo T410 T410s T410si || <!--Chipset-->qm57 with i5 m || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{maybe|use vesa Intel 5700MHD (Ironlake) core processor igp with optional Nvidia Quadro NVS 3100M}} || <!--Audio-->{{yes|HD Audio Conexant CX20585 codec playback}} || <!--USB-->{{Yes|2.0}} || <!--Ethernet-->{{no|Intel 82577lm gigabit}} || <!--Wireless-->{{unk|Intel n 6200 or Atheros AR9280 AR5BHB92 half size minipcie bios locked}} || <!--Test Distro-->Icaros 2.2 xmas || <!--Comments-->2009 64bit battery life much lower with Nvidia graphics version - no support firewire ricoh r5c832 - ricoh sd card - series 5 3400 |- | <!--Name-->X201 X201s x201t || <!--Chipset-->QM57 Core i3 370m, i5 M520 2.4GHz or i7 620LM 2.0GHz || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{Maybe|vesa 2d on Intel GMA HD}} || <!--Audio-->{{yes|Intel HD with [https://ae.amigalife.org/index.php?topic=94.0 Conexant 20585] codec}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no|Intel}} || <!--Wireless-->{{No|bios locked}} || <!--Test Distro--> || <!--Comments-->2010 X201 arrandale power consumption limits battery life to 3-4 hours for 48Whr though to 6 on 72Whr - 12.5" WXGA - 3pin cmos - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Ideapad B470, B570, V370, V470, V570 || <!--Chipset-->Intel® Core™ i5 i5-2430M, i5-2450M, || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->Vesa 2d for Intel || <!--Audio-->HDaudio 0x8086, 0x1c20 with codec || <!--USB-->USB3 || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no|whitelisted}} || <!--Test Distro--> || <!--Comments-->2011 64bit - 14in or 15.6in 768p - |- | <!--Name-->T420 type 4180 4236, t420s , T520 4239 L520 || <!--Chipset-->i5 2540, 2520 or i7 2860QM 2620 has sse4.1 avx || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS but not AHCI}} || <!--Gfx-->{{Maybe|Vesa 136 x 768 - Intel HD 3000 with optional NVS 4200M Nvidia optimus or Radeon HD 565v }} || <!--Audio-->{{Yes|HD Audio playback ear phones only with Conexant CX20672 codec - AHI 6.27}} || <!--USB-->{{Maybe| }} || <!--Ethernet-->{{No|Intel PRO 1000 82579LM}} || <!--Wireless-->{{No|Realtek 1x1, Intel Ultimate-N 6205 6250 2x2 6300 3x3 all bios locked}} || <!--Test Distro-->Icaros 2.2.2 add noacpi to grub boot options || <!--Comments-->2011 64bit - screen 1600x900 or 1366x768 - 2 ddr3l sodimm slots max 16gb - |- | <!--Name-->Thinkpad W520 || <!--Chipset--> has sse4.1 avx || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS}} || <!--Gfx-->{{Maybe|VESA Intel HD 3000 with nvidia quadro 1000m 2000m optimus issues with Nvidia Intel hybrids}} || <!--Audio-->{{Maybe|Intel Hd with CX 20585 codec}} || <!--USB--> || <!--Ethernet-->{{No|Intel 82579 Lm}} || <!--Wireless-->{{No|Intel 6000s}} || <!--Test Distro--> || <!--Comments-->2011 64bit - 15.6" TFT display with 1366x768 (HD), 1600x900 (HD+) or 1920x1080 (FHD) resolution with LED backlight |- | <!--Name-->X220 x220t || <!--Chipset-->QM67 express, dual i5 2520M or i7 dual 2620M sse4.1 avx support || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|IDE in BIOS but not AHCI}} || <!--Gfx-->{{Maybe|VESA 2D 1024 x 768 for Intel HD Graphics 3000}} || <!--Audio-->{{Yes|Intel HD playback with Conexant 20672 codec ear phones and speaker - AHI 6.27 6.34}} || <!--USB-->{{Yes|USB 2.0}} || <!--Ethernet-->{{No|Intel 82579LM}} || <!--Wireless-->{{No|Intel Centrino Advanced-N 6205 Wi-Fi bios locked}} || <!--Test Distro-->Icaros 2.3, Aros One USB 1.6 || <!--Comments-->2011 64bit possible - uses slimmer 7 mm storage sata devices - NEC USB 3.0 on i7's - unwanted trackpad gestures when palms rests on it - 2 ddr3 sodimm slots - external battery - |- | <!--Name-->Thinkpad X120e, x121e Quanta FL8A DAFL8AMB8D0 Rev D || <!--Chipset-->Hudson M1 with slow AMD E350 has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA ATI 0x9802}} || <!--Audio-->{{Maybe|ATI SBx00 Azalia HD Audio}} || <!--USB-->USB 2.0 || <!--Ethernet-->RTL8169 RTL8111 || <!--Wireless-->{{no|Broadcom 0x0576 bios locked}} || <!--Test Distro--> || <!--Comments-->2011 64bit 11.6 inch screen - 1 inch think - chiclet keyboard |- | <!--Name-->Ideapad S205 G575 G585, Edge 11 E325 || <!--Chipset-->Slow E-350 later E-450 with A75 or AMD Athlon II Neo has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA HD6310}} || <!--Audio-->{{Yes| }} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Atheros}} || <!--Wireless-->{{No|Broadcom}} || <!--Test Distro--> || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - removeable and plug in battery - 2pin CR2032 CMOS battery - |- | <!--Name-->Ideapad S206 || <!--Chipset-->AMD E300 1.3GHZ Dual has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->{{Maybe|Intel HD Audio with CX20672 codec}} || <!--USB-->{{Maybe|3.0}} || <!--Ethernet-->Broadcom 10/100 || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 11.6" and integrated battery - Conexant® |- | <!--Name-->Lenovo x130e or x131e edu || <!--Chipset-->Slow AMD E-300 or E-450 has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA Radeon HD 6310 or 6320 }} || <!--Audio-->{{Maybe|HD Audio Realtek ALC269VC / ALC3202 codec}} || <!--USB-->{{Maybe|USB 30 and USB 20}} || <!--Ethernet-->{{maybe|Realtek RTL8111 RTL8168B}} || <!--Wireless-->{{No|Realtek RTL8188CE or Broadcom BCM43228 bios locked}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - rubber edged bumper for K12 education market - 2pin CR2032 CMOS battery - |- | <!--Name-->Thinkpad Edge E135 E335 || <!--Chipset-->amd dual E-300, E2-1800 or E2-2000 slow atom like A68M FCH has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|SATA 3.0Gb/s 2.5" wide 7mm high}} || <!--Gfx-->{{Maybe|VESA radeon 6310 or 7340 vga or hdmi}} || <!--Audio-->{{Maybe|HDAudio with Realtek ALC3202 codec}} || <!--USB-->{{maybe|2 usb3, 1 powered usb2}} || <!--Ethernet-->{{maybe|rtl8169 8111f}} || <!--Wireless-->{{no|Realtek WLAN whitelist bios locked}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 11.6 inch to 13.3in 1366x768 - Acrylonitrile-Butadiene-Styrene (ABS) plastic case - external battery - 20v 65w lenovo barrel ac - 2 ddr3 sodimm 8Gb max - |- | <!--Name-->ThinkPad Edge E525 E535 LENOVO IDEAPAD Z575 || <!--Chipset-->AMD A6-3420M A8-3500M later A8-4500M has no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA AMD 6620G later 7640G}} || <!--Audio-->{{No|HDAudio with Conexant codec}} || <!--USB-->{{Maybe|USB2 but not usb3}} || <!--Ethernet-->{{maybe|rtl8169 Realtek 8111}} || <!--Wireless-->{{No|Broadcom bios locked}} || <!--Test Distro--> || <!--Comments-->2013 64bit does not support AVX or SSE 4.1 - 15.6in 1368 x 768 matt - 65W 20v lenovo round psu - thick desktop replacement - ThinkPad Edge E520 E520S E525 E530 E545 E535 E530C Laptop Keyboard swap - |- | <!--Name-->T430 t430i T530 || <!--Chipset-->ivy bridge i5 3320 3230m on Intel QM77 has sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA 1366 x 768 for Intel HD 4000 with optional Nvidia 5400M}} || <!--Audio-->{{Maybe|Intel HD with Realtek ALC3202 aka ALC269VC codec playback ear head phones - HDA 6.27}} || <!--USB-->{{Yes|USB 2 ports and usb2.0 devices thru usb 3.0 ports}} || <!--Ethernet-->{{No|Intel e1000}} || <!--Wireless-->{{unk|Intel or Atheros AR9285 bios locked}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2013 64bit fan noise and chiclet keyboard, synaptics trackpad - HD+ 768p - |- | <!--Name-->Thinkpad X230 x230t || <!--Chipset-->Intel QM67 express i5 has sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->{{Maybe|Intel HD with ALC269 aka ALC3202}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|Intel }} || <!--Wireless-->{{No|I}} || <!--Test Distro--> || <!--Comments-->2013 64bit - 12.2 in 1366 x 768 - 2 ddr3 sodimm slots - external battery - |- | <!--Name-->Thinkpad T440 t440s t440p T540 L440 L540 || <!--Chipset-->intel haswell 8 series Core i3 to i7 has sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata}} || <!--Gfx-->{{Maybe|VESA - Intel 4600 or Nvidia}} || <!--Audio-->Intel HD with Realtek ALC3232 alc269 codec or ALC292 || <!--USB-->{{maybe| }} || <!--Ethernet-->{{No|Intel}} || <!--Wireless-->{{No|Intel AC 7260 bios locked}} || <!--Test Distro--> || <!--Comments-->2014 64bit - 14 and 15" models with glitchy trackpad and no physical buttons - keyboard repair not easy as well as 4 variants of key caps - 2pin CR2032 CMOS battery - |- | <!--Name-->Thinkpad X240 x240t ultrabook TN (20AL0081GE), HD IPS display without touch (20AL007NGE) and touch (20AL0076GE) but all 65% sRGB || <!--Chipset-->haswell i7-4600U i5 4200U 4210U 4300U i3-4100U - two batteries, one internal 3cell 45N1110 (45N1111) or 45N1112 (FRU 45N1113) and external 3 / 6cell 45N1126 (FRU 45N1127) || <!--IDE-->{{N/A}} || <!--SATA-->2.5in 7mm sata (torq t7), m.2 2242 in WWAN slot (m and b key NGFF Sata) || <!--Gfx-->{{Maybe|use VESA for Intel 4400 for vga or mini-dp}} || <!--Audio-->{{No|HDAudio 0x8086, 0x0a0c 0x8086, 0x9c20 with Realtek ALC3232 aka ALC292 0x10ec, 0x0292}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{no|Intel® 82577LM Gigabit (Hanksville) }} || <!--Wireless-->{{no|Realtek or Intel 7260n I218-V or I218-LM bios locked}} || <!--Test Distro-->AROS One USB || <!--Comments-->2014 64bit - 12.2in 1366 x 768 or 1080p - 1 ddr3l sodimm slot - no keyboard spill drainage and at least 2 variants of key caps - lenovo rectangle pwr ac - TPM 1.2 - Bluetooth 4.0 no support - bottom panel with 8 retained screws - 2pin CR2032 CMOS battery - |- | <!--Name-->ThinkPad Edge E545 * key cap swap with E440 E531 E540 L440 L450 T431S T440S T440P T540 * Keyboard swap L540 T540p W540 Edge E531 E540 W541 T550 W550S L560 P50S T560 || <!--Chipset-->AMD Socket FS1r2 A6-5350M (2c2t) or A8-4500M, A8-5550M, A10-5750M (4c4t) with A76M FCH has sse4.1 and avx || <!--IDE-->{{N/A}} || <!--SATA-->2.5in 9.5mm - enter UEFI bios with Enter or ESC, config section, sata into compatibility and security, secure boot disabled - mini sata DVD burner PLSD DS8A9SH || <!--Gfx-->{{Maybe|VESA 2D for AMD 7640G, 8450G, 8550G, 8650G ?? Islands}} || <!--Audio-->{{no|VOID for HDAudio 6.34 0x1022, 0x780d with Conexant CX20590 Analog 0x14f1, 0x506e CX20671 codec 0x14f1, 0x5069 or audio over Trinity HDMI}} || <!--USB-->{{maybe|boots pen drives from yellow usb port but not from blue USB3 ones, issues with AMD usb3 hardware quirks}} || <!--Ethernet-->{{yes|rtl8169 1GbE 8111F}} || <!--Wireless-->{{No|Broadcom BCM43142 bios locked}} || <!--Test Distro-->AROS One 2.3 USB works with noacpi added to end of grub2 boot line but not booting on AROS One 64bit 1.1 via usb2 stick or iso burnt to dvd || <!--Comments-->2015 64bit - 15.6in 1366 x 768 matt - 20v 65w 90w round lenovo plug psu - 2 DDR3 SODIMM slots 16GB Max - external 6 Cell Li-Ion Battery 48Wh l11s6y01 45n1043 - 2pin CR2032 CMOS battery in wifi area jp1202 - amd v(tm) virtualization not working - |- |<!--Name-->Y50-70 || <!--Chipset-->Intel 4 || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->GTX 860M or GTX 960M || <!--Audio-->HDAudio || <!--USB-->USB3 || <!--Ethernet-->{{maybe|rtl8169 rtl8111}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2015 64bit - |- |<!--Name-->AMD platform codes *Beema: ABM, *Carizzo-L: ACL, *Carizzo: ACZ, *Godavari: AGR, *Kaveri: AKV, *Stoney Ridge: ASR, *Stoney Ridge: AST (NB), || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> *Summit Ridge: ASU, *Bristol Ridge-L: ABL, *Bristol Ridge: ABR, *Raven Ridge: ARR, *Picasso: API |- |<!--Name-->Lenovo ThinkPad P50 || <!--Chipset-->Intel i7-6820HQ || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->Quadro M2000M || <!--Audio-->HDAudio || <!--USB-->USB3 || <!--Ethernet-->{{no|Intel}} || <!--Wireless-->{{no|Intel }} || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name-->[https://www.laptop-schematics.com/db/78/V%20series%20laptops%20(Lenovo)/ V110-14AST (14in) V110-15AST, V110-14ISK V110-15ISK 80TL (15")], || <!--Chipset-->AMD E1-9000, A6-9210 to A9-9410 all dual core and intel 6006u, 6100u, 6200u || <!--IDE-->{{N/A}} || <!--SATA-->1 2.5in sata most 7mm some 9.5mm || <!--Gfx-->{{Maybe|VESA 2D for AMD R2, R3, R5 or R6 or Intel Gfx}} || <!--Audio-->{{No|HDAudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2016 64bit - 14in to 15.6in mostly 768p 220 nits - 20v 45W or 65W lenovo slim rectangle end ac - keyboard swap hard - integrated 24WHr battery - 4gb ddr4 ram soldered and 1 2133Mhz ddr4 slot max 12Gb - abs plastic - |- |<!--Name--> *ThinkPad A275 12in (1 ddr4 1866MHz sodimm) *Thinkpad A475 14in (2 ddr4 1866MHz sodimm) - both internal (main) and external (secondary) battery || <!--Chipset-->A10-8730B A10-9700B 2.500Ghz later A12-8830B A12-9800B all 4c4t (AVX2 on 9000s) || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe|7mm 2.5in sata with mbr and not gpt, setup in another machine - secure boot disabled, bios startup boot set to legacy then uefi - WWAN slot cannot use M.2 2242 sata with M and B key}} || <!--Gfx-->{{Maybe|VESA 2D for AMD R5 or R7}} || <!--Audio-->{{No|HDAudio 6.34 ahi 0x1022, 0x157a with ALC3268 aka ALC298 codec 0x10ec, 0x0298 - VOID even with QUERY / QUERYD added}} || <!--USB-->{{no|USB3 error on boot suspect AMD usb3 quirk}} || <!--Ethernet-->{{Yes|rtl8169 RTL8111EPV}} || <!--Wireless-->{{No|Realtek RTL8822BE WLAN whitelist locked cannot swap}} || <!--Test Distro-->{{maybe|AROSOne USB 32bit 1.8 with noacpi noapic noioapic added to grub2 boot line but Aros One 64bit 1.2 USB has krnPanic }} || <!--Comments-->2016 64bit 12 or 14in 768p - 45W or 65w lenovo rectangle ac adapter - F1 enter bios and F12 boot order - 6 retained screws and snap on base - 2100 error message no solution except using only efi/gpt bios option - |- |<!--Name-->320S-15AST, 320S-15ABR, ideapad Slim 1-11AST-05 81VR || <!--Chipset-->AMD A6-9220e, AMD A6-9225, A9-9425, A10-9600P 7th Gen || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in}} || <!--Gfx-->{{maybe| Vesa 2D for AMD}} || <!--Audio-->{{No| }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No|Qualcomm Atheros QCA9377 or Realtek RTL8821CE}} || <!--Test Distro--> || <!--Comments-->2018 64bit AVX2 - 14in or 15.6" 768p - 1 ddr4 sodimm slot - keyboard swap problematic - |- |<!--Name-->Lenovo Ideapad S145-14AST S145-15AST 81N3 || <!--Chipset-->AMD A6-9225, A9-9425, A10-9600P 7th Gen, AMD A12-9720P Mobo 5B20P11110 NMB341 Bristol Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in}} || <!--Gfx-->{{Maybe|VESA Radeon 8670A 8670M 8690M GCN 3}} || <!--Audio-->{{No| }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No|Qualcomm Atheros QCA9377 or Realtek RTL8821CE}} || <!--Test Distro--> || <!--Comments-->2018 64bit AVX2 - 14in or 15.6" 768p or 1080p - 1 ddr4 sodimm slot - |- |<!--Name-->Lenovo Ideapad V145-14AST V145-15AST, 81mt, Ideapad 310, Ideapad 320-15ABR, Ideapad 330-14AST 330-15AST 330-17AST || <!--Chipset-->AMD A6-9225, A9-9425 (2c2t), A10-9600P 7th Gen, AMD A12-9720P Mobo 5B20P11110 NMB341 Bristol Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|sata 2.5in with optional dvd}} || <!--Gfx-->{{Maybe|VESA Radeon 8670A 8670M 8690M GCN 3}} || <!--Audio-->{{unk|HDaudio with ALC3240-va3-cg aka ALC236? codec 0x10de, 0x0236}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{no|rtl8169 8106E 10/100 only}} || <!--Wireless-->{{No|Qualcomm Atheros QCA9377 or Realtek RTL8821CE}} || <!--Test Distro--> || <!--Comments-->2017 64bit AVX2 - 14in or 15.6" 768p or 1080p - 1 ddr4 sodimm slot - 45w 65w slim ac adapter - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- |<!--Name-->Lenovo V330-14ARR 81B1, V330-15ARR 81, 330-14ARR 81 330-15ARR 81D2 - battery internal about 30whr || <!--Chipset-->AMD Ryzen R3 2200U, 2300U or R5 2500U Raven Ridge || <!--IDE-->{{N/A}} || <!--SATA-->M.2 nvme/sata, optional 2.5in sata but no dvd || <!--Gfx-->{{Maybe|VESA Vega 3, 6 or 8 up to 1Gb of soldered ram memory taken}} || <!--Audio-->{{No|HDAudio 0x1002, 0x15de with Realtek® ALC5682I-VD codec 0x10de, 0x or coxenant CX11802 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|Realtek 1GbE}} || <!--Wireless-->{{no|Realtek}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 14" 768p 20mm thick 1.8kg - 20v 2.25a 45w ac round barrel - chiclet keyboard - 4Gb soldered and 1 ddr4 sodimm - TPM 2.0 in bios - 4GB soldered - |- |<!--Name-->Ideapad 330s-14ARR, 330s-15ARR, ideapad 330S-14IKB, 330S-15IKB, - battery internal about 30whr || <!--Chipset-->AMD Ryzen R3 2200U, 2300U or R5 2500U Raven Ridge || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|nvme}} || <!--Gfx-->{{Maybe|VESA 2D for AMD or Intel 610, 620 up to 1Gb of soldered ram memory taken}} || <!--Audio-->{{No|HD Audio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Realtek}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 14" 20mm thick 1.8kg - 20v 2.25a 45w ac round barrel - chiclet keyboard - 4Gb soldered and 1 ddr4 sodimm - TPM 2.0 in bios - 4GB soldered - |- |<!--Name-->Thinkpad Edge E485 E585 - internal battery only || <!--Chipset-->AMD Ryzen R3 2300U R5 2500U R7 2700U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|m.2 nvme optional 1 2.5in sata}} || <!--Gfx-->{{Maybe|VESA for Vega 3, 8 or 10}} || <!--Audio-->{{No|HDAudio with CX11852 codec }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 rtl8111GUS}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - 14in or 15.6in 768p or 1080p - USB-C 20V 2.25A 3.25A avoid knocking charging port as damages easily - 2 ddr4 sodimm slot max 2400Mhz 32GB - TPM 2.0 software - |- |<!--Name-->Thinkpad A285 - internal and external battery || <!--Chipset-->AMD Ryzen PRO 3 2200U 5 2500U || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|m.2 nvme/sata}} || <!--Gfx-->{{Maybe|VESA Vega up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HD Audio with ALC ALC3287 codec aka ALC257 }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{No|Mini-Ethernet/Docking}} || <!--Wireless-->{{no|Realtek or Qualcomm - WLAN whitelist no more??}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 12.5in 1080p - avoid usb-c port being lifted/moved whilst in use as damages laptop easily - soldered ram 8gb or 16gb - WWAN whitelist - keyboard swap problematic - |- |<!--Name-->Thinkpad A485 bios setting [https://github.com/PSPReverse/PSPTool AMD PSP Platform Security Processor Key] - internal and external battery || <!--Chipset-->AMD Ryzen PRO 5 2500U || <!--IDE-->{{N/A}} || <!--SATA-->sata port and m.2 nvme port || <!--Gfx-->{{Maybe|VESA Vega }} || <!--Audio-->{{unk|HD Audio with ALC ALC3287 codec aka ALC 257 }} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111GUL}} || <!--Wireless-->{{no|Realtek or Qualcomm wifi - WLAN whitelist no more??}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 14in 768p, 1080p or 1440p - avoid usb-c port being lifted/moved whilst in use as damages laptop easily - 2 ddr4 sodimm slots max 32gb - WWAN whitelist - keyboard swap problematic - |- |<!--Name-->[https://www.diy-laptoprepair.com/forum/fix-Lenovo-V155-15-repair-guide-schematics.php Lenovo v155-15api 81V5] V155 (15" AMD) budget all plastic build - MS new protocol, HID over I2C so [https://askubuntu.com/questions/1033033/elantech-touchpad-does-not-work-i2c-hid i2c] [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/input/mouse/elantech.c?h=v6.17 i2c] [https://www.kernel.org/doc/html/v4.16/input/devices/elantech.html PS2 hybrid trackpad] [https://cgit.freebsd.org/src/tree/sys/dev/atkbdc/psm.c?h=releng/14.3 elantech] [https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pckbc/?only_with_tag=OPENBSD_7_8_BASE i2c-hid] 04F3:3140 touchpad not working - internal sunwoda battery L18D3PF1, L18L3PF1, L18C3PF2 35Whr most dead after 5 years || <!--Chipset-->'''tested''' Ryzen 5 3500U and Ryzen 3 3200U - '''untested''' AMD Athlon 300U with bios winbond 25q64fwsiq soic 1.8v bios near nvme || <!--IDE-->{{N/A}} || <!--SATA-->1 M.2 nvme and usually 2.5in 7mm sata - install on mbr not gpt 2.5in in another compatible machine - mini sata dvd/cd da-8aesh11b will boot cd or dvd aros || <!--Gfx-->{{Maybe|VESA 2D to 1080p work for Vega 3 or 8 with up to 2Gb of soldered ram memory taken but hdmi 1.4b no output}} || <!--Audio-->{{Yes|HDAudio add 0x1022, 0x15E3 with ALC3287 aka Realtek ALC257 codec 0x10ec, 0x0257 with 32bit on external speaker and most of the time works on 64bit}} || <!--USB-->{{maybe|2 USB3.0, on left hand side, detected but no usb-c ports}} || <!--Ethernet-->{{yes|rtl8169 RTL8111GUS works well with 32bit and 64bit}} || <!--Wireless-->{{no|Realtek or Intel wifi}} || <!--Test Distro-->2025 AROS One 2.8 DVD 32bit and AROS One x64 1.1 and 1.2 iso DVD burnt || <!--Comments-->2019 64bit - 15.6in 768p or 1080p 200nits tn panel - 4Gb ddr4 2400MHz soldered with 1 dimm slot max 20Gb - round ac 20V 65W psu 4.0mm x 1.7mm - Fn+F2 to enter bios and F12 boot order - no sd card slot - 2pin cr2032 cmos coin battery - |- |<!--Name-->V15-ADA 82C700E4UK- elan touchpad not working - internal battery 34whr L16M2PB2 l16l2pb3 || <!--Chipset-->AMD r5 3500U || <!--IDE-->{{N/A}} || <!--SATA-->1x 2.5" HDD + 1x M.2 SSD NVMe near fan, no cd dvd || <!--Gfx-->{{Maybe|VESA 2D for Vega 3, 8 with up to 1080p with 2Gb of soldered ram memory taken}} || <!--Audio-->{{Yes|HD Audio 6.36 0x1022, 0x15E3 with R155189 ALC236 codec 0x10ec, 0x0236 on 32bit and on 64bit}} || <!--USB-->{{maybe|3 USB3, on left hand side,}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Realtek or Qualcomm wifi}} || <!--Test Distro-->2025 3500U with Aros One 32bit 2.8 installed to 2.5in drive on another machine and same for 64bit || <!--Comments-->2019 64bit - 14 or 15.6in 768p on low spec machines to 1080p - 4GB soldered with 1 ddr4 sodimm slot - 2pin cr2032 cmos coin battery - sd card slot - noisy fan - |- |<!--Name-->V15-ADA 82C7 - elan touchpad not working - internal battery 34whr L16M2PB2 l16l2pb3 || <!--Chipset-->AMD Athlon Silver 3020e, Ryzen 3 3050U, 3150U, 3250U || <!--IDE-->{{N/A}} || <!--SATA-->1x 2.5" HDD + 1x M.2 SSD NVme near fan, no cd dvd || <!--Gfx-->{{Maybe|VESA 2D for Vega 3, 8 with up to 1080p with 2Gb of soldered ram memory taken}} || <!--Audio-->{{No|HD Audio 6.36 0x1022, 0x15E3 with RTS5119 R155119 ALC230 codec}} || <!--USB-->{{maybe|3 USB3.0, on left hand side,}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Realtek or Qualcomm wifi}} || <!--Test Distro-->2025 Aros One 32bit 2.8 and 64bit || <!--Comments-->2019 64bit - 14 or 15.6in 768p on low spec machines to 1080p - 4GB soldered with 1 ddr4 sodimm slot - 2pin cr2032 cmos coin battery - sd card slot - for this mbd bios ram disable doesn't work - noisy fan - |- |<!--Name-->Lenovo V14-ADA 82C6, - elan touchpad not working - if blank black display, bios bug going from uefi->legacy so reset bios rhs push in with pin, then Down, ent, Right x3, ent, up, ent, right, ent x2 - internal battery 34whr L16M2PB2 l16l2pb3 || <!--Chipset-->'''tested''' 3250U - '''untested''' AMD Athlon Silver 3020e, Ryzen 3 3050U, 3150U - for this mbd GV451&GV551 NM-D151 bios ram disable doesn't work || <!--IDE-->{{N/A}} || <!--SATA-->1x 2.5" HDD if cbl + 1x M.2 SSD NVMe near fan, no cd dvd || <!--Gfx-->{{Maybe|VESA 2D for Vega 3 up to 1080p with 2Gb of soldered ram memory taken}} || <!--Audio-->{{no|HD Audio 6.36 0x1022, 0x15E3 with Realtek ALC3223 RTS5119 R185199 aka ALC230 codec 0x10ec, 0x0230 on 32bit and on 64bit}} || <!--USB-->{{maybe|3 USB3, on left hand side,}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Realtek or Qualcomm wifi}} || <!--Test Distro-->2025 AMD 3250U with Aros One 32bit 2.8 installed to 2.5in drive on another machine and same for 64bit || <!--Comments-->2019 64bit - 14 or 15.6in 768p on low spec machines to 1080p - 4GB soldered with 1 ddr4 sodimm slot - 2pin cr2032 cmos coin battery - sd card slot - F2 bios F12 select - |- |<!--Name-->IdeaPad 1 14ADA5 (low spec cpus) ideaPad 3 14ADA05, IdeaPad 3 15ADA05 81W100QVUK, IdeaPad 3 17ADA05 - elan touchpad not working - internal battery 34whr L16M2PB2 l16l2pb3 || <!--Chipset-->AMD Athlon Silver 3020e, Ryzen 3 3050U, 3150U, 3250U, Ryzen 5 3500U on mobo NM-C821 REV 0.2 1.0 || <!--IDE-->{{N/A}} || <!--SATA-->1x 2.5" HDD if cbl + 1x M.2 SSD NVMe near fan, no cd dvd || <!--Gfx-->{{Maybe|VESA 2D for Vega 3, 8 up to 1080p with 2Gb of soldered ram memory taken}} || <!--Audio-->{{no|HD Audio 6.36 0x1022, 0x15E3 with ALC230 codec 0x10ec, 0x0230 on 32bit and on 64bit}} || <!--USB-->{{maybe|3 USB3, on left hand side,}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Realtek or Qualcomm wifi}} || <!--Test Distro-->2025 Aros One 32bit 2.8 installed to 2.5in drive on another machine and same for 64bit || <!--Comments-->2019 64bit - 14 or 15.6in 768p on low spec machines to 1080p - 4GB soldered with 1 ddr4 sodimm slot - 2pin cr2032 cmos coin battery - sd card slot - F2 bios F12 boot select - |- |<!--Name-->Lenovo IdeaPad L340-15API 81LW001CUS L340-17API - elan trackpad not functioning - internal battery L18M3PF2 || <!--Chipset-->AMD Athlon 300U, Ryzen 3 3200U r5 3500U || <!--IDE-->{{N/A}} || <!--SATA-->1 M.2 nvme and usually 2.5in sata if ribbon cable present - mini sata dvd/cd da-8aesh11b || <!--Gfx-->{{Maybe|VESA 2D for Vega 3 or 8 with up to 2Gb of soldered ram memory taken - hdmi 1.4b}} || <!--Audio-->{{unk|HDAudio add 0x1022, 0x15E3 with Realtek ALC236 0x10ec, 0x0236}} || <!--USB-->{{maybe|USB3 not detected}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111GUS}} || <!--Wireless-->{{no|Realtek or Intel wifi}} || <!--Test Distro-->AROS One 2.8 USB - install on mbr not gpt 2.5in in another compatible machine || <!--Comments-->2019 64bit - 15.6in 768p or 1080p 200nits - 4Gb ddr4 2400MHz soldered with 1 dimm slot max 20Gb - round ac 20V 65W psu 4.0mm x 1.7mm - Return or F1 to enter bios and F12 boot order - no sd card slot - |- |<!--Name-->[https://www.laptop-schematics.com/db/78/T%20series%20laptops%20(ThinkPad)/ ThinkPad T295 T495] || <!--Chipset-->Ryzen 3 3300U, R5 Pro 3500U or R7 3700U || <!--IDE-->{{N/A}} || <!--SATA-->1 NVMe up to 2280 || <!--Gfx-->{{Maybe|VESA Vega 6, 8 or 10 up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HD Audio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111EPV}} || <!--Wireless-->{{No|Realtek RTL8822BE or Intel AC 9260}} || <!--Test Distro--> || <!--Comments-->2019 64bit - 14in 768p but mostly FHD 1080p 250 nits - internal battery - ram 8gb or 16gb 2400Mhz soldered with 1 ddr4 slot on T495 only - TPM 2.0 - usb-c charging avoid knock whilst in use - keyboard swap problematic - |- |<!--Name-->ThinkPad T495s (14in) X395 (13in) || <!--Chipset-->Ryzen 3 3300U, R5 Pro 3500U or R7 3700U || <!--IDE-->{{N/A}} || <!--SATA-->1 NVMe up to 2280 || <!--Gfx-->{{Maybe|VESA Vega 6, 8 or 10 up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HD Audio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{unk| needs Lenovo ThinkPad Ethernet Adapter Gen 2 SC10P42352 or SC10P42354}} || <!--Wireless-->{{No|Realtek RTL8822BE or Intel AC 9260 wifi}} || <!--Test Distro--> || <!--Comments-->2019 64bit - 13in or 14in 768p but mostly FHD 1080p 250 nits - internal battery - ram 8gb or 16gb 2400Mhz soldered - TPM 2.0 - usb-c charging avoid knock whilst in use - keyboard swap problematic - |- |<!--Name-->ThinkPad E14 Gen2, E15 Gen 2 (AMD) 20T8, - lenovo has a mobile phone PC Diagnostic App for error/beep codes || <!--Chipset-->AMD Ryzen 3 4300U, 5 4500U, 7 4700U || <!--IDE-->{{N/A}} || <!--SATA-->2 m.2 nvme, 1 2242 and 1 2280 || <!--Gfx-->{{Maybe|VESA 2D for AMD Radeon up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HD Audio with ALC ALC3287 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111GUS}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2020 15.6in 1080p 220 nits - TPM 2.0 - usb-c charging of internal 45Whr battery - 4gb ddr4 3200Mhz soldered and 1 ddr4 sodimm slot max 20Gb - keyboard swap problematic - plastic bendy case - |- |<!--Name-->Lenovo ThinkPad T14 Gen 1, ThinkPad P14s Gen 1 (AMD) || <!--Chipset-->AMD Ryzen 3 4300u, 5 4500U, Ryzen 5 Pro 4650U, Ryzen 7 Pro 4750U || <!--IDE-->{{N/A}} || <!--SATA-->1 NVMe || <!--Gfx-->{{Maybe|VESA 2D for AMD Vega }} || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287 0x10EC, 0x0257}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111EPV (DASH models) or RTL8111HN}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2020 64bit - USB-C charging avoid moving whilst in use - 14" or 15" 1080p - keyboard swap problematic - 8gb or 16gb 3200MHz soldered with 1 ddr4 sodimm slot - sd card slot - |- |<!--Name-->Thinkpad L14 Gen 1, L15 Gen 1, || <!--Chipset-->AMD Ryzen 3 4300u, 5 4500U, Ryzen 5 Pro 4650U, Ryzen 7 Pro 4750U || <!--IDE-->{{N/A}} || <!--SATA-->1 NVMe || <!--Gfx-->{{Maybe|VESA 2D for AMD Vega }} || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287 0x10EC, 0x0257}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{no|rtl8169 needs dongle RTL8111EPV (DASH models) or RTL8111HN}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2020 64bit - USB-C charger avoid moving whilst in use - 14" or 15" 1080p - keyboard swap problematic - 8gb or 16gb 3200MHz soldered with 1 ddr4 sodimm slot - sd card slot - |- |<!--Name-->Lenovo ThinkPad X13 Gen1 AMD, || <!--Chipset-->AMD RYZEN 3 4450U, 5 4650U or 7 4750U || <!--IDE-->{{N/A}} || <!--SATA-->One drive, up to 512GB M.2 2242 SSD or 1TB M.2 2280 SSD NVMe || <!--Gfx-->{{partial|VESA Radeon up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe| but USB-C ports can fail}} || <!--Ethernet-->{{no|Realtek RTL8111EPV, mini RJ-45 to RJ-45 via optional ThinkPad Ethernet Extension Adapter Gen 2}} || <!--Wireless-->{{no|Realtek Wi-Fi 6 RTL8852AE}} || <!--Test Distro--> || <!--Comments-->2020 13.3" HD 1366x768 to 1080p - USB-C port care needed as damages easily - Memory soldered to systemboard, no slots, dual-channel DDR4-3200 - |- |<!--Name-->Lenovo ThinkBook 14 G2, 15 G2 Are || <!--Chipset-->Ryzen 5 4500u, 7 4700U || <!--IDE-->{{N/A}} || <!--SATA-->14in has 2 m.2 nvme but 15in has 1 nvme and might have 2.5in sata metal caddy if smaller battery version || <!--Gfx-->VESA 2d for AMD Radeon up to 2Gb of soldered ram memory taken || <!--Audio-->{{unk|HDAudio with ALC???? codec 0x10EC, 0x0}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{No| wifi}} || <!--Test Distro--> || <!--Comments-->2020 64bit - 14in or 15in 1080p - usb-c charging but high failure rate on the charging port - 4gb or 8gb soldered with 1 ddr4 sodimm slot 3200mhz - hinge(s) issues - |- |<!--Name-->IdeaPad 5 14ARE05 (81YM), Ideapad 5 15ARE05 (), IdeaPad 3 17ARE05 (model 81W5) - elan touchpad MSFT0004:00 06CB:CD98 not working || <!--Chipset-->'''tested''' 4500u - '''untested''' AMD 3 4300U (4c4t), 4600U (6c12t), 7 4700u (8c16t) on AMD Promontory Bixby FCH || <!--IDE-->{{N/A}} || <!--SATA-->{{no|1x M.2 2242 slot and 1x M.2 2280 NVMe which will take sata m.2 will boot to grub then laptop reset after choice}} || <!--Gfx-->{{Maybe|VESA 2D for Vega 6 via hdmi output up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HDAudio 6.36 0x1637 0x15e3 with Realtek ALC3287 aka ALC257 codec 0x10ec 0x0257}} || <!--USB-->{{maybe|USB 3.1 or 3.2 gen 1}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Intel ax200 wifi 6}} || <!--Test Distro-->4500u with AROS One 64bit 1.2 usb installed to m.2 sata on another machine || <!--Comments-->2020 64bit 14inch 768p or 1080p - round lenovo ac - 4gb, 8gb, or 16gb ddr4 3200Mhz ram soldered with 1 slot - keyboard swap problematic - integrated battery - |- |<!--Name-->Ideapad Flex 5 81X2, Lenovo Yoga 6 13ALC6 || <!--Chipset-->AMD R5 4500u, R7 4800U, R3 5300 R5 5500U || <!--IDE-->{{N/A}} || <!--SATA-->M.2 NVMe ssd || <!--Gfx-->{{Maybe|VESA AMD Vega up to 2Gb of soldered ram memory taken}} || <!--Audio-->{{unk|HD Audio with ALC? codec}} || <!--USB-->{{maybe|USB3.1 gen 1}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|realtek ac wifi}} || <!--Test Distro--> || <!--Comments-->2020 64bit abs plastic case 14in convertible 1080p touch low nits - 65w usb-c psu ac - possible wacom esr note taking pen supplied - ram soldered DDR4 - keyboard swap problematic - |- |<!--Name-->ThinkPad T14 Gen 2, P14s Gen 2 || <!--Chipset-->AMD 5850U || <!--IDE-->{{N/A}} || <!--SATA-->NVme || <!--Gfx-->VESA 2D || <!--Audio-->{{unk|HDaudio with ALC3287-CG codec 0x10EC, 0x0}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{Maybe| }} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2021 - usb-c power 90% failure rate on the charging port - |- |<!--Name-->Lenovo ThinkBook 14 G3, 15 G3 ACL, || <!--Chipset-->Ryzen 5 5500U || <!--IDE-->{{N/A}} || <!--SATA-->m.2 nvme || <!--Gfx-->VESA 2d for AMD Radeon || <!--Audio-->{{unk|HDAudio with ALC codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 14in or 15in 1080p - usb-c charging powered - |- |<!--Name-->ThinkPad E14 G3, E15 Gen 3 (AMD) || <!--Chipset-->AMD 5300U 5500U 5650U 5700U 5800U || <!--IDE-->{{N/A}} || <!--SATA-->up to 2 m.2 nvme || <!--Gfx-->{{Maybe|VESA }} || <!--Audio-->{{unk|HDaudio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 RTL8111GUS}} || <!--Wireless-->{{no|realtek or intel }} || <!--Test Distro--> || <!--Comments-->2021 64bit - 15.6in 1080p - - usb-c charging issues - keyboard swap problematic - 4gb or 8gb soldered with 1 ddr4 3200Mhz sodimm slot - plastic bendy case - |- |<!--Name-->V14 Gen 2 (82KA, 82KC) *ALO *ALC 82KD || <!--Chipset-->Ryzen 3 5300U, 5 5500U, 7 5700U || <!--IDE-->{{N/A}} || <!--SATA-->1 nvme 2280 and optional 2.5in sata after sourcing ribbon cable and connector, no dvd || <!--Gfx-->VESA 2D for AMD radeon || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe|USB3 }} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111H-CG}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2022 64bit - 15.6" FHD 1080p - 4gb or 8gb soldered with 1 ddr4 sodimm slot - 65w round ac adaptor - |- |<!--Name-->V15 G2 Gen2 (82KB, 82KD) *ALO *ALC 82KD || <!--Chipset-->Ryzen 3 5300U, 5 5500U, 7 5700U || <!--IDE-->{{N/A}} || <!--SATA-->1 nvme 2280 and optional 2.5in sata after sourcing ribbon cable and connector, no dvd || <!--Gfx-->VESA 2D for AMD radeon || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe|USB3 }} || <!--Ethernet-->{{maybe|rtl8169 Realtek RTL8111H-CG}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2022 64bit - 15.6" FHD 1080p - 4gb or 8gb soldered with 1 ddr4 sodimm slot - 65w round ac adaptor - |- |<!--Name-->ThinkPad L15 Gen 2 (15″, AMD) || <!--Chipset-->AMD 5000 series AMD Ryzen 3 5400U (4c8t), 5 5600U, 5 5650U (6c12t), 7 PRO 5850U (8c16t) || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk|HDAudio with Realtek® ALC3287}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{no|rtl8169 needs dongle RTL8111EPV (DASH models) or RTL8111HN}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2022 64bit - 15.6in 768p or 1080p - usb-c charging - 4gb soldered with 1 ddr4 3200Mhz sodimm slot - |- |<!--Name-->ThinkPad E14 Gen 4, E15 Gen 4 (15″, AMD) || <!--Chipset-->AMD 3 5425u, 5 5625U, 7 5825u || <!--IDE-->{{N/A}} || <!--SATA-->1 (14") or 2 (15") nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk|HDAudio with ALC3287 codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 15.6in 1080p - usb-c charging - 4gb or 8gb soldered with 1 ddr4 3200Mhz sodimm slot - L19M3PDA 45Whr battery - U24 TPS65994 and QB6 QB5 mosfet issues - plastic bendy case - |- |<!--Name-->ThinkPad T14 Gen 3 Machine types MT 21AH 21AJ 21CF and 21CG, P14s Gen 3 || <!--Chipset-->AMD 6850U || <!--IDE-->{{n/a}} || <!--SATA-->NVme || <!--Gfx-->VESA 2d || <!--Audio-->{{unk| ALC3287-VA2-CG codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{Maybe|rtl8169 }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2022 64bit - 14in |- |<!--Name-->ThinkPad T14s Gen 3 || <!--Chipset-->AMD 6500U || <!--IDE-->{{n/a}} || <!--SATA-->NVme || <!--Gfx-->VESA 2d || <!--Audio-->{{unk| ALC3287-VA2-CG codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|Ethernet support via optional Lenovo® USB-C® to Ethernet Adapter}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2022 64bit - 14in |- |<!--Name-->V14 G3, V15 G3 Gen3 ALC || <!--Chipset-->Ryzen 5 6500U || <!--IDE-->{{N/A}} || <!--SATA-->nvme and optional 2.5in sata if smaller 38Wh battery and after sourcing ribbon cable and connector, no dvd || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 15"FHD - battery BYD L20B2PFO - |- |<!--Name-->ThinkPad L15 Gen 3 (15″, AMD) || <!--Chipset-->AMD 6000 series || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{No| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|rtl8169 needs dongle}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2023 64bit- 15.6in 1080p - |- |<!--Name-->Lenovo Yoga 7 14ARB7 || <!--Chipset-->AMD Ryzen 5, 6600U, 7 6800U || <!--IDE-->{{N/A}} || <!--SATA-->1 nvme || <!--Gfx-->AMD 660M or 680M || <!--Audio-->{{No|HDaudio with ALC3306 aka alc287 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2022 64bit - 14in 1800p ips 300 nits - usb-c ac charging 71whr integrated battery - sd card slot - digital pen input - 8gb, 6gb or 32gb soldered ddr5 ram - |- |<!--Name-->ThinkPad T14 Gen 4, P14s Gen 4 || <!--Chipset-->AMD Ryzen Pro 5 7540U, Ryzen Pro 7 7840U (AI NPU) || <!--IDE-->{{n/a}} || <!--SATA-->NVme || <!--Gfx-->VESA 2D for AMD 740M 780M|| <!--Audio-->{{unk|HDAudio ALC3287 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 14in 1920x1200 - 8gb, 16gb or 32gb lpddr5 soldered - usb-c charging - |- |<!--Name-->ThinkPad E14 g5, E15 Gen 5 (15″, AMD) || <!--Chipset-->AMD 7000 series Ryzen 5-7530U, 7-7730U || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk|HDAudio with codec}} || <!--USB-->{{maybe|USB3}} || <!--Ethernet-->{{maybe| }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit- 15.6in 1080p - |- |<!--Name-->Thinkbook 14 G6 ABP IRL, ThinkBook 16 G6ABP (21KK001CUK) || <!--Chipset-->AMD Ryzen 7530U 7730U || <!--IDE-->{{N/A}} || <!--SATA-->m.2 nvme || <!--Gfx-->VESA 2d for AMD Radeon || <!--Audio-->{{unk|HDaudio with codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 untested}} || <!--Wireless-->{{No| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 14in 1200p or 1440p - 100W USB-C AC power adapter - |- |<!--Name-->IdeaPad Slim 5 Light 14ABR8 Laptop || <!--Chipset-->AMD Ryzen 3 7330U (4c8t) 5 7530U (6c12t) 7 7730U (8c16t) || <!--IDE-->{{N/A}} || <!--SATA-->2 m.2 nvme slot - 1 2242, 1 2280 || <!--Gfx-->VESA 2d for AMD Radeon || <!--Audio-->{{unk|HDaudio with Realtek® ALC3287 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{No| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 14in 1080p - 8Gb or 16Gb soldered ram - usb-c charging only - |- |<!--Name-->ThinkPad X13 Gen 4 (13" AMD) || <!--Chipset-->AMD 7480U 7040U || <!--IDE-->{{N/A}} || <!--SATA-->NVMe || <!--Gfx-->{{partial|VESA}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 - avoid usb-c port damage - |- |<!--Name-->ThinkPad L14 (Gen4), L15 Gen 4 (15" AMD) || <!--Chipset-->MD Ryzen 5 PRO 7530U, 7480U 7040U || <!--IDE-->{{N/A}} || <!--SATA-->NVMe || <!--Gfx-->{{partial|VESA}} || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|rtl8169 needs dongle}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit - elan trackpad - |- |<!--Name-->Lenovo Gen 4 V14 (82YT, 82YV, 83A0, 83A1, 83CC, 83FR, 82YX, 83FG), V15 (82YU, 82YW, 83FS, 82YY, 83CR), V17 (83A2), || <!--Chipset-->AMD AMD Athlon™ Gold 7220U (2c4t), AMD Athlon™ Silver 7120U (2c2t), AMD Ryzen™ 3 7320U (4c8t), AMD Ryzen™ 5 7520U (4c8t) || <!--IDE-->{{N/A}} || <!--SATA-->nvme and 2.5in sata if smaller 38Wh battery, no dvd || <!--Gfx-->{{Maybe|VESA 2d for AMD 610M HDMI® and USB-C}} || <!--Audio-->{{unk|HDaudio with ALC3287 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no|Gigabit Ethernet, 1x RJ-45}} || <!--Wireless-->{{no|wifi 6}} || <!--Test Distro--> || <!--Comments-->2023 64bit - 15.6" FHD 1080p - 8 or 16Gb soldered - 65W round tip (3-pin) AC adapter or USB-C - |- |<!--Name-->ThinkPad e14 G6, e15 Gen 6 (15″, AMD) || <!--Chipset-->AMD 7000 series AMD Ryzen™ 7 7735HS || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D for AMD Radeon || <!--Audio-->{{unk|HDAudio codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe| }} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2023 64bit- 15.6in 1080p - |- |<!--Name-->ThinkPad L16 (16" AMD), || <!--Chipset-->AMD 8000 || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->VESA 2D || <!--Audio-->{{unk|HDAudio with codec}} || <!--USB-->{{maybe|USB4}} || <!--Ethernet-->{{no|rtl8169 needs dongle}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2025 64bit |- |<!--Name-->ThinkPad T14 Gen 5, P14s Gen 5 || <!--Chipset-->AMD Ryzen 7 PRO 8840U, AMD Ryzen™ 5 PRO 8540U || <!--IDE-->{{N/A}} || <!--SATA-->NVME || <!--Gfx-->VESA 2d || <!--Audio-->{{unk| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{maybe|rtl8169 }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2025 64bit - 14inch 1920 x 1200 - |- |<!--Name--> Lenovo WinBook 300e SKU: 82GKS00000 || <!--Chipset-->AMD 3015E || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2023 64bit 4GB 64GB SSD 11.6 Inch Touchscreen Windows 10 Pro Laptop |- |<!--Name-->ThinkPad || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- |<!--Name-->Lenovo Yoga Slim 7a || <!--Chipset-->AMD Ryzen AI 7350 || <!--IDE-->{{N/A}} || <!--SATA-->1 nvme || <!--Gfx-->AMD 860M || <!--Audio-->{{No|HDaudio with ALC3306 aka alc287 codec}} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| wifi}} || <!--Test Distro--> || <!--Comments-->2025 64bit - 14in 1800p ips 300 nits - usb-c ac charging 71whr integrated battery - sd card slot - digital pen input - 8gb, 6gb or 32gb soldered ddr5 ram - |- |<!--Name-->ThinkPad || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Samsung==== [[#top|...to the top]] {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="2%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->NP-Q1 Q1 || <!--Chipset-->Celeron-M 353 ULV 600Mhz || <!--IDE-->{{Yes|1.8" SFF HDD 20 / 60 GB }} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|GMA 915 2D and 3D opengl1 tunnel 95 gearbox 68}} || <!--Audio-->{{Yes|HD Audio with codec - head phones only}} || <!--USB-->{{Yes}} || <!--Ethernet-->{{No|Marvell}} || <!--Wireless-->{{Yes|Atheros 5006EX}} || <!--Test Distro-->2016 Icaros 2.1 || <!--Comments-->2005 32bit old style tablet UltraMobile PC UMPC - Wacom serial resistive pen or finger no support - 1 sodimm ddr2 max 1Gb - LCD 7" WVGA (800 x 480) - CompactFlash port Type II - |- | <!--Name-->NP Q1U Ultra Mobile PC UMPC Q1F NP-Q1-F000 || <!--Chipset-->Intel A100 600 / A110 Stealey 800 MHz CPU || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Maybe|GMA 950 2D and 3D opengl1}} || <!--Audio-->{{No|HD Audio 1986}} || <!--USB--> || <!--Ethernet-->Intel || <!--Wireless-->{{Maybe|Atheros 5006EX}} || <!--Test Distro-->2016 Icaros 2.1 || <!--Comments-->2006 32bit 1024×600 - sd card slot - |- | <!--Name-->NP P500 family P500Y || <!--Chipset-->AMD with SB600 || <!--IDE-->{{N/A| }} || <!--SATA-->{{Yes| }} || <!--Gfx-->{{Maybe|use VESA Ati x1250}} || <!--Audio-->{{Yes| Audio with codec }} || <!--USB--> || <!--Ethernet-->{{No|Marvell 88E8039 yukon}} || <!--Wireless-->{{yes|Atheros G}} || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments-->64bit possible - 15.4 tft display - cheap plastic okay build - 19v propriety end - |- | <!--Name-->R505 R510 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless-->Atheros G || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->R520 R522 R610H R620 || <!--Chipset-->Intel Mobile Core i3 Intel PM45 82801M ICH9-M|| <!--IDE--> || <!--SATA--> || <!--Gfx-->ATI Mobility Radeon HD 4650 (RV730) || <!--Audio-->Intel HD Audio with Realtek ALC272 || <!--USB--> || <!--Ethernet-->Marvell Yukon 88E8057 || <!--Wireless-->Atheros AR5007EG || <!--Test Distro--> || <!--Comments-->2010 64 bit possible |- | NP-R530 || || {{N/A}} || {{partial|IDE mode}} || {{yes|Intel GMA (2D)}} || {{partial|HD Audio playback}} || {{yes|USB 2.0}} || {{no|Marvell}} || {{unk|Atheros AR9285}} || Icaros 1.5.2 || <!--Comments--> |- | <!--Name-->Samsung R730 17.3 Essential Notebook NP-R730-JA02UK, NP-R730-JA01SE, R730-JT06 || <!--Chipset-->Intel HM55 Dual Core T4300 i3-370M || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA for Intel 4500MHD and GeForce G 310M with 1 VGA, 1 HDMI}} || <!--Audio-->{{Yes|HDAudio ALC??? codec Realtek}} || <!--USB-->{{yes|USB2}} || <!--Ethernet-->{{No|Marvell Yukon 88E8059 PCI-E}} || <!--Wireless-->{{unk|Broadcom, Intel or Atheros 9k AR9285}} || <!--Test Distro-->Deadwoods ISO 2023-11 || <!--Comments-->2010 64bit - 17.3in HD 1280 x 720 pixels low contrast or some 1600x900 - 2 DDR3 sodimm slots - 2.84 kg 6.26 lbs - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->[http://www.notebookcheck.net/Review-Samsung-305U1A-A01DE-Subnotebook.68246.0.html Series 3 Samsung 305u1a] || <!--Chipset-->AMD Zacate E350 or E450 || <!--IDE--> || <!--SATA--> || <!--Gfx-->AMD Radeon 6320 || <!--Audio-->ALC ACL 269 || <!--USB--> || <!--Ethernet-->Realtek 8111 8169 || <!--Wireless-->Broadcom 4313 || <!--Comments-->2011 64bit |- | <!--Name-->NP-RV415 NP-RV515 || <!--Chipset-->E350 or E450 plus A50M chipset || <!--IDE--> || <!--SATA--> || <!--Gfx-->AMD Radeon HD 6470 || <!--Audio-->HD Audio Realtek || <!--USB--> || <!--Ethernet-->{{unk|RTL8169 Realtek RTL8111 8168B}} || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro--> || <!--Comments-->2012 64bit slow - |- | <!--Name-->Series 5 NP535U3C || <!--Chipset-->A6-4455M || <!--IDE-->{{N/A}} || <!--SATA-->2.5in || <!--Gfx-->radeon || <!--Audio-->HDAudio || <!--USB-->USB2 || <!--Ethernet-->Realtek GbE || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2012 64bit slow - 13.3in 1368 x 768 - plastic build - 65w 19v psu - |- | <!--Name-->series 3 NP355V5C || <!--Chipset-->A6-4400M, A8-4500M, A10-4600M || <!--IDE-->{{N/A}} || <!--SATA-->2.5in || <!--Gfx-->7640M || <!--Audio-->HDAudio || <!--USB-->USB2 || <!--Ethernet-->Realtek GbE || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2012 64bit - 15.4in 1368 x 768 - plastic build - 65w 19v psu - |- | <!--Name-->Samsung ATIV Book 9 Lite NP905S3G || <!--Chipset-->AMD A6-1450 quad 1GHz Temash atom like || <!--IDE--> || <!--SATA-->128gb || <!--Gfx-->AMD 8250 || <!--Audio-->HD Audio || <!--USB--> || <!--Ethernet-->{{Maybe|Realtek rtl8169 but only with mini LAN AA-AE2N12B Ethernet Adapter RJ45 dongle}} || <!--Wireless-->{{unk|Atheros AR9565}} || <!--Test Distro--> || <!--Comments-->2014 64bit - 13.3 TN glossy 1366 x 768 200nits 60% srgb - plastic case - 26W battery built in with 4hr life - 19V 2.1A 3.0*1.0mm psu - 1 ddr3l slot max 4gb - 720p webcam - mini hdmi out - 1w speakers - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Toshiba==== [[#top|...to the top]] Order of Build Quality (Lowest to highest) <pre > Equium Satellite (Pro) Libretto Portege Tecra </pre > {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | Tecra 8100 8200 9000 || 440BX || {{yes|IDE}} || {{N/A}} || {{maybe|S3 Savage MX 3D (VESA only)}} || {{no|Yamaha DS-XG ymf744 ymf-754}} || {{yes|USB1.1 only}} || {{N/A}} || {{N/A}} || Icaros 1.5 || little support |- | <!--Name-->Tecra 9100 || <!--Chipset-->810 || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{maybe|S3 Savage IX}} || <!--Audio-->{{no|ymf754}} || <!--USB-->USB 1.1 || <!--Ethernet-->eeee pro100 || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->PSU Adapter For Toshiba Tecra 9000 9100 A1 A10 A11 A3 A3X A4 A5 A7 M1 M2 M3 M4 M5 M7 M9 R10 S1 series 75 Watt 15V 5A |- | [http://tuxmobil.org/toshiba_sp4600.html Satellite Pro 4600] || i810 || IDE || {{N/A}} || {{maybe|Trident Cyber Blade XP (VESA only)}} || {{no|YAMAHA DS-XG AC97 ymf754}} || {{yes|USB}} || {{yes|Intel e100}} || {{no|Agere (internal PCMCIA)}} || || little support |- | Satellite 2805 S603 || Intel 815 || {{yes|IDE}} || {{N/A}} || {{maybe|nVidia GeForce2 Go}} || {{no|Yamaha Corp YMF 754}} || {{yes|USB}} || {{yes|Intel PRO/100}} || {{dunno}} || || little support |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Satellite A10 S167 S1291 - A15 A20 A25 || <!--Chipset-->P4M || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 852GM or Radeon || <!--Audio--> || <!--USB--> || <!--Ethernet-->RTL 8139 || <!--Wireless-->{{Maybe|Intel 2100, Agere or Atheros PA3399U 1MPC minipci}} || <!--Test Distro--> || <!--Comments-->a few models came with antenna leads |- | Satellite [http://eu.computers.toshiba-europe.com/innovation/jsp/SUPPORTSECTION/discontinuedProductPage.do?service=EU&com.broadvision.session.new=Yes&PRODUCT_ID=76230 A30-714] || P4-M / 82845 i845 || {{yes|82801}} || {{N/A}} || {{maybe|VESA}} || {{yes|AC97}} || {{yes}} || {{yes|RTL8139}} || {{N/A}} || Icaros 1.2.4 || nice laptop, drawbacks: heavy, really hot (P4-3.06 GHz!!) - A30 (EU) A33 (Australian) A35 (USA) - |- | <!--Name-->Satellite A40 A45 || <!--Chipset-->P4M or Celeron M with Intel 845 865 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 852GME or Radeon 7000 Mobility || <!--Audio-->AC97 Realtek || <!--USB-->USB2.0 || <!--Ethernet--> || <!--Wireless-->Atheros 5002G 5004G - PA3299U mini pci || <!--Test Distro--> || <!--Comments-->2003 32bit - A40 S161 A40-S1611 A40-2701, A45-S120 A45-S1201 S130 S1301 S1501 - |- | <!--Name-->Satellite a50 A55 a60-s156 Equium A60 PSA67E A65 || <!--Chipset-->P4M or Celeron M with Intel 845 865 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 852GME or Radeon 7000 Mobility || <!--Audio-->AC97 Realtek || <!--USB-->USB2.0 || <!--Ethernet--> || <!--Wireless-->Atheros 5002G 5004G - PA3299U mini-pci || <!--Test Distro--> || <!--Comments-->2003 32bit - |- | <!--Name-->Satellite A70 A75-S206 A80 A85-S107 || <!--Chipset-->P4M or Celeron-M with Intel 845 865 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 852GME or Radeon 7000 Mobility || <!--Audio-->AC97 Realtek || <!--USB-->USB2.0 || <!--Ethernet--> || <!--Wireless-->Atheros 5002G 5004G - PA3299U mini-pci || <!--Test Distro-->Icaros 1.5.1 || <!--Comments-->2003 32bit - |- | Toshiba Satellite Pro M30 || intel 855 || {{yes|boots with ATA=nodma option}} || {{N/A}} || {{maybe|VESA}} || {{yes|AC97}} || {{yes|USB2.0}} || {{yes|Intel PRO/100 VE}} || {{dunno}} || Icaros 1.5 || nice laptop with some support |- | <!--Name-->Portege M300 - M200 tablet || <!--Chipset-->855GM with 1.2GHz Pentium M 753 || <!--IDE-->{{yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{maybe|VESA 2d only - tablet with nvidia 5200 go}} || <!--Audio-->{{no|AC97 STAC 9750}} || <!--USB-->{{yes}} || <!--Ethernet-->{{yes|Intel PRO 100}} || <!--Wireless-->{{no|Intel PRO Wireless 2200BG}} || <!--Test Distro--> || <!--Comments-->little support |- | <!--Name-->Tecra M2 M2-S || <!--Chipset-->Intel 855P Pentium-M || <!--IDE--> || <!--SATA-->{{N/A}} || <!--Gfx-->nvidia fx go5200 32mb or 64mb agp || <!--Audio-->AC97 1981B || <!--USB--> || <!--Ethernet--> || <!--Wireless-->Intel Pro || <!--Test Distro--> || <!--Comments-->2003 32bit - PSU 15V 5A - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Satellite Pro L20 267 (PSL2YE PSL2XE) PSL25E L30 || <!--Chipset-->Celeron M 370 1.4 1.5GHz, 1.73Ghz with RC410M SB400 || <!--IDE-->{{N/A| }} || <!--SATA-->{{yes|IDE mode}} || <!--Gfx-->{{Maybe|use VESA - Ati x200}} || <!--Audio-->{{No|[https://forums.gentoo.org/viewtopic-t-490297-start-0.html ALC861]}} || <!--USB-->{{Maybe|Boots usb sticks}} || <!--Ethernet-->{{yes|rtl8139 Realtek 8139}} || <!--Wireless-->{{No|Atheros mini-pci should work maybe not working with ATi chipset or need to swap??}} || <!--Test Distro-->2016 Icaros 2.1.1 || <!--Comments-->2004 32bit 14" pioneer dvd-rw - 19v |- | <!--Name-->Satellite L30 PSL30E L33 PSL33E || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 800 or ATi RC410 x200 || <!--Audio-->AC97 AD1981B or HD Audio ALC861 || <!--USB--> || <!--Ethernet-->realtek 8139 || <!--Wireless-->Atheros or Intel || <!--Test Distro--> || <!--Comments-->L30 PSL30L 101 PSL33E 113 115 134 00M019 - |- | Satellite Pro M40 313 psm44e || AMD with Ati || {{yes|boots with ATA=nodma}} || {{N/A}} || {{maybe|VESA}} || {{yes|AC97}} || {{yes|USB2.0}} || {{yes|}} || {{maybe|atheros askey ar5bmb5 mini pci}} || || 2005 32bit - nice laptop with some support |- | <!--Name-->Satellite L40 PSL40E PSL40L, PSL43E || <!--Chipset-->945GM with U7700 1.3GHz ULV || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 945 || <!--Audio-->{{No|Intel HD with AD1986A codec}} || <!--USB-->2 USB2.0 || <!--Ethernet-->realtek 8139 || <!--Wireless-->Atheros AR24xx Askey || <!--Test Distro-->Icaros 2.0.3 || <!--Comments-->2006 32bit only - - 12X 13G 139 14B 143 15J 19O - |- | <!--Name-->Satellite L45 PSL40U S7409 S2416 || <!--Chipset-->945GM with Celeron M 440 1.86 GHz || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 945 || <!--Audio-->{{No|Intel HD with AD1986A codec}} || <!--USB-->2 USB2.0 || <!--Ethernet-->realtek 8139 || <!--Wireless-->Atheros AR24xx Askey || <!--Test Distro-->Icaros 2.0.3 || <!--Comments-->2006 32bit only - |- | <!--Name-->Satellite Pro A100 || <!--Chipset-->940G || <!--IDE--> || <!--SATA--> || <!--Gfx-->Nvidia G72M Quadro NVS 110M GeForce Go 7300 / Ati (PSAA3E)|| <!--Audio-->HD Audio with ALC861 codec || <!--USB--> || <!--Ethernet-->Intel 100 || <!--Wireless-->Intel 3945 swap with atheros || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Satellite A110 159 (PSAB0), Equium A110 (PSAB2E), Satellite A110 233 (PSAB6), || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio-->ALC861 || <!--USB--> || <!--Ethernet-->Realtek 8136 || <!--Wireless-->Atheros || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Satellite Pro A120 PSAC0 PSAC1 PSAC1E || <!--Chipset-->Core Solo GMA 950 to T2300 || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA 945 || <!--Audio-->ALC262 or AC97 AD1981B || <!--USB-->UHCI EHCI || <!--Ethernet--> || <!--Wireless-->Atheros Ar5001 or Intel or Broadcom || <!--Test Distro--> || <!--Comments-->15V 4A charger - |- | <!--Name-->Satellite Pro A120 || <!--Chipset-->Core Duo ATi RS480 + SB450 || <!--IDE--> || <!--SATA--> || <!--Gfx-->use VESA - ATI RC410 Radeon Xpress 200M || <!--Audio-->ALC262 || <!--USB-->OCHI UHCI || <!--Ethernet-->RTL 8139 || <!--Wireless-->Intel 3945 or Atheros Ar5001 || <!--Test Distro--> || <!--Comments-->15v 5a proprietary charger needed |- | <!--Name-->Satelite A130 PSAD6U || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet-->Realtek 8101E || <!--Wireless-->Atheros or Intel || <!--Test Distro--> || <!--Comments-->ST1311 s1311 ST1312 S2276 S2386 - |- | <!--Name-->Satellite A135 S2686 (Compal LA 3391P) || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet-->Realtek 8101E || <!--Wireless-->Atheros or Intel || <!--Test Distro--> || <!--Comments-->S2246 S2346 S2256 S4477 S4666 S4827 - |- | <!--Name-->Satellite A200 PSAE1E (Inventec MW10M) || <!--Chipset-->Pentium M with 945GM Express Celeron M 520 1.6Ghz or Pentium® Core Duo T2130 1.86 GHz || <!--IDE--> {{N/A}}|| <!--SATA--> {{Maybe|SATA}}|| <!--Gfx--> {{Yes|Intel GMA 950 (2D and 3D)}}|| <!--Audio--> {{Yes|HD Audio ALC862}}|| <!--USB--> {{Yes| }}|| <!--Ethernet--> {{yes|RTL8101E rtl8139}}|| <!--Wireless--> {{yes|Atheros 5000 - FN,F5 or FN,F8 or switch}} || <!--Test Distro-->2016 AspireOS 1.8 || <!--Comments-->2006 Excellent 32 bit support! - make sure that your WLAN card is enabled, do this using the hardware switch and FN+F8 key combination |- | <!--Name--> A210, Satellite A215 AMD (Inventec 10A) S5808 || <!--Chipset--> Ati with SB690 || <!--IDE--> {{N/A}}|| <!--SATA-->{{Maybe|SATA}}|| <!--Gfx-->{{Maybe|use VESA HD2600 Mobility M76}} || <!--Audio-->HD Audio ALC268 || <!--USB--> {{Yes| }}|| <!--Ethernet-->{{yes|RTL8101E}}|| <!--Wireless--> {{yes|Atheros 5000}}|| <!--Test Distro-->2018 AspireOS 1.8 || <!--Comments-->A215-S7422 A215-S7472 A215-S4697 (USA) - |- | <!--Name--> [http://www.amiga.org/forums/showthread.php?t=62036 A215 S4757] || <!--Chipset--> Ati X1200 with SB600 || <!--IDE--> {{N/A}}|| <!--SATA-->{{Maybe|SATA}}|| <!--Gfx-->{{Maybe}} || <!--Audio-->HD Audio || <!--USB--> {{Yes| }}|| <!--Ethernet-->{{yes|RTL8101E}}|| <!--Wireless--> {{yes|Atheros 5000}}|| <!--Test Distro-->2017 AspireOS 1.8 || <!--Comments--> |- | <!--Name-->Qosmio G30 (PQG31C-HD202E) || <!--Chipset-->945 with Duo T2500 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{yes|Nouveau Nvidia Go 7600 2d and 3d}} || <!--Audio-->{{yes| }} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2006 32bit - 17" UXGA 1920x1200, |- | <!--Name-->Tecra A10 || <!--Chipset--> || <!--IDE--> {{N/A}} || <!--SATA--> {{Maybe|IDE mode}} || <!--Gfx--> {{Maybe|Intel GMA 4500M (2D)}} || <!--Audio--> {{Yes|HD Audio}} || <!--USB--> {{Yes|USB 2.0}} || <!--Ethernet-->{{No|Intel PRO 1000}} || <!--Wireless-->{{No|Intel WiFi Link 5100}} || <!--Test Distro--> || <!--Comments-->64 bit possible |- | <!--Name-->L35 - L40 PSL48E - L45 S7423 || <!--Chipset-->GL960 with Intel Celeron || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|X3100 some 2D but software 3d tunnel 9 gearbox 4}} || <!--Audio-->{{Yes|HD Audio with ALC660 codec playback}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Yes|REALTEK 8139}} || <!--Wireless-->{{No|Realtek 8187b replace with Atheros 5k}} || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments-->1,73Ghz M 520 or M 540 or Dual T2310 (1.46 GHz) T2330 (1.6 GHz) - 14H 14N 15B 17H 17K 17R 17S 18Z - |- | <!--Name-->Satellite a300 - inventec potomac 10s pt10s A300D 21H || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->ATI Mobility Radeon HD 3650 || <!--Audio-->HD Audio - Realtek || <!--USB--> || <!--Ethernet-->Realtek 8102E || <!--Wireless-->Atheros 5005 || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->satellite L300D-224 PSLC8E PSLC9E, l305 (inventec ps10s) || <!--Chipset-->AMD M780 with Turion RM70 or QL-64 || <!--IDE--> {{yes|IDE}} || <!--SATA--> {{yes|SATA}} || <!--Gfx--> {{Maybe|use VESA for Radeon 3100}} || <!--Audio-->{{maybe|HD Audio with Realtek ALC268}} || <!--USB--> {{yes|USB 2.0}} || <!--Ethernet--> {{no|rtl8169 Realtek RTL8101E RTL8102E}} || <!--Wireless-->{{no|Atheros G XB63L or Intel or Realtek}} || <!--Test Distro--> Icaros Desktop Live 2.3 AROS One 2.3 || <!--Comments--> Wireless-handler crashing when using Atheros-Wireless-Card |- | <!--Name-->Satellite P300 (PSPC0C-01D01C) || <!--Chipset-->945GM with Intel Core 2 Duo T5750 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{maybe| }} || <!--Audio-->{{No| codec}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{No| swap with Atheros 5k }} || <!--Test Distro-->AROS One 64bit || <!--Comments-->2007 |- | <!--Name-->satellite l300-1bw PSLBDE-005005AR, L300-148 PSLB0E, l300-20D PSLB8E-06Q007EN, l300-294 L300-23L PSLB9E || <!--Chipset-->Intel GM45 + PGA478 socket Celeron 900, Pentium T1600, T2390, T3400 (Socket P) to Core2 Duo T6400 T6670 || <!--IDE--> {{unk|IDE}} || <!--SATA--> {{unk|SATA}} || <!--Gfx--> {{Maybe|use VESA for Intel gma 4500M}} || <!--Audio-->{{maybe|HD Audio with Realtek ALC???}} || <!--USB--> {{unk|USB 2.0}} || <!--Ethernet--> {{unk|rtl8169 Realtek 810xE}} || <!--Wireless-->{{no|Intel or Realtek}} || <!--Test Distro--> || <!--Comments-->2009 64-bit - new unfamiliar Bios called insyde H20 - |- | <!--Name-->satellite l350d || <!--Chipset-->AMD Athlon (tm) X2 QL-60 + RS780M || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Radeon HD 3100 || <!--Audio-->HD Audio with Realtek || <!--USB--> || <!--Ethernet-->Realtek || <!--Wireless-->Realtek 8187b || <!--Test Distro--> || <!--Comments-->2009 64bit |- | <!--Name-->Satellite L450 12 13 14 || <!--Chipset-->AMD Sempron, 2.1GHz with AMD RS780M || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Radeon HD 3200 (based on HD 2400) || <!--Audio--> || <!--USB--> || <!--Ethernet-->Realtek RTL8101E RTL8102E || <!--Wireless-->Realtek 8172 || <!--Test Distro--> || <!--Comments-->2009 64bit - 12X 13P 13X 14V PSLY6E00C006EN |- | <!--Name-->Satellite Pro L450 (Compal LA-5821P) 179 || <!--Chipset-->intel celeron 900 2.20 Ghz no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->intel 4500m || <!--Audio-->HD Audio with codec || <!--USB--> || <!--Ethernet-->RTL8101 /2 /6E PCI Express Gigabit || <!--Wireless-->RTL8191 SEvB || <!--Test Distro--> || <!--Comments-->2009 64bit - 39.6cm (15.6”) Toshiba TruBrite® HD TFT 16:9 768p |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Toshiba Satellite P775, P775-S7320 and P775-10K || <!--Chipset-->Intel Core i5 (2nd Gen) 2430M i7-2630QM || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Maybe|Vesa 2D for Intel}} || <!--Audio-->{{maybe| }} || <!--USB-->{{maybe| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2011 17.3" - 1600 x 900 (HD+) - 2 DDR3 sodimm max 16Gb - |- |<!--Name-->Toshiba Satellite C660D-19X || <!--Chipset-->AMD E-300 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{maybe|Vesa 2D for ATi}} || <!--Audio-->{{no|HD Audio with Realtek codec}} || <!--USB-->{{no| }} || <!--Ethernet-->{{Maybe|r8169 rtl8101e}} || <!--Wireless-->{{no|Realtek RTL8188 8192ce rtl8192ce}} || <!--Test Distro--> || <!--Comments-->2011 64bit - |- | <!--Name-->L755D (E-350) L750D (E-450) || <!--Chipset-->AMD E350 E450 no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Radeon HD 6310 6320 || <!--Audio-->HDAudio conexant codec || <!--USB--> || <!--Ethernet--> || <!--Wireless-->Realtek || <!--Test Distro--> || <!--Comments-->2012 64bit |- | <!--Name-->Satellite Pro SP C640 C660D-15X (PSC1YE) C670D- () || <!--Chipset-->AMD E350 no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->6310G || <!--Audio-->HD Realtek ALC259 || <!--USB-->USB2 || <!--Ethernet-->Realtek || <!--Wireless-->Broadcom || <!--Test Distro--> || <!--Comments-->2012 64bit |- | <!--Name-->C70D-A C75D-A || <!--Chipset-->E1-1200 no sse4.1 or avx || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{maybe|AMD HD8330}} || <!--Audio-->{{no|HA Audio CX20751 11Z}} || <!--USB-->{{no| }} || <!--Ethernet-->{{no|Atheros AR8162 alx}} || <!--Wireless-->{{no|Realtek 8188e}} || <!--Test Distro--> || <!--Comments-->2013 64bit - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- |} ====Misc==== [[#top|...to the top]] {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Time 500 Packard Bell EasyOne 1450 1550 || <!--Chipset-->K6-3 500Mhz + VIA MVP4 vt82c686a || <!--IDE-->{{N/A|Issues}} || <!--SATA-->{{N/A}} || <!--Gfx-->Use VESA || <!--Audio-->{{No|VIA AC97 3058 with wolfson codec WM9703 WM9704 WM9707 WM9708 or WM9717}} || <!--USB-->via 3038 2 ports USB 1.1 untested || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{N/A}} || <!--Test Distro-->NB May 2013 || <!--Comments-->2001 32bit grub runs but stalls around [PCI] Everything OK |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Sony Vaio PCG FX201/FX202 FX210/FX215 FX401/FX402 FX404/FX405 972M, FX501/FX502 FX504/FX505 || <!--Chipset-->VIA KT133A KM133 Duron 800Mhz Athlon 1.3Ghz || <!--IDE-->{{partial|boot issue with 2013 kernel VIA [rev 06]}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{partial|ATI Rage Mobility Pro (VESA only)}} || <!--Audio-->{{Yes|VIA AC97 686b [rev 50] AD1881A Ear phone and Mic}} || <!--USB-->{{Maybe|issues}} || <!--Ethernet-->{{Yes|RTL 8139}} || <!--Wireless-->{{N/A}} || <!--Comments-->Nightly 1st March 2013 || <!--Comments-->booting usb pendrive from Plop Boot Loader floppy (no bios USB boot). Can freeze coz hardware issue or a ram slot problem - no support for iLink firewire VT8363/8365 pci - vt82c686b |- | <!--Name-->Sony Vaio PCG FX601/FX602, FX604/FX605 FXA53(US), FX701/FX702, FX704/FX705, FX801/FX802 FX804/FX805 || <!--Chipset-->VIA KT133A KM133 Duron 800Mhz Athlon 1.3Ghz || <!--IDE-->{{partial|boot issue with 2013 kernel VIA [rev 06]}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{partial|ATI Rage Mobility Pro (VESA only)}} || <!--Audio-->{{Yes|VIA AC97 686b [rev 50] AD1881A Ear phone and Mic}} || <!--USB-->{{Maybe|issues}} || <!--Ethernet-->{{Yes|RTL 8139}} || <!--Wireless-->{{N/A}} || <!--Comments-->Nightly 1st March 2013 || <!--Comments-->booting usb pendrive somes works |- | <!--Name-->Sony Vaio PCG FX100 R505LE || <!--Chipset-->Intel i815 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Use VESA Intel 82815 CGC || <!--Audio-->Intel ICH AC97 with ADI AD1881A codec || <!--USB--> || <!--Ethernet-->Intel e100 || <!--Wireless-->{{N/A}} || <!--Test Distro--> || <!--Comments-->PCG-FX105 FX105K PCG-FX108 FX108K PCG-FX109 FX109K FX200 FX203/FX203K FX205 FX205K FX209 FX209K FX220 [http://juljas.net/linux/vaiofx240/ FX240] FX250 FX270 FX290 FX301 FX302 FX340 FX370 FX390 FX403 FX503 FX950 |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | Sony VAIO VGN X505VP || Pentium M ULV and Intel 855GM || {{yes}} || {{N/A}} || {{maybe|Intel 855 (VESA only)}} || {{yes|AC97}} || {{yes|USB}} || {{yes|Intel PRO 100 VE}} || {{N/A}} || || 2004 32bit - 0.38 inches at its thinnest point - first laptop to feature a "chiclet" keyboard resemble Chiclets gum - |- | <!--Name-->Sony Z505LE Z505JE || <!--Chipset-->P3 || <!--IDE--> || <!--SATA-->n/a || <!--Gfx-->Rage Mobility M1 AGP mach64 || <!--Audio-->no Yamaha DS-XG PCI YMF744 || <!--USB--> || <!--Ethernet-->Intel 8255x based PCI e100 || <!--Wireless-->n/a || <!--Test Distro--> || <!--Comments-->2004 32bit - |- | <!--Name-->Panasonic Toughbook CF-18 || <!--Chipset-->Core || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{yes|gma for i915}} || <!--Audio-->{{yes|AC97 SigmaTel}} || <!--USB-->{{yes|usb2 }} || <!--Ethernet-->{{yes|RTL 8139C}} || <!--Wireless-->{{no|Intel swap for atheros 5k}} || <!--Test Distro-->Deadwoods' D02 test || <!--Comments-->2003 32bit |- | <!--Name-->Panasonic Toughbook CF-29 CF-30 || <!--Chipset-->Core || <!--IDE--> || <!--SATA--> || <!--Gfx-->use VESA || <!--Audio-->AC97 SigmaTel || <!--USB--> || <!--Ethernet-->RTL 8139C || <!--Wireless-->Intel || <!--Test Distro--> || <!--Comments-->2003 32bit |- | <!--Name-->MSI Microstar PR210 || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Maybe|use VESA ATi RS690M}} || <!--Audio-->{{Yes|HD Audio through speaker / head phones but not hdmi}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{yes|Realtek 8111 8169}} || <!--Wireless-->Atheros AR242x AR542x aw-ge780 mini pci-e || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments-->2004 32bit - ENE PCI based SD card with no bios boot option |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Advent 7106 EAA-88 || <!--Chipset-->Pentium M 1.7GHz with 915GM || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{Yes|2D and 3D tunnel 187 gearbox 67}} || <!--Audio-->{{Yes|AC97 Intel ICH6 with Conexant Cx20468 31 codec playback head phones only}} || <!--USB--> || <!--Ethernet-->{{Yes|Realtek 8169}} || <!--Wireless-->{{No|Intel 2200BG Fn/F2 replaced with atheros mini pci in small base panel - startup errors in wireless manager}} || <!--Test Distro-->2017 Icaros 2.1.1 || <!--Comments-->2005 32bit 14" cheap rubbish sadly - fan noise through audio channel - |- | <!--Name-->Motion Computing LE1600 PC Slate || <!--Chipset-->915 || <!--IDE--> || <!--SATA--> || <!--Gfx-->915 || <!--Audio-->Intel AC97 SigmaTel STAC9758 9759 || <!--USB--> || <!--Ethernet-->Realtek 8169 || <!--Wireless-->Intel PRO Wireless 2200BG || <!--Test Distro--> || <!--Comments-->2005 serial Wacom digitiser not usb |- | <!--Name-->Panasonic Toughbook CF-51 CF-P1 CF-T5 CF-Y2 || <!--Chipset-->945GMS || <!--IDE--> || <!--SATA--> || <!--Gfx-->GMA 950 || <!--Audio-->HD Audio || <!--USB--> || <!--Ethernet-->Broadcom || <!--Wireless-->Intel || <!--Test Distro--> || <!--Comments-->2006 32bit |- | <!--Name-->Sony Vaio VGN-AR11S || <!--Chipset-->ntel Core Duo T2500 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{yes| Nvidia Go 7600}} || <!--Audio-->{{yes| }} || <!--USB-->{{yes| }} || <!--Ethernet-->{{no| }} || <!--Wireless-->{{No| }} || <!--Test Distro-->Aros One 32bit || <!--Comments-->2006 32bit - 17" 1920x1200 - blu-ray - |- | Sony Vaio VGN SR29VN || Intel ICH9 || {{N/A}} || {{maybe|IDE legacy}} || {{partial|ATI HD 3400 (VESA only)}} || {{partial|HD Audio (too quiet)}} || {{yes|USB1.1 and USB2.0}} || {{no|Marvell 8040}} || {{no|Intel 5100}} || Icaros 1.5 || 2007 32bit - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Wyse XM Class DELL WYSE Xn0m LAPTOP || <!--Chipset-->AMD T-G56N 1.6 1.65Ghz || <!--IDE-->{{N/A| }} || <!--SATA-->decased 2.5in ssd || <!--Gfx-->{{Maybe|Vesa 2d only AMD 6320}} || <!--Audio-->{{Maybe| }} || <!--USB-->{{Maybe|EHCI 2.0 with NEC uPD720200 USB 3.0}} || <!--Ethernet-->{{Yes|Realtek rtl8169 8111E}} || <!--Wireless-->{{No|Atheros 93xx}} || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 - 1366 x 768 14" - 2 ddr3l slots max 16gb - 19v coax barrel plug psu - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->MSI Ge40 Ge60 || <!--Chipset-->Intel 4 || <!--IDE--> || <!--SATA--> || <!--Gfx-->GTX 860M || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{no|Killer}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2014 64bit - |- | <!--Name-->MSI GE62 2QF Apache Pro || <!--Chipset-->Intel 5 || <!--IDE--> || <!--SATA--> || <!--Gfx-->GTX 970M || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{no|Killer }} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name-->MSI GS65 Stealth || <!--Chipset-->i7-8750H and later i7-9750H || <!--IDE-->{{N/A}} || <!--SATA-->nvme || <!--Gfx-->GeForce GTX 1060 or 1070 Max Q, GTX 1660 Ti, RTX 2080 Max-Q || <!--Audio-->{{unk|HDAudio }} || <!--USB-->{{unk|US3}} || <!--Ethernet-->{{No| }} || <!--Wireless-->{{No| }} || <!--Test Distro--> || <!--Comments-->2018 64bit - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Gigabyte P35X || <!--Chipset-->Intel || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->GTX 980M || <!--Audio-->HDaudio || <!--USB-->USB3 || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2014 64bit - |- | <!--Name-->Panasonic Toughpad FZ-G1 MK2 || <!--Chipset-->Core i5-3437U, 1.9GHz || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{N/A}} || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2014 64bit - |- | <!--Name-->ToughPad FZ-G1 Mk3 || <!--Chipset-->Intel Core i5-4310U || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->Intel HD 4400 || <!--Audio-->HDaudio Codec ALC255 || <!--USB--> || <!--Ethernet-->{{N/A}} || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->2015 64bit - |- | <!--Name-->[https://wiki.recessim.com/view/Panasonic_Toughpad_FZ-G1_MK4 Panasonic Toughpad FZ-G1 MK4] || <!--Chipset-->intel 6300U || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->Intel 520 || <!--Audio-->HDaudio with ALC256 codec - o/c or s/c fails early || <!--USB-->{{maybe|USB3 but options on the right hand side of screen case}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|intel ac 8260}} || <!--Test Distro--> || <!--Comments-->2016 64bit - 10.1in 1600x1200 - 4gb ddr3l soldered - waterproof pen left hand side base - optional slot-in 4g lte and sdhc - 16v 4.06A 64.96W panasonic barrel - |- | <!--Name-->Panasonic Toughpad FZ-G1 MK5 || <!--Chipset-->intel i5-7300U || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->Intel 620 || <!--Audio-->HDaudio ALC295 codec - o/c or s/c fails early || <!--USB-->{{maybe|USB3 but optional usb2 plugin r.h.s. of screen casing}} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no|Intel}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 8gb ddr3l soldered - 10.1" WUXGA 1920 x 1200 with LED backlighting screen 2-800 nit - 10-point capacitive multi touch + Waterproof Digitizer pen l.h.s - |- | <!--Name-->ToughPad FZ-M1 || <!--Chipset-->Intel® Core TM m5-6Y57 vPro TM || <!--IDE-->{{N/A}} || <!--SATA-->sata || <!--Gfx-->Intel HD 4200 || <!--Audio-->HDaudio with ALC codec || <!--USB-->{{maybe| }} || <!--Ethernet-->{{N/A}} || <!--Wireless-->{{no| }} || <!--Test Distro--> || <!--Comments-->2016 64bit - 7in 800p - 8gb ddr3l soldered - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || IDE || SATA || Gfx || Audio || USB || Ethernet || Wireless || Test Distro || Comments |- | <!--Name-->Any Razor Razer laptops || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->AVOID unable to remove secure boot |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ===Netbook=== [[#top|...to the top]] * PC to write Aros image onto an USB pendrive with Raspberry PI writer, USB writer or Rufus for boot purposes on a netbook * SD card sometimes can boot like Dell 2100, EeePC 1001P, ASUS EeePC 900, acer aspire one d150, MSI Wind U100, ====Acer Packard Bell Netbooks==== [[#top|...to the top]] {| class="wikitable sortable" width=100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | Aspire One AOA110 (A110) (ZG5) || Intel 945GSE || {{N/A}} || {{Maybe|IDE legacy mode}} || {{Yes|Intel GMA (2D and 3D) tunnel 99 and gearbox 84 score}} || {{Yes|HD Audio ALC6628}} || {{Yes|USB1.1 and USB2.0}} || {{Yes|rtl8169 RTL8101E}} || {{Yes|AR5006}} atheros 5k || 2016 AspireOS 1.8, 2025 Aros One 2.6 32bit USB || 2007 32bit 1 core - 19v barrel A13-045N2A 19V2.37A 45W 5.5x1.7mm - |- | Aspire One AOA150 (A150) (ZG5) || Intel 945GSE || {{N/A}} || {{Maybe|ide mode}} || {{Yes|Intel GMA 2D and accelerated 3D with tunnel 99 and gearbox 84.1 result}} || {{Yes|HD Audio ALC6628}} || {{Yes|uhci and ehci}} || {{Yes|rtl8169 RTL8101E}} || {{Yes|AR5006}} atheros 5k || 2016 AspireOS 1.8, 2025 aros one 2.6 32bit USB || 2007 32bit 1 core - 19v barrel - |- | Aspire One AOD150 D150 (Compal LA-4781P), AOD110 D110 (ssd) || Intel 945GME || {{N/A}} || {{Maybe|ide legacy}} || {{Yes|Intel GMA 950 (2D)}} || {{Yes|HDAudio with alc272}} || {{Yes|USB}} || {{No|Atheros AR8121 AR8113 AR8114 l1e}} || {{Maybe|AR5007EG AR5BXB63 works but Broadcom BCM4312 has no support}} || 2010 Icaros Desktop 1.3, 2024 Aros one 32bit USB || 2008 32bit 1 core - 19v barrel - |- | Aspire One (ZG8) || Intel 945G and N270 || {{N/A}} || {{Maybe|ide mode}} || {{Yes|Intel GMA 2D and accelerated 3D}} || {{maybe|HD Audio }} || {{Yes|uhci and ehci}} || {{No|Broadcom }} || {{no|Intel}} || 2014 AspireOS 1.8 || 2009 32bit - |- | Aspire One AOD250 D250 emachines em250 || 945GME || {{N/A}} || {{Maybe|ide legacy}} || {{Yes|Intel GMA (2D)}} || {{Yes|alc272 HD Audio}} || {{Yes}} || {{No|AR8132 (L1c)}} || {{No|BCM4312 or Atheros AR5B95}} || 2010 Icaros 1.3 || 2009 32bit 1 core - 19v barrel - |- | <!--Name-->Aspire AO532H (Compal LA-5651p) 533H Pineview || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio-->{{Yes|HD Audio playback}} || <!--USB--> || <!--Ethernet-->{{No|AR8132 (L1c)}} || <!--Wireless-->{{No|Atheros 9k}} || [http://www.amigaworld.net/modules/news/article.php?mode=flat&order=0&item_id=5968 Tested AspireOS June 2011] || <!--Comments--> |- | <!--Name-->emachines eM350 NAV51 || <!--Chipset--> with N450 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Intel 3150 || <!--Audio-->HD Audio with codec || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro-->Icaros 2.2 || <!--Comments-->Single core 64bit - 160GB HDD 1GB RAM 10.1" LED backlit screen and Webcam - 3 cell li-ion battery for 3 hours usage - |- | <!--Name-->emachines eM355 || <!--Chipset--> with N455 || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments-->64bit support possible - |- | <!--Name-->Aspire One 533 || <!--Chipset-->N455 with NM10 || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes}} || <!--Gfx-->{{Yes|2D 0x8086 0xa011}} || <!--Audio-->{{Yes| ALC272 codec ich7}} || <!--USB-->{{Yes}} || <!--Ethernet-->{{No|Atheros AR8152 v1.1 1c}} || <!--Wireless-->{{No|Broadcom 4313}} || <!--Test Distro-->2016 Icaros 2.1 and AROS One 2.3 || <!--Comments-->2011 64bit - f2 setup - 10.1inch 1024 x 768 - |- | Aspire One AOD255 AOD255e AOD260 AOHAPPY (Compal LA-6221P) || N570 and Nm10 || {{N/A}} || {{Maybe|SATA}} || {{Maybe|Intel GMA 3150}} || Audio || USB || {{No|Atheros AR8152 V1.1 (1lc)}} || {{No|Broadcom BCM4313}} || || a little support |- | Aspire One 522 AO522 (Compal LA-7072p) || 1GHz dual C-50 C50 or C-60 C60 + Hudson M1 || {{N/A}} || SATA || AMD 6250 (ATI 9804) or 6290 || ATI SB CX20584 HD Audio || USB || Atheros 8152 v2.0 l1c || {{No|Broadcom BCM4313 or Atheros ath9k}} || || |- | <!--Name-->AAOD270 Aspire One D270 || <!--Chipset-->N2600 Cedarview || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes| }} || <!--Gfx-->{{Yes|2D on Intel GMA 3650}} || <!--Audio-->{{Yes| }} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Yes|RTL 8169 RTL8101E}} || <!--Wireless-->{{No|Broadcom BCM4313 but swap for Atheros 5k}} || <!--Test Distro--> || <!--Opinion-->2011 64bit atom - ddr2 so-dimm 2gb max - |- | <!--Name-->Aspire One AO532G (Compal LA-6091p) || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Aspire One D257 (Quanta ZE6) || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Acer Aspire One 722 AO722 P1VE6 || <!--Chipset-->AMD C-60 C60 with SB900 || <!--IDE-->{{N/A| }} || <!--SATA--> || <!--Gfx-->{{Maybe| use VESA Ati 6290}} || <!--Audio-->{{Yes|HD Audio with codec but no Wrestler HDMI output}} || <!--USB--> || <!--Ethernet-->{{No|Qualcomm Atheros AR8152 v2.0}} || <!--Wireless-->{{unk|Atheros AR9485}} || <!--Test Distro-->2017 Icaros 2.1.2 || <!--Comments--> |- | <!--Name-->Aspire One AO721 (Wistron SJV10-NL) || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->AO751 AO751H (Quanta ZA3) || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Packard Bell Dot .S || <!--Chipset-->N280 + || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|legacy}} || <!--Gfx-->{{yes|Intel GMA950 (2D)}}|| <!--Audio-->HD Audio ALC272X || <!--USB--> USB2.0 || <!--Ethernet--> {{no|Atheros l1e}} || <!--Wireless-->{{no|Atheros 9k}} || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Packard Bell Dot .SE || <!--Chipset-->N450 + || <!--IDE-->{{N/A}} || <!--SATA-->legacy || <!--Gfx-->Intel GMA950 (2D) || <!--Audio-->HD Audio ALC|| <!--USB-->USB2.0 || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Packard Bell Dot .S2 NAV50 || <!--Chipset-->N455 NM10 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Intel X3150 || <!--Audio-->HD Audio ALC269 || <!--USB--> || <!--Ethernet-->Atheros || <!--Wireless-->Atheros || <!--Test Distro--> || <!--Comments--> |- | <!--Name-->Packard Bell Dot M/A || <!--Chipset-->1.2GHz Athlon L110 + RS690E || <!--IDE-->{{N/A}} || <!--SATA-->legacy mode? || <!--Gfx-->AMD ATI Radeon Xpress X1270 (VESA only) || <!--Audio-->HD Audio ATI SBx00 || <!--USB--> || <!--Ethernet-->Realtek RTL8101E RTL8102E rtl8169 || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro--> || <!--Opinion--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Asus Netbooks==== {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | [http://wiki.debian.org/DebianEeePC/Models eeePC] 700 701 2G 4G 8G Surf || Intel 910GML + ICH7 || {{N/A}} || {{Maybe|IDE legacy mode}} || {{Yes|Intel GMA 900 2D and 3D tunnel 68 gearbox 43 on 701 800x480}} || {{Yes|ALC662 HD Audio}} || {{Yes|UHCI and EHCI}} || {{No|Atheros L2}} || {{Yes|Atheros 5k AR5007EG (AR2425 works}} || 2016 Icaros 2.1.1, 2.1.2, Aros One 2.5 32bit USB, || 2007 32bit - power supplies fail due to bad caps issue 9.5V 2.5A 24W Charger AD59930 4.8*1.7MM - |- | [http://wiki.debian.org/DebianEeePC/Models eeePC] 701SD || Intel 910GML + ICH7 || {{N/A}} || {{Maybe|IDE legacy mode}} || {{Maybe|Intel GMA 900 (2D)}} || {{Yes|ALC662 HD Audio}} || {{Yes|UHCI and EHCI}} || {{No|Atheros L2}} || {{No|RTL8187SE swap with Atheros 5k}} || 2014 AspireOS 1.7, || 2007 32bit - boot issues but does boot with ATA=32bit,nopoll or ATA=nodma,nopoll |- | [http://wiki.debian.org/DebianEeePC/Models eeePC] 900 || Intel 910GML + ICH7 || {{N/A}} || {{Maybe|IDE legacy mode}} || {{Maybe|Intel GMA 900 (2D, 3D in some models)}} || {{Yes|ALC662 HD Audio}} || {{Yes|UHCI and EHCI}} || {{No|Atheros L2}} || {{Maybe|depends on chipset AR5007EG (AR2425) works but not RaLink}} || 2014 AspireOS 1.7, || 2008 32bit - boot issues but does boot with ATA=32bit,nopoll or ATA=nodma,nopoll. 900's may need BIOS upgrade to boot usb optical drives. 3D available in some model revisions - AD59230 9.5v 2.31a psu - |- | eeePC 900A || 945GSE || {{N/A}} || {{Maybe|IDE legacy mode}} || {{Yes|Intel GMA 950 (3D)}} || {{Yes|HD Audio ALC269}} || {{Yes|USB2.0}} || {{No|Atheros L1e [1969 1026]}} || {{Yes|Atheros 5k AR242x}} || Nightly Build 2012, 2023 Aros One 32bit 2.4 || 2009 32bit |- | eeePC 901 1000 || 945GM || {{N/A}} || {{Maybe|IDE legacy mode}} || {{yes|Intel GMA 950 (2D)}} || {{Yes|ALC269 HD Audio}} || {{Yes|USB}} || {{No|Atheros L1E (AR8121 AR8113 AR8114)}} || {{No|RaLink Device 2860 swap with Atheros 5k}} || 2011 Icaros 1.4, || 2009 32bit - 12v 3a psu - |- | eeePC Seashell 1000HA 1000HE 1008 1005HA || N280 + Intel GMA950 || {{N/A}} || SATA || {{Yes|Intel GMA (2D)}} || {{Yes|HD Audio ALC269}} || {{Yes|USB}} || {{Maybe|Realtek but not Atheros AR8132 (L1c)}} || {{unk|Atheros AR9285}} || 2014 Aspire OS 1.6, || 2010 32bit - 12v 3a psu - |- | <!--Name-->eeePC 1001ha || <!--Chipset-->GMA945 || <!--IDE-->{{N/A}} || <!--SATA-->legacy || <!--Gfx-->Intel GMA 950 (2D) || <!--Audio-->ALC269 HD Audio || <!--USB--> || <!--Ethernet-->{{No|Attansic Atheros AR8132 l1c}} || <!--Wireless-->{{No|RaLink RT3090 swap with Atheros 5k}} || <!--Test Distro-->untested || <!--Opinion-->2010 32bit |- | eeePC 1001P T101MT 1005PX 1005PE 1015PE Pineview 1001PXD || NM10 and N450 N455 CPU || {{N/A}} || {{Maybe|IDE mode}} || {{Yes|Intel GMA 3150 (2D)}} || {{Yes|HD Audio}} || {{Yes|USB 2.0}} || {{No|Atheros AR8132 (l1c)}} || {{unk|Atheros AR928x 802.11n}} || 2010 Icaros 1.3.3, || 2011 64bit - 19V 2.1A 2.3x0.7 - |- | EeePC 1015B 1215B || single C-30 C30 or dual C-50 C50 + Hudson M1 || {{N/A}} || SATA || {{partial|AMD 6250 (VESA only)}} || ATI SBx00 HD Audio || USB || {{No|AR8152 v2.0 atl1c}} || {{No|Broadcom BCM4313 [14e4 4727]}} || untested recently || 2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name-->Flare X101CH Cedarview || <!--Chipset-->N2600 + N10 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Intel GMA 6300 || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{No|Atheros l1c 2.0}} || <!--Wireless-->{{unk|Atheros 9k AR9285}} || <!--Test Distro--> || <!--Comments-->2012 64bit |- | <!--Name-->Flare 1025CE 1225CE || <!--Chipset-->N2800 + N10 || <!--IDE--> || <!--SATA--> || <!--Gfx-->{{dunno|Intel GMA 3600}} || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{No|Atheros l1c 2.0}} || <!--Wireless-->{{unk|Atheros 9k AR9285}} || <!--Test Distro--> || <!--Comments-->2012 64bit |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Dell Netbooks==== {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | Inspiron 910 Mini 9 PP39S Vostro A90 || GMA945 || {{Maybe|STEC 8G 16G 32G IDE PATA Parallel ATA miniPCIE SSD 50MM / 70MM very slow}} || {{N/A| }} || {{yes|Intel GMA 2D and 3D opengl1}} || {{yes|ALC268 HD Audio}} || {{yes|USB2 boots and works}} || {{yes|rtl8169 Realtek RTL8102E}} || {{no|Broadcom BCM4310 and 4312 swap with atheros 5k bx32}} || ICAROS 1.3 but Icaros 2.3 (pci issues), AROS One 2.6 and Tiny AROS (digiclock startup) mouse cursor vanishes || 2008 32bit - 9inch 1024x600 screen - 1 ddr2 sodimm slot max 2gig - 19v 1.58a - 0 boot disk select - cr2032 battery under laptop base cover, while mem 2GB max under base flap - |- | <!--Name-->Inspiron Mini 10 1010 PP19S || <!--Chipset-->Atom Z520 Z530 Intel US15W Poulsbo || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{maybe|Intel GMA 500 (VESA only)}} || <!--Audio-->{{Maybe|HD Audio ALC269 codec}} || <!--USB--> || <!--Ethernet-->{{yes|rtl8169 RTL8102E}} || <!--Wireless-->{{no|Intel or BCM4312}} || <!--Test Distro-->untested || <!--Comments-->2008 32bit - 10.10 inch 16:9, 1366 x 768 glossy - 28whr or 56wHr battery options - |- | [https://wiki.ubuntu.com/HardwareSupport/Machines/Netbooks#Dell%20Mini%2010v%20(Inspiron%201011) Mini 10v 1011] [http://wiki.debian.org/InstallingDebianOn/Dell/InspironMini10v ] || Intel 950 || {{N/A}} || {{maybe|ide legacy mode}} || {{yes|Intel GMA (2D)}} || {{maybe|HDAudio}} || {{yes|USB}} || {{yes|RTL8102E 8103E}} || {{no|Dell 1397 Wireless}} || untested || 2008 32bit - |- | <!--Name-->Inspiron Mini 1018 || <!--Chipset-->Intel Atom N455 || <!--IDE-->{{N/A}} || <!--SATA-->{{partial|IDE mode }} || <!--Gfx-->{{yes|Intel GMA 3150 (2D, no VGA output)}} || <!--Audio-->{{partial|HD Audio head phones only - speaker and micro phone do not work}} || <!--USB-->{{yes|USB 2.0}} || <!--Ethernet-->{{yes|RTL8169}} || <!--Wireless-->{{unk|RTL8188CE or AR928X}} || <!--Test Distro-->2011 Icaros 1.5.1, || <!--Comments-->2009 64bit - 1 DDR3 max 2gb - |- | Latitude 2100 || Intel Atom N270 N280 1.60Ghz GMA 945GME || {{N/A}} || {{Yes|set to IDE in bios as ahci not working || {{yes|Intel GMA 950 (2D and 3D with tunnel 98 and gearbox 84)}} || {{yes|HD Audio with ALC272 codec}} || {{yes|USB2.0}} || {{No|Broadcom BCM5764M}} || {{No|Intel 5100 or BCM4322 DW 1510 half height mini pcie use small Atheros 5k}} || <!--Test Distro-->2016 AspireOS 1.8, Icaros 2.1.1 and AROS One USB 2.4 || 2009 32bit ddr2 sodimm max 2G - [https://sites.google.com/site/arosaspireone/about-aspire-one Webcam and card reader not working] lcd cable over hinge an issue - f12 bios and boot - |- | <!--Name-->Latitude 2110 2120 || <!--Chipset-->N470 1.83Ghz, N455 1.6Ghz, N550 1.5Ghz || <!--IDE-->{{N/A}} || <!--SATA-->{{Yes|ATA mode in bios not ahci}} || <!--Gfx-->{{Yes|Intel 3150 2D only}} || <!--Audio-->{{Maybe|HD Audio with ALC269 codec}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No| }} || <!--Wireless-->{{No| swap for Atheros}} || <!--Test Distro-->2014 Icaros 2.3, || <!--Comments-->2011 64bit does not support AVX or SSE 4.1 - ddr2 sodimm |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====HP Compaq Netbooks==== {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | HP Mini 2133 || VIA C7-M P4M900 / 8237 VX700 || {{N/A}} || {{maybe|SATA}} || {{maybe|VIA Chrome 9 HC (VESA only)}} || {{no|VT1708/A HD Audio}} || USB || {{no|Broadcom Corp NetXtreme BCM5788}} || {{no|Broadcom Corp BCM4312}} || untested || 2008 32bit - |- | HP mini 1000 Mi 2140 ks145ut || N270 + 945GM || {{N/A}} || SATA || <!--Gfx-->{{Yes|Intel GMA 950 (2D and opengl1 3d)}} || <!--Audio-->{{Yes|HD Audio (playback tested)}} || <!--USB-->{{Yes| }} || {{no|Marvell 88E8040}} || {{no|Broadcom Corp BCM4312 hard blocked}} || untested || 2009 32Bit - unable to change wifi card |- | <!--Name-->HP Mini 700 702 || <!--Chipset-->N270 + 945GSE || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Yes|Intel GMA 950 (2D)}} || <!--Audio-->{{Yes|HD Audio IDT 92HD75B (111d:7608, only playback tested)}} || <!--USB-->{{Yes| }} || <!--Ethernet--> || <!--Wireless-->{{No|Broadcom hard locked}} || <!--Test Distro-->untested || <!--Comments-->2009 32bit - |- | Compaq HP Mini 110 110-3112sa || 945GM Express || {{N/A}} || {{maybe|IDE mode}} || {{yes|Intel GMA 950 (2D)}} || {{yes|HD Audio IDT STAC 92xx}} || {{yes|USB 2.0}} || {{no|Atheros}} || {{no|Broadcom hard blocked Fn+F12}} || untested || 2009 32bit - unable to change wifi |- | HP Mini 200 210 || 945GM NM10 Express || {{N/A}} || SATA || Intel GMA 950 || {{Maybe|HDAudio with }} || USB || RTL8101E RTL8102E || {{no|Broadcom BCM4312 hard locked}} || untested || 2009 32bit - |- | HP Mini 311 DM1 (Quanta FP7) || N280 + ION LE || {{N/A}} || SATA || nVidia Geforce ION || {{maybe|HDAudio with }} || USB || eth || {{No|hard locked}} || untested || 2009 64bit does not support AVX or SSE 4.1 - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |} ====Lenovo Netbooks==== {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | IdeaPad S9 S9e(3G) S10 S10e(3G) || 945GME || {{N/A}} || {{maybe|SATA}} || {{yes|Intel GMA (2D)}} || {{maybe|ALC269 or SigmaTel HD Audio}} || {{yes|USB}} || {{no|Broadcom NetLink BCM5906M}} || {{no|Broadcom BCM4312 hard blocked}} || untested || 2009 32bit - |- | IdeaPad S12 || Intel Atom N270 + Nvidia ION LE MCP79 || {{N/A}} || SATA || nVidia C79 ION [Quadro FX 470M] || {{maybe|ALC269 HD Audio}} || USB || {{no|Broadcom}} || {{no|Intel locked down}} || 2012 Icaros 2.0, || 2009 32bit - does not boot - cause unknown |- | S10-2 || 945GME and N280 CPU || {{N/A}} || SATA || {{yes|Intel GMA (2D)}} || {{maybe|ALC269 HD Audio}} || {{yes}} || {{yes|rtl8169}} || {{no|Broadcom BCM4312 hard blocked}} || 2011 Icaros 1.3, || 2009 32bit - |- | S10-3 || NM410 and N450 CPU || {{N/A}} || SATA || {{yes|Intel GMA 3150 (2D)}} || {{maybe|HD Audio ALC269}} || {{yes|USB}} || {{yes|rtl8169}} || {{no|Atheros 9285 or Broadcom BCM4312 hard blocked}} || 2011 Icaros 1.3, || 2009 32bit - |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Samsung Netbooks==== [[#top|...to the top]] {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | [http://www.amigaworld.net/modules/newbb/viewtopic.php?post_id=616910&topic_id=33755&forum=28#616910 NC10] || 945GME || {{N/A}} || {{maybe|SATA}} || {{yes|Intel GMA 950 (2D)}} || {{partial|SigmaTel HD Audio (playback only)}} || {{yes|USB}} || {{maybe|rtl8169 works but not Marvell 88E8040 sky2}} || {{yes|AR5007EG}} || 2011 Icaros 1.4, || 2009 32bit - Nano silver on keyboard and lcd ribbon cable over hinge issues |- | [http://www.sammywiki.com/wiki/Samsung_NC20 NC20] || VIA VX800 || {{N/A}} || SATA || {{maybe|VIA Chrome9 (VESA only)}} || ALC272 GR (VT1708A) HD Audio || {{yes|USB}} || {{no|Marvell 88E8040}} || {{yes|Atheros AR5001}} || untested || 2009 32bit - |- | NP-N110 NP-N120 || 945GSE || {{N/A}} || SATA || {{yes|Intel GMA 950 (2D)}} || {{yes|ALC272 HD Audio or ALC6628}} || {{yes|USB}} || {{no|Marvell 88E8040}} || {{no|Realtek rtl8187}} || untested || 2009 32bit - Namuga 1.3M Webcam none |- | NP-N130 || 945GSE || {{N/A}} || {{yes|SATA in IDE mode}} || {{yes|Intel GMA 2D and opengl 1.x 99.5 tunnel 99 gearbox}} || {{yes|Intel HD with ALC272 ALC269 codec playback}} || {{yes|USB}} || {{yes|RTL 8169.device - 8101e 8102e}} || {{no|rtl 8192se rtl8187 too small an area to swap for atheros 5k}} || untested || 2009 32bit - 10.x inch 1024 x 600 - Namuga 1.3M Webcam - front slide power on and f2 setup bios - keyboard 17.7mm Pitch is made with Silver Nano (Anti-Bacterial) tech - small touchpad - 1 ddr2 2rx16 sodimm slot 2G max - 44Wh |- | <!--Name-->Go NP-N310 || <!--Chipset-->N270 + 945GME || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|IDE legacy mode}} || <!--Gfx-->{{yes|Intel GMA 950 (2D)}} || <!--Audio-->{{yes|HD Audio ALC6628}} || <!--USB-->{{yes}} || <!--Ethernet-->{{yes|rtl8169}} || <!--Wireless-->{{yes|Atheros5k}} || <!--Test Distro-->untested || <!--Opinion-->2010 32bit - N280 version changed specs |- | NP-N510 || N270 euro N280 uk + ION MCP79 || {{N/A}} || SATA || nVidia C79 ION [Quadro FX 470M] || HD Audio || USB || Marvell 88E8040 || Realtek 8192E || untested || 2010 32bit - does not boot - cause unknown |- | NP-N145 Plus || n450 + NM10 || {{N/A}} || {{maybe|IDE legacy mode}} || {{yes|Intel GMA 3150 (2D, no VGA output)}} || {{yes|Realtek HD Audio}} || {{yes|USB2.0}} || {{no|Marvell 88E8040}} || {{unk|Atheros AR9285}} || untested || 2010 some support but often the trackpad does not work |- | <!--Name-->NC110 Axx || <!--Chipset-->NM10 || <!--IDE-->{{N/A}} || <!--SATA-->Sata || <!--Gfx--> || <!--Audio-->HDAudio with ALC269 codec A9M22Q2 || <!--USB--> || <!--Ethernet-->{{Maybe|Rtl8169}} || <!--Wireless-->{{No|Broadcom BCM4313 or Atheros}} || <!--Test Distro-->untested || <!--Comments-->2011 64bit - |- | NF210 Pineview || n455 or n550 + N10 || {{N/A}} || {{maybe|SATA}} || {{maybe|Intel GMA 3150 (needs retesting, VESA works)}} || {{yes|HD Audio}} || {{yes|USB}} || {{no|Marvell 88E8040}} || Wireless || untested || 2011 64bit - some support |- | <!--Name-->NS310 NP-NS310-A03UK || <!--Chipset-->N570 with NM10 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->{{Maybe|use Vesa 2d }} || <!--Audio-->{{yes| ich7}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{yes|rtl8169 realtek 810xe }} || <!--Wireless-->{{no|bcm4313 }} || <!--Test Distro-->2022 AROS One 2.3, || <!--Comments-->2011 64bit Atom N570 or 1.5 GHz Intel Atom N550 dual core processor, 1 DDR3 sodimm slot memory, a 250GB hard drive, and a 10.1 inch, 1024 x 600 pixel 10.1" W7St - 2300mAh short life - |- | <!--Name-->[https://wiki.archlinux.org/index.php/Samsung_N150 N150] NB30 || <!--Chipset-->MN10 || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Yes|Intel GMA 3150 (2D)}} || <!--Audio-->{{No| }} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Marvell 88E8040}} || <!--Wireless-->{{unk|Atheros AR9285 or Realtek 8192E}} || <!--Test Distro-->untested || <!--Comments-->2011 a little support |- | <!--Name-->[http://www.kruedewagen.de/wiki/index.php/Samsung_N220 N210 N220] N230 || <!--Chipset-->N450 + NM10 || <!--IDE-->{{N/A}} || <!--SATA-->{{Maybe| }} || <!--Gfx-->{{Yes|Intel GMA 3150 (2D)}} || <!--Audio-->HD Audio ALC269 || <!--USB-->{{Yes| }} || <!--Ethernet-->{{No|Marvell}} || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro-->untested || <!--Comments-->2011 64bit no sse4.1 or avx - |- | <!--Name-->NC110 Pxx Cedarview || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{dunno|Intel GMA 3600}} || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless-->{{No|Intel 6000g}} || <!--Test Distro-->untested || <!--Comments-->2012 64bit |- |} ====Toshiba Netbooks==== [[#top|...to the top]] {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="10%" |Wireless ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->NB100 || <!--Chipset-->945GM || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|legacy}} || <!--Gfx-->{{yes|Intel GMA (2D)}} || <!--Audio-->{{yes|ALC262 HD Audio}} || <!--USB--> || <!--Ethernet-->{{yes|rtl8169}} || <!--Wireless-->{{yes|AR5001}} || <!--Test Distro-->untested || <!--Comments-->2009 32bit - |- | <!--Name-->Mini NB200 series NB205 || <!--Chipset-->N280 + GSE945 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|IDE legacy mode}}|| <!--Gfx-->{{yes|Intel GMA (2D)}} || <!--Audio-->ALC272 HD Audio || <!--USB-->{{yes}} || <!--Ethernet-->{{yes|RTL8169}} || <!--Wireless-->{{maybe|AR9285}} || <!--Test Distro-->untested || <!--Opinion-->2009 32bit - |- | <!--Name-->Mini 300 series NB305 || <!--Chipset-->N455 with NM10 || <!--IDE-->{{N/A}} || <!--SATA-->legacy || <!--Gfx-->Intel GMA 3150 (2D) || <!--Audio-->ALC272 HD Audio || <!--USB--> || <!--Ethernet-->{{maybe|RTL8101E RTL8102E}} || <!--Wireless-->{{maybe|AR9285}} || <!--Test Distro-->untested || <!--Opinion-->2010 64bit - |- | <!--Name-->Mini 500 series NB505 NB520 NB550-10v || <!--Chipset--> || <!--IDE-->{{N/A}} || <!--SATA-->legacy || <!--Gfx-->Intel GMA 3150 (2D) || <!--Audio-->HD Audio || <!--USB--> || <!--Ethernet-->{{maybe|RTL8101E RTL8102E}} || <!--Wireless-->{{no|Realtek 8176 RTL 8188CE}} || <!--Test Distro-->untested || <!--Opinion-->2011 64bit - |- | [http://www.notebookcheck.net/Review-Toshiba-NB550D-AMD-Fusion-Netbook.46551.0.html Mini NB550D 10G] 108 (c30) 109 (c50) || C-50 + M1 || {{N/A}} || SATA || AMD 6250 (VESA only) || HD Audio || USB || {{maybe|rtl8169 Realtek 8111e}} || {{maybe|Atheros 9k}} || untested || 2011 64bit Realtek SD card reader |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ====Misc Netbooks==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |Chipset ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="5%" |Ethernet ! width="5%" |Wireless ! width="5%" |Test Distro ! width="30%" |Comments |- | Cammy's A1600 || GME945 || {{N/A}} || {{maybe}} || {{yes|Intel GMA950 (2D)}} || {{yes|HD Audio playback}} || {{yes}} || {{no|JMC 250/260}} || Wireless || 2010 Icaros 1.2.4, || 2009 32bit - |- | <!--Name-->Fujitsu Siemens Amilo Mini Ui 3520 || <!--Chipset-->Intel 945 || <!--ACPI--> || <!--SATA-->{{yes}} || <!--Gfx-->{{yes|Intel GMA (2D)}} || <!--Audio-->ALC269 HD Audio || <!--USB-->{{yes}} || <!--Ethernet-->{{yes|rtl8169}} || <!--Wireless-->{{yes|AR5001}} || <!--Test Distro-->untested || <!--Comments-->2009 32bit - |- | Guillemot Hercules eCafe EC-900 H60G-IA], Mitac MiStation and Pioneer Computers Dreambook Light U11 IL1 || Intel 945GME || {{N/A}} || {{maybe}} || {{yes|Intel GMA950 (2D)}} || {{Yes|HD Audio (playback only)}} || {{yes|uhci and ehci}} || {{yes|rtl8169}} || {{no|RAlink RT2860}} || untested || 2009 32bit - |- | <!--Name-->Hannspree Hannsnote SN10E2 24 48 || <!--Chipset-->N450 + NM10 || <!--IDE-->{{N/A}} || <!--SATA-->IDE legacy mode || <!--Gfx-->Pineview Intel (2D) || <!--Audio-->ALC HD Audio || <!--USB-->USB2.0 || <!--Ethernet-->Atheros l1c || <!--Wireless-->{{unk|Atheros AR9285}} || <!--Test Distro-->untested || <!--Opinion-->2009 32bit - |- | MSI Wind U90/U100 || GME945 || {{N/A}} || {{maybe}} || {{yes|Intel GMA 950 (2D)}} || {{partial|HD Audio ALC888s (playback only?)}} || {{yes|uhci 1.1 and ehci 2.0}} || {{yes|rtl8169}} || {{no|RaLink RT2860 RT2700E or rtl8187se (u100x)}} || 2011 Icaros 1.3, || 2009 32bit - |- | Advent 4211 || 945GSE || {{N/A}} || {{maybe|IDE legacy mode}} || Intel GMA950 (2D) || ALC HD Audio || USB || rtl8169 || {{no|Intel 3945 ABG}} || untested || 2009 32bit - MSI U100 clone |- | <!--Name-->Hannspree Hannsnote SN10E1 || <!--Chipset-->N270 + GMA945 || <!--IDE-->{{N/A}} || <!--SATA-->{{maybe|IDE legacy mode}} || <!--Gfx-->{{yes|Intel GMA 950 (2D)}} || <!--Audio-->ALC HD Audio || <!--USB-->USB2.0 || <!--Ethernet-->{{yes|Realtek RTL8101E RTL8102E RTL8169}} || <!--Wireless-->{{no|RaLink RT2860}} || <!--Test Distro-->untested || <!--Comments-->2009 32bit MSI U100 clone |- | <!--Name--> Vaio VGN-P11Z | <!--Chipset--> | <!--IDE--> {{dunno}} | <!--SATA--> {{N/A}} | <!--Gfx--> {{Partial|Intel (VESA only)}} | <!--Audio--> {{no|HD Audio}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{no|Marvell}} | <!--Wireless--> {{unk|Atheros AR928X}} | <!--Test Distro-->2012 Icaros 2.0.3 | <!--Comments-->2008 32bit Rarely boots! |- | <!--Name-->Sony VPC-W11S1E | <!--Chipset-->N280 with 945GSE | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes| }} | <!--Gfx-->{{yes|Intel GMA950 - hdmi}} | <!--Audio-->HD Audio with realtek codec | <!--USB-->3 USB2 | <!--Ethernet-->{{No|Atheros AR8132}} | <!--Wireless-->{{unk|Atheros AR9285}} | <!--Test Distro-->untested | <!--Comments-->2009 32bit - 10.1" 1366 x 768 glossy - 3hr battery life - |- | <!--Name-->Archos 10 Netbook || <!--Chipset-->Atom with ICH7 NM10 945GSE || <!--IDE-->{{No }} || <!--SATA--> || <!--Gfx-->GMA 950 || <!--Audio-->HD Audio with ALC662 codec || <!--USB--> || <!--Ethernet-->Realtek 8139 || <!--Wireless--> || <!--Test Distro-->untested || <!--Comments-->2008 32bit - |- | <!--Name-->MSI Wind U135 DX MS-N014 || <!--Chipset-->Intel N455 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{Yes|2D only accelerated}} || <!--Audio-->{{No|ALC662 rev 1}} || <!--USB-->{{Yes| }} || <!--Ethernet-->{{Maybe|RTL}} || <!--Wireless-->{{No|Atheros AR 9K}} || <!--Test Distro-->2015 Icaros 2.1, || <!--Comments-->2009 32bit - needs noacpi notls added to grub boot line to start up |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--Chipset--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Wireless--> || <!--Test Distro--> || <!--Comments--> |- |} ===Desktop Systems=== [[#top|...to the top]] {| class="wikitable sortable" width="100%" | <!--OK-->{{Yes|'''Works well'''}} || <!--May work-->{{Maybe|'''Works a little'''}} || <!--Not working-->{{No|'''Does not work'''}} || <!--Not applicable-->{{N/A|'''N/A not applicable'''}} |- |} ====Acer==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->[https://www.acer.com/ac/en/ID/content/support-product/486;-; Veriton X270 VTX270] Intel Core 2 Duo ED7400C or Pentium dual-core UD7600C with 630i | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{Maybe|Vesa 2d Nvidia 7100 VGA and HDMI connections}} | <!--Audio-->{{Maybe| with realtek codec}} | <!--USB-->{{Maybe|4 rear and 5 front}} | <!--Ethernet-->{{Maybe| nForce}} | <!--Test Distro-->Icaros 2.3 dvd | <!--Comments-->2009 64bit capable but would not fully boot, DHCP address timeout too short and failed often. Put in a third party NIC, worked - 1 PCI Express x16 slot and a free PCI x1 slot - internal thin long psu with 12pin - |- | <!--Name--> Imedia S1710 with Intel Dual Core E5200 | <!--IDE--> {{Yes|SATA/AHCI}} | <!--SATA--> {{Maybe|Native IDE}} | <!--Gfx--> {{Yes|Nvidia nForce 7100}} | <!--Audio--> {{Yes|Nvidia MCP73}} | <!--USB--> {{Yes|USB 2.0}} | <!--Ethernet--> {{No|NVIDIA MCP73 Ethernet}} | <!--Test Distro--> Nightly Build 14-09-2023, AROS One 2.3 | <!--Comments--> 2009 64-bit - Boot over USB not working on front - 2 DDR2 dual channel max 8GB - DEL for entering Bios - F12 for boot menu - Bus weird, could be reason for Ethernet issue |- | <!--Name-->Acer Revo AR1600, R1600 AR3600, R3600, Packard Bell IMAX Mini N3600, ACER Veriton N260G N270G slim nettop subcompact | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|Native IDE mode, '''when it works''' boots}} | <!--Gfx-->{{Maybe|Nvidia ION GeForce 9300M - nouveau 3d - '''when it boots''' 400 fps in shell'ed gearbox, 278 in tunnel, 42 in teapot}} | <!--Audio-->{{Maybe|HD Audio with alc662 codec but nothing from HDMI audio}} | <!--USB-->{{Maybe|Nvidia USB boot usb2 stick issues and slower with usb3 drives}} | <!--Ethernet-->{{No|MCP79 nForce}} | <!--Test Distro-->ArosOne 32bit very often boot stuck around ehciInit, 64bit ... | <!--Comments-->2009 64bit does not support AVX or SSE 4.1 Intel Atom 230 N280 - 20cm/8" high 1 ltr noisy fan - DEL setup F12 boot options - 2 ddr2 sodimm slots max 4GB - 19v special barrel size 5.5mm/1.7mm psu - 2 ddr2 sodimm slots max 4GB - atheros 5k AR5BXB63 wifi - 3 wire CMOS coin battery - |- | <!--Name-->Revo AR3610 R3610 3610 Atom 330 nettop subcompact dual core | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|Native IDE mode, '''when it works''' boots}} | <!--Gfx-->{{Maybe|Nvidia ION GeForce 9400M LE MCP79MX 0x10de 0x087d - nouveau 3d - '''when it boots''' 400 fps in shell'ed gearbox, 278 in tunnel, 42 in teapot}} | <!--Audio-->{{Yes|HD Audio with Realtek alc662 rev1 alc662-hd later ALC885 codec but nothing from HDMI audio}} | <!--USB-->{{Maybe|Nvidia USB with 1% chance slow boot with usb2 sticks, more issues with usb3 drives}} | <!--Ethernet-->{{No|RTL8211CL MCP79 nForce 0x10de 0x0ab0}} | <!--Test Distro-->AROS One 32bit 1.5, 1.6 and 2.4 usb around ehciInit or Kernel SATA, etc try ATA=off, and 64bit 1.2 USB boot often stuck at device 0x00000000b05228c8 interrrupt by using noacpi noiopica | <!--Comments-->2010 64bit does not support AVX or SSE 4.1 20cm/8" high 1 ltr noisy fan - non usb hub keyboard - DEL bios setup, F12 BBS POPUP/drive boot - 2 ddr2 sodimm slots max 4GB - 19v barrel psu with smaller inner pin size 5.5mm/1.7mm - replace wifi RT3090 ver c (0x1814 0x3090) with atheros 5k - 3 wire CMOS coin battery - |- | <!--Name-->Revo N281G | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe| }} | <!--Gfx-->{{maybe|GMA 2d for GMA 3100}} | <!--Audio-->HD audio codec | <!--USB-->USB2 | <!--Ethernet-->Realtek | <!--Test Distro--> | <!--Comments-->2011 64bit does not support AVX and SSE 4.1 Atom D425 - 19v 65w barrel psu thinner inner pin - 2 DDR3L single channel max 4GB - replace wifi RT3090 ver d with atheros 5k mini pci-e - 1lr or 1.5 ltr dvdrw case 209.89 mm, (D) 209.89 mm, (H) 35.35 mm - del enter bios - 3 wire CMOS coin battery - |- | <!--Name-->REVO AR3700 R3700 3700 - ACER Veriton N282G *one long beep with two short - bios damaged *looping one long two short - video card fault *two short beeps - CMOS damaged *got one long and one short beep - board error? | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes|IDE ready in Bios * Known issue, boot into bios, set bios to UEFI and reboot, set bios back to defaults and reboot, blank display, repair with reflash of 8 pin Winbond W25Q socketed bios chip with ch341a using P01.B0L or P01.A4 renamed amiboot.rom}} | <!--Gfx-->{{Yes|Nvidia ION2 GT218 9400M class 0x10de 0x0a64 with vga fine but hdmi fussy over cable and display port used - 32bit nouveau 2d & 3d gearbox 404 tunnel 292 teapot 48 - 64bit not detected}} | <!--Audio-->{{Yes|HDA Intel with Realtek ALC662 rev1 codec 0x10ec 0x0662, head phones only but nothing from NVidia HDMI 0x10de 0x000b}} | <!--USB-->{{Yes|Intel® NM10 Express (NM10 is basically an ICH7 with a die shrink and IDE removed) USB boots usb, installs usb, accesses ok}} | <!--Ethernet-->{{Yes|rtl8169 Realtek rtl8111g}} | <!--Test Distro-->AROS one 32bit USB 1.5 and 1.6 and ArosOne 64bit usb 1.2 | <!--Comments-->2011 Atom D525 64bit does not support AVX or SSE 4.1 - 20cm/8" high 1 ltr noisy fan - early 2 ddr2 sodimm slots but later 2 ddr3 sodimm slots 1Rx8 max 4GB - 19v barrel psu thinner pin - replace wifi RT3090 ver d with atheros 5k mini pci-e - cmos 3pin cr2032CL plastic wrapped - del bios f12 boot choice - |- | <!--Name-->Revo 70 (RL70) with or without dvdrw | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->6320 or 6310 | <!--Audio-->HD audio ALC662-VCO-GR codec | <!--USB-->USB2, 1.1 Hudson D1 | <!--Ethernet-->Realtek 8111E | <!--Test Distro--> | <!--Comments-->2012 64bit does not support AVX or SSE 4.1 AMD E450 1.65GHz - 19v 65w barrel psu thinner inner pin - 2 DDR3L single channel max 4GB - replace wifi RT3090 ver d with atheros 5k mini pci-e - 1lr or 1.5 ltr dvdrw case 209.89 mm, (D) 209.89 mm, (H) 35.35 mm - del enter bios - |- |} ====Asus==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->EEEbox B202 | <!--IDE--> | <!--SATA--> | <!--Gfx-->Intel GMA950 | <!--Audio-->Intel Azalia HDaudio with Realtek ALC662 or ALC888-GR CODEC | <!--USB--> | <!--Ethernet-->Realtek 8111 or JM250 | <!--Test Distro-->Icaros | <!--Comments-->internal 3 types of wifi chipset not supported |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- |} ====Dell==== {| class="wikitable sortable" width="100%" ! width="10%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name--> Precision 340 | <!--IDE--> {{yes}} | <!--SATA--> {{n/a}} | <!--Gfx--> {{n/a}} | <!--Audio--> {{yes|Intel AC97}} | <!--USB--> {{yes|USB 1.1 (UHCI)}} | <!--Ethernet--> {{yes|3Com}} | <!--Test Distro--> Nightly Build 2014 09-27 | <!--Comments--> |- | <!--Name-->Dimension 2400 | <!--IDE-->{{Yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{Yes|Intel 82845GL Brookdale G/GE (VESA 640x480 by 16)}} | <!--Audio-->{{Unk|AC97 with ADI codec}} | <!--USB-->{{Yes|UHCI EHCI}} | <!--Ethernet-->{{Maybe|Broadcom 440x 4401}} | <!--Test Distro-->[http://eab.abime.net/showthread.php?p=832495 Icaros 1.4] | <!--Comments-->Graphics chipset is capable of higher resolution. |- | <!--Name-->Dimension 4600 | <!--IDE-->{{yes}} | <!--SATA-->{{dunno}} | <!--Gfx-->{{partial|Intel Extreme (VESA only)}} | <!--Audio-->{{yes|Intel AC97 (use rear black port)}} | <!--USB-->{{Yes|UHCI/EHCI}} | <!--Ethernet-->{{yes|Intel PRO/100}} | <!--Test Distro-->Icaros 1.5.2 | <!--Comments--> |- | <!--Name--> Optiplex 170L | <!--IDE--> {{yes|IDE}} | <!--SATA--> {{partial|IDE mode}} | <!--Gfx--> {{partial|Intel Extreme (VESA only)}} | <!--Audio--> {{no|Intel AC97}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{yes|Intel PRO/100}} | <!--Test Distro--> {{dunno}} | <!--Comments--> |- | <!--Name--> Optiplex GX260 | <!--IDE--> {{yes|IDE}} | <!--SATA--> {{N/A}} | <!--Gfx--> {{partial|Intel Extreme (VESA only)}} | <!--Audio--> {{yes|Intel AC97}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{no|Intel PRO/1000}} | <!--Test Distro--> Nightly Build 2014 09-27 | <!--Comments--> |- | Optiplex GX270 | {{yes|Working}} | {{partial|IDE mode}} | {{partial|Intel Extreme (VESA only)}} | {{yes|Intel AC97}} | {{yes|USB 2.0}} | {{no|Intel PRO/1000}} | Icaros 1.5.2 | <!--Comments--> |- | Optiplex GX280 | {{yes|Working}} | {{partial|IDE mode}} | {{maybe|Intel GMA (only VESA tested)}} | {{yes|Intel AC97}} | {{yes|USB 2.0}} | {{no|Broadcom}} | Nightly Build 2014 09-27 | <!--Comments--> |- | <!--Name--> Optiplex GX520 | <!--IDE--> {{yes|IDE}} | <!--SATA--> {{partial|IDE mode}} | <!--Gfx--> {{yes|Intel GMA}} | <!--Audio--> {{partial|Intel AC97 (no line-out)}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{no|Broadcom}} | <!--Test Distro--> {{dunno}} | <!--Comments--> |- | <!--Name--> Optiplex 745 | <!--IDE--> {{N/A}} | <!--SATA--> {{partial|IDE mode}} | <!--Gfx--> {{partial|Intel GMA (VESA only)}} | <!--Audio--> {{partial|HD Audio (no volume control)}} | <!--USB--> {{partial|Only keyboard mouse (legacy mode)}} | <!--Ethernet--> {{no|Broadcom}} | <!--Test Distro--> {{dunno}} | <!--Comments--> |- | <!--Name--> Optiplex 755 | <!--IDE--> {{N/A}} | <!--SATA--> {{partial|IDE mode}} | <!--Gfx--> {{partial|Intel GMA (VESA only)}} | <!--Audio--> {{no|HD Audio}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{no|Intel Gigabit}} | <!--Test Distro--> Icaros 1.5.1 | <!--Comments--> Around 25 second delay in booting from USB |- | <!--Name--> Optiplex 990 | <!--IDE--> {{N/A}} | <!--SATA--> {{partial|non-RAID mode}} | <!--Gfx--> {{partial|Intel HD (VESA only)}} | <!--Audio-->{{no|HD Audio}} | <!--USB--> {{yes|USB 2.0}} | <!--Ethernet--> {{no|Intel Gigabit}} | <!--Test Distro--> Nightly Build 2014 09-27 | <!--Comments--> |- | <!--Name-->Optiplex 360 | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{maybe|ordinary boot gives VGA mode only - VESA}} | <!--Audio-->{{no|HD Audio (Analog Devices ID 194a)}} | <!--USB--> | <!--Ethernet-->{{no|Broadcom}} | <!--Test Distro-->Aspire Xenon | <!--Comments-->poor support |- | <!--Name-->Dell Wyse Vx0 (V90 V30), Vx0L (V10L V90L), Vx0LE (V30LE V90LE) from VIA C7 800GHz to Eden 1.2GHz | <!--IDE-->{{Maybe| }} | <!--SATA-->{{N/A| }} | <!--Gfx-->{{Maybe|Vesa 2d for S3 UniChrome Pro}} | <!--Audio-->{{No|AC97 VIA VT8233A with ?? codec}} | <!--USB-->{{yes|2 back and 1 front USB2}} | <!--Ethernet-->{{Maybe|early models work but later VT6102-3 do not}} | <!--Test Distro-->AROS One 2.2 | <!--Comments-->2006 to 2009 32bit - 12V 4A Coax 5.5mm/2.1mm - 1 sodimm DDR 333MHz SO-DIMM later DDR2 - early V90s do seem to have a reliability problem - |- | <!--Name-->[https://www.poppedinmyhead.com/2021/01/wyse-cx0-thin-client-notes-experiences.html Dell Wyse Cx0] C00LE, C10LE, C30LE, C50LE, C90LE, C90LE7, C90LEW VIA C7 Eden 1GHz | <!--IDE-->{{Maybe| }} | <!--SATA-->{{N/A| }} | <!--Gfx-->{{Maybe|Vesa 2d VX855 VX875 Chrome 9}} | <!--Audio-->{{Maybe|some VIA VT8237A VT8251 HDA with ?? codec work}} | <!--USB-->{{yes|4 outside 2 inside USB2}} | <!--Ethernet-->{{No|VT6120 VT6121 VT6122 Gigabit}} | <!--Test Distro-->Icaros 2.3 | <!--Comments-->2010 to 2013 32bit - [https://ae.amigalife.org/index.php?topic=815.0 boots and works] - 12V 2.5A Coax 5.5mm/2.1mm - 1 sodimm ddr2 - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->Dell RxxL Rx0L Wyse thin client *R00L Cloud PC of Wyse WSM *R10L Wyse Thin OS *R50L Suse Linux Enterprise *R90L Win XP Embedded *R90LW Win Embedded Standard 2009 *R90L7 Win Embedded Standard 7 | <!--IDE-->128Mb IDE or 1GB | <!--SATA-->{{Maybe|SATA Hyperdisk}} | <!--Gfx-->AMD 690E RS690M Radeon Xpress 1200 1250 1270 | <!--Audio--> | <!--USB-->4 usb2 | <!--Ethernet-->Realtek | <!--Test Distro--> | <!--Comments-->2009 64bit AMD Sempron™ 210U SMG210UOAX3DVE 1.5GHz SB600, up to 4GB single slot 240-pin DDR2 DIMM, 19v barrel psu, DEL key bios - Late 2012 2 data sockets added but only CN18 be used with two white sockets (CN13 & CN15) can used to power the SATA device "4-pin Micro JST 1.25mm |- | <!--Name-->Optiplex 390 sff small form factor - mt mini tower desktop - dt full desktop | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{maybe|1 pci-e}} | <!--Audio-->{{maybe|HD Audio}} | <!--USB--> | <!--Ethernet-->{{maybe|realtek}} | <!--Test Distro-->aros one 1.6 usb | <!--Comments-->2011 64bit dual i3 2xxx - kettle iec plug psu cable - add nvidia gf218 gfx - error code 3 mobo or cpu - |- | <!--Name-->Optiplex 3010 sff small form factor | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{maybe|1 pci-e}} | <!--Audio-->{{maybe|HD Audio}} | <!--USB-->{{maybe| }} | <!--Ethernet-->{{no|Broadcom 57XX}} | <!--Test Distro--> | <!--Comments-->2012 64bit dual i3 3xxx - kettle iec plug psu cable - |- | <!--Name-->Optiplex 7010 sff small form factor | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{maybe|1 pci-e}} | <!--Audio-->{{maybe|HD Audio}} | <!--USB--> | <!--Ethernet-->{{no|Broadcom or Intel 825xx}} | <!--Test Distro--> | <!--Comments-->2012 64bit dual i3 3xxx Q77 - kettle iec plug psu cable - add pci-e ethernet and nvidia gf218 gfx - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->Dell Wyse 5010 thin client ThinOS D class (D10D D00D D00DX, Dx0D), PCoIP (D10DP) or D90D7, 5040 *username: Administrator, admin, [blank] *password: Fireport, DellCCCvdi, rappot, Wyse#123, Administrator, administrator, r@p8p0r+ | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes|IDE mode may need 30cm ext cable as small area for half-slim sata ssd - decased new ssd??}} | <!--Gfx-->{{Maybe|Vesa 2d 1400x1050 HD6250E IGP by using DVI to hdmi cable and 1 display port, no hdmi port}} | <!--Audio-->{{Maybe|HD 6.34 audio chipset detected but codec alc269 working from one case speaker - none if v6.29 used}} | <!--USB-->{{Yes|most 5010 have 4 USB 2.0 but D90Q7 has 2 USB3 instead}} | <!--Ethernet-->{{Yes|rtl8169 Realtek 8168 8169 - rev 1.?? 8111? - rev 1.91 8111E}} | <!--Test Distro-->Icaros 2.3 | <!--Comments-->2011 64bit no SSE4.1 or AVX slow AMD G-T44R 1.2Ghz later G-T48E 1.4Ghz Dual Bobcat Brazos BGA413 - Del for BIOS - p key to select boot with noacpi - single DDR3 sodimm slot max 4Gb, (8Gb hynix 2rx8 ddr3l)? (remove small board to upgrade) - passive no fan - 15cm/6" small 1ltr case and lack of expansion options - PA16 19v barrel psu Coax 5.5mm/2.5mm |- | <!--Name-->Dell Wyse 7010 DTS thin client (Z class Zx0D) *2011 Zx0 Z90D7 2GF/2GR *2013 Z10D *2014 Z50D 2GF/2GR *2012 Cisco VXC 6000 CVXC-6215-K9 white | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes|Bios set Sata mode to IDE mode and grub boot add 'noacpi' for half slim sata2 ssd or/with 50cm sata ext cable}} | <!--Gfx-->{{Maybe|VESA 2d HD6310 HD6320 Terascale 2 through DVI and sometimes DP 1.1a - no hdmi port}} | <!--Audio-->{{Maybe|HD Audio 6.34 detected but ALC269VB codec works on the one case speaker only}} | <!--USB-->{{Yes|2.0 works but NEC 720200 3.0 not working}} | <!--Ethernet-->{{Yes|rtl8169 Realtek 8169 8111e 8111F}} | <!--Test Distro-->Icaros 2.3 and Aros One 32bit 1.5, 1.9 and 2.3 usb and 64bit 1.2 | <!--Comments-->2011 64bit does not support AVX or SSE 4.1 slow AMD G-t52R 1.5GHz later G-T56N 1.65 GHz Dual with A50M FCH - 20cm/8" high 1.5ltr larger fanless black plastic case with metal ventilated box inside - 2 desktop DDR3L DIMM slots max 16GB - PA-16 19v external psu Coax 5.5mm/2.5mm - 2 40cm SMA female WiFi Antenna to IPEX IPX u.fl Ufl Cable pigtail needed - does not like uefi boot devices - |- | <!--Name-->Wyse 7020 Thin Client * 2013 Quad-core AMD GX-420CA 2.0 GHz (25W) - * 2018 Zx0Q Quad-core AMD GX-415GA 1.5 GHz (15W) with Quad display 3dp and 1dvi | <!--IDE-->{{N/A}} | <!--SATA-->1 sata port | <!--Gfx-->{{Maybe|Vesa 2d only for AMD Radeon HD8400E radeonsi (dual display) or AMD Radeon HD 8330E IGP with AMD Radeon E6240 Seymour E6460 (quad display), no hdmi ports}} | <!--Audio--> | <!--USB-->4 x USB2.0 works but 2 USB3.0 | <!--Ethernet-->rtl8169 Realtek 8169 8111 | <!--Test Distro--> | <!--Comments-->2013 64bit does support AVX or SSE 4.1 quad eKabini Jaguar cores - two SODIMM sockets layered in centre of mobo DDR3L RAM - Coax 5.5mm/2.5mm ac psu 9mm plug is too short but 14mm length is fine - 15cm/6" high smaller 1ltr case and lack of expansion options - |- | <!--Name-->Dell Wyse Dx0Q (5020) D90Q8 NJXG4 AMD G-Series | <!--IDE-->{{N/A}} | <!--SATA-->1 sata port | <!--Gfx-->HD 8330E | <!--Audio--> with Realtek codec | <!--USB-->4 x USB2.0 works but 2 USB3.0 | <!--Ethernet-->rtl8169 Realtek 8169 8111 | <!--Test Distro--> | <!--Comments-->2014 64bit does support AVX or SSE 4.1 Quad-core AMD GX-415GA 1.5 GHz - 2 layered near edge of mobo 204-pin DDR3L SODIMM (bottom one tricky to insert) - 19v Coax 5.5mm/2.5mm - passive no fan - 15cm/6" high smaller 1ltr case and lack of expansion options |- | <!--Name-->Dell Wyse 5060 N07D thin client | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes|IDE bios mode for sata2 port}} | <!--Gfx-->{{maybe|Vesa 2d - AMD R5E GCN2 IGP Sea Islands thru dp1 with an hdmi adapter no output thru dp2 - no hdmi dvi ports}} | <!--Audio-->{{maybe|HD Audio with Realtek ALC231 codec head phones only}} | <!--USB-->{{Maybe|4 x USB2.0 works but 2 USB3.0}} | <!--Ethernet-->{{yes|rtl8169 realtek 8169 8111h}} | <!--Test Distro-->AROS One 1.6 usb | <!--Comments-->2017 64bit does support AVX or SSE 4.1 quad GX-424CC 19.5v external psu - CN-0Y62H1 mobo with 2 layered ddr3l 16Gb max sodimm slots at edge of mobo, bottom 0 one blocking - passive no fan so quiet - 15cm/6" high smaller 1ltr case and lack of expansion options - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- |} ====Fujitsu Siemens==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="15%" |Test Distro ! width="20%" |Comments |- | Scenic [http://uk.ts.fujitsu.com/rl/servicesupport/techsupport/ProfessionalPC/Scenic/ScenicE/ScenicE.htm E600] (compact desktop) | | | {{partial|VESA only}} | {{yes|AC97}} | | {{no|Intel PRO/1000}} | {{dunno}} | Nice small, silent PC with good AROS support. |- | Scenic T i845 | {{dunno}} | {{n/a}} | {{n/a}} | {{dunno|Intel AC97}} | {{dunno|UHCI}} | {{dunno|Intel PRO/100}} | Icaros 1.5.2 | AROS does not boot |- | <!--Name-->Futro S200 S210 S220 and later S300 | <!--IDE-->{{yes| compactflash CF card max ??}} | <!--SATA--> | <!--Gfx-->{{maybe|VESA Silicon Integrated Systems [SiS] 315PRO PCI/AGP }} | <!--Audio-->{{unk|AC97 via }} | <!--USB-->{{unk|via uhci and ehci}} | <!--Ethernet-->{{unk|via VT6102 [Rhine-II] (rev 74) }} | <!--Test Distro--> | <!--Comments-->2008 32bit - TR5670 Rev 1.4 mother with Transmeta TM5800 cpu - pci socket - single SODIMM socket for DDR memory PC2700S max 512MB - |- | <!--Name-->Futro S400 | <!--IDE-->{{yes| but swap with compactflash CF card already with AROS installed}} | <!--SATA--> | <!--Gfx-->{{maybe|VESA Silicon Integrated Systems [SiS] SiS741CX }} | <!--Audio-->{{unk|AC97 SiS7018}} | <!--USB-->{{unk|sis uhci and ehci}} | <!--Ethernet-->{{unk|rtl8169 }} | <!--Test Distro--> | <!--Comments-->2008 32bit - AMD Geode NX1500 1GHz gets hot - SiS 963L / SiS 741CX chipset - 12V 4.2A 4-pin (DP-003-R) psu - single SODIMM socket for DDR PC2700S max 1G - large case 246 x 48 x 177cms torx screws - pci socket - |- | <!--Name-->FUJITSU Futro S700 and S900 Thin Client (based on mini-ITX motherboard D3003-A12, D3003-C1 lesser variant of [https://www.parkytowers.me.uk/thin/Futro/s900/TechNotes_V3.1_Mini-ITX_D3003-S.pdf D3003-S]) *G-T56N 1.65GHz *G-T40N 1.00GHz *G-T44R 1.20GHz | <!--IDE-->{{N/A}} | <!--SATA-->1 sata data socket but mSata 18+8pins 1GB-16GB | <!--Gfx-->Radeon HD 6320, HD 6250, HD 6290 dvi or displayport (DP runs higher) | <!--Audio-->HDAudio | <!--USB-->{{yes|two USB2 front sockets and four on the rear}} | <!--Ethernet-->{{Maybe|Realtek}} | <!--Test Distro--> | <!--Comments-->2011 64bit AMD slow atom-like and fanless - 20V 2A psu 5.5mm/2.1mm coax (S900) - 2 DDR3L SODIMM sockets max 8GB tricky to run 1333 MHz on the Futro S900 - proprietary X2 PCI-e - 1 PCI socket but need a right-angle adaptor - |- | <!--Name-->esprimo p420 e85 desktop case | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|IDE mode}} | <!--Gfx-->Intel 4600 or old Geforce in pci-e slot | <!--Audio-->HDAudio realtek alc671 codec | <!--USB-->USB3 | <!--Ethernet-->rtl8169 8111 | <!--Test Distro--> | <!--Comments-->2013 64bit - 2 ddr3 dimm slots - 16 pin special psu - |- | <!--Name-->esprimo E420 e85+ SFF case | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|IDE mode}} | <!--Gfx-->Intel 4600 or low profile pci-e card | <!--Audio-->HDAudio realtek alc671 codec | <!--USB-->USB3 | <!--Ethernet-->rtl8169 8111G | <!--Test Distro--> | <!--Comments-->2013 64bit - 2 ddr3 dimm slots - 16ish pin special psu - hd under front metal bracket, take front cover off first with 3 tabs - 3 slim pci-e slots - |- | <!--Name-->Futro S520 AMD dual 1.0Ghz codenamed "Steppe Eagle" * GX-210HA @ 1.0GHz * GX-212ZC @ 1.2GHz | <!--IDE-->{{N/A}} | <!--SATA-->no sata - 4Gb or 16Gb flash memory soldered to the board | <!--Gfx-->AMD Radeon HD 8210E (GX210HA) or AMD Radeon R1E (GX212ZC) | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet-->rtl8169 rtl8111e | <!--Test Distro--> | <!--Comments-->2016 64bit does support AVX or SSE 4.1 - smaller than ITX 160mm x 160mm Fujitsu D3314-A11 - 19V 3.4A PSU standard 5.5mm/2.1mm coax plug - 1 ddr3 sodimm slot - |- | <!--Name-->Fujitsu Futro S720 ThinClient D3313-B13 D3313-F *2014 64bit AMD GX-217GA 1.65GHz VFY:S0720P8009FR VFY:S0720P8008DE VFY:S0720P4009GB *2015 64bit AMD GX-222GC 2.20GHz VFY:S0720P702BDE VFY:S0720P702BFR all begin VFY:S0720P and end two digit country code | <!--IDE--> {{N/A|}} | <!--SATA--> {{Yes|up to 2 Sata-cable-connector with space in casing so normal SSD/HDD over Sata was running very well on AHCI and IDE-Mode and 2242 mSata}} | <!--Gfx--> {{Maybe|use VESA 2D for AMD Radeon HD 8280E IGP ( islands) or later R5E IGP ( islands)}} | <!--Audio--> {{yes|HDAudio ALC671 codec partially working, external audio speaker}} | <!--USB--> {{yes|4 rear USB 2.0 but not front 2 USB 3.1}} | <!--Ethernet-->{{yes|rtl8169 Realtek 8169}} | <!--Test Distro-->AROS One USB 2.0 | <!--Comments-->2014 64bit supports AVX and SSE 4.1 - 1 ddr3 Sodimm slot max 8Gb - 19V-20V 2A 5.5mm/2.5mm coax - D3313-B13 stripped down Mini-ITX mobo D3313-S1/-S2/-S3 (eKabini) D3313-S4/-S5/-S6 - SATA data socket can be located under the fins of the cpu heatsink is fanless - mPCIe socket for wireless card - |- | <!--Name-->Fujitsu FUTRO S920 D3313-E D3313-G *2016 AMD GX-222GC SOC 2.20GHz Dual *2017 AMD G-Series GX-415GA (1.50 GHz, Quad Core, 2 MB, AMD Radeon™ HD 8330E) *2017 AMD G-Series GX-424CC 2.40 GHz Quad | <!--IDE--> {{N/A}} | <!--SATA--> {{yes|2242 mSata and 1 Sata-cable-connector with space in casing so normal SSD/HDD over Sata possible}} | <!--Gfx--> {{yes|use VESA 2D for Radeon R5E GCN2/3 IGP}} | <!--Audio--> {{yes|HDAudio ALC671 codec partially working}} | <!--USB--> {{yes|4 rear USB 2.0, front 2 USB 3.1 downgradable to 2.0 in BIOS setting}} | <!--Ethernet--> {{yes|rtl8169 Realtek 8169}} | <!--Test Distro--> AROS One USB 2.4 | <!--Comments-->2016 64bit does support AVX or SSE 4.1 - 2 so dimm slot with max of 8 GB - 19v barrel psu 5.5mm 2.5mm - SATA data socket can be located under the fins of the heatsink - mPCIe a e keyed socket for wireless card - propetary X2 connector with official raizer to X1 connector - almost silent background noise, not affecting sound quality in any way |- | <!--Name-->Fujitsu Thin Client Futro S5011 S7011 | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->{{maybe|Vesa 2D for AMD Vega 3 on 2 dp 1.4}} | <!--Audio-->{{No|HDAudio with ALC623 codec}} | <!--USB-->{{maybe|USB3 USB 3.2 Gen 2 front and 3 usb2 rear }} | <!--Ethernet-->rtl8169 Realtek RTL8111H | <!--Test Distro--> | <!--Comments-->2019 64bit - AMD Ryzen Dual Core R1305G or R1505G 1ltr case - 2 ddr4 sodimm slots - TPM 2.0 - 19v 3.42amp round coax or usb-c 20c 3.25a external psu - |- | <!--Name-->Fujitsu FUTRO S9011 Thin Client VFY:S9011THU1EIN || <!--IDE-->{{N/A}} || <!--SATA-->NVMe || <!--Gfx-->{{maybe|Vesa 2D for AMD Vega 3 on 2 dp 1.4}} || <!--Audio-->{{No|HDAudio with ALC623 codec}} || <!--USB-->{{maybe|USB3 USB 3.2 Gen 2 front and 3 usb2 rear }} || <!--Ethernet-->rtl8169 Realtek RTL8111H || <!--Test Distro--> || <!--Comments-->2020 64bit Ryzen Embedded R1606G - 2 ddr4 sodimm slots - TPM 2.0 - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- |} ====HP Compaq==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Compaq presario 7360 | <!--IDE-->{{yes|Working}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{Maybe|VESA}} | <!--Audio-->{{Maybe|AC97 via}} | <!--USB-->{{Maybe|issues}} | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->Compaq EP Series 6400/10 | <!--IDE--> {{yes|IDE}} | <!--SATA--> {{N/A}} | <!--Gfx--> {{N/A}} | <!--Audio--> {{no|ISA}} | <!--USB--> {{yes|USB 1.1}} | <!--Ethernet--> {{N/A}} | <!--Test Distro--> {{dunno}} | <!--Comments--> |- | <!--Name-->Compaq Evo D510 | {{yes|Working}} | {{N/A}} | {{partial|Intel Extreme (VESA only)}} | {{yes|AC97}} | {{yes|Working}} | {{yes|Intel PRO/100}} | Icaros 1.5 | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->Compaq DX2000 MT | <!--IDE-->{{yes}} | <!--SATA-->{{maybe}} | <!--Gfx-->{{maybe|Intel Extreme 2 (VESA only)}} | <!--Audio-->{{no|detects AC97 but no support for ADI AD1888 codec}} | <!--USB-->{{yes|OHCI/EHCI }} | <!--Ethernet-->{{no|Intel 82526EZ e1000}} | <!--Test Distro--> Icaros 1.51 | <!--Comments-->boots ok but no audio |- | <!--Name-->Compaq DX 2200 | <!--IDE-->{{yes}} | <!--SATA-->{{maybe}} | <!--Gfx-->{{maybe|RC410 [Radeon Xpress 200] (VESA only)}} | <!--Audio-->{{dunno|HD Audio}} | <!--USB-->{{maybe|OHCI/EHCI issues }} | <!--Ethernet-->{{N/A}} | <!--Test Distro--> {{dunno}} | <!--Comments-->issues |- | <!--Name--> d230 | <!--IDE--> {{yes|UDMA}} | <!--SATA--> {{N/A}} | <!--Gfx--> {{partial|Intel Extreme (VESA only)}} | <!--Audio--> {{partial|Intel AC97 (speaker and headphones only, no line-out)}} | <!--USB--> {{yes|USB}} | <!--Ethernet--> {{Maybe|Broadcom BCM4401}} | <!--Test Distro--> Icaros 1.4.5 | <!--Comments--> |- | <!--Name-->HP Pavilion a220n || <!--IDE-->{{Yes}} || <!--SATA-->{{N/A}} || <!--Gfx-->{{Yes|VESA 1024x768 on nVidia GF4 MX with 64MB shared video ram}} || <!--Audio-->{{Yes|Realtek ALC650 AC'97 comp.}} || <!--USB-->{{Yes|USB 2.0}} || <!--Ethernet-->{{Yes|Realtek 8201BL 10/100 LAN}} || <!--Test Distro-->AROS One 2.5|| <!--Comments-->2004 32bit athlon xp 2600+ Socket 462 / Socket A - 2 dimm ddr pc2700 - |- | <!--Name-->t500 | <!--IDE-->{{Yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{Yes|FX5200 (2D; 3D with older driver)}} | <!--Audio-->{{Yes|AC97 ICH4 ALC658D}} | <!--USB-->{{Yes|UHCI/EHCI}} | <!--Ethernet-->{{Yes|RTL 8101L 8139}} | <!--Test Distro-->Nightly Build 2012-09-22 | <!--Comments-->2004 |- | <!--Name-->DC7700 | <!--IDE-->{{Yes}} | <!--SATA-->{{Yes}} | <!--Gfx-->{{Yes|GMA 2D}} | <!--Audio-->{{Yes| ICH8}} | <!--USB-->{{Yes}} | <!--Ethernet-->{{No|82566DM e1000e}} | <!--Test Distro-->Nightly Build 2013-??-?? | <!--Comments-->2006 Some support at low cost |- | <!--Name-->HP dc 7600 CMT | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{Yes|Intel Graphics Media Accelerator 950}} | <!--Audio-->{{Yes|Realtek ACL 260}} | <!--USB-->{{Yes|USB 2.0}} | <!--Ethernet-->{{No|Intel PRO/1000 GT}} | <!--Test Distro--> | <!--Comments-->2007 |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->HP t5000 thin client series t5500 t5510 t5515 PC538A or PC542A t5700 t5710 Transmeta Crusoe Code Morphing TM 5400 5600 800Mhz | <!--IDE-->128mb to 512MB | <!--SATA-->{{N/A}} | <!--Gfx-->Ati Radeon 7000M | <!--Audio-->VIA with codec | <!--USB-->{{No|Issues}} | <!--Ethernet-->VIA Rhine 2 | <!--Test Distro--> | <!--Comments-->2006 32bit - ddr max 1GB - F10 setup - all t51xx and some t55xx units will not include a SODIMM slot - |- | <!--Name-->HP t5000 thin client series CN700 *HSTNC-002L-TC t5135, t5530 | <!--IDE--> | <!--SATA--> | <!--Gfx-->Vesa 2d 128Mb Via S3 32-bit colour | <!--Audio-->AC97 | <!--USB--> | <!--Ethernet-->VIA VT6102 VT6103 [Rhine-II] (rev 78) | <!--Test Distro--> | <!--Comments-->2007 32bit t5135 appears identical to the t5530 except the CPU VIA Esther 400 MHz - RAM 64Mb (? max) - 8 x USB2.0 - 12V 3.33A Coax 5.5mm/2.1mm |- | <!--Name-->HP t5720, t5725 HSTNC-001L-TC | <!--IDE-->{{unk| }} | <!--SATA-->{{N/A}} | <!--Gfx-->VESA 2d SiS741GX 2048 x 1536 32-bit colour | <!--Audio-->AC97 SiS SiS7012 AC'97 | <!--USB-->6 x USB2.0 | <!--Ethernet-->VIA VT6102 VT6103 [Rhine-II] (rev 8d) | <!--Test Distro--> | <!--Comments-->2007 32bit AMD Geode NX1500 1GHz socketed - RAM 512MB or 1GB, 256MB, 512MB or 1GB - 12V psu - sis DDMA support - custom 1.13 BIOS - pci low profile - |- | <!--Name-->t5000 series VX800 HSTNC-004-TC t5145, t5540, t5545, t5630 | <!--IDE--> | <!--SATA--> | <!--Gfx-->Vesa 2d VIA Chrome9 | <!--Audio-->HD Audio VIA | <!--USB--> | <!--Ethernet-->{{No|VT6120 VT6121 VT6122 Gigabit (rev 82)}} | <!--Test Distro--> | <!--Comments-->2010 32bit - RAM 64Mb (? max) - 8 x USB2.0 - 12V 4.16A Coax: 5.5mm/2.1mm - |- | <!--Name-->t5730w HSTNC-003-TC t5730 | <!--IDE-->{{n/a|ATA 44pin DOM Flash}} | <!--SATA--> | <!--Gfx-->Vesa 2d ATI Radeon X1250 2048 x 1536 no 3D | <!--Audio-->HD audio with codec | <!--USB-->{{Yes|6 x USB2.0}} | <!--Ethernet-->{{No|Broadcom 5707M tg3 10/100/1000}} | <!--Test Distro--> | <!--Comments-->2008 64bit AMD Sempron 2100+ 1GHz - 1 slot of ddr2 sodimm (Max 2GB) - 12V 4.16A Coax 5.5mm/2.1mm - F10 enter bios F12 boot devices - |- | <!--Name-->HSTNC-005-TC gt7720, gt7725 | <!--IDE--> | <!--SATA--> | <!--Gfx-->Vesa 2d AMD RS780G HD 3200 - 2560 x 1600 DVI-D & DVI-H | <!--Audio--> | <!--USB-->8 x USB2.0 | <!--Ethernet-->{{No|Broadcom BCM5787M}} | <!--Test Distro--> | <!--Comments-->2009 64bit AMD Turion Dual Core CPU 2.3GHz - 1 DDR2 200-pin SODIMM - 19V 4.16A Coax 7.4mm/5.0mm (gt7725) - |- | <!--Name-->HP t5740 Thin Client HSTNC-006-TC t5740, t5745, st5742 | <!--IDE-->1 port | <!--SATA-->1 port | <!--Gfx-->{{Maybe|VESA for Intel CL40 VGA and DisplayPort connectors}} | <!--Audio-->{{Yes|HD audio with IDT codec}} | <!--USB-->{{Maybe| }} | <!--Ethernet-->{{No|Broadcom BCM57780 Gigabit}} | <!--Test Distro-->Nightly build and Icaros | <!--Comments-->2009 32bit Atom N280 - F10 on power up to get into the BIOS screens. F12 brings up the boot options - hp 19V one with a coax connector, outer diameter 4.8mm with inner to be 1.7mm to 1.4mm - 2 ddr3 sodimm slots max 3gb due to 32bit - 1 pci-e slot completely non standard - |- | <!--Name-->t5000 series HSTNC-012-TC VIA Nano u3500 VX900 *t5550 512MB/1GB Windows CE6 R3 *t5565 1GB/1GB HP ThinPro *t5570 2GB/1GB WES 2009 | <!--IDE--> | <!--SATA--> | <!--Gfx-->Vesa 2d VIA ChromotionHD 2.0 GPU Chrome9 | <!--Audio-->VIA 9170 VT1708S codec | <!--USB--> | <!--Ethernet-->{{No|Broadcom BCM57780 Gigabit}} | <!--Test Distro--> | <!--Comments-->32bit - 1 sodimm - 19V 3.42A supply connector standard yellow-tip coax plug 4.8mm/1.8mm "Standard HP Compaq DC Power Plug 4.8mm x 1.5mm / 1.7mm Yellow Tip Connector - |- | <!--Name-->HP t510 Via Eden X2 U4200 HSTNC-012-TC shares features with t5570e, t5565z | <!--IDE-->2G ATA Flash DOM | <!--SATA-->one | <!--Gfx-->{{Maybe|Vesa 2d for Chrome9 VIA ChromotionHD 2.0 gfx}} | <!--Audio-->{{Maybe|VIA VT8237A VT8251 HDA with codec}} | <!--USB-->{{Maybe|6 USB2 }} | <!--Ethernet-->{{No|Broadcom Corporation NetLink BCM57780 Gigabit Ethernet PCIe}} | <!--Test Distro--> | <!--Comments-->2010 32bit - one slot ddr3 sodimm max 4GB - 19V 3.42A Coax 4.8mm/1.8mm - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->HP T610 Thin Client and thicker PLUS version AMD G-T56N A55E | <!--IDE-->{{Maybe|}} | <!--SATA-->2 sata | <!--Gfx-->Radeon 6320 1 dp port 1 dvi | <!--Audio-->HDAudio with ALC codec | <!--USB-->two USB2 on the front, two USB2 and two USB 3 ports on the rear | <!--Ethernet-->{{No|Broadcom BCM57780}} | <!--Test Distro--> | <!--Comments-->2010 64bit does not support AVX SSE 4.1 - 2 204-pin DDR3 1600MHz SODIMMs PC3-12800 under motherboard via removable panel - 19.5V 3A Coax male 7.4mm/5.0mm + centre pin - |- | <!--Name-->HP T420 Thin Client *AMD Embedded G-Series GX-209JA SOC (1 GHz, 2 cores) | <!--IDE-->{{N/A}} | <!--SATA-->{{N/A}} | <!--Gfx-->Radeon 8180 dvi vga | <!--Audio-->HDAudio with ALC codec | <!--USB-->2 front 2 rear USB2 | <!--Ethernet-->{{Yes|Realtek}} | <!--Test Distro--> | <!--Comments-->2015 64bit supports AVX SSE 4.1 - soldered in place 2GB DDR3 - smaller than usual 19.5V 2.31A Coax male 4.5mm/3.0mm + centre pin - usb stick internal for storage - E15 BBR - |- | <!--Name-->HP t520 TPC-W016 *AMD GX-212JC 1.2Ghz (2 core) | <!--IDE-->{{N/A}} | <!--SATA-->1 m.2 mounting holes for 2242 and 2260 SSDs SATA (not NVME) | <!--Gfx-->Radeon R2E GCN2 IGP Sea Islands | <!--Audio-->HDAudio with ALC codec | <!--USB-->2 USB3 front, 4 USB2 back | <!--Ethernet-->{{Yes|Realtek}} | <!--Test Distro--> | <!--Comments-->2014 2017 64 bit supports AVX SSE 4.1 - 1 204-pin DDR3 SODIMM - 19.5V 3.33A 7.4mm Coax with central pin |- | <!--Name-->HP t620 TPC-I004-TC *AMD G-Series GX-217GA 2 core APU 1.65GHz (65W) *AMD GX-415GA (65W) and t620 PLUS (PRO wider version) TPC-I020-TC *AMD GX-420CA SOC (Plus 85W) | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|single M.2 2280 socket sata3, mSATA socket removed end of 2014}} | <!--Gfx-->{{maybe|Vesa 2d for Radeon HD 8280E graphics 8330E Islands GCN2 IGP - 2 dp ports no dvi}} | <!--Audio-->{{yes|HDAudio with Realtek ALC221 codec 0x10EC 0x0221}} | <!--USB-->{{unk|4 front, 2 back, 1 inside limited space}} | <!--Ethernet-->{{Yes|Realtek 8169}} | <!--Test Distro-->Aros One 32bit | <!--Comments-->2014 64bit supports AVX SSE 4.1 - 2 DDR3L SODIMMs side by side - mSATA ssd and M.2 SSD are M1.6 screws, M2.0 screws used on most SSDs - 19.5V 3.33A Coax male 7.4mm 5mm with centre pin - changed the network card to a Atheros 5000 compatible - |- | <!--Name-->HP T530 *AMD GX-215JJ (2 core) 1.5GHz | <!--IDE-->{{N/A}} | <!--SATA-->1 m.2 sata ssd up to 2280 | <!--Gfx-->Radeon R2E | <!--Audio-->HDAudio with ALC codec | <!--USB-->1 USB3.1, 1 usb-c front, 4 USB2 back | <!--Ethernet-->{{Yes|Realtek}} | <!--Test Distro--> | <!--Comments-->2015 64 bit does support AVX SSE 4.1 - 1 204-pin DDR4 SODIMM - 19.5V 2.31A Coax male 4.5mm/3.0mm with centre pin - |- | <!--Name-->HP T730 Wider "Thin" Client TPC-I018-TC Pixar RX-427BB (2c4t) - no display and fans blowing full speed caused by '''disabling internal gpu in bios''' flash L43_0116.bin onto smc MX25L6473F (3.3V 8-PIN SOP (200mil) SPI 25xx) ([https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/troubleshooting-desktop-motherboards-graphics-cards-and-pc-peripherals/bios-schematic-requests/96303-hp-t730-password-locked-bios in the rom rcvry socket under a delicate thin narrow surface flap]) with ch341a alike switchable from 5v, 3.3v to 1.8v | <!--IDE-->{{N/A}} | <!--SATA-->{{partial|Storage bios option to IDE and not AHCI to prevent constant install error messages to DH0: - add noacpi to end of grub boot line - 1 M.2 SATA slot (Key B+M) up to 2280 with T8 torx secure stub}} | <!--Gfx-->{{maybe|use VESA for non-vulkan Radeon R7 GCN 2 UVD4.2 Sea Islands with 4 dp outs '''but too easy bricking''' if swapping with 1 PCIe 3.0 x8 slot 30W slim factor low profile 8400gs gt210 nvs295 nvs310 gt1030}} | <!--Audio-->{{yes|HDaudio 6.34 realtek alc221 codec thru case speaker only}} | <!--USB-->{{yes|'''Works''' for 4 USB2 in the back with 2 in the front, 2 USB3.0 ports on front and 1 more internal (not bootable)}} | <!--Ethernet-->{{yes|rtl8169 Realtek RTL8111HSH-CG set up first in Prefs/Network}} | <!--Test Distro-->boots with AROS One 32bit and 64bit USB with added noacpi added to grub boot line - press e - Latest distros can select grub boot options with Aros One 64bit USB and Aros One USB 2.8 but system seems to freeze after choice | <!--Comments-->2016 64bit supports AVX SSE 4.1 - 2 DDR3L sodimm stacked slots max 32GB - '''Larger''' 20cm/8" high 3.5ltr case noisy fan - TPM2 - esc/F9 boot selector F10 enter bios - 2 serial and 1 parallel old ports - Key E Wireless - PCIe slot (x16 physical, x8 electrical) - 19.5V 4.36A 85w TPC-LA561 HP 7.4mm black-ring-tip power plug, red flashing power button, wrong psu or bad MotherBoard MB - |- | <!--Name-->HP t630 Thin Client TPC-I020-TC *AMD Embedded G-Series SoC GX-420GI quad core 2Ghz | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|ahci.device mbr msdos partiton table for 2 Sata M.2, sata0 up to 2280 (1tb max), sata1 2242 (64gb max), both T8 torx secure stubs}} | <!--Gfx-->{{maybe|use VESA for Radeon AMD Wani R7E with 2 displayport 1.2 sockets, use one nearest to power jack - no dvi / hdmi}} | <!--Audio-->{{Yes|HDAudio 6.36 0x1022, 0x157a and ALC255 aka ALC3234 codec 0x10ec, 0x0255, pins 0x17 as LFE and 0x1b as int speaker but not ahi 6.34}} | <!--USB-->{{yes|USB2 2 front and 2 rear, 2 front USB3 and 1 inside}} | <!--Ethernet-->{{Yes|Realtek 8169 8111H}} | <!--Test Distro-->AROS One USB 2.2, 2.8 and 64bit USB 1.0, 1.2, 1.3 with noacpi added to the end of the grub bootline (press e) | <!--Comments-->2016 64bit supports AVX SSE 4.1 - 2 DDR4 SODIMMs side by side speed 1866Mhz limit - 19.5V 3.33A 65W TPC-BA54 Coax male 7.4mm with centre pin - can be easily bricked, might reflash bios with M40 SP149736 - 20cm/8" high 1.5ltr larger fanless case - esc f1 f9 f10 - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->HP Compaq Elite 7200 7300 8200 8300 SFF with kettle IEC psu cable | <!--IDE--> | <!--SATA-->{{yes|IDE ata legacy only in BIOS}} | <!--Gfx-->i pci-e | <!--Audio-->{{Maybe|8200 works}} | <!--USB-->{{yes| }} | <!--Ethernet-->{{no|Intel or Broadcom}} | <!--Test Distro-->icaros 2.3 | <!--Comments-->2013 64bit dual core - add pci-e rtl8169 ethernet card and pci-e gf210 nvidia low height - |- | <!--Name-->HP Compaq Pro 6305 Small Form Factor SFF AMD A75 chipset (FCH 6 SATA 6 Gb/s, 4 USB 3.0) *AMD Quad A10-5800B *AMD A8-5500B *AMD Dual A6-5400B *AMD A4-5300B | <!--IDE--> | <!--SATA--> | <!--Gfx-->Radeon 7000 Terascale iGPU series Radeon HD 7660D, Radeon HD 7560D, Radeon HD 7540D, Radeon HD 7480D | <!--Audio-->HD ALC221 | <!--USB--> | <!--Ethernet-->{{No|Broadcom 5761}} | <!--Test Distro--> | <!--Comments-->2012 64bit |- | <!--Name-->Elitedesk 705 G1 - SFF *AMD A10-8850B, Quad-Core A10 PRO-7850B, A10-8750B *AMD A10-7800B, A10 PRO-6800B, A8-7600B *AMD A8-8650B, A6-8550B *AMD A6-8350B, Dual A6 PRO 7400B, A4-7300B | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe| }} | <!--Gfx-->{{Maybe|VESA 2D with Radeon R7 or 8000}} | <!--Audio-->{{Maybe|HD audio with Realtek ALC221 codec}} | <!--USB-->{{Maybe| }} | <!--Ethernet-->{{No|Broadcom or Intel}} | <!--Test Distro--> | <!--Comments-->2014 64bit - T15 security torx psu with 6pin PWR 200W connector - |- | <!--Name-->HP EliteDesk 705 G2, 705 G3 Mini PC USFF thin client | <!--IDE-->{{N/A}} | <!--SATA-->2.5in and m.2 | <!--Gfx-->Radeon R7 | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet-->{{No|Broadcom BCM5762 GbE}} | <!--Test Distro--> | <!--Comments-->2014 64bit AM4 socket with 35W TDP A10-8770E (4c), AMD PRO A6-8570E (2c), AMD Pro A6-9500E, or AMD PRO A10-9700E on AMD B300 FCH - ddr4 sodimm slots - 77 x 175 x 34mm (6.97 x 6.89 x 1.34in) 1L and about 3lbs - |- | <!--Name-->HP EliteDesk 705 G4 Mini 1ltr USFF AMD Ryzen 3 2200G (4c t) or 5 2400G (4c t) | <!--IDE-->{{N/A|}} | <!--SATA-->{{Maybe|Nvme 2280 and 2.5in sata}} | <!--Gfx-->Vega 8 thru DP1.2 port | <!--Audio-->{{No|HD Audio Conexant codec}} | <!--USB-->USB2 usb3 | <!--Ethernet-->rtl8169 realtek | <!--Test Distro--> | <!--Comments-->2016 64bit Am4 socket - 2 sodimm 16GB max - 19.5v hp socket ext psu - |- | <!--Name-->Elitedesk 705 G4 35w, HP Prodesk 405 G4 35W USFF - baseboard 83e9 35W - AMD Athlon PRO 200GE (2c 4t), 2200GE (4c t) or 2400GE (4c t) on AMD B350 FCH | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|Nvme 2280 and older models 2.5in sata}} | <!--Gfx-->Vega 3, 8 or 11 with 2 dp1.2 ports | <!--Audio-->{{no|HDAudio with Conexant CX20632 codec}} | <!--USB-->USB3 | <!--Ethernet-->rtl8169 Realtek 8169 8111EPH 1Gbe or Realtek RTL8111F | <!--Test Distro--> | <!--Comments-->2017 64bit - realtek wifi 8821 or 8822 - up to 1 ddr4 dimm slots - hp barrel external ac - |- | <!--Name-->Elitedesk 705 G5, HP Elitedesk 806 G6, Prodesk 405 G6 || <!--IDE-->{{N/A}} || <!--SATA-->2x NVMe or 1x SATA + 1x NVMe, but not all three drives at the same time without serious modding of hd caddie || <!--Gfx-->Vega with DP1.4 port || <!--Audio-->{{no|HDAudio with Realtek ALC3205 codec}} || <!--USB-->USB3 || <!--Ethernet-->{{maybe|Realtek}} || <!--Test Distro--> || <!--Comments-->2018 64bit - 2 ddr4 sodimm slots - 3400GE Ryzen 5 PRO 3350GE (4c 8t), Ryzen 3 PRO 3200GE 3150GE (4c 4t), AMD Athlon Silver PRO 3125GE (2c 4t) on AMD PRO 565 |- | <!--Name-->HP t540 1ddr4 slot, t640 2 DDR4 SDRAM sodimm SO-DIMM 260-pin non-ECC max 32gb thin client USFF | <!--IDE-->{{N/A}} | <!--SATA-->1 NVM Express (NVMe) 2230 or 2280 | <!--Gfx-->Vega 3 VGA, DisplayPort | <!--Audio-->HD Audio with codec | <!--USB-->2 USB3 gen1 | <!--Ethernet-->rtl8169 Realtek Realtek RTL8111HSH or RTL8111E PH-CG | <!--Test Distro--> | <!--Comments-->2019 64bit ryzen r1000 series Ryzen Embedded R1305G 1.5 GHz, R1505G dual (2c 4t) 2.0Ghz or R1606G ?.?Ghz (2c4t) - Realtek RTL8852AE wifi - 45W psu Coax male 4.5mm/3.0mm + centre pin - |- | <!--Name-->HP t740 SFF Thin Client | <!--IDE-->{{N/A}} | <!--SATA-->2 M.2, one is sata and other nvme | <!--Gfx-->Vega 8 DisplayPort or + optional pci-e 30W Radeon E9173 | <!--Audio-->HD Audio with codec | <!--USB-->USB3 | <!--Ethernet-->Realtek RTL8111E PH-CG 1Gbe | <!--Test Distro--> | <!--Comments-->2019 64bit - Ryzen Embedded V1756B 3.25Ghz quad - 90W 19.5V 4.62A psu Coax male 4.5mm/3.0mm + centre pin - sodimm DDR4 max 64Gb - slightly noisy fan - |- | <!--Name-->HP EliteDesk 805 G6 Mini 4750GE (8t 16t), Prodesk 405 G6 Ryzen 5 PRO 4650GE (6c 12t) or Ryzen 3 PRO 4350GE (4c 8t) on AMD PRO 565 | <!--IDE-->{{N/A}} | <!--SATA-->2.5in carrier and 2 slots m.2 nvme | <!--Gfx-->Vega 8 with DP1.4 and HDMI flex io2 output options | <!--Audio-->HDAudio with Realtek ALC3205 codec | <!--USB-->4 usb a - gen 2 10gig and gen 1 5gig ports | <!--Ethernet-->{{N/A}} | <!--Test Distro--> | <!--Comments-->2021 64bit AMD Ryzen 4000 SBC unlocked - 2 sodimm ddr4 slots - wifi6 - 90W ac - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- |} ====Lenovo==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Lenovo Nettop IdeaCentre Q150 (40812HU) | <!--IDE--> | <!--SATA--> | <!--Gfx-->ION2 | <!--Audio--> realtek codec | <!--USB-->USB2 | <!--Ethernet-->intel 10/100 | <!--Test Distro--> | <!--Comments-->2011 64bit D510 |- | <!--Name-->M625q Tiny (1L) | <!--IDE-->{{N/A}} | <!--SATA-->M.2 Sata | <!--Gfx-->Stoney Radeon R2, R3 or R4 and later R5 with 2 dp ports | <!--Audio-->HD audio with ALC233-VB2-CG codec 0x10EC 0x0233 | <!--USB-->{{No|3 usb3.1 Gen 1 and 3 usb2}} | <!--Ethernet-->rtl8169 RTL8111 | <!--Test Distro--> | <!--Comments-->2016 64bit all dual cores - e2-9000e or a4-9120e later A9-9420e - heatsink covers 70% area covers wifi - 65w or 135w lenovo rectangle ac - 1 ddr4 2666MHz slot max 8gb - tpm 2.0 - |- | <!--Name-->M715q Gen 1 AMD A6 A8 A10-9700E 9770E (2c2t) | <!--IDE-->{{N/A}} | <!--SATA-->m.2 | <!--Gfx-->R4 | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2016 64bit - |- | <!--Name-->M715q Gen 2 Ryzen 5 PRO 2400GE 4C 8T | <!--IDE-->{{N/A}} | <!--SATA-->m.2 | <!--Gfx-->Vega 11 | <!--Audio-->HD Audio with codec | <!--USB-->USB3 | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2018 64bit - f1 enter setup, esc device boot - fixed 1.8v ch341a needed to reflash 1.8v bios if no boot SOP8 DIP8 Winbond W25Q64, MXIC MX25U1635, MX25U6435 - |- | <!--Name-->ThinkCenter M75n nano Ryzen3 3300U | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->ThinkCentre M75q M75q-1 Tiny 1ltr TMM *AMD Ryzen 5 PRO Quad 3500 Pro 3400GE (4c 8t) 11a5 soe400 *AMD 3200GE (2c 4t) zen1+ 11a4 | <!--IDE-->{{N/A|}} | <!--SATA-->{{Maybe|NVMe 2280 1Tb max - untested 2.5inch}} | <!--Gfx-->Vega 11 | <!--Audio-->HD Audio Realtek ALC222-CG codec ALC3287 | <!--USB-->3 USB3 Gen 1 | <!--Ethernet-->rtl8169 Realtek 8169 8111 | <!--Test Distro--> | <!--Comments-->2019 64bit - 65w 20v 3.25A to 135W rectangle psu - 2 sodimm ddr4 sodimm max 32GB locked 2666MHz - |- | <!--Name-->ThinkCentre Ryzen 7 PRO Tiny 1ltr Gen 2 AMD 4000 series *AMD 4650GE (6c12t) 4750GE (8c16t) 4350G (4c8t) Zen2 - | <!--IDE-->{{N/A|}} | <!--SATA-->{{Maybe|NVme}} | <!--Gfx-->Vega 8 | <!--Audio-->HD Audio codec | <!--USB--> | <!--Ethernet-->Realtek 8169 8111 | <!--Test Distro--> | <!--Comments-->2021 64bit vendor locked - 20v psu - 2 sodimm - |- | <!--Name-->Thinkcenter M75q-2 Gen2 refresh | <!--IDE-->{{N/A}} | <!--SATA-->m.2 nvme | <!--Gfx-->Radeon Vega | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet-->1GigE | <!--Test Distro--> | <!--Comments-->2022 64bit 5650GE (6c12t) 5750GE (8c16t) - vendor/PSB can lock your AMD CPU - f12 boot devices |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->Thinkcentre M75q Tiny Gen5 | <!--IDE-->{{N/A| }} | <!--SATA-->2 NVMe | <!--Gfx-->Radeon 780M dp1.4a or hdmi | <!--Audio-->HDAudio with codec | <!--USB-->USB3 usb-c | <!--Ethernet-->1GBe port | <!--Test Distro--> | <!--Comments-->2024 Ryzen PRO 7 8700GE - 90W yellow rectangle connector psu - 2 DDR5 sodimm slots max 128Gb - |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |} ====Misc==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="5%" |Test Distro ! width="20%" |Comments |- | <!--Name-->Impart impact Media Group IQ Box mini Digital Signage with MB896 mini itx | <!--IDE-->{{Yes| }} | <!--SATA-->{{N/A}} | <!--Gfx-->GMA 915 gme | <!--Audio--> via audio | <!--USB-->{{yes| }} | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2007 32bit - 1 ddr2 slot - pentium m 1.73GHz - |- | <!--Name-->[https://everymac.com/systems/apple/mac_mini/specs/mac_mini_cd_1.83-specs.html Apple A1176 Intel MacMini1,1] | <!--IDE-->{{N/A}} | <!--SATA-->{{unk|gpt/efi }} | <!--Gfx-->{{Yes|gma950 2d and 3d}} | <!--Audio-->{{No|HDAudio with ICH7 [https://answers.launchpad.net/ubuntu/+source/alsa-driver/+question/186749 Sigmatel Stac 9221] [https://android.googlesource.com/kernel/msm/+/android-wear-5.1.1_r0.6/sound/pci/hda/patch_sigmatel.c codec][https://alsa-devel.alsa-project.narkive.com/Yt20W6cE/sigmatel-stac9221-mux-amp-out-0x02-microphone-not-working mic]}} | <!--USB-->{{Yes|USB2}} | <!--Ethernet-->{{No|Marvell}} | <!--Test Distro--> | <!--Comments-->2006 32bit possible 1.83 GHz Intel “Core Duo” (T2400) - swap pci-e wifi for atheros 5k AR5007EG - maybe hack with a 2,1 firmware - max 4GB Ram ddr2 sodimms - external apple psu - dvd boot only with c key - |- | <!--Name-->[https://everymac.com/systems/apple/mac_mini/specs/mac-mini-core-2-duo-1.83-specs.html Apple A1176 Intel Mac Mini2,1] | <!--IDE-->{{N/A}} | <!--SATA-->{{unk|gpt/efi }} | <!--Gfx-->{{Yes|gma950 2d and 3d}} | <!--Audio-->{{No|HDAudio with ICH7 Sigmatel Stac 9221 codec}} | <!--USB-->{{Yes|USB2}} | <!--Ethernet-->{{No|Marvell}} | <!--Test Distro-->Aros One 2.0/ Icaros | <!--Comments-->2007 64bit - swap pci-e wifi for atheros 5k AR5007EG - hacked with a 2,1 firmware and replaced the cpu for T7600 2.33 Ghz C2D and max 4GB Ram ddr2 sodimms - external apple psu - dvd boot only via c key |- | <!--Name-->Apple iMac 5,1 "Core 2 Duo" 1.83GHz 17" T5600 MA710LL || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->GMA 950 with 64Mb || <!--Audio-->HDAudio idt codec || <!--USB-->3 USB2 || <!--Ethernet--> || <!--Test Distro--> || <!--Comments-->2006 64bit - 2 ddr2 667MHz sodimm slots - 17.0" TFT widescreen 1440x900 - polycarbonate |- | <!--Name-->Apple iMac 6,1 "Core 2 Duo" 2.16 2.33 24" only T7400 T7600 aka MA456LL/A A1200 (EMC 2111) || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Nvidia 7300GT with 128 MB of GDDR3 SDRAM PCI Express or GeForce 7600GT with 256Mb mini dvi, vga || <!--Audio-->HDAudio || <!--USB-->3 USB2 || <!--Ethernet--> || <!--Test Distro--> || <!--Comments-->2006 64bit - 2 ddr2 667MHz sodimm slots - 24.0" TFT widescreen 1920 x 1200 - polycarbonate plastic case iMacs of this generation are the most difficult iMacs to service due to their front bezel design |- | <!--Name-->Neoware CA2 | <!--IDE-->flash DOM | <!--SATA-->{{N/A}} | <!--Gfx-->S3 Inc ProSavage PM133 (rev 02) vga | <!--Audio-->VIA VT82C686 AC97 Audio | <!--USB-->USB | <!--Ethernet-->rtl8139 | <!--Test Distro--> | <!--Comments-->2003 32bit - VIA Ezra 800MHz - 2 PC100 sodimm slots - riser board carries an ISA slot and a PCI slot - external 12V power supply.with 4 pins - |- | <!--Name-->Neoware CA5 Capio One | <!--IDE-->44pin Disk On Module DOM | <!--SATA-->{{N/A}} | <!--Gfx-->SiS550 vga | <!--Audio-->AC97 with SiS7019 codec | <!--USB-->USB1.1 | <!--Ethernet-->rtl8139 | <!--Test Distro--> | <!--Comments-->2004 32bit - internal power supply with mains lead has a "clover leaf" style - 2 144-pin PC100 or PC133 SODIMM might have 24MB of RAM soldered - |- | <!--Name-->Neoware CA10 *E140 model BL-XX-XX (800MHz CPU) later *E100 model BK-XX-XX (1GHz CPU) | <!--IDE--> | <!--SATA-->{{N/A}} | <!--Gfx-->VIA VT8623 (Apollo CLE266) vga | <!--Audio-->AC97 with | <!--USB-->4 USB2 | <!--Ethernet-->VIA VT6102/VT6103 [Rhine-II] (rev 74) | <!--Test Distro--> | <!--Comments-->2004/5 32bit - 12v 5.5mm/2.1mm - 2 184-pin DDR DIMM - |- | <!--Name-->VXL Itona thin client *TC3200, *TC3x41 (P3VB-VXL) TC3541 TC3641 TC3841, *TC3xx1 (6VLE-VXL0) TC3931, *TC43xx (Gigabyte C7V7VX) TC4321 | <!--IDE--> | <!--SATA-->{{N/A}} | <!--Gfx-->VIA vga | <!--Audio-->AC'97 Audio with VIA VT | <!--USB-->VIA USB | <!--Ethernet-->Realtek 8100B | <!--Test Distro--> | <!--Comments-->2005 2006 32bit VIA Samuel 2, VIA C3 Nehamiah CPU, 1 DIMM slot, internal psu, |- | <!--Name-->Neoware Capio C50, model CA15 Thin Clients] *Login Administrator Password Administrator *Login User Password User | <!--IDE-->1 flash Disk On Module | <!--SATA-->{{N/A}} | <!--Gfx-->VIA VT8623 (Apollo CLE266) vga | <!--Audio-->AC97 with via codec | <!--USB-->USB | <!--Ethernet-->VIA | <!--Test Distro--> | <!--Comments-->2006 32bit VIA Eden (Samuel II core) CPU - 1 ddr sodimm slot max 512mb - slot - internal psu clover leaf - |- | <!--Name-->[http://etoy.spritesmind.net/neowareca21.html Neoware CA21 Thin Clients] Igel 3210 (and maybe the Clientron G270) *Login Administrator Password Administrator *Login User Password User | <!--IDE-->1 flash Disk On Module DOM | <!--SATA-->{{N/A}} | <!--Gfx-->VIA CN700 vga | <!--Audio-->AC97 with via codec | <!--USB-->USB2 | <!--Ethernet-->VIA | <!--Test Distro--> | <!--Comments-->2007 32bit VIA C3 Nehemiah instead of Ezra-T - made 2 version of the CA 21, one with an Award bios and one with a Phoenix bios - 1 ddr2 sodimm slot max 1gb - VT6656 wireless - slot - internal psu iec - |- | <!--Name-->Neoware CA22 (e140), part number DD-L2-GE with BCOM WinNET P680 (V4) as the Igel 4210LX (Igel 5/4) | <!--IDE-->1 VIA VT82C586A/B VT82C686/A/B VT823x/A/C PIPC Bus Master IDE (rev 06) | <!--SATA-->{{N/A}} | <!--Gfx-->VIA CN700 P4M800 Pro CE VN800 Graphics [S3 UniChrome Pro] (rev 01) vga | <!--Audio-->AC97 with codec | <!--USB-->USB2 VIA VT8237R Plus | <!--Ethernet-->VIA VT6102/VT6103 [Rhine-II] (rev 78) | <!--Test Distro--> | <!--Comments-->2007 32bit - VIA Esther to later C7 1GHz - 1 ddr2 sodimm slots max 512mb - +12V DC/4.16A/50W 5.5mm/2.1mm coaxial - |- | <!--Name-->10Zig RBT402, Clientron U700, | <!--IDE-->{{Yes|44 pin header very little room}} | <!--SATA-->{{N/A|}} | <!--Gfx-->{{Partial|VESA dvi}} | <!--Audio-->{{unk|AC97 with codec}} | <!--USB-->{{unk|VIA }} | <!--Ethernet-->{{unk|}} | <!--Test Distro--> | <!--Comments-->2008 32bit - very small cases with very limited expansion - 1 sodimm 2GB max - 12v 3a psu - Password Fireport |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->Dell Optiplex FX170 D05U thin client, 10Zig 56xx range 5602, 5616v, 5617v, 5672v, Clientron U800, Devon IT TC5, | <!--IDE-->{{Yes|44 pin header very little room}} | <!--SATA-->{{N/A|}} | <!--Gfx-->{{partial|GMA 950 dvi}} | <!--Audio-->{{Yes|HD Audio with codec}} | <!--USB-->{{Yes| }} | <!--Ethernet-->{{No|Broadcom}} | <!--Test Distro-->Icaros 2.3 | <!--Comments-->2009 32bit - very small cases with very limited expansion - 1 ddr2 sodimm 2GB max - 12v 3a psu - Password Fireport - ps2 keyboard socket - |- | <!--Name-->10Zig RBT-616V or Chip PC Technologies EX-PC (model number XPD4741) | <!--IDE-->{{unk|44 pin header very little room}} | <!--SATA-->{{N/A|}} | <!--Gfx-->{{Yes|GMA 950}} | <!--Audio-->{{unk|HD Audio with codec}} | <!--USB-->{{unk| }} | <!--Ethernet-->{{unk|rtl8169}} | <!--Test Distro--> | <!--Comments-->2010 32bit N270 on NM10 with ICH7 - very small cases with very limited expansion - 1 sodimm 2GB max - 12v 4a psu - Password Fireport |- | <!--Name-->Gigabyte Brix GS-A21S-RH (rev. 1.0) SFF | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{maybe|X3100}} | <!--Audio-->{{No|HD Audio with ALC883-GR codec}} | <!--USB-->Intel USB | <!--Ethernet-->{{no|Intel 82566DC}} | <!--Test Distro-->ICAROS 2.3 | <!--Comments-->2009 64bit Intel GME965 chipset with Intel ICH8M - 2 DDR2 Dimm slots - GA-6KIEH2-RH Rev.1.x mini ITX Case 213mm(D) x 64mm(W) x 234mm(H) - custom psu - |- | <!--Name-->VXL Itona MD+24 MD27 MD54 MD64 MD76 thin client | <!--IDE--> | <!--SATA--> | <!--Gfx-->VIA Chrome 9 | <!--Audio-->HD Audio with VIA VT | <!--USB-->VIA | <!--Ethernet-->VIA | <!--Test Distro--> | <!--Comments-->2009 32bit VIA X2 U4200 - 12v-19v barrel psu - |- | <!--Name-->Acer Revo 100 RL100 AMD Athlon II X2 K325 || <!--IDE--> || <!--SATA--> || <!--Gfx-->NVIDIA® ION™ 9300m || <!--Audio-->HDAudio with ALC662 codec || <!--USB-->USB2 1 front 2 back || <!--Ethernet-->NVIDIA nForce 10/100/1000 || <!--Test Distro--> || <!--Comments-->2010 64bit but no AVX - 4Gb DDR3 sodimm - 500 GB - 19v 3.42a 65W - dvd but later BD drive - |- | <!--Name-->Asrock ION 330 330Pro HT-BD, Foxconn NT-330i, Zotac ION F (IONITX mini itx), | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{Maybe|ION geforce 9400}} | <!--Audio-->{{Maybe| }} | <!--USB-->{{Maybe|Nvidia USB}} | <!--Ethernet-->{{No|Nvidia }} | <!--Test Distro--> | <!--Comments-->2010 32bit slow atom cpu - 2.5L 8" by 8" plastic case - 2 ddr2 sodimm max 4G - external 19v 65W 3.42A Plug 5.5mm X 2.5mm - little whiny fan - |- | <!--Name-->Zotac ZBOXHD-ND01 | <!--IDE--> | <!--SATA--> | <!--Gfx-->ION1 | <!--Audio-->HDaudio | <!--USB-->USB2 | <!--Ethernet-->NVidia | <!--Test Distro--> | <!--Comments-->2009 32bit |- | <!--Name-->Zotac ZBOX HD-ID11 | <!--IDE--> | <!--SATA--> | <!--Gfx-->ION2 | <!--Audio-->HDaudio with ALC888 codec | <!--USB-->USB2 | <!--Ethernet-->rtl8169 rtl8111D | <!--Test Distro--> | <!--Comments-->2010 |- | <!--Name-->ZOTAC ZBOX Blu-ray 3D ID36 Plus | <!--IDE-->{{N/A}} | <!--SATA-->sata | <!--Gfx-->ION2 | <!--Audio-->HDaudio | <!--USB-->2 USB3 | <!--Ethernet-->GbE | <!--Opinion-->2011 64bit - |- | <!--Name-->Shuttle XS35GT || <!--IDE--> || <!--SATA--> || <!--Gfx-->ION || <!--Audio-->HD audio IDT92HD81 || <!--USB--> || <!--Ethernet-->{{No|JMC261}} || <!--Test Distro--> || <!--Comments-->2011 64bit - Atom™ D510 NM10 - DDR2 |- | <!--Name-->Shuttle XS35GT V2 || <!--IDE--> || <!--SATA--> || <!--Gfx-->ION2 || <!--Audio-->HD audio IDT92HD81 || <!--USB-->Intel || <!--Ethernet-->{{No|JMC251}} || <!--Test Distro--> || <!--Comments-->2011 64bit Atom™ D525 NM10 chipset - DDR3 |- | <!--Name-->Sapphire Edge-HD || <!--IDE--> || <!--SATA--> || <!--Gfx-->ION2 GT218 with vga and hdmi || <!--Audio-->HDAudio realtek codec || <!--USB--> || <!--Ethernet-->{{Unk|Realtek}} || <!--Test Distro--> || <!--Comments-->2011 64bit - Atom™ D510 NM10 - DDR2 65 W AC, DC 19V~3.42A, 19.3L x 14.8w x 2.2H cm (1l), weight 530g, |- | <!--Name-->Sapphire Edge-HD2 || <!--IDE-->{{N/A}} || <!--SATA-->{{yes|IDE mode}} || <!--Gfx-->{{Yes|nouveau ION2 GT218 with vga and hdmi 2d and 3d}} || <!--Audio-->{{Yes|HDAudio}} || <!--USB-->{{Yes|Intel USB2}} || <!--Ethernet-->{{Yes|}} || <!--Test Distro--> || <!--Comments-->2011 64bit Atom™ D525 NM10 chipset - DDR3 |- | <!--Name-->AOPEN Digital Engine DE67-HA(I) | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe| }} | <!--Gfx-->{{Maybe| Vesa 2d for Intel HD}} | <!--Audio-->{{maybe|HDAudio for ALC662 codec}} | <!--USB-->{{maybe|usb3}} | <!--Ethernet-->{{no|Intel WG82579LM}} | <!--Test Distro--> | <!--Comments-->2011 |- | <!--Name-->[https://www.jetwaycomputer.com/JBC600C99352W.html Jetway JBC600C99352W] | <!--IDE--> | <!--SATA--> | <!--Gfx-->ION2 | <!--Audio-->{{No|C-Media CM108AH}} | <!--USB-->USB2 | <!--Ethernet-->Realtek 8111DL | <!--Test Distro--> | <!--Comments-->2011 64bit D525 - DDR3 - 12v psu |- | <!--Name-->Foxconn nT-A3550 A3500 AMD A45 Chipset DDR3 Nettop Barebones - White | <!--IDE-->{{N/A}} | <!--SATA-->1 slot | <!--Gfx-->AMD Radeon HD6310 | <!--Audio--> | <!--USB-->4 USB2 back and 2 USB3 front | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2012 64bit does not support AVX or SSE 4.1 AMD Dual-core E350 1.6GHz CPU - 1 ddr3 sodimm - |- | <!--Name-->Asus EeeBox PC EB1021 || <!--IDE--> || <!--SATA--> || <!--Gfx-->Radeon HD6320M || <!--Audio-->HDAudio with ALC codec || <!--USB-->USB2 || <!--Ethernet-->Realtek GbE1 || <!--Test Distro--> || <!--Comments-->2012 64bit - AMD® Brazos E-350 SFF or E-450 with A50M - 2 ddr3l so-dimm - 40W ac - |- | <!--Name-->Xi3 Piston PC Athlon64 X2 3400e (X5A), AMD R-464L quad (X7A) Z3RO NUC | <!--IDE-->{{N/A}} | <!--SATA-->{{N/A}} | <!--Gfx-->AMD mobility HD3650 to radeon HD 7660G | <!--Audio--> codec | <!--USB-->4 USB2 3 USB3 | <!--Ethernet-->{{no|Atheros AR8161}} | <!--Test Distro--> | <!--Comments-->2012 - 2 sodimm 8GB max - 19v 3.3a round - Titan105 bios update - |- | <!--Name-->Sapphire Edge-HD3 || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->Radeon HD6320M with vga and hdmi || <!--Audio-->HDAudio with Realtek ALC662 codec || <!--USB-->USB2 || <!--Ethernet-->Realtek GbE1 || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 AMD® Brazos E-450 with A45M - ddr3l so-dimm - 65W ac - Wireless is Realtek 8191SU WiFi (802.11n) or AzureWave (802.11bgn) - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->Samsung Syncmaster Thin Client Display TC-W Series 24" LF24 TOWHBFM/EN TC220W LED LF22TOW HBDN/EN || <!--IDE-->{{N/A}} || <!--SATA-->8gb SSD || <!--Gfx-->{{Maybe| VESA mode only Radeon HD 6290}} || <!--Audio--> || <!--USB-->2 USB 2.0 || <!--Ethernet--> || <!--Test Distro--> || <!--Comments-->2012 64bit does not support AVX or SSE 4.1 thin Client C-50 C50 AMD® 1000 MHz and no wireless |- | <!--Name-->Advantech TPC-2140 thin client | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{Maybe|VESA }} | <!--Audio--> | <!--USB-->USB2 | <!--Ethernet-->{{Yes|Realtek}} | <!--Test Distro--> | <!--Comments-->2012 64bit does not support AVX or SSE 4.1 atom-like G-T56E 1.65Ghz up to SSE3, BGA413 soldered - |- | <!--Name-->CompuLab FIT-PC3 fitPC3 USFF PC AMD G-T56N || <!--IDE-->{{N/A}} || <!--SATA-->{{yes| }} || <!--Gfx-->RADEON HD 6320 || <!--Audio-->{{yes|HDAudio ALC888 codec}} || <!--USB-->{{yes| }} || <!--Ethernet-->{{yes|rtl8169 8111}} || <!--Test Distro--> || <!--Comments-->2012 64 bit does not support AVX or SSE 4.1 - 12v 3a - 2x sodimm DDR3 max 4GB - wifi rtl8188ce |- | <!--Name-->10Zig 6872 thin client | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{Maybe|VESA }} | <!--Audio--> | <!--USB--> | <!--Ethernet-->{{Yes|Realtek}} | <!--Test Distro--> | <!--Comments-->2012 64bit does not support AVX or SSE 4.1 atom-like G-T56N up to SSE3 BGA413 (FT1) soldered - DDR3l single channel - |- | <!--Name-->10ZiG Technology 9972 1.6 GHz Linux 1.47 kg Black RX-216GD thin client | <!--IDE--> | <!--SATA--> | <!--Gfx-->AMD Radeon 5E 3840 x 2160 @ 30Hz to 2560 x 1600 @ 60Hz 2 x Display Port | <!--Audio--> | <!--USB-->6 x USB2.0 2 x USB3.0 | <!--Ethernet-->{{Maybe|Realtek}} | <!--Test Distro--> | <!--Comments-->2016 64bit does support AVX or SSE 4.1 AMD RX-216TD - 1 ddr3 sodimm - 12V 4A Coax 5.5mm/2.1mm |- | <!--Name-->10ZiG 7800q thin client | <!--IDE--> | <!--SATA--> | <!--Gfx-->AMD Radeon 5E 3840 x 2160 @ 30Hz to 2560 x 1600 @ 60Hz 2 x Display Port | <!--Audio--> | <!--USB-->6 x USB2.0 2 x USB3.0 | <!--Ethernet-->{{Maybe|Realtek}} | <!--Test Distro--> | <!--Comments-->2016 64bit does support AVX or SSE 4.1 AMD GX-424CC (Quad Core) 2.4GHz BGA769 (FT3b) - 1 ddr3 sodimm - 12V 4A Coax 5.5mm/2.1mm |- | <!--Name--> *Itona VXL MZE12 AMD a4-5000 thin client *VXL Itona LQ27 LQ+27 LQ44 LQ+44 LQ49 LQ+49 LQ50 LQ+50 LQ64 LQ+64 thin client | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->Ati 8330 vga hdmi dp | <!--Audio--> | <!--USB-->4 usb2 2 usb3 | <!--Ethernet-->Realtek | <!--Test Distro--> | <!--Comments-->2014 64bit quad BGA769 (FT3) soldered - 2 stacked sodimm ddr3 middle of mobo - 2 m.2 sata slots - 1 sata short cable half size space - limited 1ltr 8in case no fan - 19v hp style psu connector - |- | <!--Name-->Dell Wyse 5212 21.5" AIO Thin Client W11B | <!--IDE-->{{N/A}} | <!--SATA-->Sata | <!--Gfx-->R3 out from DP or vga | <!--Audio-->HDAudio | <!--USB-->USB2 | <!--Ethernet-->Realtek | <!--Test Distro--> | <!--Comments-->2015 64bit slow atom like dual core AMD G-T48E 1.4 GHz - dell type round ac needed 90W 19.5V 4.62A - 21 inch 1080p screen - |- | <!--Name-->LG 24CK560N-3A 24' All-in-One Thin Client Monitor, 27CN650N-6N 27CN650W-AC 27', 34CN650W-AC 34', | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2018 64bit AMD Prairie Falcon GX-212JJ |- | <!--Name-->CompuLab fit-PC4 fitPC4 4x 2Ghz AMD || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet-->{{no|Intel}} || <!--Test Distro--> || <!--Comments-->2018 64 - 2x DDR4 sodimm - |- | <!--Name-->IGEL Hedgehog M340C UD3 thin client *2016 V1.0 AMD GX-412HC 1.2GHz-1.6GHz Radeon R3E, normal bios DEL for Bios or F12 boot selector *2018 AMD GX-424CC 2.4GHz, Radeon R5E, UEFI hit DEL and choose boot or SCU icon | <!--IDE-->{{N/A|}} | <!--SATA-->SATA half slim version '''limited space''' with msata 8+18pins slot on earlier 2016 models | <!--Gfx-->{{Maybe|VESA for Radeon R3E later R5E sea islands vulkan 1.2 with dvi dp output}} | <!--Audio-->{{Yes|HD Audio with codec ?? (412) and Realtek ALC662-VD0-GR (424), both case speaker}} | <!--USB-->amd usb3 boot usb2 with bios "disable usb" entry | <!--Ethernet-->{{Yes|Realtek 8169 8111 (412) and (424)}} | <!--Test Distro-->Aros One x86 USB 1.5, 1.8 and 2.2 but ArosOne 64bit 1.2 boot loop in usb2 port | <!--Comments-->2016 64bit - 20cm/8" high case - 1 DDR3L sodimm slot max 8Gb 1600MHz - external '''12V 3A''' supply with 5.5mm/2.1mm coaxial - IDE like interface under base stand is for legacy addon ports RS232 parallel etc - capacitive touch power on - case opening 3 stages, remove stand and narrow black plastic strip from the back, top cover slides off to the back and lifts off - |- | <!--Name--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Test Distro--> || <!--Comments--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->10ZiG 6148v 6048qv (6100 series) | <!--IDE-->{{N/A}} | <!--SATA-->{{maybe| }} | <!--Gfx--> | <!--Audio-->{{maybe| }} | <!--USB-->{{No| }} | <!--Ethernet-->{{maybe| }} | <!--Test Distro--> | <!--Comments-->2018 64bit AMD Ryzen V1202B |- | <!--Name-->10ZiG 7111q | <!--IDE-->{{N/A}} | <!--SATA-->{{maybe| }} | <!--Gfx--> | <!--Audio-->{{maybe| }} | <!--USB-->{{maybe| }} | <!--Ethernet-->{{maybe| }} | <!--Test Distro--> | <!--Comments-->2019 64bit AMD Ryzen R2514 2.1 GHz - |- | <!--Name-->Shuttle DA320 | <!--IDE--> | <!--SATA--> | <!--Gfx-->R3 R5 | <!--Audio-->HD Audio with ALC662 codec | <!--USB-->{{maybe| }} | <!--Ethernet-->dual realtek 1GbE 8111H | <!--Test Distro--> | <!--Opinion-->2017 64bit AMD 2200G 2400G - Robust metal 1.3-liter case - A320 chipset DDR4 - 19V 6.32A DC PSU - |- | <!--Name-->IGEL UD7 H850C around december 2019 '''AMD Secure Processor''' is a built-in dedicated security system that checks if the BIOS has a valid signature and thus secures the next step in the boot process. This ensures that only devices with a signed BIOS will boot | <!--IDE-->{{N/A}} | <!--SATA-->None but 8gb emmc | <!--Gfx-->Vega 3 | <!--Audio-->HD Audio with Realtek ALC897 or ALC888S codec | <!--USB-->USB 3.2 and 2.0 | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2018 64bit - AMD Ryzen™ Dual-Core 10W TDP - 2 DDR4 sodimms slots max 16Gb - 12V 4A psu - 2x DisplayPort 1.2 no dvi or hdmi - Intel® 9260 or SparkLAN WNFT-238AX wifi - 1x rear serial Prolific PL2303 chipset - locked down components and very limited expansion options |- | <!--Name-->IGEL UD7 H860C - '''AMD Secure Processor''' is a built-in dedicated security system that checks if the BIOS has a valid signature and thus secures the next step in the boot process. This ensures that only devices with a signed BIOS will boot | <!--IDE-->{{N/A}} | <!--SATA-->None but 8gb emmc | <!--Gfx-->Vega 3 | <!--Audio-->HD Audio with Realtek ALC897 or ALC888S codec | <!--USB-->USB 3.2 and 2.0 | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2018 64bit - AMD Ryzen™ Dual-Core 10W TDP - 2 DDR4 sodimms slots max 16Gb - 12V 4A psu - 2x DisplayPort 1.2 no dvi or hdmi - Intel® 9260 or SparkLAN WNFT-238AX wifi - 1x rear serial Prolific PL2303 chipset - locked down components and very limited expansion options |- | <!--Name-->IGEL UD3 M350C (UEFI issues) | <!--IDE-->{{N/A}} | <!--SATA-->None but 8gb emmc | <!--Gfx-->Vega 3 | <!--Audio-->HD Audio with Realtek ALC897 or ALC888S codec | <!--USB-->USB 3.2 and 2.0 | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2018 64bit - AMD Ryzen™ R R1505G Dual-Core 10W TDP - 2 DDR4 sodimms slots max 16Gb - 12V 4A psu - 2x DisplayPort 1.2 no dvi or hdmi - Intel® 9260 or SparkLAN WNFT-238AX wifi - 1x rear serial Prolific PL2303 chipset - locked down components and very limited expansion options |- | <!--Name-->IGEL UD7 H860C AMD Ryzen V1605B Thin Client - '''AMD Secure Processor''' is a built-in dedicated security system that checks if the BIOS has a valid signature and thus secures the next step in the boot process. This ensures that only devices with a signed BIOS will boot | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDAudio | <!--USB-->{{maybe| }} | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2020 AMD Ryzen™ Embedded V1605B 2 – 3.6 GHz (Quad-Core) - 12v 5A psu - up to 16GB RAM DDR4 - locked down components and very limited expansion options |- | <!--Name-->Gigabyte Brix Barebone Mini PC BSRE-1605 | <!--IDE-->{{N/A}} | <!--SATA-->2 M.2 | <!--Gfx-->Vega 8 | <!--Audio-->HD Audio ALC269 codec | <!--USB-->USB3 | <!--Ethernet-->2 GbE | <!--Test Distro--> | <!--Comments-->2020 64bit AMD Ryzen V1605B - 2 DDR4 sodimm slots |- | <!--Name-->MINISFORUM Deskmini UM250 Mini PC | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB-->{{maybe| }} | <!--Ethernet-->{{maybe| }} | <!--Test Distro--> | <!--Comments-->2020 64bit AMD Ryzen V1605B - |- | <!--Name-->T-Bao MN25 Mini PC 2500U | <!--IDE-->{{N/A| }} | <!--SATA-->{{Unk|Intel NVMe}} | <!--Gfx-->{{No|VESA Radeon Vega 8}} | <!--Audio-->{{Unk| }} | <!--USB-->{{maybe|USB 3}} | <!--Ethernet-->{{Yes|Realtek PCIe 1GbE}} | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->Atari VCS || <!--IDE-->{{N/A}} || <!--SATA--> || <!--Gfx-->{{maybe|Vesa 2D for AMD Vega 3}} || <!--Audio-->{{unk|HDAudio with ALC codec}} || <!--USB-->{{maybe|USB3 USB 3.2 Gen 2 front and 3 usb2 rear }} || <!--Ethernet-->rtl8169 Realtek RTL8111H || <!--Test Distro--> || <!--Comments-->2021 64bit Ryzen Embedded R1606G - 2 ddr4 sodimm slots - TPM 2.0 - |- | <!--Name-->Minis Forum M200 Silver Athlon M300 3300U | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->Vega 8 | <!--Audio--> | <!--USB-->{{maybe|USB 3.1 gen 1 and 2}} | <!--Ethernet-->{{No|Realtek PCIe 2.5G}} | <!--Test Distro--> | <!--Comments-->2021 64bit |- | <!--Name-->Minis Forum DeskMini UM300 3300U, UM350 DMAF5 3550H, UM370 and UM700 with 3750H | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->Vega 8 | <!--Audio--> | <!--USB-->{{maybe|USB 3.1 gen 1 and 2}} | <!--Ethernet-->{{No|Realtek PCIe 2.5G}} | <!--Test Distro--> | <!--Comments-->2021 64bit |- | <!--Name-->MinisForum X300 with AMD 3400G | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->Vega 8 | <!--Audio--> | <!--USB-->{{maybe|USB 3.1 gen 1 and 2}} | <!--Ethernet-->{{No|Realtek PCIe 2.5G}} | <!--Test Distro--> | <!--Comments-->2021 64bit |- | <!--Name-->Beelink SER3 GTR4 | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->AMD Vega 3 or 10 | <!--Audio-->HD Audio with codec | <!--USB-->{{maybe|USB3}} | <!--Ethernet-->Realtek RJ45 1GbE | <!--Test Distro--> | <!--Comments-->2020 64bit 3200u or 3750h |- | <!--Name-->AsRock DeskMini X300 | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2020 Ryzen 7 Pro 4750G 5600G |- | <!--Name-->MinisForum Besstar Tech X400 with AMD 4650G | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->AMD | <!--Audio--> | <!--USB-->{{maybe|USB 3.1 gen 1 and 2}} | <!--Ethernet-->{{No|Realtek PCIe 2.5G}} | <!--Test Distro--> | <!--Comments-->2021 64bit - MP1584 - kill NB679 NB679GD-Z=ALTM=AL** QFN-12 IC-REG-DL buck/linear synchronous chip IC with bad usb cables - |- | <!--Name-->Beelink SER4 GTR5 | <!--IDE-->{{N/A}} | <!--SATA-->cant boot from installed SSDs unless its an M.2 | <!--Gfx-->AMD Vega | <!--Audio--> | <!--USB-->{{maybe|USB3}} | <!--Ethernet-->1 or 2 Realtek | <!--Test Distro--> | <!--Comments-->2021 64bit 4700U or 5900HX |- | <!--Name-->MSI PRO DP20Z 5M Mini PC - AMD Ryzen 5 5300G | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet-->{{No|Realtek 2.5G LAN RTL8125}} | <!--Test Distro--> | <!--Comments-->2018-2021 R3 3200G Vega 8 - R5 3400G Vega 11 - Ryzen 5 5600G Vega 7 - Athlon 3000G |- | <!--Name-->Minisforum UM450 | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->Vega | <!--Audio-->HDaudio | <!--USB-->USB3 | <!--Ethernet-->{{No|Realtek 2.5G LAN RTL8125}} | <!--Test Distro--> | <!--Comments-->2022 64bit - Ryzen 4500U - |- | <!--Name-->Gigabyte Brix GB-BRR7-4800 (rev. 1.0) GB-BRR7-4700 (rev. 1.0) GB-BRR5-4500 (rev. 1.0) GB-BRR3-4300 (rev. 1.0) | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB-->{{maybe|}} | <!--Ethernet-->Realtek 2.5G LAN RTL8125 | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->ASUS PN50 mini PC AMD Ryzen 7 4700U | <!--IDE--> | <!--SATA--> | <!--Gfx-->Vega | <!--Audio-->HD audio with codec | <!--USB-->{{maybe|3.1 gen1}} | <!--Ethernet-->{{No|realtek 2.5GbE}} | <!--Test Distro--> | <!--Comments-->2022 64bit - |- | <!--Name-->ASUS PN51-S1 mini PC AMD Ryzen 7 5700U | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->Vega thru dp or hdmi | <!--Audio-->HD audio with codec | <!--USB-->{{maybe|3.1 gen1}} | <!--Ethernet-->{{No|realtek 2.5GbE}} | <!--Test Distro--> | <!--Comments-->2022 64bit - 19v or 19.5v 90w psu round barrel - 32gb ddr4 sodimm - |- | <!--Name-->Minis Forum Bessstar Tech EliteMini B550 | <!--IDE-->{{N/A}} | <!--SATA-->1 x 2.5in and 2 nvme | <!--Gfx-->Vega 8 | <!--Audio--> | <!--USB-->{{maybe|4 usb3.1}} | <!--Ethernet-->{{No|realtek 8125 2.5GbE}} | <!--Test Distro--> | <!--Comments-->2022 64bit AMD 4700G 5700G desktop cpu - 19v 120w round barrel - |- | <!--Name-->ASRock A300 and later X300 Mini itx with Desktop AM4 socket | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->Vega | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet-->1GbE | <!--Test Distro--> | <!--Comments-->2022 64bit - choose your own AMD APU GE 35w based - DDR4 - |- | <!--Name-->ASRock 4x4 BOX-5800U Zen 3-based AMD Ryzen 7 5800U 15W - | <!--IDE-->{{N/A}} | <!--SATA-->m.2 slot gen 3 and sata | <!--Gfx-->vega | <!--Audio-->HD audio with codec | <!--USB-->{{maybe|}} | <!--Ethernet-->{{Maybe|1 GbE and 1 2.5GbE}} | <!--Test Distro--> | <!--Comments-->2022 64bit - WiFi 6E - |- | <!--Name-->Topton S500+ Gaming Mini PC - Morefine S500+ 5900HX Mini PC - Minisforum UM590 Ryzen AMD Zen3 Ryzen 9 5900HX 7 5800H 45W - | <!--IDE-->{{N/A}} | <!--SATA-->2 nvme 1 sata | <!--Gfx-->Vega 8 thru HDMI 2.0, DP 1.4, and USB type-C | <!--Audio--> | <!--USB-->{{maybe|usb3.1}} | <!--Ethernet-->{{Maybe|1 realtek rtl 8111h and 1 8125 2.5GbE bg-cg}} | <!--Test Distro--> | <!--Comments-->2022 64bit - 2 sodimm ddr4 3200MHz - |- | <!--Name-->Chuwi RzBox later Ubox | <!--IDE-->{{N/A}} | <!--SATA-->2 nvme | <!--Gfx-->Vega 8 later to 660m vga, dp, hdmi | <!--Audio-->HDaudio | <!--USB-->{{maybe|usb-c usb2}} | <!--Ethernet-->dual gigabit | <!--Test Distro--> | <!--Comments-->2022 2025 64bit amd 5800h 4800h 6600H - 90w psu - |- | <!--Name-->Beelink Mini PC SER5, Trigkey AZW S5, Asus PN52, ZHI BEN MX-JB560, | <!--IDE-->{{N/A}} | <!--SATA-->PCIe3 M.2 2280 nvme | <!--Gfx-->AMD Vega 6 with 1 or 2 hdmi | <!--Audio-->HDAudio | <!--USB-->{{maybe|USB3.0}} | <!--Ethernet-->{{Maybe|Realtek 1GbE}} | <!--Test Distro--> | <!--Comments-->2022 64bit 5500U 5560u 5600U to PRO 5600H 5800H - 19v 3.42W 65W psu - |- | <!--Name-->NIPOGI Kamrui ACEMAGICIAN AM06PRO Dual LAN Mini PC AMD Ryzen 7 5800U, 5 5500U or 5600U/5625U | <!--IDE-->{{N/A}} | <!--SATA-->M.2 and 2.5in sata | <!--Gfx-->Vega 7 | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet-->2 GbE ports | <!--Test Distro--> | <!--Comments-->2022 64bit - plastic build - 90w usb-c power - loud at 25W setting - |- | <!--Name-->Topton FU02 Fanless Mini PC AMD Ryzen 7 4700U 5600U 5800U 8 Core 16 Threads | <!--IDE-->{{N/A}} | <!--SATA-->NVMe and 2.5in sata | <!--Gfx-->Vega | <!--Audio-->HDAudio | <!--USB-->4 3.0 with 2 2.0 | <!--Ethernet-->2 x 1G | <!--Test Distro--> | <!--Comments-->2022 64 - 2 ddr4 sodimm slots - fanless with copper cube from cpu to metal sheet which gets warm |- | <!--Name-->Xuu XR1 Lite (5300u 4c 8t) PRO 5400U MAX 5600U | <!--IDE-->{{N/A}} | <!--SATA-->1 NVMe 2242 slot | <!--Gfx-->Vega 6 | <!--Audio-->HDAudio | <!--USB-->2 3.0 | <!--Ethernet-->1G | <!--Test Distro--> | <!--Comments-->2022 64 quiet fan - very small case no expansions - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->MINISFORUM UM690 Venus Series | <!--IDE-->{{N/A}} | <!--SATA-->pcie4 nvme 2280 and 1 sata3 2.5in | <!--Gfx-->680m RNDA2 12CU with 2 hdmi | <!--Audio-->HD Audio with codec | <!--USB-->{{maybe|1 USB4 and 2 USB3.2}} | <!--Ethernet-->{{No|2.5G LAN}} | <!--Test Distro--> | <!--Comments-->2022 64bit 6900hx 8C16T - 2 ddr5 sodimmm - 19v ???W - |- | <!--Name-->Beelink Mini PC GTR6 | <!--IDE-->{{N/A}} | <!--SATA-->PCIe4 | <!--Gfx-->AMD 680M RDNA2 | <!--Audio--> | <!--USB-->USB3.2 | <!--Ethernet-->{{No|Realtek 2.5GbE or intel i225}} | <!--Test Distro--> | <!--Comments-->2022 64bit Ryzen 9 6900HX Zen3+ and a 2gb Radeon 680m 12CU ddr5 sodimm - 19v 120w psu - |- | <!--Name-->Asus PN53, Geekom AS 6, | <!--IDE-->{{N/A}} | <!--SATA-->pcie gen4 nvme and ata 2.5in | <!--Gfx-->680m RNDA2 12CU with 2 hdmi and 1 dp | <!--Audio-->HD Audio with codec | <!--USB-->{{maybe|2 usb-c, 2 USB2.1 and 3 USB3.2}} | <!--Ethernet-->{{No|1G LAN}} | <!--Test Distro--> | <!--Comments-->2022 64bit 6900hx 8C 16T - 2 slots ddr5 sodimmm (64Gb max) - 19v 120W - 4 retained base screws beware ribbon cable - |- | <!--Name-->Micro Computer (HK) Tech Ltd MinisForum UM773 Lite later UM750L slim, GMKtec K2 Mini PC | <!--IDE-->{{N/A}} | <!--SATA-->NVMe PCIe4.0 | <!--Gfx-->RDNA | <!--Audio-->HD Audio | <!--USB-->USB4 | <!--Ethernet-->2.5GbE | <!--Test Distro--> | <!--Comments-->2023 2025 64bit - AMD Zen 3+ (8c 16t) Ryzen 7 7735HS, 7840HS and AMD Ryzen 9 7845HX AMD Ryzen™5 7545U (6c12t) - 19v up to 120w ac adapter - ddr5 sodimm 4800Mhz - |- | <!--Name-->[https://www.asrockind.com/en-gb/4x4 ASrock 4x4 SBC] | <!--IDE-->{{N/A}} | <!--SATA-->sata or nvme | <!--Gfx-->Vega or 680M | <!--Audio-->HDAudio | <!--USB-->USB3 or USB4 | <!--Ethernet-->Realtek 1GbE or intel 2.5GbE | <!--Test Distro--> | <!--Comments-->2022 64bit - |- | <!--Name-->Beelink Mini PC GTR7 SER7 | <!--IDE-->{{N/A}} | <!--SATA-->PCIe4 nvme 2280 up to 2Tb | <!--Gfx-->AMD 780M RDNA3 GPU output on hdmi and dp | <!--Audio-->HDAudio | <!--USB-->USB3.2 | <!--Ethernet-->{{No|1 or 2 2.5GbE}} | <!--Test Distro--> | <!--Comments-->2023 64bit AMD Phoenix APUs Zen 4 CPU Ryzen 7 7840HS or 9 7940HS (8c 16t) - 19v 5.26A 120w psu - del dios setup f7 choose boot - 2 usb-c on back - up to 64gb via 2 ddr5 sodimm slots - |- | <!--Name-->MINISFORUM BD770i Ryzen 7 7745HX (8c16t) or BD795i SE 790i 9 7945HX (16c32t) or F1FXM_MB_V1.1 795M LGA1700 mATX | <!--IDE-->{{N/A}} | <!--SATA-->2 NVMe | <!--Gfx-->Radeon 610m over usb-c, dp or hdmi | <!--Audio-->HDAudio with codec | <!--USB-->USB3 with 2 rear USB2 | <!--Ethernet-->Realtek 2.5G | <!--Test Distro--> | <!--Opinion-->2024 mini-ITX M/B is the first MoDT (Mobile on Desktop) with soldered AMD CPU - 2 dual PCIe4.0 M.2 slots - 2 ddr5 sodimm slots max 5200Mhz - 8pin cpu power - battery not easily replaceable underneath - |- | <!--Name-->Minisforum ms-a1 MS-a2 * 5700G to 8700G apu * 9955HX | <!--IDE-->{{N/A}} | <!--SATA-->2 nvme | <!--Gfx-->AMD 610M | <!--Audio-->HDAudio | <!--USB-->USB3 | <!--Ethernet-->dual 2.5GbE | <!--Test Distro--> | <!--Comments-->2024 64bit - 19v ?A round barrel jack - 2 ddr5 so-dimm slots - |- | <!--Name-->AOOSTAR GT68 | <!--IDE-->{{N/A}} | <!--SATA-->Nvme | <!--Gfx-->680m | <!--Audio-->HDaudio | <!--USB-->USB3 | <!--Ethernet-->2 2.5Gb | <!--Test Distro--> | <!--Comments-->2025 Ryzen7 Pro 6850H, |- | <!--Name-->NextSBC 7840HS | <!--IDE-->{{N/A}} | <!--SATA-->Nvme | <!--Gfx-->AMD 780M 12CU | <!--Audio-->HDAudio with codec | <!--USB-->USB4 and USB 3.2 | <!--Ethernet-->2 GbE | <!--Test Distro--> | <!--Comments-->2025 64bit - 32Gb soldered - |- | <!--Name-->Firebat A6 R7 6800H | <!--IDE-->{{N/A}} | <!--SATA-->nvme | <!--Gfx-->AMD 680M | <!--Audio-->HDaudio | <!--USB-->USB3 | <!--Ethernet-->rtl8169 | <!--Test Distro--> | <!--Comments-->2025 64bit - |- | <!--Name-->Minisforum UM760 7640HS | <!--IDE-->{{N/A}} | <!--SATA-->nvme | <!--Gfx-->AMD 760 | <!--Audio-->HDaudio | <!--USB-->USB4 | <!--Ethernet-->rtl8169 and 2.5Gb | <!--Test Distro--> | <!--Comments-->2025 64bit - |- | <!--Name-->Peladn WO4 Mini PC | <!--IDE-->{{N/A}} | <!--SATA-->nvme | <!--Gfx-->AMD 760 | <!--Audio-->HDaudio | <!--USB-->USB3 | <!--Ethernet-->rtl8169 | <!--Test Distro--> | <!--Comments-->2025 64bit 7640HS - 19v 5.26A 120W - |- | <!--Name-->BossGame M4 Neo 7840HS | <!--IDE-->{{N/A}} | <!--SATA-->nvme | <!--Gfx-->AMD 780 | <!--Audio-->HDaudio | <!--USB-->USB3 | <!--Ethernet-->rtl8169 | <!--Test Distro--> | <!--Comments-->2025 64bit - |- | <!--Name-->Minisforum UM870 || <!--IDE-->{{N/A}} || <!--SATA-->NVme || <!--Gfx-->AMD 780M || <!--Audio-->HDaudio || <!--USB-->USB3 || <!--Ethernet-->2.5GbE || <!--Test Distro--> || <!--Comments-->2025 64bit - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || IDE || SATA || Gfx || Audio || USB || Ethernet || Test Distro || Comments |- | <!--Name-->GEEKOM A8 Max AI Mini PC AMD Ryzen™ 9 8945HS, Ryzen™ 7 8845HS or 8745HS | <!--IDE-->{{N/A}} | <!--SATA-->NVme | <!--Gfx-->AMD 780M | <!--Audio-->HDAudio with codec | <!--USB-->{{maybe| USB4}} | <!--Ethernet-->{{No|Dual 2.5 G Ethernet ports}} | <!--Test Distro--> | <!--Comments-->2025 64bit - |- | <!--Name-->Beelink SER 9 | <!--IDE-->{{N/A}} | <!--SATA-->NVme | <!--Gfx-->Radeon 890M | <!--Audio-->HDaudio | <!--USB-->USB4 | <!--Ethernet-->{{No| }} | <!--Test Distro--> | <!--Comments-->2025 64bit - Ryzen AI HX 370 strix point - |- | <!--Name-->GMKtec EVO-X2 mini pc | <!--IDE-->{{n/a}} | <!--SATA-->nvme | <!--Gfx-->AMD 8060S iGPU RDNA3.5 RADV GFX1151 | <!--Audio-->HDaudio | <!--USB-->USB4 | <!--Ethernet-->{{No| }} | <!--Test Distro--> | <!--Comments-->2025 64bit - amd ryzen AI Max+ 395 (16c32t) strix halo - |- | <!--Name-->BosGame M5 | <!--IDE-->{{n/a}} | <!--SATA-->nvme | <!--Gfx-->AMD 8060S iGPU RDNA3.5 RADV GFX1151 | <!--Audio-->HDaudio | <!--USB-->USB4 | <!--Ethernet-->{{No| }} | <!--Test Distro--> | <!--Comments-->2025 64bit - amd ryzen AI Max+ 395 (16c32t) - |- | <!--Name-->Steam Machine GabeCube | <!--IDE-->{{N/A}} | <!--SATA-->nvme | <!--Gfx-->semi-custom 1080p amd 7600m like with 28cu 8gb ddr6 gddr 10GFlops | <!--Audio-->hdaudio with codec | <!--USB-->usb3 | <!--Ethernet-->{{maybe|rtl8169}} | <!--Test Distro--> | <!--Comments-->2026 64bit amd 1772 hawk point2 6c12t zen4 avx512 FP7 socket with FCH51 - 16gb ddr5 - |- | <!--Name-->AMD Ryzen AI Halo Developer Platform Workstation | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments-->2026 64bit - amd ryzen AI Max+ 395 (16c32t) - |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |} ===Server Systems=== [[#top|...to the top]] ====IBM==== {| class="wikitable sortable" width="100%" ! width="15%" |Name ! width="5%" |IDE ! width="5%" |SATA ! width="10%" |Integrated Gfx ! width="10%" |Audio ! width="10%" |USB ! width="10%" |Ethernet ! width="15%" |Test Distro ! width="20%" |Comments |- | <!--Name-->xSeries 206m | <!--IDE-->{{yes}} | <!--SATA-->{{yes}} | <!--Gfx-->{{Maybe|ATI RN50b (VESA only)}} | <!--Audio-->{{n/a}} | <!--USB-->{{yes|USB 2.0 (UHCI/EHCI)}} | <!--Ethernet-->{{no|Broadcom}} | <!--Test Distro-->Nightly Build 2014-09-27 | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- |} ===Motherboard=== [[#top|...to the top]] * Late 2002, USB2.0 added and slightly better AROS sound support (AC97) appeared * 2002-2005 and still, to a limited extent, ongoing [http://en.wikipedia.org/wiki/Capacitor_plague bad capacitors] * Late 2003, ATX PSUs moved from 5V to 12v rails (extra 4pin on motherboard for CPU) * Late 2005, PCI Express replaced AGP and HDAudio replaced AC97 * Late 2007, ATX PSUs added extra 12V PCI-E connectors and 4+4pin for CPUs * Late 2010, USB3.0 appears on motherboards or needing a PCI-E motherboard slot * Late 2014 Hardware USB2 removed from USB3 chipsets ====AMD Sockets==== [[#top|...to the top]] =====Socket 7 (1997/1999)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->1997 VT82C586B (QFP-208) is the first from VIA with DDMA |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2000 VT82C686 has close to excellent DDMA support |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->SiS 5581/5582 SiS 5591/5595 SiS 530 /5595 SiS 600/5595 SiS 620/5595 |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} =====Socket A 462 (2001/4)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->[http://www.sharkyextreme.com/hardware/motherboards/article.php/2217921/ABIT-NF7-S-nForce2-Motherboard-Review.htm Abit NF7-S] | <!--Chipset-->nForce 2 | <!--ACPI--> | <!--IDE-->2 ports | <!--SATA-->SIL 3112A | <!--Gfx--> | <!--Audio-->{{yes|ALC650 AC97 (Nvidia APU)}} | <!--USB-->{{yes}} | <!--Ethernet-->Realtek RTL 8201LB | <!--Opinion-->Firewire Realtek RTL8801B |- | <!--Name-->ASRock K7NF2 | <!--Chipset-->nforce2 ultra 400 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{yes|AGP 8x}} | <!--Audio-->CMedia CMI 9761A AC'97 | <!--USB-->{{yes}} | <!--Ethernet-->Realtek 8201 | <!--Opinion--> |- | <!--Name-->ASRock K7S8X | <!--Chipset-->SIS 746FX | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA--> | <!--Gfx-->{{yes|AGP 8x}} | <!--Audio-->{{yes|AC'97 cmedia}} | <!--USB-->{{maybe|USB2.0 works but does not boot}} | <!--Ethernet-->{{yes|SiS900}} | <!--Opinion--> |- | <!--Name-->ASRock K7S41GX | <!--Chipset-->SIS 741GX + DDR 333 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA--> | <!--Gfx-->{{maybe|onboard sis does not work with vga or vesa but AGP 8x works}} | <!--Audio-->{{yes|AC97 SIS 7012}} | <!--USB-->{{maybe|USB2.0 works but does not boot}} | <!--Ethernet-->{{yes|SiS 900}} | <!--Opinion-->works ok |- | <!--Name-->[http://www.asus.com ASUS A7N8X] | <!--Chipset-->nForce2 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->Silicon Image Sil 3112A | <!--Gfx-->1 AGP slot | <!--Audio-->{{yes|ac97 ALC650}} | <!--USB-->{{yes|ehci USB2.0}} | <!--Ethernet-->{{yes|rtl8201BL - nforce}} | <!--Opinion-->first total support for AROS in 2004/5 - damocles and M Schulz |- | <!--Name-->Biostar M7NCD | <!--Chipset-->nForce2 Ultra 400 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{yes|ALC650 AC97}} | <!--USB--> | <!--Ethernet-->{{yes|RTL8201BL}} | <!--Opinion--> |- | <!--Name-->Chaintech 7NJS Ultra Zenith | <!--Chipset-->nForce2 Ultra 400 | <!--ACPI--> | <!--IDE--> | <!--SATA-->Promise PDC 20376 | <!--Gfx--> | <!--Audio-->{{yes|CMI8738}} | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->DFI Lanparty NF2 Ultra | <!--Chipset-->nForce2 Ultra 400 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{no|via ac97 VT1616}} | <!--USB--> | <!--Ethernet-->RTL8139C | <!--Opinion--> |- | <!--Name-->ECS N2U400-A | <!--Chipset-->nForce2 Ultra 400 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{no|Cmedia 9379A AC97}} | <!--USB-->{{yes|usb2.0}} | <!--Ethernet-->{{no|VIA VT6103L}} | <!--Opinion--> |- | <!--Name-->Gigabyte GA7N400L | <!--Chipset-->nForce2 Ultra 400 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->1 AGP 8x slot | <!--Audio-->{{yes|AC97 ALC650}} | <!--USB-->2 USB2.0 | <!--Ethernet-->RTL8100C | <!--Opinion--> |- | <!--Name-->[http://www.gigabyte.lv/products/page/mb/ga-8siml Gigabyte 8SIML] | <!--Chipset-->SIS 650 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA--> | <!--Gfx-->{{maybe|VESA}} | <!--Audio-->{{yes|AC'97}} | <!--USB-->{{maybe|working}} | <!--Ethernet-->{{no|Realtek RTL8100L LAN}} | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Matsonic [http://www.elhvb.com/mobokive/archive/matsonic/manual/index.html Manuals] MS83708E | <!--Chipset-->SIS730 | <!--ACPI--> | <!--IDE-->{{yes|SiS 5513}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{maybe|sis 305 no support use VESA}} | <!--Audio-->{{no|sis7018}} | <!--USB-->{{no|SiS 7001 USB 1.1 only}} | <!--Ethernet-->{{yes|SIS900}} | <!--Opinion-->little support |- | <!--Name-->[http://h10025.www1.hp.com/ewfrf/wc/document?docname=bph07585&lc=en&dlc=en&cc=us&dest_page=softwareCategory&os=228&tool=softwareCategory&query=Pavilion%20742n&product=89232 MSI MS-6367 HP 722n 742n (Mambo) (2001/2)] | <!--Chipset-->Nvidia nforce 220D (2001/2) | <!--ACPI--> | <!--IDE-->{{Yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->GeForce2 AGP works 2D nouveau only | <!--Audio-->{{Maybe|AC97 ADI 1885 no volume control on Units 0-3}} | <!--USB-->{{Yes|4 USB1.1 ports AMD based - front 2 ports iffy}} | <!--Ethernet-->{{No|nForce}} | <!--Opinion-->Tested 20th Aug 2012 NB |- | <!--Name-->MSI K7N2 [http://us.msi.com/index.php?func=proddesc&maincat_no=1&prod_no=546/ Delta ILSR] Delta-L | <!--Chipset-->nForce2 (2002/3) | <!--ACPI--> | <!--IDE-->{{yes|Primary & Secondary ports}} IDE Tertiary port (RAID) | <!--SATA-->2 ports (RAID) | <!--Gfx-->{{yes|when fitted with an agp video card}} | <!--Audio-->{{yes|ac97 ALC650}} | <!--USB-->{{yes}} | <!--Ethernet-->{{yes|rtl8201BL - nforce}} | <!--Opinion-->runs AROS well. Tested with Icaros 1.2.3 |- | <!--Name-->MSI K7N2 Delta2-LSR Platinum | <!--Chipset-->nForce2 (2002/3) | <!--ACPI--> | <!--IDE-->{{yes|Primary & Secondary ports}} IDE Tertiary port (RAID) | <!--SATA-->2 ports (RAID) | <!--Gfx-->{{yes|when fitted with an agp video card}} | <!--Audio-->{{No|ac97 ALC655}} | <!--USB-->{{yes}} | <!--Ethernet-->{{yes|rtl8201BL - nforce}} | <!--Opinion-->runs AROS well. Tested with Icaros 1.2.3 |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->[http://www.sharkyextreme.com/hardware/motherboards/article.php/2204281/Soltek-SL-75MRN-L-nForce2-Motherboard-Review.htm Soltek 75FRN-L] | <!--Chipset-->nForce2 | <!--ACPI--> | <!--IDE-->{{yes|2 ports}} | <!--SATA-->{{N/A}} | <!--Gfx-->AGP slot | <!--Audio-->{{yes|ALC650}} | <!--USB-->{{yes|2 usb2.0}} | <!--Ethernet-->{{yes|Realtek RTL8201BL}} | <!--Opinion-->good support |- | <!--Name-->[http://www.3dvelocity.com/reviews/mach4nf2ultra/mach4.htm XFX Pine Mach4 nForce2 Ultra 400] | <!--Chipset-->nForce2 | <!--ACPI--> | <!--IDE-->{{yes|3 ports}} | <!--SATA-->{{maybe|2 ports VIA VT6240}} | <!--Gfx-->1 AGP 8x slot | <!--Audio-->{{yes|ALC650}} | <!--USB-->{{yes|2 USB2.0}} | <!--Ethernet-->{{yes|RTL8201BL}} | <!--Opinion-->some support |- | <!--Name-->ASUS A7V266 | <!--Chipset-->via KT266A + 8233 | <!--ACPI--> | <!--IDE-->{{no|issues}} | <!--SATA--> | <!--Gfx-->1 AGP slot | <!--Audio-->AC97 with AD1980 codec | <!--USB-->via 8233 | <!--Ethernet-->VIA VT6103 | <!--Opinion-->2002 issues with booting |- | <!--Name-->Asus A7V8X-X | <!--Chipset-->VIA KT400 | <!--ACPI--> | <!--IDE-->{{unk| }} | <!--SATA-->{{N/A}} | <!--Gfx-->{{yes|agp}} | <!--Audio-->{{unk|AC97 with ADI AD1980 codec}} | <!--USB-->{{unk|VIA 8235}} | <!--Ethernet-->{{unk|Realtek 10/100}} | <!--Opinion-->2003 not booting for Socket A for AMD Barton/Thoroughbred/Athlon XP/Athlon/Duron 2.25+ GHz CPU - 3 x DDR DIMM Sockets Max. 3 GB - |- |} =====Socket 754 (2004/5)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Abit NF8-V2 | <!--Chipset-->nForce3 250GB (2004/5) | <!--ACPI--> | <!--IDE-->{{yes|2 ports}} | <!--SATA-->{{maybe|2 ports}} | <!--Gfx-->1 AGP slot x8 | <!--Audio-->ALC658 ac97 | <!--USB-->{{yes|2 USB2.0}} | <!--Ethernet-->{{no|RTL8201C}} | <!--Opinion-->a little support but no Firewire VIA VT6306 |- | <!--Name-->Biostar CK8 K8HNA Pro | <!--Chipset-->nforce3 150 | <!--ACPI--> | <!--IDE--> | <!--SATA-->VT6420 thru ide legacy only | <!--Gfx--> | <!--Audio-->{{no|AC97 ALC655}} | <!--USB--> | <!--Ethernet-->Realtek RTL8110S | <!--Opinion-->Firewire VT6307 no |- | <!--Name-->[http://www.extremeoverclocking.com/reviews/motherboards/Chaintech_ZNF3-150_3.html Chaintech ZNF3-150 Zenith] | <!--Chipset-->nforce3 150 | <!--ACPI--> | <!--IDE-->2 ports | <!--SATA-->{{maybe|Sli3114 SATA via IDE emul}} | <!--Gfx-->1 AGP slot | <!--Audio-->{{no|VIA Envy24PT (VT1720) + VT1616}} | <!--USB-->{{Maybe|2 USB2.0}} | <!--Ethernet-->{{no|Broadcom GbE 5788}} | <!--Opinion-->very little support needs PCI cards but no Firewire VIA VT6306 |- | <!--Name-->DFI Lanparty UT nF3 250GB | <!--Chipset-->nForce3 250gb | <!--ACPI--> | <!--IDE-->2 ports | <!--SATA-->{{maybe|2 ports nForce3 and 2 Marvell SATA PHY}} | <!--Gfx--> | <!--Audio-->{{yes|AC97 ALC850}} | <!--USB-->{{Maybe|2 USB2.0}} | <!--Ethernet-->CK8S - Winfast NF3 250K8AA works and Marvell 88E1111 does not work | <!--Opinion-->2005 some support but no Firewire VIA VT6307 |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Gigabyte GA-K8N | <!--Chipset-->NVIDIA nForce3 150 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->Realtek ALC658 AC97 | <!--USB--> | <!--Ethernet-->Realtek RTL8100C | <!--Opinion-->Firewire TI43AB23 no |- | <!--Name-->Gigabyte K8NNXP | <!--Chipset-->nForce3 150 | <!--ACPI--> | <!--IDE--> | <!--SATA-->Sata sil3512 | <!--Gfx--> | <!--Audio-->ALC658 AC97 | <!--USB--> | <!--Ethernet-->RTl8110S | <!--Opinion-->Firewire TI STB82AA2 no |- | <!--Name-->Gigabyte GA-K8NSNXP | <!--Chipset-->nForce3 250GB | <!--ACPI--> | <!--IDE--> | <!--SATA-->SiI 3512 CT128 Sata Sil3515 | <!--Gfx--> | <!--Audio-->ALC850 AC97 | <!--USB--> | <!--Ethernet-->{{No|Marvel 88E8001}} | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->MSI K8N Neo-FIS2R | <!--Chipset-->nVIDIA NF3-250Gb | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->Realtek 7.1 AC'97 ALC850 | <!--USB--> | <!--Ethernet-->{{No|Marvell 88E1111}} | <!--Opinion--> |- | <!--Name-->[http://techreport.com/articles.x/5748/1 Shuttle AN50R] | <!--Chipset-->nF3-150 | <!--ACPI--> | <!--IDE--> | <!--SATA-->Sil 3112 | <!--Gfx--> | <!--Audio-->ALC650 AC97 | <!--USB--> | <!--Ethernet-->Nvidia nF3 (10/100) Intel 82540EM Gigabit | <!--Opinion-->Firewire VT6307 no |- | <!--Name--> Foxconn WinFast K8S755A | <!--Chipset-->SiS755 + SiS964 (DDR333) | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> {{yes|AC97}} | <!--USB--> | <!--Ethernet--> {{yes|RTL8169}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket 939 (2005)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Asus A8N-LA GeForce 6150 LE | <!--Chipset-->Geforce 6150 (MCP51) + nForce 430 (PC-3200) | <!--ACPI--> | <!--IDE-->{{yes|two ATA 133}} | <!--SATA-->{{maybe|four 3.0GB/s SATAII ports}} | <!--Gfx-->built in or PCI-E x16 | <!--Audio-->Realtek ALC883 HD Audio | <!--USB-->6 USB2.0 | <!--Ethernet-->Realtek RTL 8201CL | <!--Opinion--> |- | <!--Name-->Asus A8N-SLI Premium | <!--Chipset-->NVidia | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{Yes|PCIe slot}} | <!--Audio-->{{Yes|AC97}} | <!--USB-->{{Maybe}} | <!--Ethernet-->{{Yes|nForce LAN but not Marvell}} | <!--Opinion-->Works well |- | <!--Name-->DFI nF4 Ultra-D LanParty - Diamond Flower International sold to BenQ group 2010 | <!--Chipset-->nF4 | <!--ACPI--> | <!--IDE-->2 ports | <!--SATA-->4 ports SATA 2 | <!--Gfx-->2 PCIe x16 slots | <!--Audio-->AC97 with ALC850 codec | <!--USB--> | <!--Ethernet-->Dual Gigabit Ethernet, PCIe by Vitesse VSC8201 PHY nee Cicada 8201, PCI by Marvel 88E8001 | <!--Opinion-->2006 64bit - Four 184-pin DDR Dual-Channel Slots - 1 pci on Ultra, 2 pci on sli, |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus A8V E SE | <!--Chipset-->VIA K8T890 +VT8237R CHIPSET ATX AMD Motherboard with Athlon 64 X2 / Athlon 64 FX / Athlon 64 | <!--ACPI-->{{N/A}} | <!--IDE-->{{Yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{N/A}} | <!--Audio-->{{Maybe}} AC97 driver using Realtek ALC850 codec | <!--USB-->{{Yes}} USB 2.0 only | <!--Ethernet-->{{No}} Marvell 88E8053 | <!--Opinion-->Good base but needs additional PCI cards added for better support |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->ASUS A8V Deluxe (2004) | <!--Chipset-->VIA K8T800 Pro (DDR400) | <!--ACPI--> | <!--IDE-->Promise 20378 2 ports | <!--SATA-->2 SATA2 | <!--Gfx--> | <!--Audio-->{{no|VIA VT8233A 8235 8237 AC97}} | <!--USB--> | <!--Ethernet-->{{no|Marvell 88E8001 Gigabit}} | <!--Opinion-->needs extra PCI cards |- |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Test Distro--> | <!--Comments--> |- | <!--Name-->AsRock 939Dual-SATA2 | <!--Chipset-->Ali Uli M1695 PCIe with M1567 AGP | <!--ACPI--> | <!--IDE-->2 ports | <!--SATA-->1 Sata with JMicron JMB360 chip | <!--Gfx-->1 pci-e and 1 agp | <!--Audio-->AC97 with ALC850 codec | <!--USB--> | <!--Ethernet-->Realtek RTL8201CL PHY ULi 10/100 | <!--Opinion-->64bit pci-e and agp combo on board - 4 ddr slots - |} =====Socket AM2 (2006/8) and AM2+ (2007-2010) ===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-M61PME-S2 (rev. 2.x) | <!--Chipset-->NVIDIA® GeForce 6100 / nForce 430 chipset | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{maybe|VESA 2d for vga}} | <!--Audio-->{{yes|HDAudio Realtek ALC662 Audio Codec}} | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus M2N61-AR mini itx | <!--Chipset-->NVIDIA nForce 430 | <!--ACPI--> | <!--IDE-->1 | <!--SATA-->2 | <!--Gfx-->GeForce 6150SE via vga or 1 pci-e slot | <!--Audio-->HD Audio with codec | <!--USB-->Nvidia | <!--Ethernet-->Nvidia | <!--Opinion-->2006 32bit - 1 pci - 2 ddr2 dimm slots non-eec - |- | <!--Name-->asus m2n68-am se2 | <!--Chipset-->nvidia 630a 630/a MCP68SE | <!--ACPI--> | <!--IDE-->1 ports | <!--SATA-->2 ports MCP61 chipset is SATA over IDE, not SATA over AHCI and reports subsystem as 0x1 IDE, not 0x6 SATA | <!--Gfx-->{{Yes|nvidia 7025 2d and 3d thru vga}} | <!--Audio-->{{Yes|hd audio with realtek alc662 codec}} | <!--USB-->{{Yes| }} | <!--Ethernet-->{{Yes|nForce chipset RTL 8201CP}} | <!--Opinion-->2007 64bit Phenom IIX2, Athlon 64 LE X2, Sempron, and Phenom FX processors - ddr2 667Mhz ram max 4Gb - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-MA770-UD3 (rev. 1.0) | <!--Chipset-->AMD 770 with SB700 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes| }} | <!--Gfx-->pci-e | <!--Audio-->{{yes|ALC888 codec }} | <!--USB-->{{yes|USB2}} | <!--Ethernet-->{{yes|rtl8169 8111C later 8111D}} | <!--Opinion-->Good support for AM2+ / AM2 with 4 ddr2 ram - 4 x PCI Express x1, 2 x PCI slots - firewire T.I. TSB43AB23 chip no support - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus M3A32-MVP Deluxe | <!--Chipset-->AMD 790FX RD790 + SB600 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{No|Marvell 88SE6121 SATA II}} | <!--Gfx-->pci-e 1.1 support | <!--Audio-->{{No|HD Audio ADI® AD1988}} | <!--USB--> | <!--Ethernet-->{{No|Marvell 88E8056}} | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASROCK N68-S N68C-S | <!--Chipset-->AMD based nForce 630a | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->{{yes|slimline DVD drive works}} | <!--Gfx-->{{maybe|GF 7025 use vesa}} | <!--Audio-->{{yes|HDAudio for VIA 1708S VT1705}} | <!--USB-->{{Maybe|echi usb 2.0}} | <!--Ethernet-->{{no|RTL8201EL / 8201CL - nforce}} | <!--Opinion-->2008 unbuffered 1066Mhz ddr2 ram - N68C-S may need noacpi added to grub boot line to disable pci temporarily to run as it cannot get to [PCI] Everything OK - |- | <!--Name-->Asus M2N68-AM Plus | <!--Chipset-->Athlon 64, Sempron, Athlon 64 X2, Athlon 64 FX with nvidia 630a | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->no vga, pci-e slot only | <!--Audio-->{{yes|HD Audio with ALC662 codec}} | <!--USB--> | <!--Ethernet-->{{no|RTL8211CL Gigabit LAN}} | <!--Opinion-->adding "noacpi noapic noioapic" to the GRUB options - Dual channel DDR2 1066, 800, 667 MHz - |- | <!--Name-->Gigabyte GA-M68M-S2 (1.0) S2P (2.3) S2L GA-M68SM-S2 (1.x) | <!--Chipset-->nForce 630a chipset | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->NVIDIA® GeForce 7025, vga (s2 and s2p), dvi (s2l) | <!--Audio-->ALC883 (S2), ALC888B (S2P), ALC662 (S2L), | <!--USB--> | <!--Ethernet-->RTL 8201CL (S2), 8211CL (S2P), 8211BL (S2L), | <!--Opinion-->2008 64bit possible with AMD AM2+ CPU on AM2 motherboard, the system bus speed will downgrade from HT3.0(5200MHz) to HT1.0(2000 MT/s) spec |- | <!--Name-->ASUS M2N68-VM | <!--Chipset-->nForce 630a (MCP68PVNT) | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->Nvidia GeForce ® 7050PV hdmi, dvi and vga | <!--Audio-->HD audio VIA 1708B codec | <!--USB--> | <!--Ethernet-->RTL 8211C | <!--Opinion-->2008 64bit - ddr2 800Mhz |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket AM3 White socket (2010/11)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Gigabyte GA-MA74GM-S2 GA-MA74GM-S2H | <!--Chipset-->740g with sb710 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes|bios IDE}} | <!--Gfx-->Radeon 2100 and pci-e slot | <!--Audio-->ALC888 (r1.x),ALC888b (r2.0), ALC888B (rev4.x) | <!--USB-->USB2 | <!--Ethernet-->rtl8169 Realtek 8111C later 8111D | <!--Opinion-->2010 64bit - 2 x 1.8V DDR2 DIMM sockets max 8 GB - Micro ATX Form Factor 24.4cm x 23.4cm - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->[http://www.vesalia.de/e_aresone2011.htm Aresone 2011] | <!--Chipset-->760g | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes}} | <!--Gfx-->{{Maybe|no Radeon HD3000 driver yet<br>vesa driver works<br>and add PCIe card}} | <!--Audio-->{{Yes|HD Audio}} | <!--USB-->{{Yes|USB2.0}} | <!--Ethernet-->{{yes}} | <!--Opinion-->Good support - 4 DDR3 memory sockets - |- | <!--Name-->Foxconn A76ML-K 3.0 | <!--Chipset-->AMD 760g rev3.0 | <!--ACPI--> | <!--IDE-->{{Yes|1 }} | <!--SATA-->{{Yes|4 in IDE mode }} | <!--Gfx-->HD3000 with pci-e slot | <!--Audio-->HDAudio with ALC662-GR codec | <!--USB-->USB2 | <!--Ethernet-->rtl8169 rtl8111E | <!--Opinion-->2011 64bit - 2 ddr3 slots - 2 pci slots - |- | <!--Name-->GA-MA770T-UD3P (rev. 1.0 to 1.4) | <!--Chipset-->amd 770 with sb710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|4 sata}} | <!--Gfx-->pci-e | <!--Audio-->{{yes|HDAudio with Realtek ALC888 codec}} | <!--USB-->{{yes| }} | <!--Ethernet-->{{yes|rtl8168 rtl8111c/d}} | <!--Opinion-->2011 64 - 4 ddr3 dimm slots - |- | <!--Name-->Gigabyte GA-MA770-UD3 (rev. 2.0 2.1) | <!--Chipset-->AMD 770 with SB700 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes| }} | <!--Gfx-->pci-e | <!--Audio-->{{yes|ALC888 codec }} | <!--USB-->{{yes|USB2}} | <!--Ethernet-->{{yes|rtl8169 8111C later 8111D}} | <!--Opinion-->Good support for AM3 with 4 ddr2 ram - 4 x PCI Express x1, 2 x PCI slots - firewire T.I. TSB43AB23 chip no support - |- | <!--Name-->Asus M4A785TD-M PRO | <!--Chipset-->785G and SB710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{Maybe|ide legacy}} | <!--Gfx-->{{Maybe|ATI Radeon HD 4200 - use vesa}} or pci-e 2.0 slot | <!--Audio-->{{Yes|HD Audio}} | <!--USB-->{{Yes| }} | <!--Ethernet-->{{Yes| }} | <!--Opinion-->Good support with 1366 ddr3 ram - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->ASUS M4A88T-I Deluxe ITX | <!--Chipset-->AMD 880G with AMD SB710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->Three SATA 3Gbps | <!--Gfx-->Radeon HD 4350 GPU with HDMI and DVI or One 16x PCI-Express 2.0 | <!--Audio-->HDAudio with Realtek ALC889 | <!--USB-->6 x USB 2, 2 x USB 3 | <!--Ethernet-->{{No|Realtek RTL8112L}} | <!--Opinion-->2014 64bit - 2 SODIMM DDR3 slots max 8GB |- | <!--Name-->Asus M4A88T-M Version E5907 E5826 | <!--Chipset-->AMD 880G SB710 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->Radeon 4250 | <!--Audio-->HD Audio with VIA VT 1708S codec | <!--USB--> | <!--Ethernet-->Realtek rtl8169 8111E | <!--Opinion-->2010 64bit - |- | <!--Name-->GigaByte 890GPA-UD3H | <!--Chipset-->AMD 890GX together with SB850 | <!--ACPI--> | <!--IDE--> | <!--SATA-->Yes | <!--Gfx-->use pci-e nvidia | <!--Audio-->Maybe - ALC892 rev. 1.0, ALC892 rev 2.1, ALC889 rev. 3.1 | <!--USB-->Yes | <!--Ethernet-->Yes | <!--Opinion-->works well overall |- | <!--Name-->Gigabyte GA-890FXA-UD7 | <!--Chipset-->AMD 890FX with SB850 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes|IDE }} | <!--Gfx--> | <!--Audio-->ALC889 (rev 2.x) | <!--USB-->{{Yes|AMD USB2 but limited with NEC D720200F1 USB3}} | <!--Ethernet-->2 x Realtek 8111D | <!--Opinion-->2012 64bit - XL-ATX Form Factor 32.5cm x 24.4cm - 4 ddr3 slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI 890GXM-G65 | <!--Chipset-->890GX + SB750 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{Maybe|legacy}} | <!--Gfx-->{{Maybe|ATI 4290 built-in (vesa)}} | <!--Audio-->{{Maybe|ALC889 DD GR}} HD Audio crackles | <!--USB-->{{Yes}} | <!--Ethernet-->{{Yes|RTL 8169}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->ASRock N68-VS3 FX | <!--Chipset-->NVIDIA® GeForce 7025 / nForce 630a | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 Sata2 | <!--Gfx-->Integrated NVIDIA® GeForce 7025 | <!--Audio-->HD Audio with VIA® VT1705 Codec | <!--USB-->USB2 | <!--Ethernet-->Realtek PHY RTL8201EL | <!--Opinion-->2010 64bit - 2 x DDR3 DIMM slots - |- | <!--Name-->MSI GF615M-P35 MS-7597 | <!--Chipset-->NVIDIA® nForce 430 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->GeForce 6150SE | <!--Audio-->{{Maybe|HD Audio with Realtek® ALC888S}} | <!--USB-->{{No|freezes}} | <!--Ethernet-->{{No|Realtek 8211CL}} | <!--Opinion-->2010 64bit |- | <!--Name-->Gigabyte GA-M68MT-S2 | <!--Chipset--> nForce 630a | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->NVIDIA® GeForce 7025 vga | <!--Audio-->ALC888B (1.3), ACL887 (3.1), | <!--USB--> | <!--Ethernet-->RTL8211CL (all) | <!--Opinion-->2010 64bit possible, AMD AM3 CPU on this motherboard, the system bus speed will downgrade from HT3.0 (5200MT/s) to HT1.0 (2000 MT/s) spec |- | <!--Name-->Gigabyte GA-M68MT-S2P | <!--Chipset--> nForce 630a | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->NVIDIA® GeForce 7025 vga | <!--Audio-->ALC888B (1.x 2.x), ALC889 (3.0), ALC888B/889 (3.1), | <!--USB--> | <!--Ethernet-->RTL8211CL (all) | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus M4N78 PRO | <!--Chipset-->NVIDIA GeForce 8300 | <!--ACPI--> | <!--IDE-->1 xUltraDMA 133/100 | <!--SATA-->6 xSATA 3 Gbit/s ports | <!--Gfx-->Integrated NVIDIA® GeForce® 8 series GPU with 1 PCIe 2.0 slot | <!--Audio-->HD Audio with VIA1708S 8 -Channel codec | <!--USB-->12 USB 2.0 ports (8 ports at mid-board, 4 ports at back panel) | <!--Ethernet-->NVIDIA Gigabit | <!--Opinion-->4 x DIMM, Max. 16 GB, DDR2 1200(O.C.)/1066*/800/667 ECC,Non-ECC,Un-buffered Memory - ATX Form Factor 12 inch x 9.6 inch ( 30.5 cm x 24.4 cm ) - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} =====Socket AM3+ Black socket (2012/15)===== *095W FX-6300 FD6300WMHKBOX (bulldozer SSE4.1 AVX) 970 mobos with FX-8320E 8core Black Editions FD832EWMHKBOX FX-8370E (Vishera/Piledriver) *125W FX-6310 (bulldozer) 970 mobos with FX-8320 FX-8350 FX-8370 (Vishera/Piledriver) *220W 990FX mobos with FX-9000 FX-9370 FX-9590 {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->ASUS M5A78L-M LX3 | <!--Chipset-->AMD 760G with SB710 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{Yes|bios IDE mode}} | <!--Gfx-->HD3000 with pci-e slot | <!--Audio-->HDAudio with ALC887, V? ALC892 codecs | <!--USB-->USB2 | <!--Ethernet-->{{No|Qualcomm Atheros 8161/8171 add realtek 8111? pci-e card}} | <!--Opinion-->2012 64bit - uATX Form Factor 9.6 inch x 7.4 inch ( 24.4 cm x 18.8 cm ) - 2 x DIMM, Max. 16GB, DDR3 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-78LMT-S2P | <!--Chipset-->AMD 760G and SB710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|6 SATA2 ports}} | <!--Gfx-->GT240 and a nv7900gs, both pci-e | <!--Audio-->{{Maybe|ALC889 (r3.1), ALC??? (rev. 4.0), ALC887 (r5.x)}} | <!--USB-->4 USB2 | <!--Ethernet-->{{Maybe|Realtek 8111E (r3.1), Atheros (rev4.0), Atheros (r5.x) }} | <!--Opinion-->2012 offers very poor control over its EFI vs. BIOS booting partition features |- | <!--Name-->Gigabyte GA-78LMT-USB3 (r3.0), (r4.1 Blue board), (r5.0 dark board), (rev6 dark mobo) | <!--Chipset-->AMD 760G and SB710 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes|Bios IDE mode for SATA2 on early ones}} | <!--Gfx-->AMD HD3000, pci-e GT240 and a nv7900gs | <!--Audio-->{{Maybe|ALC??? (r3.0), ALC887 (r4.1), VIA VT2021 (r5.0), Realtek® ALC892 codec (rev6) }} | <!--USB-->{{yes|AMD USB2 but not VIA® VL805 USB3}} | <!--Ethernet-->Realtek GbE | <!--Opinion-->2013 64bit - Micro ATX Form Factor 24.4cm x 24.4cm - 4 x DDR3 DIMM sockets - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI 760GM | <!--Chipset-->ATI 760G plus SB710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{yes| }} | <!--Gfx-->HD3000 Use Vesa | <!--Audio-->{{Maybe|P33 VT1705; P34, P21 and P23 (FX) MS7641 v3.0 ALC887, E51 ALC892}} | <!--USB-->{{yes| }} | <!--Ethernet-->{{Yes|Realtek}} | <!--Opinion-->P23 issues with audio ALC887 crackles thru earphones - |- | <!--Name-->Gigayte GA-MA770T-UD3P (rev. 3.1) | <!--Chipset-->amd 770 with sb710 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata | <!--Gfx-->pci-e slot | <!--Audio-->HDaudio with Realtek ALC888/892 codec | <!--USB--> | <!--Ethernet-->rtl8169 rtl8111d/e | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASRock 890FX Deluxe5 Extreme3 | <!--Chipset-->AMD 890FX + AMD SB850 or SB950 (Extreme3) | <!--ACPI--> | <!--IDE-->{{Yes}} | <!--SATA-->{{Yes}} | <!--Gfx-->{{N/A}} | <!--Audio-->{{Maybe|ALC892}} | <!--USB-->{{Yes}} | <!--Ethernet-->{{Yes|RTL8111E rtl8169}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus M5A97 R2.0 EVO | <!--Chipset-->AMD 970 and SB950 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->Asmedia SATA Controller | <!--Gfx-->n/a | <!--Audio-->HDAudio with Realtek ALC887 (LE), ALC887 (Regular), ALC892 (EVO) codec | <!--USB-->4 USB 2.0 and 2 Asmedia USB3.0 Controller | <!--Ethernet-->Realtek 8111F | <!--Opinion--> |- | <!--Name-->Gigabyte GA-970A-D3 | <!--Chipset-->AMD 970 with SB950 | <!--ACPI--> | <!--IDE-->{{Yes| }} | <!--SATA-->{{Yes|IDE mode}} | <!--Gfx-->pci-e | <!--Audio--> ALC??? (rev. 1.0/1.1), ALC887 (rev1.2), VIA VT2021 codec (rev 1.3 1.4 and rev3.0) | <!--USB-->{{yes|AMD USB2 but not Etron EJ168 chip (USB3)}} | <!--Ethernet-->Realtek GbE 8111E (all revisions), | <!--Opinion-->2015 64bit - ATX Form Factor 30.5cm x 22.4cm - 4 x 1.5V DDR3 DIMM sockets - |- | <!--Name-->MSI 970 Gaming | <!--Chipset-->970FX SB950 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->Realtek® ALC1150 Codec | <!--USB-->6 usb2 with 2 USB3 VIA VL806 Chipset | <!--Ethernet-->Killer E2205 Gigabit LAN | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus M5A99X EVO | <!--Chipset-->990X - RD980 with SB920 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->2 pci-e gen ? | <!--Audio-->HDAudio with ALC892 codec | <!--USB--> | <!--Ethernet-->rtl8169 realtek 8111e | <!--Opinion-->2012 64bit - |- | <!--Name-->Gigabyte GA-990XA-UD3 | <!--Chipset-->AMD 990 with SB950 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes| }} | <!--Gfx--> | <!--Audio-->ALC889 (rev 1.x, 3.0, 3.1), | <!--USB-->{{yes|AMD USB2 not 2 x Etron EJ168 chips for USB3}} | <!--Ethernet-->realtek rtl8169 8111e | <!--Opinion-->2012 64bit - ATX Form Factor; 30.5cm x 24.4cm - 4 ddr3 slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====AMD Fusion (2011/14)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | 1.2GHz single Bobcat Fusion C30 + Hudson M1 | ACPI | IDE | SATA | AMD 6250 | Audio | USB | Ethernet | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | Asus E35M1-M PRO uATX | 1.6GHz 18W AMD Fusion E-350 dual core + Hudson M1 | ACPI | {{N/A}} | SATA | AMD 6310 - no HD driver yet | ALC887 VD2 | USB | RTL8111E | 2011 64bit does not support AVX or SSE 4.1 - EFI bios - pci slot - |- | Asus E35M1-I Deluxe miniITX | 1.6GHz dual AMD Fusion E350 + Hudson M1 + DDR3 | ACPI | {{N/A}} | SATA | AMD 6310 - no HD driver yet | ALC892 | USB | Realtek 8111E | 2011 64bit does not support AVX or SSE 4.1 - no support for Atheros AR5008 on a Mini PCI-E - 1 pci slot - |- | ASRock E350M1 / USB3 (also version with USB3.0 added) | 1.6GHz dual AMD Fusion E350 + Hudson M1 | ACPI | {{N/A}} | SATA - 4 SATA3 | {{Maybe|AMD 6310 - use vesa with hdmi and dvi}} | {{Yes|Audio ALC892 playback but no HDMI output}} | USB - 4 USB2.0 and 2 USB3.0 | {{Yes|rtl8169 for Realtek rtl8111E}} | 2011 64bit does not support AVX or SSE 4.1 - 1 pci-e 2.0 x4 slot - f2 or del bios, f11 boot select - |- | <!--Name-->Gigabyte GA-E350N-USB3 mini-ITX | <!--Chipset--> Hudson M1 FCH | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 SATA3 | <!--Gfx--> plus HDMI, DVI | <!--Audio-->ALC892 | <!--USB-->2 NEC USB3.0 with 4 USB2.0 | <!--Ethernet-->rtl8169 for Realtek rtl8111E | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - 1 pci slot - |- | <!--Name-->Gigabyte GA-E350N Win8 V1.0 | <!--Chipset-->Hudson M1 FCH A45 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 SATA3 | <!--Gfx-->{{maybe|Use VESA - AMD 6310 plus HDMI, DVI}} | <!--Audio-->{{yes|ALC887 playback through headphones but not thru hdmi}} | <!--USB-->{{maybe|4 USB2.0 needs more testing}} | <!--Ethernet-->{{yes|rtl8169 for Realtek 8111e}} | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - works well but need to test with sata hard disk |- | <!--Name-->MSI E350IA-E45 | <!--Chipset-->e-350 + Hudson M1 + DDR3 | <!--ACPI-->no support | <!--IDE-->{{N/A}} | <!--SATA-->4 Sata3 ports | <!--Gfx-->AMD 6310 gpu | <!--Audio-->ALC HDA | <!--USB-->6 USB2.0 and 2 USB3.0 through NEC 720200 chipset | <!--Ethernet-->Realtek RTL8111E | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASUS E45M1-M PRO | <!--Chipset-->E450 APU with Hudson M1 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->ALC887 | <!--USB--> | <!--Ethernet-->Realtek | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name-->ASUS E45M1-I Deluxe | <!--Chipset-->E-450 together | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->ALC892 | <!--USB--> | <!--Ethernet-->Realtek 8111E | <!--Opinion-->2011 64bit does not support AVX or SSE 4.1 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket FM1 (2011/13)===== On board Graphic on CPU - HD6410D, HD6530D, HD6550D, {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->ASUS F1A55-M LE | <!--Chipset--> with AMD A55 FCH (Hudson D2) | <!--ACPI--> | <!--IDE--> | <!--SATA-->6 x SATA 3Gbit/s port(s), blue Support Raid 0, 1, 10, JBOD | <!--Gfx-->PCI-e 2.0 slot or Integrated AMD Radeon™ HD 6000 in Llano APU | <!--Audio-->Realtek® ALC887 Audio CODEC | <!--USB-->6 USB2.0 ports | <!--Ethernet-->Realtek 8111E rtl8169 | <!--Opinion-->2012 2011 64bit does not support AVX or SSE 4.1 - A-Series/E2- Series APUs up to 4 cores - 2 x DIMM, Max. 32GB, DDR3 2250(O.C.)/1866/1600/1333/1066 MHz Non-ECC, Un-buffered Memory Dual Channel Memory Architecture - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket FM2 White Socket (2012/13)===== Onboard Gfx on CPU - HD6570, HD7480D, HD7540D, {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset-->A75 A85X | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2012 64bit does not support AVX or SSE 4.1 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket FM2 Plus Black socket (2013/15)===== Onboard Gfx on CPU - HD6570, HD7480D, HD7540D, {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset-->A88X | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket AM1 FS1b socket (2014/1x)===== 5350 4 core Jaguar cores 2GHz with Integrated AMD Radeon R Series Graphics in the APU Kabini [Radeon HD 8400] Later Beema APU with 2/4 core Puma (slightly updated Jaguar) cores, GCN graphics and a compute capable Radeon core, along with a brand new AMD security processor and FT3 BGA packaging (probably best avoided for long term survival). {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->ASUS AM1I-A | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HD Audio Realtek® ALC887-VD | <!--USB--> | <!--Ethernet-->Realtek 8111GR 8168 | <!--Opinion-->2011 64bit may support AVX or SSE 4.1 - |- | <!--Name-->MSI AM1I | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->HD Audio ALC887 | <!--USB--> | <!--Ethernet-->Realtek 8111G | <!--Opinion--> |- | <!--Name-->MSI AM1M | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->HD Audio ALC887 | <!--USB--> | <!--Ethernet-->Realtek 8111G | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->BGA FT3 AM1x |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket AM4 FM3 Summit Ridge Zen Zen+ (2016/22)===== Jim Keller’s group designed x86 Zen CPU - new and covering the same AM4 platform/socket for desktop Zen will also shift from Bulldozer’s Clustered Multithreading (CMT) to Simultaneous Multithreading (SMT, aka Intel’s Hyperthreading). CMT is the basis for Bulldozer’s unusual combination of multiple integer cores sharing a single FPU within a module, so the move to SMT is a more “traditional” design for improving resource usage Trusted Platform Module, or fTPM, that Windows 11 requires. Ryzen processors using a firmware TPM are causing stutters, even when doing mundane tasks. To enable TPM 2.0 on your AMD system please follow the steps below. <pre> Power on system and press DEL or F2 to get into the BIOS. Navigate to Advanced\CPU Configuration. Enable AMD fTPM switch. Press F10 to save changes. </pre> {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Asus ROG Crosshair VI Hero | <!--Chipset-->X370 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e 3.0 (1x16 or 2x8) | <!--Audio-->SupremeFX audio features an S1220 codec | <!--USB--> | <!--Ethernet-->Intel I211 | <!--Opinion-->Ryzen 7 1800X 1700X |- | <!--Name-->Biostar X370gtn Itx Am4 | <!--Chipset-->AMD X370 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio-->HDAudio with ALC892 | <!--USB--> | <!--Ethernet-->Realtek Dragon LAN RTL8118AS | <!--Opinion--> 2 ddr4 slots |- | <!--Name-->Gigabyte GA-AX370 K7 | <!--Chipset--> X370 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio-->HDAudio with 2 x Realtek® ALC1220 codec 0x10EC, 0x0295 | <!--USB--> | <!--Ethernet-->1 intel and 1 E2500 | <!--Opinion--> 4 ddr4 slots |- | <!--Name-->MSI Xpower Gaming Titanium | <!--Chipset--> X370 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio-->8-channel Realtek 1220 Codec 0x10EC, 0x0295 | <!--USB-->ASMedia® ASM2142 and amd cpu | <!--Ethernet-->1 x Intel® I211AT Gigabit LAN | <!--Opinion--> 2 ddr4 slots |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus Prime B350 Plus ATX | <!--Chipset-->B350 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> x PCIe 3.0/2.0 x16 (x16 mode) | <!--Audio-->Realtek® ALC887 8-Channel | <!--USB--> | <!--Ethernet-->Realtek® RTL8111H | <!--Opinion-->Ryzen 5 1600x 1600 1500X 1400 - 4 x DIMM Max 64GB, DDR4 up to 2666MHz ECC and non-ECC Memory - ATX 12 inch x 9.35 inch ( 30.5 cm x 23.7 cm ) - 2 pci |- | <!--Name-->Asus PRIME B350M-A/CSM Micro ATX | <!--Chipset-->AMD B350 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio-->HDaudio with | <!--USB--> | <!--Ethernet-->Realtek LAN | <!--Opinion-->Ryzen 3 1300x 1200 1100 |- | <!--Name-->AsRock Pro4 AB350 | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->2 PCIe 3.0 x16, 4 PCIe 2.0 x1 | <!--Audio-->Realtek ALC892 | <!--USB--> | <!--Ethernet-->Realtek | <!--Opinion-->2017 64bit - |- | <!--Name-->ASRock AB350 Gaming-ITX/ac | <!--Chipset--> B350 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio--> | <!--USB--> | <!--Ethernet-->Intel LAN | <!--Opinion--> |- | <!--Name-->MSI B350 Tomahawk Arctic Mortar | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->1 x PCIe 3.0 x16 (x16 mode) | <!--Audio-->Realtek ALC892 | <!--USB--> | <!--Ethernet-->Realtek RTL8111H | <!--Opinion-->white and grey colours - 2 pci-e and 2 pci slots - m.2 in middle - atx 12 in by 9.6 in and matx versions - |- | <!--Name-->Jginyue M-ATX B350M-TI | <!--Chipset-->B350 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Jginyue B350I-Plus ITX | <!--Chipset-->B350 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->ASRock A320M-ITX MINI ITX Rev1.0 Rev2 Rev2.1 | <!--Chipset-->A320 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2018 |- | <!--Name-->Asus PRIME A320M-C R2.0 rev1.1 A320M-K | <!--Chipset-->A320 A/B300 SFF | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->PCIe 3.0 | <!--Audio-->HD audio with Realtek ALC887 alc897 CODEC | <!--USB-->2 usb 3.1 gen 1 | <!--Ethernet-->Realtek 8111E | <!--Opinion-->2019 64bit - 3rd/2nd/1st Gen AMD Ryzen™ / 2nd and 1st Gen AMD Ryzen™ with Radeon™ Vega |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI A320M-A PRO MicroATX | <!--Chipset-->AMD A320 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->pci-e 3.0 | <!--Audio-->HDAudio Realtek® ALC892 | <!--USB-->USB3 | <!--Ethernet-->Realtek® 8111H | <!--Opinion-->2019 64bit - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus ROG X399 Zenith Extreme | <!--Chipset-->AMD X399 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio--> supremefx s1220 | <!--USB--> | <!--Ethernet-->intel | <!--Opinion-->Threadripper 1950X 1920X 1900X TR4 skt |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->AsRock Fatality X470 Gaming K4 mATX | <!--Chipset-->X470 | <!--ACPI--> | <!--IDE--> | <!--SATA-->nvme | <!--Gfx-->pci-e rebar possible | <!--Audio--> | <!--USB--> | <!--Ethernet-->intel | <!--Opinion--> |- | <!--Name-->Asrock Fatal1ty X470 Gaming-ITXac AMD AM4 | <!--Chipset-->AMD X470 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet-->intel | <!--Comments--> |- | <!--Name-->ASUS ROG STRIX X470-I GAMING AM4 ITX Motherboard | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus B450-I Gaming | <!--Chipset-->AMD B450 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->high VRM temps - raven ridge 14nm+ like 2200G 2400G |- | <!--Name-->AsRock B450 Gaming K4 | <!--Chipset-->B450 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> alc892 | <!--USB--> | <!--Ethernet--> | <!--Opinion--> 4 ddr4 slots - low VRM thermals 3900x 3950x |- | <!--Name-->Gigabyte B450 I Aorus Pro Wifi | <!--Chipset-->AMD B450 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->1 nvme pcie3 with 4 sata | <!--Gfx-->pcie | <!--Audio-->HDAudio with Realtek® ALC1220-VB codec | <!--USB--> | <!--Ethernet-->Intel LAN | <!--Opinion-->very high vrm temps |- | <!--Name-->Jginyue B450i Gaming ITX | <!--Chipset-->B450 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata3 - none nvme | <!--Gfx-->pcie3 | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet-->1G | <!--Opinion-->2021 64 2nd 3rd AMD - 2 ddr4 dimm slots |- | <!--Name-->MSI b450 tomahawk max | <!--Chipset--> b450 | <!--ACPI--> | <!--IDE-->{{n/A}} | <!--SATA--> | <!--Gfx-->PCIe 3.0 | <!--Audio-->HD audio with Realtek® ALC892 Codec | <!--USB--> | <!--Ethernet-->Realtek 8111H | <!--Opinion--> |- | <!--Name-->MSI B450 Pro Carbon | <!--Chipset-->B450 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> ALC codec | <!--USB--> | <!--Ethernet-->Intel LAN | <!--Opinion--> |- | <!--Name-->MSI B450-A PRO | <!--Chipset-->B450 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->ALC892 | <!--USB--> | <!--Ethernet-->rtl8169 8111h | <!--Opinion--> |- | <!--Name-->MSI B450I GAMING Plus AC ITX | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2019 - 2nd and 3rd gen AMD - 2 ddr4 slots - |- | <!--Name-->MSI B450 GAMING PLUS MAX | <!--Chipset-->B450 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDAudio with Realtek® ALC892/ALC897 Codec | <!--USB-->USB3 | <!--Ethernet-->rtl8169 8111H | <!--Opinion--> |- | <!--Name-->MAXSUN AMD Challenger B450M M-ATX (aka Soyo) | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASRock X570 PHANTOM GAMING-ITX/TB3 Mini ITX AM4 | <!--Chipset-->X570 | <!--ACPI--> | <!--IDE--> | <!--SATA-->nvme | <!--Gfx-->PCIe 4.0 | <!--Audio--> ALC1200 | <!--USB--> | <!--Ethernet-->Intel LAN | <!--Comments--> |- | <!--Name-->Asus ROG Crosshair VIII Dark Hero | <!--Chipset-->AMD X570 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> SupremeFX7.1 codec | <!--USB--> | <!--Ethernet-->Intel® I211-AT and Realtek® RTL8125-CG 2.5G LAN | <!--Opinion--> |- | <!--Name-->Asus ROG Strix X570-I Gaming Mini ITX AM4 Motherboard | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI MPG X570 Gaming Plus | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> alc1220 codec | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus ROG Strix B550-i AM4 ITX Motherboard | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2022 - |- | <!--Name-->Jginyue Jingyue B550i Gaming itx | <!--Chipset-->B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->3 with 1 nvme | <!--Gfx-->1 pci-e 4 | <!--Audio-->HDAudio alc | <!--USB--> | <!--Ethernet-->1G | <!--Comments-->2022 64bit max of Ryzen 5500 (c t), 5600, 5600g (6c12t) - 2 ddr4 |- | <!--Name-->Asrock B550 PHANTOM GAMING ITX/AX | <!--Chipset-->AMD B550 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> pci-e | <!--Audio-->HDAudio with alc1220 codec | <!--USB-->USB3 | <!--Ethernet-->{{no|intel 2.5G}} | <!--Comments--> |- | <!--Name-->AsRock B550M-ITX/ac | <!--Chipset-->B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDAudio with Realtek ALC887 ALC897 Audio Codec | <!--USB--> | <!--Ethernet-->Realtek Gigabit LAN | <!--Opinion-->2022 - 2 ddr4 slots |- | <!--Name-->AsRock ASRock B550M-HDV | <!--Chipset-->B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->nvme and sata3 | <!--Gfx-->pci-e 4.0 | <!--Audio-->HDAudio with Realtek ALC887 or ALC897 Audio Codec unknown | <!--USB-->usb3 | <!--Ethernet-->{{yes|rtl8169 Realtek rtl8111h Gigabit LAN}} | <!--Opinion-->2022 - 2 ddr4 slots - 1 pcie x1 slot - |- | <!--Name-->Asus ROG STRIX B550-A GAMING | <!--Chipset-->B550 | <!--ACPI--> | <!--IDE--> | <!--SATA-->PCIe Gen4 x4 & SATA3 | <!--Gfx-->pci-e 4 | <!--Audio--> supremefx S1220A | <!--USB--> | <!--Ethernet-->{{No|Intel® I225-V 2.5Gb}} | <!--Opinion--> |- | <!--Name-->Gigabyte AMD B550I AORUS PRO AX Mini-ITX rev 1.0 | <!--Chipset-->AMD B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 nvme pci-e3 with 4 sata3 | <!--Gfx-->pci-e | <!--Audio-->Realtek® ALC1220-VB codec | <!--USB--> | <!--Ethernet-->{{no|Realtek® 2.5GbE LAN}} | <!--Opinion-->2021 2 x DDR4 DIMM sockets 1Rx8/2Rx8/1Rx16 - |- | <!--Name-->Gigabyte B550 AORUS ELITE AX V2 ATX | <!--Chipset-->B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->PCI-e 4.0 DP and hdmi | <!--Audio-->HDAudio ALC1200 | <!--USB-->USB3 USB 3.2 Gen1 Type-C | <!--Ethernet-->{{No|2.5GbE LAN}} | <!--Opinion-->2022 64bit- finer tuning than A520's - AMD Ryzen 5000 Series/ 3rd Gen Ryzen and 3rd Gen Ryzen with Radeon Graphics CPU - Dual Channel ECC/ Non-ECC Unbuffered DDR4, 4 DIMMs - |- | <!--Name-->Gigabyte B550M DS3H mATX | <!--Chipset--> B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 NVMe | <!--Gfx-->PCI-e 4.0 | <!--Audio-->HDaudio ALC887 | <!--USB-->USB3 | <!--Ethernet-->realtek rtl8118 | <!--Opinion-->2021 64bit - 4 ddr4 dimms - |- | <!--Name-->MSI MPG B550 GAMING PLUS ATX | <!--Chipset--> B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->PCI-e 4.0 | <!--Audio-->HDAudio ALC892 | <!--USB-->USB 3 | <!--Ethernet-->rtl8169 Realtek 8111H | <!--Opinion-->2022 64bit - 3rd Gen AMD Ryzen Processors - 4 dimm ddr4 - |- | <!--Name-->MSI MAG B550 TOMAHAWK ATX | <!--Chipset--> B550 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe 1 x M.2, Socket 3, M Key (up to Type 22110) and 1 x M.2, Socket 3, M Key (Type 2242/2260/2280) | <!--Gfx-->PCI-e 4.0 with dp and hdmi | <!--Audio-->HDaudio ALC1200 | <!--USB-->USB3 1 x USB 3.1 Type-C and 1 x USB 3.1 Type-A | <!--Ethernet-->Realtek RTL8125B and Realtek RTL8111H | <!--Opinion-->2022 64bit - 4 Dimm slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Jginyue A520M-H mATX | <!--Chipset-->A520 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> old bios with random issues with APU ryzens - |- | <!--Name-->Gigabyte A520M S2H mATX | <!--Chipset-->AMD A520 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet-->Realtek 1GbE | <!--Opinion-->2022 64bit Zen3 65W and up - 2 ddr4 - |- | <!--Name-->Gigabyte A520I AC mITX mini-itx | <!--Chipset-->AMD A520 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2022 64bit Zen3 65W and up 5600G (6c12t) or 5700G (8c16t) - 2 ddr4 dimm slots - |- | <!--Name-->MSI A520M-A PRO mATX | <!--Chipset-->A520 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe 1 x M.2, Socket 3, M Key (Type 2242/2260/2280) | <!--Gfx-->PCI-e 3.0 | <!--Audio-->HDAudio ALC892 | <!--USB-->USB3 | <!--Ethernet-->rtl8169 rtl8111H | <!--Opinion-->2022 64bit - 2 ddr4 dimm slots - 3rd Gen AMD Ryzen Desktop and AMD Ryzen 4000 G-Series CPU |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} ===== (Socket AM5 LGA1718 Zen4 Zen5 Zen6 2022/27)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Asrock Steel Legend | <!--Chipset-->x670e | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->PCI-e rnda2 | <!--Audio-->HD audio | <!--USB-->USB3 | <!--Ethernet--> | <!--Opinion-->2022 64bit - ddr5 ecc (10 chip) and non-ecc (8 chips) 64Gb @ 6000Mhz or 128GB @ 4800Mhz - |- | <!--Name-->Asrock TaiChi | <!--Chipset-->x670e | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->PCI-e rnda2 | <!--Audio-->HD Audio | <!--USB-->USB4 with Thunderbolt 4 equivalent | <!--Ethernet-->{{No|Realtek killer E3000 2.5GbE}} | <!--Opinion-->2022 64bit - ddr5 ecc (10 chip) and non-ecc (8 chips) |- | <!--Name-->Asus ROG Crosshair Hero | <!--Chipset-->x670e | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe rnda2 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2022 64bit |- | <!--Name--> | <!--Chipset-->x670e | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->rnda3 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2022 64bit 7950x3d 120W, 7900 7800 7600 90W |- | <!--Name--> | <!--Chipset-->x670e | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->rnda3 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2022 64bit |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus B650E-I | <!--Chipset-->B650 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->pci-e 5 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2023 - better sound with an actual AMP, PCIe 5, USB-C display outs - |- | <!--Name--> | <!--Chipset-->x650 B650 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->x650 B650 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->x650 B650 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MAXSUN AMD Challenger B650M WIFI M-ATX (aka Soyo) | <!--Chipset-->B650 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI b650i mini itx | <!--Chipset-->B650 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->NVMe | <!--Gfx-->pci-e 4 | <!--Audio--> | <!--USB--> | <!--Ethernet-->Realtek | <!--Opinion-->2023 - front panel connectors at the back of the board - dead rear nvme slot and a drained CMOS battery as the CMOS button being pressed during shipping - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset-->A620M Zen4 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->A620M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->A620M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->A620M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> Zen5 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> Zen6 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> || <!--Chipset--> || <!--ACPI--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Opinion-->2026 FP8 Zen 6 Medusa Point 4bigC, 4 econC, 2lpC, 8coreGPU - |- | <!--Name--> || <!--Chipset--> || <!--ACPI--> || <!--IDE--> || <!--SATA--> || <!--Gfx--> || <!--Audio--> || <!--USB--> || <!--Ethernet--> || <!--Opinion-->2026 FP10 Zen 6 Medusa Point 4bigC, 4 econC, 2lpC, 8coreGPU - |- |} ===== (Zen7 AM6 2027/3x)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} ===== (Zen AM 203x/3x)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} ====Intel Sockets==== [[#top|...to the top]] =====Socket 370 (2000/2)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Intel D815EEA | <!--Chipset-->866Mhz P3 and i815 chipset | <!--ACPI--> | <!--IDE-->{{Yes}} | <!--SATA-->{{N/A}} | <!--Gfx-->{{Yes|Nvidia AGPx8 6200LE added}} | <!--Audio-->{{N/A}} | <!--USB-->{{Yes|2 USB1.1}} | <!--Ethernet-->{{N/A}} | <!--Opinion-->Tested AspireOS 1.7, simple basic board with useful 5 PCI slots |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} =====Socket 478 (2002/4)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->[http://translate.google.co.uk/translate?hl=en&sl=zh-CN&u=http://detail.zol.com.cn/motherboard/index46381.shtml&prev=/search%3Fq%3Dc.865pe.l%2Bmotherboard%26client%3Dfirefox-a%26hs%3DsZB%26rls%3Dorg.mozilla:en-US:official Colorful Technology C.865PE-L Silver Fighter Warrior V2.3] | <!--Chipset-->865PE | <!--ACPI-->{{dunno| }} | <!--IDE-->{{Yes|tested with CDROM}} | <!--SATA-->{{dunno| }} | <!--Gfx-->{{Maybe|AGP slot}} | <!--Audio-->{{Yes|ALC650 AC97}} | <!--USB-->{{Yes|USB 1.1 and 2.0}} | <!--Ethernet-->{{Yes|RTL 8100 8139}} | <!--Opinion-->Still testing with NB (Nightly Build) May 2013 |- | <!--Name-->Intel 845 | <!--Chipset-->865P | <!--ACPI--> | <!--IDE-->{{Yes}} | <!--SATA--> | <!--Gfx-->{{No|intel 800}} | <!--Audio-->{{No|AC97 AD1985}} | <!--USB-->{{Yes|USB1.1 and USB2.0}} | <!--Ethernet-->{{No|e1000}} | <!--Opinion-->Tested ICAROS 1.3 |- | <!--Name-->Intel 845 | <!--Chipset-->865GC | <!--ACPI--> | <!--IDE-->{{Yes}} | <!--SATA--> | <!--Gfx-->{{No|intel 865 Extreme Graphics 2}} | <!--Audio-->{{No|AC97 AD1985}} | <!--USB-->{{Yes|USB1.1 and USB2.0}} | <!--Ethernet-->{{No|e1000}} | <!--Opinion-->Tested ICAROS 1.3 |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA775 s775 (2005/8)===== an industry standard DDR2 module could in theory contain fallback JEDEC, intel XMP and AMD EPP configuration data Intel PC CL5 ram modules but an "AMD" CL5 ram module the BIOS cannot read the AMD EPP info on the SPD (Serial Presence Detect) but can recognize the CL5 timing info in the JEDEC data table. PC BIOS auto configures for the AMD ram module and boots normally. an AMD PC CL6 ram modules but an "INTEL" CL6 ram module the BIOS cannot read the INTEL XMP info on the SPD but can recognize the CL6 timing info in JEDEC data table. PC BIOS auto configures for the AMD ram module and boots normally. an INTEL PC needs CL6 ram modules but have an "AMD" CL4 ram module. INTEL BIOS cannot read the AMD EPP info on the SPD but can recognize the CL4 timing info in JEDEC data table. PC BIOS recognizes module timings as incompatible an refuses to boot. entirely separate issue if the RAM module timing specs are incompatible.(i.e. CL4 RAM in a "CL6 only" PC) {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Abit AG8 | <!--Chipset-->P915 + ICH6R | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 ports SATA1 | <!--Gfx-->1 PCIe x16 Slot | <!--Audio-->Realtek ALC658 AC97 | <!--USB-->4 USB2.0 | <!--Ethernet-->Realtek 8110S-32 | <!--Opinion-->2004 32bit - Firewire TI 4200R7T no |- | <!--Name-->MSI 915 Neo2 | <!--Chipset-->P915 + ICH6R | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 ports SATA1 | <!--Gfx-->1 PCIe x16 Slot | <!--Audio-->CMI 9880L HD Audio | <!--USB-->4 USB2.0 | <!--Ethernet-->{{no|Broadcomm BCM5751 PCIe}} | <!--Opinion-->Firewire VIA VT6306 no |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus P5GC P5GC-MX | <!--Chipset-->P945GC Lakeport-GC + ICH7R northbridge | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 SATA1 3.0 Gbit/s ports | <!--Gfx-->1 PCIe 1.1 slot | <!--Audio-->HD Audio with ALC662 codec | <!--USB-->{{yes|2 usb2.0}} | <!--Ethernet-->{{no|atheros L2}} | <!--Opinion-->2005 32bit - 3 pci slots - 4 x 240-pin DIMM Sockets max. 4GB DDR2 667/533 non-ECC - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Foxconn PC45CM-SA 45CM-S | <!--Chipset-->945GC with ICH7 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 sata2 ports | <!--Gfx-->{{Yes|pcie 1.0 slot with gma950 integrated}} | <!--Audio-->{{Yes|HD audio with aLC883 codec playback}} | <!--USB-->{{Yes|}} | <!--Ethernet-->{{Yes|realtek 8139 8100sc}} | <!--Opinion-->2 dimm slots 667mhz max 4gb - can be found in Advent desktops - 2 pci-e and 2 pci - core 2 duo only e6xxx - Micro ATX (9.6” x 8.8”) - |- | <!--Name-->Gigabyte GA-81945GM MFY-RH | <!--Chipset-->Intel® 945GM Express with ICH7M-DH | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->{{Yes|GMA950 VGA15 and PCI-e 1.0 slot}} | <!--Audio-->{{Yes|HD Audio with ALC880 codec playback only rear port}} | <!--USB-->{{Yes|4 usb 2.0}} | <!--Ethernet-->{{No|Intel PRO1000PL 82573L Gigabit Ethernet}} | <!--Opinion-->2006 MoDT term “Mobile on DeskTop.”, low TDP CPUs to work on desktop form-factor motherboards. mATX Micro ATX 24.4cm x 24.4cm - 2 DDR2 dimm 1.8v slots with 4Gb max - will not boot if PCI2 slot occupied - |- | <!--Name-->Gigabyte GA-945 GCM S2C | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{yes|ALC662 (1.x)}} | <!--USB--> | <!--Ethernet-->{{yes|8101E Rtl 8169 (1.x)}} | <!--Opinion--> |- | <!--Name-->Gigabyte GA945-GCM S2L | <!--Chipset-->945GC with ICH7 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 SATA1 ports | <!--Gfx-->PCi-E slot | <!--Audio-->{{Maybe|Intel HD Audio with ALC662 codec 2/4/5.1-channel (1.x)}} | <!--USB-->{{Yes|4 USB2.0}} | <!--Ethernet-->{{Yes|Realtek 8111c 8169 (1.x)}} | <!--Opinion-->2 x 1.8V DDR2 DIMM 4GB DDR2 memory max - 2 PCI-e and 2 PCI - Micro ATX form factor; 24.4cm x 19.3cm - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI 945P Neo-F rev 1.0 | <!--Chipset-->P945 + ICH7 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 SATA1 ports | <!--Gfx-->PCie 1.0 slot | <!--Audio-->ALC662 HDA | <!--USB-->4 USB2.0 | <!--Ethernet-->8110SC (rtl8169) | <!--Opinion--> |- | <!--Name-->MSI 945P Neo2-F rev 1.2 | <!--Chipset-->P945 + ICH7 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 SATA1 ports | <!--Gfx-->PCie 1.0 slot | <!--Audio-->ALC850 AC97 | <!--USB-->4 USB2.0 | <!--Ethernet-->8110SC (rtl8169) | <!--Opinion--> |- | <!--Name-->Gigabyte GA-P31-DS3L | <!--Chipset-->P31 with ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCI Express x16 | <!--Audio-->HD Audio with ALC888 codec | <!--USB-->4 USB 2.0 | <!--Ethernet-->Realtek 8111B | <!--Opinion-->DDR2 800Mhz up to 4Gb 4 x 240 pin - 3 PCI - ATX 12.0" x 8.3" - |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus P5KPL-AM /PS | <!--Chipset-->G31 with ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA-->4 xSATA 3 Gbit/s ports | <!--Gfx-->PCIe 1.1 with integrated Intel® GMA 3100 | <!--Audio-->HD Audio with VIA VT1708B with ALC662 codec | <!--USB--> | <!--Ethernet-->Realtek RTL8102EL 100/10 LAN with Realtek RTL8111C Gigabit LAN | <!--Opinion-->2 x 2 GB DDR2 Non-ECC,Un-buffered DIMMs with 2 PCI - Intel Graphics Media Accelerator - |- | <!--Name-->Asus P5KPL/EPU | <!--Chipset-->G31 with ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->Pci-e 1.0 slot | <!--Audio-->{{Yes|HD audio with ALC887 codec}} | <!--USB--> | <!--Ethernet-->{{Yes|RTL8169 Realtek 8111C}} | <!--Opinion-->Tested - 4 240-pin DIMM, Max. 4 GB - 4 pci-e and 3 pci - ATX Form Factor 12 inch x 8.2 inch ( 30.5 cm x 20.8 cm ) - |- | <!--Name-->Gigabyte GA-G31M ES2L | <!--Chipset-->G31 plus ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{Yes|Intel GMA 3100 2d}} | <!--Audio-->{{Maybe|ALC883 (1.x), ALC883/888B (2.x)}} | <!--USB--> | <!--Ethernet-->{{Maybe|RTL8111C (1.x), Atheros 8131 (2.x)}} | <!--Opinion-->reduces DRAM capacity to 4GB |- | <!--Name-->ASRock G31M-S r1.0 G31M-GS | <!--Chipset-->G31 + ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{maybe|4 sata2}} | <!--Gfx-->{{maybe|GMA 3100 2d not 3d}} | <!--Audio-->{{yes|ALC662}} | <!--USB-->{{yes|4 USB2.0}} | <!--Ethernet-->{{partial|rtl8169 RTL8111DL 8169 (for -GS) RTL8102EL (for -S)}} | <!--Opinion-->2007 64bit Core2 - 2 DDR2 800 max 8Gig AMI bios MicroATX - |- | <!--Name-->ASRock G31M-S r2.0 | <!--Chipset-->G31 + ICH7 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{maybe|4 sata2}} | <!--Gfx-->{{maybe|GMA 3100 2d not 3d}} | <!--Audio-->{{yes|ALC662}} | <!--USB-->{{yes|4 USB2.0}} | <!--Ethernet-->{{yes|RTL 8111DL 8169}} | <!--Opinion-->2008 64bit core2 - 2 DDR2 800 max 8Gig MicroATX |- | <!--Name-->[http://www.intel.com/cd/channel/reseller/apac/eng/products/desktop/bdb/dg31pr/feature/index.htm Intel DG31PR] | <!--Chipset-->iG31 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->{{maybe|3100 but can use PCIe 1.1 slot}} | <!--Audio-->{{yes|ALC888 playback}} | <!--USB--> | <!--Ethernet-->{{yes|RTL8111B Rtl 8169}} | <!--Opinion-->good support |- | <!--Name--> | <!--Chipset-->Intel G33 Express Chipset with ich9 southbridge | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->Intel 3100 powervr tile based | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2008 64bit - embedded on Core 2 Quad, Core 2 Duo, Pentium Dual-Core CPUS with Integrated GPU Intel GMA 3100 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->ASUS P5G41T-M LX | <!--Chipset-->G41 + ICH8 + DDR3 | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->{{maybe}} | <!--Gfx-->{{yes|X4500 some 2d only)}} | <!--Audio-->ALC887 | <!--USB-->3 USB2.0 | <!--Ethernet-->{{no|Atheros L1c AR8131}} | <!--Opinion-->reduces maximum supported memory ddr3 from 16 to 8GB 2 dimm slots non-EEC - demotes the PCIe controller mode from revision 2.0 (5.0GT/s) to revision 1.1 (2.5GT/s |- | <!--Name-->Gigabyte GA-G41MT S2 | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->VT1708S (1.3), ALC887-VD2 (1.4), ALC887 (2.1), | <!--USB--> | <!--Ethernet-->Atheros AR8151 l1c (1.x 2.x), | <!--Opinion--> |- | <!--Name-->Gigabyte GA-G41MT S2PT | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->ALC887 (1.0), VIA (2.0), ALC887 (2.1) | <!--USB--> | <!--Ethernet-->RTL8111E (1.x), Atheros AR8151 l1c (2.1), | <!--Opinion--> |- | <!--Name-->Gigabyte GA-G41MT D3 | <!--Chipset-->G41 + ICH7 | <!--ACPI--> | <!--IDE-->1 Port | <!--SATA-->4 Ports | <!--Gfx-->{{yes|GMA X4500 2d only and pci-e 1.1 slot}} | <!--Audio-->{{yes|ALC888B}} | <!--USB-->4 ports + headers | <!--Ethernet-->{{yes|RTL8111 D/E}} | <!--Opinion--> |- | <!--Name-->Gigabyte GA-P41T D3P | <!--Chipset-->G41 + ICH7 with Intel Core 2 Duo (E6xxx) CPU | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4ports | <!--Gfx-->GMA X4500 2d | <!--Audio-->ALC888 889/892 | <!--USB-->4 ports | <!--Ethernet-->RTL 8111C or D/E | <!--Opinion--> |- | <!--Name-->Intel DG41AN Classic | <!--Chipset-->iG41 + | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 ports | <!--Gfx-->X4500 2d | <!--Audio-->ALC888S ALC888VC | <!--USB-->4 ports | <!--Ethernet-->8111E | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->AsRock P5B-DE | <!--Chipset-->P965 + ICH8 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{Maybe|works ide legacy}} |<!--Gfx-->{{Yes|with PCI-E 1.1 slot}} | <!--Audio-->{{Yes|HD Audio via VT1708S}} | <!--USB-->{{Yes}} | <!--Ethernet-->{{Yes|RTL8169}} | <!--Opinion-->2006 works well |- | <!--Name-->Asus P5B SE | <!--Chipset-->965 intel | <!--ACPI--> | <!--IDE-->{{Yes| }} | <!--SATA-->{{Yes| }} | <!--Gfx-->{{N/A}} | <!--Audio-->{{Yes|HD Audio ALC662 codec}} | <!--USB-->{{Yes}} | <!--Ethernet-->{{No| }} | <!--Opinion-->works well except ethernet |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus P5W DH Deluxe P5WDG2 WS PRO | <!--Chipset-->975X | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->2 ports | <!--Gfx-->2 PCIe x16 slots | <!--Audio-->ALC882 AND LATER ADI 1988B | <!--USB-->2 USB2.0 | <!--Ethernet-->{{No|Marvell 88E8052 88E8053}} | <!--Opinion-->Firewire TI TSB43AB22A no |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Abit IP35 | <!--Chipset-->P35 Express + ICH9R | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 ports | <!--Gfx--> | <!--Audio-->ALC888 HDA | <!--USB-->4 USB2.0 | <!--Ethernet-->two RTL8110SC | <!--Opinion-->Firewire Texas TSB43 AB22A no |- | <!--Name-->MSI P35 Neo F FL MS-7630 rev 1 | <!--Chipset-->Intel P35 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->pci-e 1.1 support | <!--Audio-->HD Audio ALC888 | <!--USB--> | <!--Ethernet-->Realtek | <!--Opinion-->Base model of this range of P35 mobos |- | <!--Name-->GA-P35-DS3 | <!--Chipset-->P35 and ICH9 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->4 ports | <!--Gfx--> | <!--Audio-->HDAudio with Realtek ALC889A codec | <!--USB--> | <!--Ethernet-->rtl8169 Realtek 8111B | <!--Opinion-->2008 - 4 x 1.8V DDR2 DIMM sockets max 8 GB - |- | <!--Name-->GA-EP35-DS3 (rev. 2.1) | <!--Chipset-->Intel® P35 + ICH9 Chipset | <!--ACPI--> | <!--IDE-->{{unk|}} | <!--SATA-->{{unk|4 }} | <!--Gfx-->pci-e | <!--Audio-->{{unk|Realtek ALC889A codec }} | <!--USB-->{{yes | }} | <!--Ethernet-->{{yes|rtl8169 Realtek 8111B}} | <!--Opinion-->good |- | <!--Name-->Abit IX38 Quad GT | <!--Chipset-->X38 / ICH9R Chipset | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 ports | <!--Gfx-->PCI-E 2.0 slot | <!--Audio--> HD Audio ALC888 | <!--USB-->4 USB2.0 | <!--Ethernet-->Realtek RTL 8110SC 8169SC | <!--Opinion-->Firewire Texas TSB 43AB22A no |- | <!--Name-->Gigabyte X38-DQ6 | <!--Chipset-->X38 / ICH9R Chipset | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 ports | <!--Gfx-->PCI-E 2.0 slot | <!--Audio-->ALC889A HDA | <!--USB-->4 USB2.0 | <!--Ethernet-->twin 8111B 8169 | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Gigabyte GA-EP45 DS3 (2008) | <!--Chipset-->P45 + ICH9 or ICH10 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 x SATA 3Gbit/s (SATAII0, SATAII1, SATAII2, SATAII3, SATAII4, SATAII5) | <!--Gfx-->two PCI-E v2.0 x16 slots support splitting its 16 PCIe 2.0 lanes across two cards at x8 transfers | <!--Audio-->HD Audio with ALC888 or ALC889A codec | <!--USB-->6 USB2.0 | <!--Ethernet-->2 x Realtek 8111C chips (10/100 /1000 Mbit) | <!--Opinion-->4 x 1.8V DDR2 DIMM sockets non-EEC |- | <!--Name-->MSI P45 Platinum (2008) | <!--Chipset-->P45 + ICH9 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 sata2 ports | <!--Gfx-->two PCI-E x16 v2.0 slots | <!--Audio-->ALC888 HD Audio | <!--USB-->6 USB2.0 | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->G45 + | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->adds Intel’s GMA X4500HD graphics engine to P45 Express features | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->G43 + | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->GMA X4500 2d | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->removes HD video acceleration from the G45’s features |- | <!--Name-->Asus P5E Deluxe | <!--Chipset--> X48 with ICH9 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->HD Audio with ADI 1988B codec | <!--USB--> | <!--Ethernet-->Marvell 88E8001 | <!--Opinion--> |- | <!--Name-->GigaByte GA-X48 DQ6 | <!--Chipset-->X48 plus ICH9R | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->8 ports | <!--Gfx-->two PCI-E x16 v2.0 slots | <!--Audio-->ALC889A | <!--USB-->8 USB2.0 | <!--Ethernet-->RTL 8111B 8169 | <!--Opinion-->Firewire TSB43AB23 no - ICH9 pairs with Intel’s 3-series (X38, P35, etc.) chipsets, in addition to the X48 Express, but excluding the G35 Express |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Gigabyte EP43-DS3L and Gigabyte GA-EP43-UD3L | <!--Chipset-->P43 with ICH10 | <!--ACPI--> | <!--IDE-->1 port | <!--SATA-->6 x SATA 3Gbit/s connectors | <!--Gfx-->1 x PCI Express x16 slot PCI Express 2.0 standard | <!--Audio-->HD Audio with ALC888 codec | <!--USB--> | <!--Ethernet-->realtek 8111C | <!--Opinion-->4 x 1.8V DDR2 DIMM sockets - 4 pcie x1 - 2 pci - ATX Form Factor; 30.5cm x 21.0cm |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Gigabyte 73-pvm-s2h rev.1.0 | <!--Chipset-->NVIDIA GeForce 7100 nForce 630i | <!--ACPI--> | <!--IDE-->{{Yes|1 port}} | <!--SATA-->{{yes|3 ports SATA2}} | <!--Gfx-->{{Maybe|Vesa 2d GeForce 7100 (vga /hdmi/dvi), 1 PCIe x16 Slot }} | <!--Audio-->{{Yes|Realtek ALC889A MCP73}} | <!--USB-->{{Yes|7 USB2.0}} | <!--Ethernet-->{{no|RTL 8211B MCP73}} | <!--Opinion-->Firewire Not, tested with Icaros Desktop 2.0.3 MCP73 is a single chip solution in three different versions |- | <!--Name-->Nvidia 7150 630i | <!--Chipset-->intel based nForce 630i (MCP73) | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->{{maybe|ide legacy}} | <!--GFX-->GF 7150 | <!--Audio-->{{yes|HD AUDIO ALC883}} | <!--USB-->{{yes|ohci echi}} | <!--Ethernet-->{{no|RTL8201C}} | <!--Opinion-->being tested |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->pci-e 2.0 x16 | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> the MCP73PV or the GeForce 7050/nForce 630i |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->the MCP73S or the GeForce7025/nForce 630i |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->the MCP73V or the GeForce 7025/nForce 610i |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Atom SOC (2008/2x)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->D945CLF | <!--Chipset-->N230 single core | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA--> | <!--Gfx-->{{yes|GMA945}} | <!--Audio-->{{yes|ALC662}} Skt 441 | <!--USB-->{{yes|uhci and ehci}} | <!--Ethernet-->{{yes|rtl8169}} | <!--Opinion-->works very well |- | <!--Name-->[http://www.clusteruk.com iMica D945GCKF2 mobo] | <!--Chipset-->Intel Atom N330 Dual Core | <!--ACPI-->wip | <!--IDE-->{{yes|IDE}} | <!--SATA-->{{maybe}} | <!--Gfx-->{{yes|gma}} | <!--Audio-->{{yes|HD AUDIO}} | <!--USB-->{{yes|uhci ehci}} | <!--Ethernet-->{{yes|rtl8169}} | <!--Opinion--> |- | <!--Name-->D945GSEJT + Morex T1610 | <!--Chipset-->Atom 230 with 945GSE | <!--ACPI--> | <!--IDE-->{{yes}} | <!--SATA-->{{maybe}} | <!--Gfx-->{{yes|GMA900 vga but issues with DVI output}} | <!--Audio-->{{yes|HDAudio with ALC662 codec}} | <!--USB-->{{yes| }} | <!--Ethernet-->{{yes|RTL8169 8111DL}} | <!--Opinion-->small size, runs off 12V |- | <!--Name-->ASUS AT3N7A-I | <!--Chipset-->Atom N330 Nvidia ION | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{maybe|3 ports legacy IDE}} | <!--Gfx-->{{yes|nouveau cube cube 2 45 quake 3 }} | <!--Audio-->{{yes|HD Audio with VIA 1708S codec playback}} | <!--USB-->{{yes}} | <!--Ethernet-->{{yes|RTL8169 device}} | <!--Opinion--><ref>http://www.youtube.com/watch?v=EAiJpvu73iw</ref> good but can freeze randomly at times |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->D410PT 45nm pinetrail | <!--Chipset-->D410 and NM10 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{maybe|ide legacy}} | <!--Gfx-->{{maybe|GMA3150}} | <!--Audio-->{{yes|ALC262 or ALC66x odd clicks}} | <!--USB-->{{yes}} | <!--Ethernet-->{{yes|RTL8111DL}} | <!--Opinion-->some support |- | <!--Name-->45nm pinetrail | <!--Chipset-->D510 and NM10 + GMA3150 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->GMA3150 | <!--Audio-->ALC888B or ALC66x | <!--USB-->{{yes}} | <!--Ethernet-->RTL8111DL | <!--Opinion-->some support |- | <!--Name-->Gigabyte GA-D525TUD (rev. 1.0 1.2 1.5) | <!--Chipset-->D525 NM10 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->gma 3150 | <!--Audio-->HDAudio ALC887 | <!--USB--> | <!--Ethernet-->rtl8169 rtl8111f | <!--Opinion-->2012 64 - 2 ddr3 dimm slots max 8g - Mini-ITX Form Factor; 17.0cm x 17.0cm - |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- |} =====Socket 1366 (2009/10)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Asus P6T DELUXE | <!--Chipset-->x58 + ICH10 and Intel 1st gen. (Nehalem/Lynnfield) Core i7 (8xx) CPU | <!--ACPI--> | <!--IDE-->{{yes|1 port}} | <!--SATA-->4 ports | <!--Gfx-->2 PCIe x16 (r2.0) slots | <!--Audio-->ADI AD2000B HD Audio | <!--USB-->{{yes|4 USB2.0}} | <!--Ethernet-->{{no|Marvell 88E8056 Gigabit}} | <!--Opinion-->Firewire VIA VT6308 no |- | <!--Name-->gigabyte ex58 ds | <!--Chipset--> x58 + ICH10 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet-->Realtek 8111D rtl8169 | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket 1156 (2010)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->Acer Aspire M3910 | <!--Chipset-->i3 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{unk| }} | <!--Gfx-->{{maybe|VESA intel HD}} | <!--Audio-->{{unk|HDAudio with Realtek ALC}} | <!--USB-->{{yes| }} | <!--Ethernet-->{{unk| Realtek}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H55M-S2H | <!--Chipset-->H55 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->PCIe slot | <!--Audio-->{{Yes|ALCxxx playback}} ALC888B (Rev1.x) | <!--USB-->{{Yes| }} | <!--Ethernet-->{{Yes|RTL8111D}} (Rev 1.x) | <!--Opinion-->Tested but no support for WLAN Realtek 8188su |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI H55M-E33 v1.0 | <!--Chipset-->E7636 M7636 H55 chipset so older i3/i5/i7 system | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{yes|HD Audio ALC889}} | <!--USB--> | <!--Ethernet-->{{Yes|PCI-E Realtek 8111DL}} | <!--Opinion-->Works well |- | <!--Name-->Asus P7P55D | <!--Chipset-->P55 | <!--ACPI--> | <!--IDE-->{{unk| }} | <!--SATA-->{{unk| }} | <!--Gfx-->pci-e | <!--Audio-->{{maybe | via codec}} | <!--USB-->{{unk| }} | <!--Ethernet-->{{maybe |rtl8169 Realtek RTL8111B/C RTL8112L }} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA 1155 H2 (2010/13)===== {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->ASUS P8H61-I LX R2.0 | <!--Chipset-->H61 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata | <!--Gfx-->1 pci-e slot | <!--Audio-->{{unk|HDAudio via7018s codec}} | <!--USB-->USB3 | <!--Ethernet-->{{yes|rtl8169 8111f}} | <!--Opinion-->2013 64bit up to intel ivybridge cpus - 2 ddr3 dimm slots - |- | <!--Name-->Asus P8H61-I/RM/SI mini-itx | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 sata | <!--Gfx-->pci-e 2 | <!--Audio-->{{unk|HDAudio via7018s codec}} | <!--USB--> | <!--Ethernet-->{{yes|rtl8169 8111f}} | <!--Opinion-->2013 64bit up to i3-2010 - OEM board from an RM machine but not ivybridge as the Asus BIOS isn't compatible with these, 0909 hacked one might work - |- | <!--Name-->asus p8h61-i lx r2.0/rm/si mini itx | <!--Chipset-->h61 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e 2.0 | <!--Audio-->HDaudio with VIA codec | <!--USB--> | <!--Ethernet-->rtl8169 rtl8111e | <!--Opinion-->2012 sandy and ivy - oem from rm machine 2 x 240-Pin DDR3 DIMM sockets max DDR3 1333MHz - |- | <!--Name-->‎Bewinner 63q9c7omvs V301 ITX | <!--Chipset-->H61 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata with nvme | <!--Gfx-->pci-e 4 | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet-->Realtek 8106E 100M Network Card | <!--Opinion-->2022 64 |- | <!--Name-->Biostar H61 H61MHV2 H61MHV3 Ver. 7.0 | <!--Chipset-->H61 with Intel Pentium G 2xxx series CPU | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->Realtek ALC662 later ALC897 | <!--USB-->4 usb2 | <!--Ethernet-->rtl8169 Realtek RTL8111H | <!--Opinion-->2014 - 2 ddr3 dimm slots - |- | <!--Name-->Gigabyte GA-H61M-D2-B3 | <!--Chipset-->H61 + Sandybridge | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 ports sata2 | <!--Gfx--> | <!--Audio-->ALC889 | <!--USB-->2 ports | <!--Ethernet-->Realtek RTL8111E | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H61MA-D3V | <!--Chipset-->H61 + | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 ports sata2 | <!--Gfx--> | <!--Audio-->Maybe HDAudio with Realtek ALC887 (Rev 2.0) ALC887 (Rev2.1) | <!--USB-->2 USB 2.0/1.1 ports | <!--Ethernet-->Realtek RTL8111E | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H61N-D2V | <!--Chipset-->H61 + | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata2 and maybe 4 sata3 | <!--Gfx-->pci-e 2.0 slot wit 1 x DVI-I port | <!--Audio-->{{unk|HDAudio with Realtek ALC887 (Rev 1.0)}} | <!--USB-->2 USB 2.0/1.1 ports | <!--Ethernet-->Realtek RTL8111E | <!--Opinion-->2013 64bit- 2 x 1.5V DDR3 DIMM sockets up to 16 GB - |- | <!--Name-->GA-H61M-S2PV | <!--Chipset-->H61 with 2400k 2500k 2600k 2700k | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx-->pci-e 2.0 slot | <!--Audio-->ALC887 (rev 1.0 2.0 2.1 2.2 2.3) | <!--USB-->4 USB 2.0 | <!--Ethernet-->Rtl811E (1.0) 8151 (2.0) Rtl8111F (2.1 2.2 2.3) | <!--Opinion-->Micro ATX Form Factor; 24.4cm x 20cm with 2 pci-e and 2 pci - |- | <!--Name-->Intel Classic Series DH61CR Desktop | <!--Chipset-->H61 + | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 ports | <!--Gfx--> | <!--Audio-->Intel HD with ALC892 | <!--USB-->4 ports | <!--Ethernet-->{{no|Intel 82579V}} | <!--Opinion--> |- | <!--Name-->MSI H61M-P20 (G3) MS-7788 *retail MSI board *OEM Advent, etc | <!--Chipset-->H61 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|four SATAII ports}} | <!--Gfx-->1 PCI Express gen3 (retail) gen2 (oem) x16 slot | <!--Audio-->{{yes|HDAudio ALC887 codec}} | <!--USB-->{{yes|}} | <!--Ethernet-->{{yes|Realtek 8105E 100M Network Card}} | <!--Opinion-->2012 64bit - 2 ddr3 slots - 22.6cm(L) x 17.3cm(W) M-ATX Form Factor - BIOS - [https://www.arosworld.org/infusions/forum/viewthread.php?thread_id=1149&rowstart=140&pid=6009#post_6007 works well], |- | <!--Name-->MSI H61I-E35 (B3) MS-7677 Ver.1.2 | <!--Chipset-->H61 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata2 3gbps | <!--Gfx-->{{maybe|VESA 2d for hdmi and 1 pcie 2.0 x1 slot}} | <!--Audio-->{{yes|https://www.arosworld.org/infusions/forum/viewthread.php?thread_id=1149&rowstart=140&pid=5861#post_5861 works}} | <!--USB-->USB3 and USB2 | <!--Ethernet-->{{yes|rtl8169 rtl8111e}} | <!--Opinion-->2012 64bit - 2 ddr3 slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus P8H67-M | <!--Chipset-->H67 + | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 sata3 - 4 sata2 | <!--Gfx--> | <!--Audio-->Intel HD with ALC887 | <!--USB-->6 USB2.0 | <!--Ethernet-->Realtek® 8111E | <!--Opinion--> |- | <!--Name-->Asus P8P67 | <!--Chipset-->P67 with sandybridge and ivybridge cpus | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->{{unk|HDAudio with ALC codec}} | <!--USB--> | <!--Ethernet-->{{unk|rtl8169 realtek rtl8111}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus P8Z68-V LX | <!--Chipset-->Z68 + Intel 2nd generation (Sandy Bridge) CPU and possibly ivybridge | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{yes|2 sata3 - 4 sata2}} | <!--Gfx-->pci-e slot | <!--Audio-->{{yes|HDAudio Intel HD with ALC887 codec}} | <!--USB-->{{yes|2 USB3.0 - 4 USB2.0}} | <!--Ethernet-->{{yes|rtl8169 Realtek® 8111E}} | <!--Opinion-->2011 64bit SSE 4.1 and AVX - EFI bios - 4 ddr3 dimm slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte Z68AP-D3 (B3) | <!--Chipset-->Z68 + Ivybridge | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 sata3 - 4 sata2 | <!--Gfx--> | <!--Audio-->Intel HD with ALC889 | <!--USB-->2 USB3.0 - 4 USB2.0 | <!--Ethernet-->Realtek® 8111E | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus B75M-A | <!--Chipset-->B75 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes| }} | <!--Gfx-->pci-e | <!--Audio-->{{maybe|HDAudio with Realtek ® ALC887-VD codec}} | <!--USB-->{{maybe| }} | <!--Ethernet-->{{yes|rtl8169 Realtek ® 8111F-VB-CG }} | <!--Opinion-->2013 64bit - 2 ddr3 slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->H77 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H77-D3H 1.0 1.1 | <!--Chipset-->H77 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata 3.0 | <!--Gfx-->pci-e | <!--Audio-->{{No|HDAudio VIA VT2021 codec}} | <!--USB--> | <!--Ethernet-->{{No|Atheros GbE LAN chip}} | <!--Opinion-->2013 64bit i5 3550 7 3770 - 4 DDR3 slots - 2 full pci-e 2 pci slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Gigabyte GA Z77 D3H with i3 3225 dual | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->{{No|HDAudio VIA VT2021 codec}} | <!--USB--> | <!--Ethernet-->{{No|Atheros GbE LAN chip}} | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA 1150 H3 (2013/2016)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->[https://theretroweb.com/motherboards/s/asus-b85m-e-rev-1-02 Asus B85M-E] | <!--Chipset-->B85 | <!--ACPI--> | <!--IDE-->{{yes| }} | <!--SATA-->{{yes| }} | <!--Gfx-->pci-e | <!--Audio-->{{maybe|HDAudio with Realtek ® ALC887-VD2 codec}} | <!--USB-->{{no| }} | <!--Ethernet-->{{yes|rtl8169 Realtek 8111F}} | <!--Opinion-->2014 64bit - 4 ddr3 slots - |- | <!--Name-->Gigabyte GA-H87N-WIFI mITX | <!--Chipset-->H87 and Intel 4th generation (Haswell) Core i5 (4xxx) CPU | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->Intel HD with ALC892 | <!--USB--> | <!--Ethernet-->Intel Atheros | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASUS H81I-PLUS Mini ITX | <!--Chipset-->H81 with intel 4590t 4690t | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata3 6gbps | <!--Gfx-->pci-e 3.0 x4 slot | <!--Audio-->{{yes|HDAudio 6.34 with ALC8878 codec playback only}} | <!--USB-->{{yes|USB3 USB2}} | <!--Ethernet-->{{yes|rtl8169 rtl8111g}} | <!--Opinion-->2014 64bit - 2 ddr3 dimm slots max 16gb - f2 or DEL bios and f8 boot select - |- | <!--Name-->Asus H81M-C H81M-P-SI | <!--Chipset-->H81 with 4th generation (Haswell) Core i7 (4xxx) CPU | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2x3g 2x6g | <!--Gfx-->pci-e slot | <!--Audio-->hdaudio alc887 vd | <!--USB--> | <!--Ethernet-->realtek 8111gr | <!--Opinion-->2013 skt 1150 - 2 ddr3 max 16g - mini atx - |- | <!--Name-->Asus H81T | <!--Chipset-->H81 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 sata | <!--Gfx-->HD4000 igpu only | <!--Audio-->HDAudio ALC887-VD | <!--USB-->Intel USB3 | <!--Ethernet-->rtl8169 realtek 8111G | <!--Opinion-->2013 64bit intel 4th gen mini itx - external dc brick with 19v rare barrel pin 7.4MM x 5.0MM - 2 ddr3 laptop sodimm slots - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H81M-S2V | <!--Chipset-->H81 | <!--ACPI--> | <!--IDE-->{{N/A|}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->HDAudio ALC887 | <!--USB-->USB3 | <!--Ethernet-->Realtek® GbE LAN chip | <!--Opinion-->2014 64bit up to i7 4790K - 2 DDR3 slots - |- | <!--Name-->Gigabyte GA-H81M-D3V (rev. 1.0) | <!--Chipset-->H81 | <!--ACPI--> | <!--IDE-->{{N/A| }} | <!--SATA-->{{yes|2 sata2 2 sata3 }} | <!--Gfx-->pci-e | <!--Audio-->{{unk| HDAudio Realtek® ALC887 codec}} | <!--USB-->{{unk|intel and VIA® VL805}} | <!--Ethernet-->{{unk|rtl8169 Realtek }} | <!--Opinion--> |- | <!--Name-->MSI H81M-E34 (MS-7817) | <!--Chipset-->H81 | <!--ACPI--> | <!--IDE--> | <!--SATA-->{{yes| }} | <!--Gfx-->PCIe 2.0 x16 | <!--Audio-->HDAudio with ALC887 codec | <!--USB-->USB3 | <!--Ethernet-->{{yes|rtl8169 RTL8111G}} | <!--Opinion-->2013 64bit - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus Z87-K | <!--Chipset-->Z87 with 4th generation (Haswell) Core i7 4c8t i5 4c4t CPU | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->Intel HD with ALC | <!--USB--> | <!--Ethernet-->Realtek lan | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-Z87X-UD3H | <!--Chipset-->Z87 Express | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->Intel HD with Realtek® ALC898 codec | <!--USB--> | <!--Ethernet-->intel | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA H97M D3H r1.0 r1.1 with i3 4360 or 4370 dual | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->pci-e | <!--Audio-->Intel HD with ALC892 | <!--USB--> | <!--Ethernet-->Realtek lan | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus Z97 A with i7 4790K | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx-->750, 960, 970 and 980 nvidia GTX cards | <!--Audio-->Intel HD with ALC | <!--USB--> | <!--Ethernet-->intel lan ethernet | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA Z97X UD3H rev1.0 1.1 1.2 | <!--Chipset-->Z97 with i5 4690K | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio-->HDaudio with ALC1150 | <!--USB--> | <!--Ethernet-->intel lan | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI GAMING 5 Z97 | <!--Chipset-->Z97 with 4th generation (Haswell) Core i7 4c8t CPU | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->ASUS Q87M-E | <!--Chipset-->Q87 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2014 64bit - 4 DDR3 slots - |- | <!--Name--> | <!--Chipset-->H99 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA2011V2 s2011-2 (2012/15)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset-->x79 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2013 Xeon e5-???? W TDP, e5-2667V2 W TDP, e5-????V2 W TDP, Sandybridge and Ivybridge V2 |- | <!--Name-->Asus | <!--Chipset-->X79 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA2011V3 s2011-3 (2015/18)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset-->x99 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2016 Xeon e5-1620v3 130W TDP, e5-1650V3 (i7-5930K) 140W TDP, e5-2640V3 90W TDP, Haswell-EP |- | <!--Name-->Asus | <!--Chipset-->X99 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->most cheap Ryzens are better nowadays |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Huananzhi X99-CD4 | <!--Chipset-->Intel C612 and X99 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata 3 connectors and 1 m.2 nvme slot | <!--Gfx-->pcie slot | <!--Audio-->HDaudio with ALC897 codec | <!--USB-->{{No|USB3}} | <!--Ethernet-->{{maybe|rtl8169}} | <!--Opinion-->2024 quality might not be great outside of a simple setup - 2 ddr4 dimms - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Keyiyou X99 XD4 | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Machinist MR9A Pro | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2023 |- | <!--Name-->Machinist MR9A Pro | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2023 |- | <!--Name-->Mogul | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Qiyida X99 H9S | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2023 |- | <!--Name-->Soyo | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA 1151 Socket H4 (2015/2018)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->Skylake CPUs have TPM 2.0 embedded |- | <!--Name-->Asus H110 Plus H110M-A/DP | <!--Chipset--> with 6th Gen Core and 7th with bios update | <!--ACPI--> | <!--IDE--> | <!--SATA-->Sunrise Point-H SATA [AHCI mode] [8086 a102] | <!--Gfx-->{{No|Skylake Integrated HD Graphics use PIC-E slot}} | <!--Audio-->Intel HD Audio with Realtek ALC887 Audio CODEC | <!--USB-->Sunrise Point-H USB 3.0 xHCI [8086: a12f] no usb2.0 fallback | <!--Ethernet-->{{Yes|Realtek 8111GR or 8111H RTL8111 8168 8411}} | <!--Opinion-->ATX with 3 pci-e and 2 DDR4 slots - uatx version smaller - turn off TLSF as it was causing AHI driver to corrupt. Turned off ACPI for errors but works fine once booted - |- | <!--Name-->ASUS H110M-R M-ATX | <!--Chipset-->H110 6th Gen Skylake Core™ i7 Core™ 6950X i7-6970HQ i7-6700K 4c8t hyperthreading, i5/Core™ i5-6600K 4c4t i3/Pentium® / Celeron® | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 x SATA 6Gb/s | <!--Gfx-->pci-e | <!--Audio-->HDAudio with Realtek® ALC887 codec | <!--USB-->Intel USB3 | <!--Ethernet-->Realtek® RTL8111H | <!--Opinion-->2016 64bit - 2 DDR4 DIMMS Max 32GB 2133MHz - 1 full pci-e and 2 pci-e 1 - |- | <!--Name-->Asus H110T | <!--Chipset-->H110 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->2 sata | <!--Gfx-->intel igpu only | <!--Audio-->HDaudio | <!--USB--> | <!--Ethernet-->Dual Intel/Realtek GbE languard | <!--Opinion-->2016 - mini itx 12v / 19v laptop type rare barrel pin 7.4MM x 5.0MM - 2 sodimm ddr4 slots - no pci-e slot - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte GA-H110M-S2H MATX Rev1.0 | <!--Chipset-->H110 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata | <!--Gfx-->pci-e 3.0 | <!--Audio-->Realtek® ALC887 codec | <!--USB-->2 (USB 3.1 Gen 1) ports with 4 us2 | <!--Ethernet-->Realtek® GbE LAN | <!--Opinion--> 2 ddr4 slots |- | <!--Name-->Gigabyte ga-h110n | <!--Chipset-->H110 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->{{Yes| sata}} | <!--Gfx-->{{maybe|Vesa 2d for Intel or PCI-e slot}} | <!--Audio-->{{Maybe|HDaudio for ALC887 codec}} | <!--USB-->{{Maybe| }} | <!--Ethernet-->{{maybe|RTL8169}} | <!--Opinion-->2016 mini-itx 6th gen |- | <!--Name-->Msi H110M-PRO-VH | <!--Chipset--> | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 x SATA 6Gb/s | <!--Gfx-->pci-e 3.0 | <!--Audio--> Realtek® ALC887 Codec | <!--USB--> | <!--Ethernet-->rtl8169 rtl8111h | <!--Opinion--> 6th gen intel - 2 ddr4 slots |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus H170 Pro Gaming | <!--Chipset-->H170 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sata | <!--Gfx-->pci-e | <!--Audio-->HDAudio | <!--USB-->Asmedia USB3.1/3.0 | <!--Ethernet-->intel lan | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->MSI Z170A TOMAHAWK | <!--Chipset-->Z170 | <!--ACPI--> | <!--IDE-->{{N/A}} | <!--SATA-->4 sara, 1 x 2280 Key M(PCIe Gen3 x4/SATA), 1 x 2230 Key E(Wi-Fi) | <!--Gfx-->pci-e | <!--Audio-->HDAudio | <!--USB--> | <!--Ethernet-->intel lan | <!--Opinion-->2016 64bit up to i7 7700k - 2 DDR4 - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->GIGABYTE GA-B250M-DS3H HD3P D3H D2V | <!--Chipset-->B250 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2018 coffee lake intel 8th gen |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus | <!--Chipset--> with Kaby Lake X Intel 7th Gen | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> up to 16 pcie lanes |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus | <!--Chipset--> Z390 with Kaby Lake X | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> up to 16 pcie lanes |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> Q370M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> H370M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> B360M | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Asus Rampage | <!--Chipset-->x299 with i9 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> - up to 24 to 44 pcie lanes |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name-->Gigabyte | <!--Chipset--X299 > | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} =====Socket LGA 1200 (2020/2022)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->MSI H510M-A PRO (MS-7D22) | <!--Chipset--> with 10th gen Comet Lake X | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2021 64bit - up to 16 pcie lanes rebar possible |- | <!--Name-->Asus PRIME H410M-E Asrock H470M-HDV/M.2 | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus | <!--Chipset--> with 11th gen Rocket Lake X | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> up to 16 pcie lanes |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} =====Socket LGA 1700 (2023/ )===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset-->Alder Lake / 14th gen Raptor Lake | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2021 2022 64bit - QoS work to 2 level cpus, P down to E cores - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset-->Meteor Lake ultra 5 7 1xxH series 1 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2023 2024 64bit 10nm - 3 level cpus, Low Power Island (SOC tile) to E onto P cores - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> 15th gen Arrow Lake | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset-->Lunar lake ultra 5 7 2xxV series 2 | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2025 64bit 7nm - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->Nova Lake | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2026 64bit - |- | <!--Name--> | <!--Chipset-->Panther Lake | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2026 64bit - either 44, 484, or 448 tiled cores 18A process - core ultra x9 288h, x7 358H, - |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- |} =====Socket LGA 1954 (2027/ )===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name--> | <!--Chipset-->Nova Lake-S | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset-->Serpent Lake, Titan Lake, and Razer Lake | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion-->2027 |- |} =====Socket LGA (203x/203x)===== [[#top|...to the top]] {| class="wikitable sortable" width="90%" ! width="10%" |Name ! width="5%" |Chipset ! width="5%" |ACPI ! width="5%" |IDE ! width="5%" |SATA ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |USB ! width="10%" |Ethernet ! width="30%" |Opinion |- | <!--Name-->MSI | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- style="background:lightgrey; text-align:center; font-weight:bold;" | Name || Chipset || ACPI || IDE || SATA || Gfx || Audio || USB || Ethernet || Opinion |- | <!--Name-->Asus | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |- | <!--Name--> | <!--Chipset--> | <!--ACPI--> | <!--IDE--> | <!--SATA--> | <!--Gfx--> | <!--Audio--> | <!--USB--> | <!--Ethernet--> | <!--Opinion--> |} ===Chromebooks=== For most (EOL) cromebooks, the recommended UEFI path forward is to: *put the device into Developer Mode *disable firmware write protection *flash MrChromebox's UEFI Full ROM firmware *install ChromeOS Flex, Linux, etc See [https://mrchromebox.tech/#home MrChrome], [https://mrchromebox.tech MrChrome] and the [https://www.reddit.com/r/chrultrabook/ chrultrabook subreddit] for more info ChromeOS has several different boot modes, which are important to understand in the context of modifying your device to run an alternate OS: *Normal/Verified Boot Mode Can only boot Google-signed ChromeOS images Full verification of firmware and OS kernel No root access to the system, no ability to run Linux or boot other OSes Automatically enters Recovery Mode if any step of Verified Boot fails Default / out-of-the-box setting for all ChromeOS devices *Recovery Mode User presented with Recovery Mode boot screen (white screen with 'ChromeOS is missing or damaged') Boots only USB/SD with signed Google recovery image Automatically entered when Verified Boot Mode fails Can be manually invoked: On Chromebooks, via keystroke: [ESC+Refresh+Power] On Chromeboxes, by pressing a physical recovery button at power-on On Convertibles/Tablets, by holding the Power, Vol+, and Vol- buttons for 10s and then release Allows for transition from Verified Boot Mode to Developer Mode On Chromebooks/Chromeboxes, via keystroke: [CTRL+D] On Convertibles/Tablets, via button press: Vol+/Vol- simultaneously Booting recovery media on USB/SD will repartition/reformat internal storage and reload ChromeOS Note: The ChromeOS recovery process does not reset the firmware boot flags (GBB Flags), so if those are changed from the default, they will still need to be reset for factory default post-recovery. *Developer Mode "Jailbreak" mode built-in to every ChromeOS device Loosened security restrictions, allows root/shell access, ability to run Linux via crouton Verified Boot (signature checking) disabled by default, but can be re-enabled Enabled via [CTRL+D] on the Recovery Mode boot screen Boots to the developer mode boot screen (white screen with 'OS verification is off' text), The user can select via keystroke <pre> ChromeOS (in developer mode) on internal storage ( [CTRL+D] ) ChromeOS/ChromiumOS on USB ( [CTRL+U] ) Legacy Boot Mode ( [CTRL+L] ) </pre> Boot screen displays the ChromeOS device/board name in the hardware ID string (eg, PANTHER F5U-C92, which is useful to know in the context of device recovery, firmware support, or in determining what steps are required to install a given alternate OS on the device. *Legacy Boot Mode Unsupported method for booting alternate OSes (Linux, Windows) via the SeaBIOS RW_LEGACY firmware Accessed via [CTRL+L] on the developer mode boot screen Requires explicit enabling in Developer Mode via command line: sudo crossystem dev_boot_legacy=1 Most ChromeOS devices require a RW_LEGACY firmware update first Boots to the (black) SeaBIOS splash screen; if multiple boot devices are available, prompt shows the boot menu Note: If you hear two beeps after pressing [CTRL+L], then either your device doesn't have a valid Legacy Boot Mode / RW_LEGACY firmware installed, or legacy boot capability has not been been enabled via crossystem. https://www.howtogeek.com/278953/how-to-install-windows-on-a-chromebook/ Chromebooks don’t officially support other OSs. You normally can’t even install as Chromebooks ship with a special type of BIOS designed for Chrome OS. But there are ways to install, if you’re willing to get your hands dirty and potentially ruin everything [https://mrchromebox.tech/#devices Firmware Compatibility] [https://wiki.galliumos.org/Hardware_Compatibility Here is the list of hardware that the GalliumOS supports and information on getting Gallium OS on to those devices] Development on GalliumOS has been discontinued, and for most users, GalliumOS is not the best option for running Linux due to lack of hardware support or a kernel that's out of date and lacking important security fixes. Meet Eupnea and Depthboot, the successors to Galliumos and Breath [https://eupnea-linux.github.io This is the bleeding edge] Most older Chromebooks need the write-protect screw removed in order to install MrChromebox's firmware that allows you to install other operating systems. Most newer Chromebooks don't work in the same way as there is no write-protect screw on them. Very rough guide to '''total''' (i.e. all cores / threads) processor performance (AROS usually uses only the [https://gmplib.org/gmpbench one core]) [[#top|...to the top]] <pre> 060000 AMD Ryzen 9 7900X (AM5 170W), 056000 AMD Ryzen 9 5950X, 055000 AMD Ryzen 9 5900X3D, 053000 AMD Ryzen 9 5900X (AM4 105W), AMD Ryzen 9 3950X (105W), 044000 AMD Ryzen 7 5800X3D, 042000 AMD Ryzen 9 6900HX, AMD Ryzen 5 5600X3D (AM4 95W), AMD Ryzen 7 PRO 5750GE (AM4 35W), 039000 AMD Ryzen 9 5900HS, Intel Core i7-12700T, AMD Ryzen 7 7735HS (8c16t 45W), AMD 8840U, 038000 AMD Ryzen 7 5800H (FP6 45W), AMD Ryzen 7 6800U, Intel Core i5-12490F, Intel Core i5-12500E, 037000 AMD Ryzen 7 5800HS (FP6 35W), AMD Ryzen 5 8500G 8600GE (AM5 6c12t 35W), AMD Ryzen Z2 (8c16t), 036500 AMD Ryzen 7 5700G (AM4 8c16t 65W), AMD Ryzen 9 6900HS, Intel Core i7-12800H, 036200 AMD Ryzen 7 5700GE (AM4 8c16t 35W), AMD Ryzen Z1 Extreme (top TDP), AMD Ryzen 5 8600G (AM5 65W), 036000 AMD Ryzen 5 3600X (Am4 95W), AMD Ryzen 5 5500 (AM4 65W), AMD Ryzen 5 5600 (65W), 035000 AMD Ryzen 5 6600H, Intel Core i5-12400F, 031000 AMD Ryzen™ 9 8945HS, Ryzen™ 7 8845HS, AMD Ryzen 7 7840U, 030000 AMD Ryzen 7 4800U, AMD Ryzen 4800H, Intel Core i5-11400F, Intel Zeon E5-2697A V4, 029500 AMD Ryzen 5 4500 (AM4 65W), AMD Ryzen 5 3600 (65W), Apple M3 Pro 12c, 029000 AMD Ryzen 5 4600G (AM4 65W), AMD Ryzen 5 PRO 4650GE (AM4 35W), AMD Ryzen 7 PRO 1700X (AM4 95W), 028500 AMD Ryzen 5 PRO 5675U, AMD Ryzen 7 1700 (AM4 65W), AMD Ryzen 7 2700 (65W), Ryzen 3 7540U, 028000 AMD Ryzen 5 PRO 5650U, 5 5560U (FP6 25W 6c12t Zen3), Intel Core i5-13500H, AMD Ryzen 7 4800HS, 027700 AMD Ryzen 9 PRO 7940HS (FP8 65W), AMD 8745HS, AMD Ryzen H255 AI, AMD Ryzen 3 7545U, 027500 AMD Ryzen 3 7736U, AMD Ryzen 5 7640U, 027400 AMD Ryzen 5 8540U, AMD Ryzen 5 PRO 5650GE (AM4 6c12t 35W), AMD Ryzen 5 PRO 4650G (AM4 45W), 027300 AMD Ryzen 7 PRO 4750GE, AMD Ryzen 5 5600H, AMD Ryzen 7 5825U (FP6 8c16t 15W), 027200 AMD Ryzen 5 6600U, AMD Ryzen 7 2700X, AMD Ryzen 5 5600GE (AM4 35W), AMD Ryzen Z1, 027100 AMD Ryzen 7 7730U (FP6 15W 8c16t), AMD Ryzen 7 5800U (FP6 25W 8c16t), Ryzen 9 4900H, 027000 AMD Ryzen 7 PRO 4750U (8c16t), Ryzen 5 7430U (FP6 6c12t), Ryzen 5 PRO 6650U, Intel 10500H, 026500 AMD Ryzen 7 PRO 7840HS (FP7 65W), AMD Ryzen 7 8840HS, AMD Ryzen Z2 Extreme, 025000 AMD Ryzen 5 5600U (FP6 25W hot 6c12t Zen3), AMD Ryzen 5 2600 (65W), Ryzen 5 7530U, 024500 AMD Ryzen 5 4600HS (FP6 35W 6c12t), Apple M1 Pro, AMD Ryzen 5 5625U (FP6 15W 6c12t), 023700 AMD Ryzen 3 PRO 5350GE (AM4 35W), AMD Ryzen 5 3500X (AM4 95W), Intel Core i7-9700, 023500 AMD Ryzen 5 1600X (95W), AMD Ryzen 3 5300GE (AM4 4c8t 35W), AMD Ryzen 7 5700U (FP6 25W 8c16t Zen2), 023200 AMD Ryzen 3 7330U (FP6 15W 4c8t), AMD Ryzen 7 4700U (FP6 25W 8c8t), AMD Ryzen 5 4400G, 023000 Intel Core i7-1255U, Intel Core i7 13700H, Ryzen 7640HS, 022000 AMD Ryzen Z2 Go (4c8t), AMD Ryzen 5 5500U (FP6 25W 6c12t Zen2), Snapdragon 8 Elite, 020500 AMD Ryzen 3 4300G (AM4 65W), AMD Ryzen 3 5450U 5425U, AMD Ryzen 5 PRO 4650U (6c12t), 019500 Intel Core i5-1135G7, AMD Ryzen 5 5500H, AMD Ryzen 5 4600U (FP6 25W 6c), AMD Ryzen 5 2600 (65W), 019250 Intel Core i5-1145G7, 019000 AMD Ryzen 5 3400G (AM4 65W), AMD Ryzen 5 2500X, AMD Ryzen 5 7520U, AMD Ryzen V3C18I (? 15W), 017750 AMD Ryzen 5 3400GE (AM4 35W), Intel Core i5-8400, AMD Ryzen 5 1500X (AM4 65W), Xbox One Series X, 017500 Intel Core i7-6700K, Intel i5-10400, AMD Ryzen 5 4500U (FP6 25W 6c6t), AMD Ryzen 3 5400U, 017000 AMD Ryzen 3 PRO 4350GE (AM4 35W), AMD Ryzen 3 5300U (FP6 25W 4c8t), Intel Core i5-11300H, 016500 AMD Ryzen 7 3750H, AMD Ryzen Embedded V1756B (FP5 45W), AMD Ryzen 3 PRO 4200GE, SD G3 Gen3, 016250 Intel Core i5-1035G7, intel core i5 7600 (4c4t 65W), 016000 AMD Ryzen 5 2400G (AM4 65W), AMD Ryzen 5 3550H, Ryzen 5 PRO 3350GE (4c 8t), Intel Core i5-8500T, 015500 AMD Ryzen Embedded R2544, 015000 AMD Ryzen 3 7320U, Ryzen 7 3700U, Ryzen 3200G (AM4 65W), Intel Core i7-8550U, Intel Core i5-1035G1, 014000 AMD Ryzen 5 2400GE (AM4 35W), Intel Core i7-6700T, AMD Ryzen 5 3550U, 013500 AMD Ryzen 5 3500U (FP5 15W 4c8t), AMD Ryzen 3 4300U, AMD Athlon Gold 4150GE, AMD Ryzen 5 3450U, 013250 AMD Ryzen 3 3200GE (AM4 45W), AMD Ryzen 3 1300X (65W), AMD Ryzen 3 2200G, Xbox One Series S, 013000 AMD Ryzen Embedded V1605B (FP5 25W), AMD Ryzen 2700U, AMD Ryzen R2514, 012500 AMD Ryzen 5 2500U (FP5 25W 4c8t), Intel Core i3-8300T, Intel Xeon X5680, Intel i3-1115G4 (2c4t), 012300 Intel Core i7-8565U, Intel Core i5-8350U, Intel Core i7-8700, Allwinner A733 (2 A76, 6 A55), 012200 ARM Cortex-X3 Prime Snapdragon SD8G2 Gen2 4nm 64-bit Kryo CPU, i5-8250U (4c8t), 012000 AMD Ryzen 3 2200GE, AMD Ryzen 3 1200 (65W), AMD Ryzen 5 3500C, 011500 AMD Ryzen 3 3300U, Intel Core i3-8100T, Intel Core i5-8265U, Intel i5-10210U, CORE i5-10310U, 010500 AMD Ryzen 3 2300U (FP5 25W 4c4t), Allwinner A527 (8 A55), Intel i5 4690K, 010300 Intel Core i7-3630QM, Intel Core i5-6600T, Intel Core i5-4670K, 010200 Intel Core i5-6440HQ, Intel Core i7-3610QM, Snapdragon SD865, 010000 AMD FX-8320E (AM3+ 125W 8c8t), Intel Core i5-7500T, Intel Core i5-4690, Intel i5 4690T, 009000 Spectrum Unisoc Tiger T7280 (T620), Cortex-X2, MediaTek Dimensity 1300 (4 A78, 4 A55), 008700 AMD FX-6130 (AM3+ 90W 6c6t), Intel Core i5-7400T, Intel Core i5-4590T, 008500 Intel Core i5-6500T, AMD Athlon 300GE (AM4, 35W), AMD Athlon Gold 7220U, 008000 AMD Ryzen R1606G (FP5 15W), AMD FX-6300 (AM3 65W 6c6t), Intel Core i5-2500K, 007500 AMD Ryzen 3 3200U, AMD Ryzen 3 3250U, Intel Alderlake ULX N100 / N95, 007200 AMD Ryzen 3 2200U (FP5 25W 2c4t), Intel Core i3-7100T, Intel Twinlakes N150 N200, Xbox(TM) One S, 007100 AMD Ryzen R1505G (FP5, 15W), RK3576 4 A72, 4 A53, Snapdragon XR2 Gen 1, Intel i7-6600U and 7600U, 006600 Qualcomm Snapdragon 888 5G, AMD Athlon 300U (FP5 2c4t 15W), Intel Core i7-7500U, AMD V1202B, 006500 Intel Core i7-6500U, AMD Athlon Gold 3150U, Intel Celeron N5105 (FCBGA1338 15W), SD 685, 006300 Intel Core i3-8130U (15W), Intel Celeron N5095 (FCBGA1338 15W), Intel Core i3-6100T, 006100 Intel Core i5-6300U, Intel Core i5-7200U (2c4t), Intel i7-5500U, Intel Core i7-6600U (2c4t), 006000 Intel Core i5-6200U (2c4t), Intel Core i3-7130U, Intel i7-4500U, Qualcomm Snapdragon 888 4G, 005950 Intel Core i5-4570T, Intel Core i5-5257U, Rockchip RK3588 (4 A76, 4 A55), Snapdragon 7325, 005900 Intel Xeon X5550, Intel Core i5-4300M, MediaTek Dimensity 1200 (4 A78, 4 A55), Unisoc 7255 (T616), 005800 Intel Celeron J4125 J4105 (FCBGA1090 15W), Intel Core i5-3470T, AMD A8-6600K APU, AMD 3015E (2c4t), 005600 Intel Core i5-3360M, Intel Core i7-3520M, Intel Core i5-4210M, Intel Pentium G4600T, 005400 MediaTek Dimensity 900 (2 A78, 6 A55), AMD Athlon Silver 7120U, Snapdragon 860, 005300 AMD PRO A12-9800B 7th Gen APU (FP4 15W), AMD FX-4300 4c4t, AMD Ryzen R1305G, 005250 Intel Core i5-3230M, AMD FX-7600P, Intel Pentium G4400, Unisoc T7200 (Unisoc T606 2 A76, 6 A55), 005200 AMD PRO A10-8770E, AMD A10-9700E, AMD PRO A10-9700B (FP4 15W), Intel Core i3-4130T, 005100 AMD RX-427BB (FP3 15W), AMD A10-9620P, AMD A12-9720P, Intel Core i3-8145U, AMD A12-9830B, 005050 AMD A8-5500 (FM2 65W), AMD A10 PRO-7800B APU, Intel Pentium Silver N5000, Intel Core i7-5500U, 005000 Intel Core i5-5300U, Intel Core i5-3320M (2c4t), Intel Core i5-5350U, Unisoc T618 (2 A73 6 A53), 004900 Intel Core i5-4300U, Intel Core i5-5200U, Intel Core i3-4100M, Snapdragon 662 (SM6115), 004860 Intel Core i7-2620M, Intel Core i7-2640M, AMD Athlon Silver 3050U 3050e, Intel i3-7020U, 004650 Intel Core i5-2520M (2c4t), Intel Core i5-3210M, AMD A10-9600P (FP4 4c 15W), Pentium 4415U, 004625 Intel Core i3-7100U (FCBGA1356 15W), ARM A76 RK3588S, AMD A10-6800B APU, 004600 AMD PRO A8-9600B, AMD PRO A12-8830B, AMD PRO A10-8730B, AMD A12-9700P, Intel Core i3-6100U, 004200 AMD A10-8700P A8-8600P, Intel Core i5-4200U, Intel Core i5-2540M, Intel i3-6006U, Intel i3-4150T, 004000 Intel Core i5-2430M, AMD PRO A8-8600B, AMD 3020e, Mediatek MT6797 Helio X20, 003850 Intel Core i5-2410M (2c4t), Intel Core i3-2120 (LGA1155 65W), Mediatek MT8786, 003800 AMD A10-4600M APU, AMD A10 PRO-7350B APU, AMD A10-5750M APU, Rockchip RK3399, 003600 AMD A8-6500T APU, AMD A8-7410 APU, AMD PRO A6-8550B, AMD A8-5550M (4c4t), 003500 AMD GX-424CC SOC (FT3b 25W 4c4t), ARM A75 Unisoc Tiger T610 (Spreadtrum) (8c 5W), intel i5-5250u, 003400 AMD A10-7300 APU, AMD A6-7310 APU, AMD A8-6410, AMD A10-5745M APU, Intel Core i3-4000M, 003350 Intel Pentium G2020, Intel Core i3-3120M (G2 2c4t), AMD R-464L APU, Intel® Core m5-6Y57 (2c4t), 003300 AMD GX-420CA SOC (FT3 BGA769 25W), AMD A6-9500E, Intel Celeron N4200, AMD A6-5200 ( 25W 2c2t), 003200 AMD A6-6310 APU, AMD A6-6400B APU, AMD A6-8570E, AMD A8-4500M APU, AMD A6-7400K APU, 003000 AMD A8-7150B, AMD A9-9410, A9-9420, A9-9425, AMD A6-8500B (FP4 15W), AMD A8-7100, Intel 5010u, 002900 AMD PRO A6-8530B, AMD A6-8500P, AMD A8-3500M APU, Intel Core i3-2120T, Intel i5-4250u, 002700 AMD Embedded GX-420GI (FP4 15W), AMD PRO A6-9500B, AMD GX-415GA, AMD A4-6210 APU, Intel i3-5005U, 002600 AMD A6-9225, AMD A8-4555M APU, AMD A4-5000 APU (FT3 15W), AMD A6-9220, AMD A6-3420M APU, 002450 Intel Celeron 2950M, Intel Pentium N3700, Intel Core i3-2350M, Allwinner A523 (8 A55), 002400 Intel Celeron N3150, Intel Core i3-2330M, Intel Xeon W3505, AMD A6-9210, Allwinner H618 (4 A53), 002300 Intel Celeron N3350, AMD A4-9120, AMD A4-9125, Intel Core i3-2310M, Intel Celeron 3865U, 002200 AMD A9-9420e, AMD A6-5350M APU, AMD E2-6110 APU, AMD E2-9000e, Celeron N4500, Intel N3710, 002000 AMD GX-412HC, AMD A4-4300M APU, AMD A6 PRO-7050B APU, AMD A6-4400M APU, AMD A6-7000, 001925 Intel Core2 Duo E6700, Intel Pentium Extreme Edition 965, Intel Core i3-370M, Celeron N4020, 001750 Intel Core i3-2365M 2375M, AMD A4-9120C, Intel Core2 Duo T8300, Qualcomm MSM8939, 001600 AMD GX-222GC (BGA769 FT3b 15W), AMD A4-9120e, AMD Embedded GX-215JJ, AMD A4-4355M APU, 001550 Intel Core2 Duo SL9400 T7600 T6600, AMD E2-3200, AMD A6-9220e, Mediatek MT8783, AMD E2-3800, 001520 Intel Celeron N4000, 001500 AMD GX-218GL SOC, AMD A6-4455M, AMD A4-5150M APU, ARM A55 RK3566 (4c 3W), Intel Core2 Duo T8100, 001400 AMD GX-217GA SOC, ARM Cortex-A53 4c4t H700, AMD A4-3300M APU, Allwinner A133P A64 (4 A53), 001300 AMD Turion 64 X2 Mobile TL-64 TL-62, Intel Core2 Duo T7300, Intel Core2 Duo T5600, AMD RX-216TD, 001250 AMD GX-412TC SOC, AMD A4-3320M APU, AMD Athlon 64 X2 QL-66, Intel Core2 Duo T7200 001200 AMD Athlon 64 X2 2c TK-57, AMD Turion 64 X2 Mobile TL-60 RM-74, AMD E1-2500, AMD E2-7015, 001150 Intel Core2 Duo T5550, Intel Core2 Duo L7500, AMD E2-3000M APU, ARM A35 RK3266, AMD E2-7110, 001100 Intel Core2 Duo T5300, AMD Athlon 64 X2 3800, Intel Core2 Duo E4300, Mediatek MT8127, 001050 AMD E1-6010 APU, Intel Pentium T4300, Intel Celeron N2840, 001050 AMD Athlon 64 FX-57, AMD Athlon 64 X2 Dual-Core TK-55, AMD Turion 64 X2 Mobile TL-52 001000 Intel Core2 Duo T5500, Intel Core2 Duo L7300, Intel Core2 Duo SU9400, 000950 AMD G-T56N, AMD Athlon 64 3100+, AMD E2-2000 APU, 000950 AMD Turion 64 X2 Mobile TL-50, AMD E1-2200 APU, Intel Celeron U3400, 000925 AMD TurionX2 Dual Core Mobile RM-72, AMD Sempron 140 000920 Intel Celeron SU2300, Intel Core2 Duo T5200, AMD Turion 64 X2 Mobile TL-56 000890 AMD E2-1800 APU, AMD Turion 64 X2 Mobile TL-58 000880 AMD G-T56E, AMD G-T48E, 000860 AMD E-450 APU, AMD E-350 APU, AMD Athlon LE-1620 000820 AMD A4-1250 APU, AMD Athlon LE-1600, 000810 AMD E1-2100 APU, Intel Core Duo T2500, 000810 Intel Atom D510, Intel Core2 Duo U7500, 000800 AMD Geode NX 2400+, AMD Turion 64 Mobile ML-42, AMD Athlon II Neo K325, 000760 AMD V140, AMD E1-1200 APU, AMD Athlon 64 3300+, 000730 Intel Core Duo T2400, AMD Turion 64 Mobile MK-38, AMD Sempron 3600+, 000700 Intel Core2 Duo U7600 U7700, AMD Sempron LE-1200, AMD V120 000680 AMD GX-212JC SOC, AMD E-300 APU, AMD A4-1200 APU, 000670 AMD Turion 64 Mobile MK-36 ML-37 ML-40, Mobile AMD Sempron 3800+ 000640 Intel Atom N2600, Intel Atom N570, Mobile AMD Athlon 64 3200+ 000640 Intel Core Duo T2300, Intel Core Duo T2050, 000630 VIA Eden X2 U4200, AMD Sempron LE-1100, AMD Sempron 3100+ 3600+, 000620 AMD C-70 C70 APU, Intel Atom 330, AMD G-T40N, AMD Athlon Neo MV-40, 000610 Intel Core2 Duo U7300, AMD Athlon II Neo K125 K145, 000600 Intel Atom N550, Intel Pentium 4, AMD Athlon 64 2800+, 000580 AMD C-60 C60, AMD G-T40E, AMD Sempron LE-1250 000530 AMD C-50 C50, Intel Celeron M 723, AMD Sempron 210U, 000490 AMD GX-210JA SOC, PowerPC 970 G5 IBM's 970 server CPU (2c), 000470 Mobile AMD Sempron 3500+, Mobile AMD Athlon XP-M 2200+, 000460 AMD Athlon XP 2500+, AMD Sempron 3500+, Mobile Intel Pentium 4, 000440 Intel Atom D425, Intel Atom N470, POWER 4 PPC, 000410 Intel Pentium M, Intel Celeron M, AMD Sempron 2300+ 000400 Intel Atom N450, AMD Sempron 2400+, 000340 Intel Atom D410, AMD G-T52R, AMD C-30, AMD Sempron 2200+ 000330 Intel Atom N455, Intel Atom N280, Intel Atom N270 (1c1t 2W), Intel P3, 000320 Freescale NXP QorIQ P1022 000310 PowerPC G4 7447 1Ghz (1c1t 15W), PPC440 core, 000230 PowerPC PPC G3/PPC 750, 000160 Pentium II, Motorola 68060 000080 Intel 80486, Motorola 68030, 000040 Intel 80386, 000030 Motorola 68020 000008 Motorola 68000 </pre> === Recommended hardware (32-bit) === [[#top|...to the top]] Recommended hardware is hardware that has been tested with latest release of AROS and is relatively easy to purchase second hand (ie. ebay). This hardware also comes with commitment that compatibility will be maintained with each future release. If in future decision will be made to drop any of the recommended hardware from the list (for example due to it no longer being available for purchase), such hardware will move to list of legacy supported systems and will have an indicated end of life date so that users have time to switch to other hardware. {| class="wikitable sortable" width="100%" | <!--OK-->{{Yes|'''Works well'''}} || <!--Not working-->{{No|'''Does not work'''}} || <!--Not applicable-->{{N/A|'''N/A not applicable'''}} |- |} ==== Virtual Hardware ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | VirtualBox 7.x (Other/Unknown template) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VMWARESVGA}} || {{Yes|HDAudio}} || {{Yes|PCNET32<br/>E1000}} || NOT APPLICABLE || NOT APPLICABLE || <!--Comments--> |- | VMware 16+ (Other32 template) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VMWARESVGA}} || {{Yes|SB128}} || {{Yes|PCNET32}} || NOT APPLICABLE || NOT APPLICABLE || <!--Comments--> |- | QEMU 8.x ("pc" and "q35" machines) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|SB128}} || {{Yes|PCNET32}} || NOT APPLICABLE || NOT APPLICABLE || <!--Comments--> |- |} ==== Laptops ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | ACER Aspire One ZG5 || {{Yes|IDE<br/>SATA(IDE)}} || {{Yes|GMA}} || {{Yes|HDAudio}} || {{Yes|RTL8169}} || {{Yes|ATHEROS}} || NOT APPLICABLE || <!--Comments--> |- | Dell Latitude D520 || {{Yes|IDE}} || {{Yes|GMA}} || {{Yes|HDAudio}} || {{Yes|BCM4400}} || {{No|}} || {{Yes|Atheros AR5BXB63}} || * select Intel Core 2 64-bit version, not Celeron 32-bit version <br/> * replace WiFi card to get wireless working |- |} ==== Desktop Systems ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | Fujitsu Futro S720 || {{Yes|SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|HDAudio}} || {{Yes|RTL8169}} || NOT APPLICABLE || NOT APPLICABLE || * no 2D/3D acceleration<br/> * use USB ports at back |- |} ==== Motherboards ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | ASUS P8Z68V LX || {{Yes|SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || {{Yes|GeForce 8xxx/9xxx}} || * add external PCIe video card for better performance |- | Gigabyte GA-MA770T UD3/UD3P || {{Yes|IDE<br/>SATA(AHCI)}} || NOT APPLICABLE || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || {{Yes|GeForce 8xxx/9xxx}} || * requires external PCIe video card |- | ASUS M2N68-AM SE2 || {{Yes|IDE}} || {{Yes|NVIDIA}} || {{Yes|HDAudio}}|| {{Yes|NVNET}} || NOT APPLICABLE || {{Yes|GeForce 8xxx/9xxx}} || * connecting a disk via SATA connector is not supported at this time <br/> * add external PCIe video card for better performance |- | Gigabyte GA-H55M-S2H || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || {{Yes|GeForce 8xxx/9xxx}} || * add external PCIe video card for better performance |- |} ==== Legacy supported hardware ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="10%" |EOL ! width="35%" |Comments |- | iMica || {{Yes|IDE}} || {{Yes|GMA}} || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || NOT APPLICABLE || 2026-12-31 || |- | Gigabyte GA-MA770 UD3 || {{Yes|IDE<br/>SATA(IDE)}} || NOT APPLICABLE || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || {{Yes|GeForce 8xxx/9xxx}} || 2026-12-31 || * requires external PCIe video card |- |} === Recommended hardware (64-bit) === [[#top|...to the top]] Recommended hardware is hardware that has been tested with latest release of AROS and is relatively easy to purchase second hand (ie. ebay). This hardware also comes with commitment that compatibility will be maintained with each future release. ==== Virtual Hardware ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | VirtualBox 7.x (Other/Unknown (64-bit) template) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VMWARESVGA}} || {{Yes|HDAudio}} || {{Yes|PCNET32<br/>E1000}} || NOT APPLICABLE || NOT APPLICABLE || * No accelerated 3D support |- | VMware 16+ (Other64 template) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VMWARESVGA}} || {{Yes|SB128}} || {{Yes|E1000}} || NOT APPLICABLE || NOT APPLICABLE || * No accelerated 3D support |- | QEMU 8.x ("pc" and "q35" machines) || {{Yes|IDE<br/>SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|SB128}} || {{Yes|PCNET32}} || NOT APPLICABLE || NOT APPLICABLE || * No accelerated 3D support |- |} ==== Motherboards ==== {| class="wikitable" width="100%" ! width="20%" |Name ! width="5%" |Storage ! width="5%" |Gfx ! width="5%" |Audio ! width="5%" |Ethernet ! width="5%" |Wireless ! width="10%" |Additional hardware ! width="45%" |Comments |- | ASUS P8Z68V LX || {{Yes|SATA(AHCI)}} || {{Yes|VESA}} || {{Yes|HDAudio}}|| {{Yes|RTL8169}} || NOT APPLICABLE || NOT APPLICABLE || * No accelerated 3D support |- |} ==References== [[#top|...to the top]] {{reflist}} {{BookCat}} layv167rtcqvouesiz9xrsb9pbempnx 0 281266 4655484 3685654 2026-07-25T02:06:19Z ~2026-41269-10 3616777 /* b. Make a list of ten famous historic places in your country. */ I added 20 historical buildings under the heading 4655484 wikitext text/x-wiki {{honor_header|1|1938|Outreach|General Conference}} ==1. Describe the national, state or provincial, AY, Pathfinder, and Christian flags.== {| border="0" cellspacing="5" cellpadding="5" |- |'''National Flag:''' Description of national flag |[[Image:Pathfinderflag.jpg|thumb|300px|'''Pathfinder Flag:''' The Pathfinder flag is made from one of several materials, cotton bunting, rayon, or nylon. The flag is divided through the center both vertically and horizontally making four equal parts. The background colors are royal blue and white alternately sewed together with the upper left hand comer being royal blue. The Pathfinder emblem is centered in the heart of the background. The colors are descriptive of the purposes and ideals of Pathfindering. White means purity, blue means loyalty, red reminds us of the shed blood of Christ (sacrifice), and gold means excellence. The symbols also have meanings. The shield is the protection of God, the sword is his word, the Bible, and the triangle represents completeness. Completeness of the Godhead (Father, Son, and Holy Spirit), and completeness of the three parts of education (Mental, Physical, and Spiritual).]] |- |[[Image:Ayflag.jpg|thumb|300px|'''AY Flag:''' The background is red and white, red symbolizing the blood of Christ and white representing purity. In the center, there is a logo that has AY which means Adventist Youth and it has three angels meaning the 3 angels message.]] |[[Image:Christian flag.svg|thumb|300px|'''Christian Flag:''' The "Christian Flag" is a white flag with a blue canton and a red cross in it. It was designed by Charles Overton in 1897 to represent Protestants of all denominations. The cross symbolizes the crucifixion of Christ.]] |} ===Current state/provincial flags=== <!-- Find images of all the provincial flags of your country and put them here. --> ==2. Know how to display the national flag with two other flags under the following situations: a. Camp out/camporee b. Fair c. Pathfinder Day program d. Parade== ==3. Demonstrate how to fold and salute your national flag. Mention when and how it should be displayed. == ===Folding=== ===Flag Protocol=== ==4. Explain the meaning of and reason for the National Anthem, and recite the words from memory. == The national anthem of Trinidad and Tobago reflects the nature and strength of the people, their courage as one nation, working toward living in unity despite our diversity. The national anthem was written to celebrate the nation becoming independent in 1962. Words of the National Anthem : Forged from the love of liberty in the fires of hope and prayer, With boundless faith in our destiny we solemnly declare. Side by side we stand, islands of the blue Caribbean Sea, This our native land, we pledge our lives to thee. Here every creed and race find an equal place and may God bless our nation. Here every creed and race find an equal place and may God bless our nation. ==5. Give the rights and responsibilities of a citizen of your country. == ===Rights=== Based on the constitution, there are basic rights of the citizen: 1. Right to life and liberty. 2. Right to equality before the law. 3. Right to respect for private an family life. 4. Right to equal treatment from state institutions. 5. Right to expression of political views. 6. Right to freedom of expression. 7. Right to education. 8. Right to freedom of religion. 9. Right to freedom of assembly. 10. Right to freedom of the press. ===Responsibilities=== ==6. Have an interview with a local, regional, or national official of your country, and learn about his duties. == It is generally easier to get a local official to agree to an interview, though it is often more exciting to interview a more prominent person. The interview can be accomplished during a club meeting, and multiple Pathfinders can ask questions. Invite your guest well ahead of time, and make sure everyone in the club is on time. A visit by an official would be a very good reason to have everyone in the club wear their class A uniforms. If desired, you can make up several questions ahead of time, writing them on index cards, and distributing them to the members of your club. But do not be so rigid as to not allow them to ask spontaneous questions. Having questions prepared ahead of time on index cards are a good way to get things rolling. Here are some suggested questions: * Could you describe a typical day at work? * What is the most difficult part of your job? * What is the most satisfying aspect of your job? * To whom do you report? * How did you get your position? Were you elected, appointed, or hired? * How should a young person prepare for a life of public service? ==7. Write a one-page essay or give a two-minute oral report about a famous person in your country. Mention what he has done to gain his recognition. == This would be an excellent opportunity to present a worship during the opening exercises of a regular club meeting. Encourage your Pathfinder to choose a person they are personally interested in. If they cannot think of anyone themselves, have a list of suggested persons at hand and encourage them to choose from the list. Famous people might be historical figures, politicians, actors, sports stars, or anyone else. It would be preferable to choose a person who has been a positive influence on the country. Although the requirement asks that you "mention what ''he'' has done to gain ''his'' recognition," this should not be interpreted as excluding women. Men are not the ''only'' famous people in a country. Note that just because the requirement suggests that the famous person should be male (''his'' recognition), the Pathfinder should in no way feel constrained to limit the selection to just men. ==8. Do one of the following == ===a. Make a list of ten famous quotations from leaders of your country.=== ===b. Make a list of ten famous historic places in your country. === # Stollmeyer's Castle (Killarney) # Lopinot Historical Complex # Mystery Tombstone # Sacred Heart Church # Mille Fleurs # White Hall (Rosenweg) # Archbishop’s Palace # Cathedral of the Immaculate Conception # Ambard’s House (Roomor) # Hayes Court # Queen’s Royal College # Dattatreya Mandir # The Red House # Mount St. Benedict Abbey # Cabildo Building # Angelo Bissessarsingh Heritage House # Woodford Square # Lion House # Our Lady of Montserrat Church # Ortinola Estates ===c. Make a list of ten famous historic events in your country.=== ==9. Describe what you can do as a citizen to help your church and country. == The best way to help either your church or your country is by ''getting involved''. Edmund Burke, an English philosopher summed this up when he said ''"The only thing necessary for the triumph of evil is for good men to do nothing."'' In your church, this means that you will show up for services on a regular basis. It also means you will support it with your tithes and offering, show up for business meetings, and not wait to be asked before you volunteer your services. If you see something that needs done, ''do it.'' If you do not have the skill to do it, or you think that you need permission first, talk to your pastor, an elder, deacon, or deaconess. Find your ministry! For your country, it is much the same. Show up for public meetings, stay informed about the issues of the day, vote if you are eligible, and pay your taxes fairly and promptly. ==10. Go through the steps of an individual acquiring citizenship in the country and learn how this is done. == ==11. Know how to explain the process of government in your country. == ==12. Explain the meaning of this statement Jesus made in Matthew 22:21: "Render therefore unto Caesar the things which are Caesar's, and unto God the things that are God's. == This verse teaches that governmental authority is to be respected, as long as it does not conflict with the moral obligations of being a Christian. Government serves a holy purpose; preserving social order, promoting the well-being of its citizens, and protecting their safety. If you believe that this does not apply today because you see the government as corrupt, you are urged to research the Roman government of the first century A.D. when these words were spoken by Jesus. Was Herod corrupt? Was Pilate just? ==13. Explain why laws are established in your country. == ==References== {{BookCat}} bxvf8669oedt51oj8esyrn2v0d8yczd 1 302217 4655471 4629990 2026-07-24T20:10:13Z ~2026-41422-85 3616729 /* Missing documentation */ Reply 4655471 wikitext text/x-wiki Please add sample pictures! So is des nix. Meybe add sample data (points) from file last graph and function but not sin(x) data from file. tikz have importing image i'm not see any example of it. == Texample == http://www.texample.net/ has loads of examples for PGF/tikZ usage - maybe add that as a link under "see also". == Title clear in scope == If the book will address only PGF/TikZ (e.g. not <tt>picture</tt>) commands, it would be helpful if the title made this clearer, e.g. 'Drawing in LaTeX using PGF/TikZ'. (Or even just TikZ, if none of the low-level commands will be included.) == Missing documentation == The link to the documentation lead to a 404 error. It seems there is no more official documentation available for the TikZ package. [[Special:Contributions/&#126;2026-22393-43|&#126;2026-22393-43]] ([[User talk:&#126;2026-22393-43|talk]]) 22:53, 11 April 2026 (UTC) :The link is outdated - the correct link is <nowiki>https://mirrors.ctan.org/graphics/pgf/base/doc/generic/pgf/pgfmanual.pdf</nowiki>. The next link (<nowiki>http://www.texample.net/tikz/</nowiki>) leads to a page in Japanese; <nowiki>https://tikz.net/topics/</nowiki> might be better. [[Special:Contributions/&#126;2026-41422-85|&#126;2026-41422-85]] ([[User talk:&#126;2026-41422-85|talk]]) 20:10, 24 July 2026 (UTC) mmafeuteoxcih5shwm4alnxj18uu6zu 0 363856 4655473 4654275 2026-07-24T20:42:01Z Young Sigma Male 3580062 /* */ 4655473 wikitext text/x-wiki The Klingon digits from 0 to 9 are: *'''pagh''' - ''zero, 0'' *'''wa’''' - ''one, 1'' *'''cha’''' - ''two, 2'' *'''wej''' - ''three, 3'' *'''loS''' - ''four, 4'' *'''vagh''' - ''five, 5'' *'''jav''' - ''six, 6'' *'''Soch''' - ''seven, 7'' *'''chorgh''' - ''eight, 8'' *'''Hut''' - ''nine, 9'' Numbers greater than '''Hut''' are affixed to form a higher number such as '''wa’­vatlh''' (one hundred) or '''wej­vatlh vagh­maH loS''' (three hundred fifty four). *'''-maH''' - ''ten, 10'' *'''-vatlh''' - ''hundred, 100'' *'''-SaD/-Sa­nID''' - ''thousand, 1000'' *'''-netlh''' - ''ten thousand, 10,000'' *'''-bIp''' - ''hundred thousand, 100,000'' *'''-’uy’''' - ''million, 1,000,000'' *'''-Saghan''' - ''billion, 1,000,000,000'' Numbers that precede a noun are used for counting (e.g. '''cha’ Duj''' two vessels), numbers that follow a noun are used for numbering (e.g. '''Duj cha’''' vessel number two). Other number modifiers include: *'''-DIch''' - ''ordinal (follows the noun)'' *'''-logh''' - ''repetitions; multiples (becomes adverb)'' <br> * '''wa’DIch''' - first * '''cha’DIch''' - second * '''wa’maH vaghDIch''' - fifteenth <br> * '''wa’logh''' - once * '''cha’logh''' - twice * '''chorghvatlhlogh''' - eight hundred times {{BookCat}} gve7by9um98trcpww7gtm7lgdu94em7 0 383033 4655459 4655456 2026-07-24T12:22:17Z Kittycataclysm 3371989 Rejected the last text change (by [[Special:Contributions/All About World History|All About World History]]) and restored revision 4294742 by 41.113.172.73; outlinks like this are not wikibooks custom 4655459 wikitext text/x-wiki Aristotle was an ancient Greek philosopher and scientist born in the city of Stagira, Chalkidice, on the northern periphery of Classical Greece. His father, Nicomachus, died when Aristotle was a child, whereafter Proxenus of Atarneus became his guardian. At seventeen or eighteen years of age, he joined Plato's Academy in Athens and remained there until the age of thirty-seven (c. 347 BC). His writings cover many subjects – including physics, biology, zoology, metaphysics, logic, ethics, aesthetics, poetry, theater, music, rhetoric, psychology, linguistics, politics and government – and constitute the first comprehensive system of Western philosophy. Shortly after Plato died, Aristotle left Athens and, at the request of Philip II of Macedon, tutored Alexander the Great beginning in 343 BC == Life of Aristotle == == Teleology == == ''The Politics'' == == ''Nicomachean Ethics'' == == Reference and further readings == * {{wikipedia-inline|Aristotle}} {{wikipedia-inline|Politics (Aristotle)}} {{wikipedia-inline|Nicomachean Ethics}} {{...}} {{BookCat}} 8qo6nu8u49w39esjkazin67wihyokr8 0 398642 4655470 4108830 2026-07-24T19:11:34Z ~2026-41230-40 3616722 4655470 wikitext text/x-wiki {{Navigate|Book=Intellectual Property and the Internet|Curr=Search engines|Prev=Proxy servers|Next=Anonymizers}} [[File:Mayflower Wikimedia Commons image search engine screenshot.png|thumb|upright=1.35|The results of a search for the term "lunar eclipse" in a web-based image search engine]] A '''search engine''' is a software system that is designed to search for information placed on web pages on the Internet. The response from the service is generally presented in a vertical list on what is most often referred to as a ''results page''. The information may be a mix of web pages, images, videos, maps and other types of files. Some search engines also mine data from public databases or open directories. Unlike web directories, which are maintained only by human editors, search engines also maintain real-time information by running a web crawler which applies their search algorithm to all new and changed web pages it finds. Internet content that is not capable of being searched by a web search engine is generally described as the "deep web." == History == <!-- Keep this list limited to notable engines (i.e. those that already have Wikipedia articles) to avoid link spam. --> {| class="wikitable bordered infobox" |+ Search engine timeline<!--Note: "Launch" refers only to web availability of original crawl-based web search engine results.--> |- ! Year !! Engine !! Current status |- | rowspan="4" | 1993 | W3Catalog | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Aliweb | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | JumpStation | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | World-Wide Web Worm | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="4" | 1994 | WebCrawler | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (Aggregator) |- | Go.com | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Disney) |- | Lycos | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Infoseek | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Disney) |- | rowspan="6" | 1995 | Daum | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Magellan | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Excite | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | SAPO | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Yahoo! (directory) | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (as Yahoo! Search since 2004) |- | AltaVista | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (acquired by Yahoo!: 2003, redirected: 2013) |- | rowspan="4" | 1996 | Dogpile | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (Aggregator) |- | Inktomi | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (acquired by Yahoo!) |- | HotBot | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (Lycos.com) |- | Ask Jeeves | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (rebranded as Ask.com) |- | rowspan="2" | 1997 | Northern Light | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Yandex | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | rowspan="4" | 1998 | Google | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Ixquick | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (alias of Startpage) |- | MSN Search | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (as Bing) |- | empas | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (merged with NATE) |- | rowspan="5" | 1999 | AlltheWeb | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Yahoo!) |- | GenieKnows | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (rebranded Yellowee.com) |- | Naver | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Teoma | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Ask.com) |- | Vivisimo | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="3" | 2000 | Baidu | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Exalead | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Gigablast | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | 2001 | Kartoo | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="2" | 2003 | Info.com | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Scroogle | style="background-color: #ff9090; color: #00; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="3" | 2004 | Yahoo! Search | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (originally Yahoo! (directory), 1995) |- | A9.com | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Sogou | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | rowspan="2" | 2005 | AOL Search | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | SearchMe | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="6" | 2006 | Soso | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Sogou) |- | Quaero | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Search.com | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | ChaCha | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Ask.com | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (originally Ask Jeeves, 1996) |- | Live Search | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (as Bing, originally MSN Search, 1998) |- | rowspan="4" | 2007 | wikiseek | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Sproose | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Wikia Search | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Blackle.com | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (alias of Google) |- | rowspan="7" | 2008 | Powerset | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Bing) |- | Picollator | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Viewzi | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Boogami | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | LeapFish | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Forestle | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Ecosia) |- | DuckDuckGo | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | rowspan="6" | 2009 | Bing | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (originally MSN Search, 1998) |- | Yebol | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Mugurdy | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" |Inactive |- | Scout (by Goby) | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | NATE | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Ecosia | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | rowspan="3" | 2010 | Blekko | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (sold to IBM) |- | Cuil | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | Yandex (English) | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | 2011 | YaCy | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (Peer-to-peer search engine) |- | rowspan="1" | 2012 | Volunia | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive |- | rowspan="2" | 2013 | Qwant | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |- | Infoseek | style="background-color: #ff9090; color: #000; text-align: center; vertical-align: middle;" | Inactive (redirects to Disney) |- | 2014 | Egerin | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (Kurdish/Sorani search engine) |- | 2015 | Cliqz | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active (browser-integrated search engine) |- | 2016 | Search Encrypt | style="background-color: #90ff90; color: #000; text-align: center; vertical-align: middle;" | Active |} Internet search engines themselves predate the debut of the Web in December 1990. The ''Who is'' user search dates back to 1982<ref>{{Cite web|first1=Ken|last1=Harrenstien|first2=Vic|last2=White|url=https://tools.ietf.org/html/rfc812|title=RFC 812 - NICNAME/WHOIS|publisher=Internet Engineering Task Force|date=1982-03-01|access-date=2022-02-12|df=mdy-all}}</ref> and the Knowbot Information Service multi-network user search was first implemented in 1989.<ref>{{Cite web|url=https://www.cnri.reston.va.us/home/koe/iwooos-full.html|title=Knowbot programming: System support for mobile agents|publisher=Corporation for National Research Initiatives}}</ref> The first well-documented search engine that searched content files, namely [[Communication Networks/File Transfer Protocol|FTP]] files was ''Archie'', which debuted on September 10^th, 1990.<ref>{{Cite web|url=https://groups.google.com/g/comp.archives/c/LWVA50W8BKk/m/wyRbF_lDc6cJ|title=&#91;next&#93; An Internet archive server server (was about Lisp) - comp.archives|last=Deutsch|first=Peter|date=1990-09-11|website=Google Groups|access-date=2022-02-12|df=mdy-all}}</ref> Prior to September, 1993, the World Wide Web was entirely indexed by hand. There was a list of web servers edited by Tim Berners-Lee and hosted on the CERN web site. One Google.nl snapshot of the list in 1992 remains,<ref>{{Cite web|url=https://www.w3.org/History/19921103-hypertext/hypertext/DataSources/WWW/Servers.html|title=World-Wide Web Servers|publisher=World Wide Web Consortium (W3C)|access-date=2022-02-12|df=mdy-all}}</ref> but as more and more web servers went online, the central list could no longer keep up. On the NCSA (National Center for Supercomputing Applications) site, new servers were announced under the title "What's New!"<ref>{{Cite web|url=http://home.mcom.com/home/whatsnew/whats_new_0294.html|title=What's New! February 1994|publisher=Mosaic Communications Corporation|access-date=2022-02-12|df=mdy-all}}</ref> The first tool used for searching content (as opposed to users) on the [[Internet]] was Archie.<ref name="LeidenUnivSE">{{Cite web|url=http://www.internethistory.leidenuniv.nl/index.php3?c=7|title=Internet History - Search Engines (from Search Engine Watch)|publisher=Universiteit Leiden|date=September 2001|archive-url=https://web.archive.org/web/20090413030108if_/http://www.internethistory.leidenuniv.nl:80/index.php3?c=7|archive-date=2009-04-13|url-status=dead|access-date=2022-02-12|language=en-US|df=mdy-all}}</ref> The name stands for "archive," without the "v". It was created by Alan Emtage, Bill Heelan and J. Peter Deutsch, all computer science students at McGill University in Montreal, Quebec, Canada. The program downloaded the directory listings of all the files located on public, anonymous FTP (File Transfer Protocol) sites to create a searchable database of file names; however, Archie Search Engine did not index the contents of these sites, since the amount of data was so limited it could be readily searched manually. The rise of Gopher (created in 1991 by Mark McCahill at the University of Minnesota) led to two new search programs, Veronica and Jughead. Like Archie, they searched the file names and titles stored in Gopher index systems. Veronica (''V''ery ''E''asy ''R''odent-''O''riented ''N''et-wide ''I''ndex to ''C''omputerized ''A''rchives) provided a keyword search of most Gopher menu titles in the entire Gopher listings. Jughead (''J''onzy's ''U''niversal ''G''opher ''H''ierarchy ''E''xcavation ''A''nd ''D''isplay) was a tool for obtaining menu information from specific Gopher servers. While the name of the search engine "Archie Search Engine" was not a reference to the Archie comic book series, "Veronica" and "Jughead" are characters in the series, thus referencing their predecessor. In the summer of 1993, no search engine existed for the web, though numerous specialized catalogues were maintained by hand. Oscar Nierstrasz at the University of Geneva wrote a series of [[Perl]] scripts that periodically mirrored these pages and rewrote them into a standard format. This formed the basis for W3Catalog, the web's first primitive search engine, released on September 2^nd, 1993.<ref name="Announcement html">{{Cite web|url=https://groups.google.com/g/comp.infosystems.www/c/IXZSajbci9M?hl=en#2718fd17812937ac|title=Searchable Catalog of WWW Resources (experimental)|first=Oscar|last=Nierstrasz|date=1993-09-02|access-date=2022-02-12|df=mdy-all}}</ref> In June 1993, Matthew Gray, then at MIT, produced what was probably the first web robot, the [[Perl]]-based World Wide Web Wanderer, and used it to generate an index called 'Wandex'. The purpose of the Wanderer was to measure the size of the World Wide Web, which it did until late 1995. The web's second search engine, Aliweb, appeared in November 1993. Aliweb did not use a web robot, but instead depended on being notified by website administrators of the existence at each site of an index file in a particular format. The National Center for Supercomputing Applications' Mosaic™ web browser wasn't the first to exist, but it was the first to make a major splash.<ref>{{Cite web|url=http://www.ncsa.illinois.edu/enabling/mosaic|title=Enabling Discovery - NCSA Mosaic|publisher=National Center for Supercomputing Applications|archive-url=https://web.archive.org/web/20210817193708if_/http://www.ncsa.illinois.edu/enabling/mosaic|archive-date=2021-08-17|url-status=dead|df=mdy-all}}</ref> In November 1993, Mosaic v1.0 broke away from the small pack of existing browsers by including features like icons, bookmarks, a more attractive interface and pictures—that made the software easy to use and appealing to "non-geeks." JumpStation (created in December 1993<ref>{{Cite web|url=http://archive.ncsa.uiuc.edu/SDG/Software/Mosaic/Docs/old-whats-new/whats-new-1293.html|archive-url=https://web.archive.org/web/20060117031744if_/http://archive.ncsa.uiuc.edu:80/SDG/Software/Mosaic/Docs/old-whats-new/whats-new-1293.html|archive-date=2006-01-17|url-status=dead|title=What's New, December 1993|publisher=National Center for Supercomputing Applications|date=1993-12-28|access-date=2022-02-12|df=mdy-all}}</ref> by Jonathon Fletcher) used a web robot to find web pages and to build its index, and used a web form as the interface to its query program. It was, thus, the first WWW resource-discovery tool to combine the three essential features of a web search engine (crawling, indexing and searching) as described below. Because of the limited resources available on the platform it ran on, its indexing was limited to the titles and headings found in the web pages the crawler encountered, with such limits naturally extending to the searches performed on it as well. One of the first "all text" crawler-based search engines was WebCrawler, which came out in 1994. Unlike its predecessors, it allowed users to search for any word on any webpage, which has long been the standard for all major search engines of the modern era. It was also the first one widely known by the public. Later in 1994, Lycos (which started at Carnegie Mellon University) was launched and became a major commercial endeavor in the field. Soon after, many search engines appeared and vied for popularity. These included Magellan, Excite, Infoseek, Inktomi, Northern Light, and AltaVista. Yahoo! was among the most popular ways for people to find web pages of interest, but its search function operated on its web directory, rather than its full-text copies of web pages. Information seekers could also browse the directory instead of doing a keyword-based search. In 1996, Netscape was looking to give an exclusive deal to a single search engine to appear as the featured search engine in their eponymous web browser. There was so much interest that instead Netscape struck deals with five of the major search engines: for $5 million/year, each search engine would be in rotation on the Netscape search engine page. The five engines were: Yahoo!, Magellan, Lycos, Infoseek, and Excite.<ref>{{Cite web|title=Yahoo! And Netscape Ink International Distribution Deal|url=https://www.altaba.com/news-releases/news-release-details/yahoo-and-netscape-ink-international-distribution-deal|date=1997-07-08|website=Yahoo!|access-date=2022-02-12|df=mdy-all}}</ref><ref>{{Cite journal|date=1996-04-01|title=Browser Deals Push Netscape Stock Up 7.8%|publisher=Los Angeles Times|url=https://www.latimes.com/archives/la-xpm-1996-04-01-fi-53780-story.html|access-date=2022-02-12|df=mdy-all}}</ref> Google adopted the idea of selling search terms in 1998, from a small search engine company named goto.com. This move had a significant effect on the SE business, which went from struggling to one of the most profitable businesses in the internet.<ref>{{Cite web|url=https://psu.pb.unizin.org/ist110/chapter/2-1-search-engines/|title=Search Engines|last=Pursel|first=Bart|date=|website=Penn State Pressbooks|access-date=February 20, 2018}}</ref> Search engines were also known as some of the brightest stars in the Internet investing frenzy that occurred in the late 1990s.<ref>{{cite journal |last=Gandal |first=Neil |authorlink= |year=2001 |title=The dynamics of competition in the internet search engine market |journal=International Journal of Industrial Organization |volume=19 |issue=7 |pages=1103–1117 |doi=10.1016/S0167-7187(01)00065-0 |url= |accessdate=|quote= }}</ref> Several companies entered the market spectacularly, receiving record gains during their initial public offerings. Some have taken down their public search engine, and are marketing enterprise-only editions, such as Northern Light. Many search engine companies were caught up in the dot-com bubble, a speculation-driven market boom that peaked in 1999 and ended in 2001. * Around 2000, Google's search engine rose to prominence.<ref>{{cite web|url=https://www.google.com/about/company/history/ |title=Our History in depth |publisher=W3.org |accessdate=2012-10-31}}</ref> The company achieved better results for many searches with an innovation called PageRank, as was explained in the paper ''Anatomy of a Search Engine'' written by Sergey Brin and Larry Page, the later founders of Google.<ref>{{cite web|url=http://ilpubs.stanford.edu:8090/361/1/1998-8.pdf|title=The Anatomy of a Large-Scale Hypertextual Web Search Engine|last1=Brin|first1=Sergey|last2=Page|first2=Larry}}</ref> This iterative algorithm ranks web pages based on the number and PageRank of other web sites and pages that link there, on the premise that good or desirable pages are linked to more than others. Google also maintained a minimalist interface to its search engine. In contrast, many of its competitors embedded a search engine in a web portal. In fact, Google search engine became so popular that spoof engines emerged such as Mystery Seeker. By 2000, Yahoo! was providing search services based on Inktomi's search engine. Yahoo! acquired Inktomi in 2002, and Overture (which owned AlltheWeb and AltaVista) in 2003. Yahoo! switched to Google's search engine until 2004, when it launched its own search engine based on the combined technologies of its acquisitions. Microsoft first launched MSN Search in the fall of 1998 using search results from Inktomi. In early 1999 the site began to display listings from Looksmart, blended with results from Inktomi. For a short time in 1999, MSN Search used results from AltaVista instead. In 2004, Microsoft began a transition to its own search technology, powered by its own web crawler (called msnbot). Microsoft's rebranded search engine, Bing, was launched on June 1, 2009. On July 29, 2009, Yahoo! and Microsoft finalized a deal in which Yahoo! Search would be powered by Microsoft Bing technology. == Approach == {{anchor|Workings}} A search engine maintains the following processes in near real time: # Web crawling # Indexing # Searching<ref name=Jawadekar2011>{{citation |year=2011 |author=Jawadekar, Waman S |title=Knowledge Management: Text & Cases |url= |chapter=8. Knowledge Management: Tools and Technology |chapterurl=https://books.google.com/books?id=XmGx4J9daUMC&pg=PA278 |page=278 |place=New Delhi |publisher=Tata McGraw-Hill Education Private Ltd |isbn=978-0-07-07-0086-4 |accessdate=November 23, 2012 }}</ref> Web search engines get their information by web crawling from site to site. The "spider" checks for the standard filename ''robots.txt'', addressed to it, before sending certain information back to be indexed depending on many factors, such as the titles, page content, [[JavaScript]], [[Cascading Style Sheets]] (CSS), headings, as evidenced by the standard [[HTML]] markup of the informational content, or its metadata in HTML meta tags. "[N]o web crawler may actually crawl the entire reachable web. Due to infinite websites, spider traps, spam, and other exigencies of the real web, crawlers instead apply a crawl policy to determine when the crawling of a site should be deemed sufficient. Some sites are crawled exhaustively, while others are crawled only partially".<ref>Dasgupta, Anirban; Ghosh, Arpita; Kumar, Ravi; Olston, Christopher; Pandey, Sandeep; and Tomkins, Andrew. ''The Discoverability of the Web''. http://www.arpitaghosh.com/papers/discoverability.pdf</ref> Indexing means associating words and other definable tokens found on web pages to their domain names and HTML-based fields. The associations are made in a public database, made available for web search queries. A query from a user can be a single word. The index helps find information relating to the query as quickly as possible.<ref name=Jawadekar2011/> Some of the techniques for indexing, and caching are trade secrets, whereas web crawling is a straightforward process of visiting all sites on a systematic basis. Between visits by the ''spider'', the cached version of page (some or all the content needed to render it) stored in the search engine working memory is quickly sent to an inquirer. If a visit is overdue, the search engine can just act as a web proxy instead. In this case the page may differ from the search terms indexed.<ref name=Jawadekar2011/> The cached page holds the appearance of the version whose words were indexed, so a cached version of a page can be useful to the web site when the actual page has been lost, but this problem is also considered a mild form of linkrot. <!-- perhaps at web cache: , and Google's handling of it increases [[usability]] by satisfying [[user expectations]] that the search terms will be on the returned webpage. This satisfies the [[principle of least astonishment]], since the user normally expects that the search terms will be on the returned pages. Increased search relevance makes these cached pages very useful as they may contain data that may no longer be available elsewhere.{{Citation needed|date=November 2012}} --> [[File:WebCrawlerArchitecture.svg|thumb|High-level architecture of a standard Web crawler]] Typically when a user enters a query into a search engine it is a few keywords.<ref>Jansen, B. J., Spink, A., and Saracevic, T. 2000. [https://faculty.ist.psu.edu/jjansen/academic/pubs/jansen_real_life_real_users_and_real_needs.pdf Real life, real users, and real needs: A study and analysis of user queries on the web. Information Processing & Management]. 36(2), 207-227.</ref> The index already has the names of the sites containing the keywords, and these are instantly obtained from the index. The real processing load is in generating the web pages that are the search results list: Every page in the entire list must be weighted according to information in the indexes.<ref name=Jawadekar2011/> Then the top search result item requires the lookup, reconstruction, and markup of the ''snippets'' showing the context of the keywords matched. These are only part of the processing each search results web page requires, and further pages (next to the top) require more of this post processing. Beyond simple keyword lookups, search engines offer their own GUI- or command-driven operators and search parameters to refine the search results. These provide the necessary controls for the user engaged in the feedback loop users create by ''filtering'' and ''weighting'' while refining the search results, given the initial pages of the first search results. For example, from 2007 the Google.com search engine has allowed one to ''filter'' by date by clicking "Show search tools" in the leftmost column of the initial search results page, and then selecting the desired date range.<ref>{{cite web|last1=Chitu|first1=Alex|title=Easy Way to Find Recent Web Pages|url=http://googlesystem.blogspot.com/2007/08/easy-way-to-find-recent-web-pages.html|website=Google Operating System|accessdate=22 February 2015|date=August 30, 2007}}</ref> It's also possible to ''weight'' by date because each page has a modification time. Most search engines support the use of the boolean operators AND, OR and NOT to help end users refine the search query. Boolean operators are for literal searches that allow the user to refine and extend the terms of the search. The engine looks for the words or phrases exactly as entered. Some search engines provide an advanced feature called proximity search, which allows users to define the distance between keywords.<ref name=Jawadekar2011/> There is also concept-based searching where the research involves using statistical analysis on pages containing the words or phrases you search for. As well, natural language queries allow the user to type a question in the same form one would ask it to a human.<ref>"[https://www.academia.edu/2475776/Versatile_question_answering_systems_seeing_in_synthesis Versatile question answering systems: seeing in synthesis]", Mittal et al., IJIIDS, 5(2), 119-142, 2011.</ref> A site like this would be ask.com.<ref>http://www.ask.com. Retrieved 10 September 2015.</ref> The usefulness of a search engine depends on the relevance of the ''result set'' it gives back. While there may be millions of web pages that include a particular word or phrase, some pages may be more relevant, popular, or authoritative than others. Most search engines employ methods to rank the results to provide the "best" results first. How a search engine decides which pages are the best matches, and what order the results should be shown in, varies widely from one engine to another.<ref name=Jawadekar2011/> The methods also change over time as Internet usage changes and new techniques evolve. There are two main types of search engine that have evolved: one is a system of predefined and hierarchically ordered keywords that humans have programmed extensively. The other is a system that generates an "inverted index" by analyzing texts it locates. This first form relies much more heavily on the computer itself to do the bulk of the work. Most Web search engines are commercial ventures supported by [[advertising]] revenue and thus some of them allow advertisers to have their listings ranked higher in search results for a fee. Search engines that do not accept money for their search results make money by running search related ads alongside the regular search engine results. The search engines make money every time someone clicks on one of these ads.<ref>{{cite web|title=FAQ|url=https://rankstar.io/|publisher=RankStar|accessdate=19 June 2013}}</ref> == Market share == Google is the world's most popular search engine, with a market share of 74.52 percent as of February, 2018.<ref name="NMS">{{cite web|url=https://www.netmarketshare.com/search-engine-market-share.aspx?qprid=4&qpcustomd=0|title=Desktop Search Engine Market Share|publisher=NetMarketShare|accessdate=15 February 2018}}</ref> The world's most popular search engines (with >1% market share) are: {| class="wikitable sortable" ! Search engine !! colspan="2" | Market share (as of February 2018) |- | [[Google Search|Google]] || style="text-align: right;" | {{#if:{{{2|}}} | {{#if:{{#titleparts:{{{2}}}|1|2}}|{{#if:{{#titleparts:{{{2}}}|1|1}}|{{{1}}}{{{2}}}|{{convert|{{{1}}}|{{#titleparts:{{{2}}}|1|2}}|{{#titleparts:{{{2}}}|1|3}}|{{#titleparts:{{{2}}}|1|4}}|abbr=on}} }}|{{{1}}}{{{2}}} }} | {{{1|&mdash;}}} }} {{#ifexpr:{{#if:{{{3|}}}|{{{3}}}|0}}<0 | {{!}}{{!}} {{#ifexpr:{{formatnum:{{{1|0}}}|R}}<0 | align="right" {{!}} <div style="width:{{#expr:-abs({{#if:{{{3|}}}|{{{3}}}|1}})*{{formatnum:{{{1}}}|R}} }}px;height:{{#if:{{{4|}}}|{{{4}}}|2ex}};background:#aaa;{{{5|}}}">&nbsp;</div>|}} | }} | {{#ifexpr:{{formatnum:{{{1|0}}}|R}}>0 | align="left" {{!}} <span style="display:none;">{{#expr:{{formatnum:{{{1}}}|R}} }}</span><div style="width:{{#expr:abs({{#if:{{{3|}}}|{{{3}}}|1}})*{{formatnum:{{{1}}}|R}} }}px;height:{{#if:{{{4|}}}|{{{4}}}|2ex}};background:#aaa;{{{5|}}}">&nbsp;</div>|}}{{bartable| 74.06|%|2}} |- | [[Bing (search engine)|Bing]] || style="text-align:right;"|{{bartable| 8.06|%|2}} |- | [[Baidu]] || style="text-align:right;"|{{bartable| 10.94|%|2}} |- | [[Yahoo!]] || style="text-align:right;"|{{bartable| 5.32|%|2}} |} === East Asia and Russia === In some East Asian countries and Russia, Google is not the most popular search engine. In Russia, Yandex commands a marketshare of 61.9 percent, compared to Google's 28.3 percent.<ref>{{cite web|url=http://www.liveinternet.ru/stat/ru/searches.html?slice=ru;period=week|title=Live Internet - Site Statistics|publisher=Live Internet|accessdate=2014-06-04}}</ref> In China, Baidu is the most popular search engine.<ref>{{cite news|url=https://www.theguardian.com/world/2014/jun/03/chinese-technology-companies-huawei-dominate-world|title=The Chinese technology companies poised to dominate the world|publisher=The Guardian|author=Arthur, Charles|date=2014-06-03|accessdate=2014-06-04}}</ref> South Korea's homegrown search portal, Naver, is used for 70 percent of online searches in the country.<ref>{{cite web|url=https://blogs.wsj.com/korearealtime/2014/05/21/how-naver-hurts-companies-productivity/|title=How Naver Hurts Companies’ Productivity|publisher=The Wall Street Journal|date=2014-05-21|accessdate=2014-06-04}}</ref> Yahoo! Japan and Yahoo! Taiwan are the most popular avenues for internet search in Japan and Taiwan, respectively.<ref>{{cite web|url=http://geography.oii.ox.ac.uk/?page=age-of-internet-empires|title=Age of Internet Empires|publisher=Oxford Internet Institute|accessdate=2014-06-04}}</ref> ===Europe=== Markets in Western Europe are mostly dominated by Google, with some exceptions such as the Czech Republic, where Seznam is a strong competitor.<ref>[http://www.doz.com/search-engine/seznam-search-engine Seznam Takes on Google in the Czech Republic]. Doz.</ref> == Search engine bias == Although search engines are programmed to rank websites based on some combination of their popularity and relevancy, empirical studies indicate various political, economic, and social biases in the information they provide<ref>Segev, El (2010). Google and the Digital Divide: The Biases of Online Knowledge, Oxford: Chandos Publishing.</ref><ref name=vaughan-thelwall>{{cite journal|last=Vaughan|first=Liwen|author2=Mike Thelwall |title=Search engine coverage bias: evidence and possible causes|journal=Information Processing & Management|year=2004|volume=40|issue=4|pages=693–707|doi=10.1016/S0306-4573(03)00063-3}}</ref> and the underlying assumptions about the technology.<ref>Jansen, B. J. and Rieh, S. (2010) [https://faculty.ist.psu.edu/jjansen/academic/jansen_theoretical_constructs.pdf The Seventeen Theoretical Constructs of Information Searching and Information Retrieval]. Journal of the American Society for Information Sciences and Technology. 61(8), 1517-1534.</ref> These biases can be a direct result of economic and commercial processes (e.g., companies that advertise with a search engine can become also more popular in its organic search results), and political processes (e.g., the removal of search results to comply with local laws).<ref>Berkman Center for Internet & Society (2002), [http://cyber.law.harvard.edu/filtering/china/google-replacements/ "Replacement of Google with Alternative Search Systems in China: Documentation and Screen Shots"], Harvard Law School.</ref> For example, Google will not surface certain neo-Nazi websites in France and Germany, where Holocaust denial is illegal. Biases can also be a result of social processes, as search engine algorithms are frequently designed to exclude non-normative viewpoints in favor of more "popular" results.<ref>{{cite journal|last=Introna|first=Lucas|author2=[[Helen Nissenbaum]] |title=Shaping the Web: Why the Politics of Search Engines Matters|journal=The Information Society: An International Journal|year=2000|volume=16|issue=3|doi=10.1080/01972240050133634}}</ref> Indexing algorithms of major search engines skew towards coverage of U.S.-based sites, rather than websites from non-U.S. countries.<ref name=vaughan-thelwall /> Google Bombing is one example of an attempt to manipulate search results for political, social or commercial reasons. Several scholars have studied the cultural changes triggered by search engines,<ref>{{Cite book|title = Google and the Culture of Search|url = https://books.google.com/books?id=R7Lzp7apkJgC|publisher = Routledge|date = 2012-10-12|isbn = 9781136933066|first = Ken|last = Hillis|first2 = Michael|last2 = Petit|first3 = Kylie|last3 = Jarrett}}</ref> and the representation of certain controversial topics in their results, such as terrorism in Ireland<ref>{{Cite book|title = ‘Googling’ Terrorists: Are Northern Irish Terrorists Visible on Internet Search Engines?|url = https://link.springer.com/chapter/10.1007/978-3-540-75829-7_10|publisher = Springer Berlin Heidelberg|date = 2008-01-01|isbn = 978-3-540-75828-0|pages = 151–175|series = Information Science and Knowledge Management|doi = 10.1007/978-3-540-75829-7_10|first = P.|last = Reilly|editor-first = Prof Dr Amanda|editor-last = Spink|editor-first2 = Michael|editor-last2 = Zimmer}}</ref> and conspiracy theories.<ref>{{Cite web|url = http://firstmonday.org/ojs/index.php/fm/article/view/5597|title = Google chemtrails: A methodology to analyze topic representation in search engines|date = |accessdate = |website = First Monday|publisher = |last = Ballatore|first = A}}</ref> == Customized results and filter bubbles == Many search engines such as Google and Bing provide customized results based on the user's activity history. This leads to an effect that has been called a filter bubble. The term describes a phenomenon in which websites use algorithms to selectively guess what information a user would like to see, based on information about the user (such as location, past click behaviour and search history). As a result, websites tend to show only information that agrees with the user's past viewpoints, effectively isolating the user in a bubble that tends to exclude contrary information. Prime examples are Google's personalized search results and Facebook's personalized news stream. According to Eli Pariser, who coined the term, users get less exposure to conflicting viewpoints and are isolated intellectually in their own informational bubble. Pariser relayed an example in which one user searched Google for "BP" and got investment news about British Petroleum while another searcher got information about the Deepwater Horizon oil spill and that the two search results pages were "strikingly different".<ref name=twsT43>{{cite news |first1= Lynn | last1= Parramore |title= The Filter Bubble |work= The Atlantic |quote= Since Dec. 4, 2009, Google has been personalized for everyone. So when I had two friends this spring Google "BP," one of them got a set of links that was about investment opportunities in BP. The other one got information about the oil spill.... |date= 10 October 2010 |url= https://www.theatlantic.com/daily-dish/archive/2010/10/the-filter-bubble/181427/ |accessdate= 2011-04-20 }}</ref><ref name=twsO11>{{cite news |first= Jacob | last= Weisberg |title= Bubble Trouble: Is Web personalization turning us into solipsistic twits? |work= Slate |date= 10 June 2011 |url= http://www.slate.com/id/2296633/ |accessdate= 2011-08-15 }}</ref><ref name=twsO14>{{cite news |first= Doug | last= Gross |title= What the Internet is hiding from you |publisher= ''CNN'' |quote= I had friends Google BP when the oil spill was happening. These are two women who were quite similar in a lot of ways. One got a lot of results about the environmental consequences of what was happening and the spill. The other one just got investment information and nothing about the spill at all. |date= May 19, 2011 |url= http://edition.cnn.com/2011/TECH/web/05/19/online.privacy.pariser/ |accessdate= 2011-08-15 }}</ref> The bubble effect may have negative implications for civic discourse, according to Pariser.<ref>{{cite journal| last1= Zhang | first1= Yuan Cao | first2= Diarmuid Ó |last2= Séaghdha | first3= Daniele | last3= Quercia | first4 =Tamas | last4 = Jambor |title=Auralist: Introducing Serendipity into Music Recommendation|journal=ACM WSDM |date=February 2012|url=http://www-typo3.cs.ucl.ac.uk/fileadmin/UCL-CS/research/Research_Notes/RN_11_21.pdf}}</ref> Since this problem has been identified, competing search engines have emerged that seek to avoid this problem by not tracking or "bubbling" users, such as DuckDuckGo. Other scholars do not share Pariser's view, finding the evidence in support of his thesis unconvincing.<ref>{{Cite journal|title = In Worship of an Echo|url = http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6841549|journal = IEEE Internet Computing|date = 2014-07-01|issn = 1089-7801|pages = 79–83|volume = 18|issue = 4|doi = 10.1109/MIC.2014.71|first = K.|last = O'Hara}}</ref> == Christian, Islamic and Jewish search engines == The global growth of the Internet and electronic media in the Arab and Muslim World during the last decade has encouraged Islamic adherents in the Middle East and Asian sub-continent, to attempt their own search engines, their own filtered search portals that would enable users to perform safe searches. More than usual ''safe search'' filters, these Islamic web portals categorizing websites into being either "halal" or "haram", based on modern, expert, interpretation of the "Law of Islam". ImHalal came online in September 2011. Halalgoogling came online in July 2013. These use haram filters on the collections from Google and Bing (and others).<ref>{{cite web|url=http://news.msn.com/science-technology/new-islam-approved-search-engine-for-muslims |title=New Islam-approved search engine for Muslims |publisher=News.msn.com |date= |accessdate=2013-07-11}}</ref> While lack of investment and slow pace in technologies in the Muslim World has hindered progress and thwarted success of an Islamic search engine, targeting as the main consumers Islamic adherents, projects like Muxlim, a Muslim lifestyle site, did receive millions of dollars from investors like Rite Internet Ventures, and it also faltered. Other religion-oriented search engines are Jewgle, the Jewish version of Google, and SeekFind.org, which is Christian. SeekFind filters sites that attack or degrade their faith.<ref>{{cite web|url=http://allchristiannews.com/halalgoogling-muslims-get-their-own-sin-free-google-should-christians-have-christian-google/|title=Halalgoogling: Muslims Get Their Own "sin free" Google; Should Christians Have Christian Google? - Christian Blog|work=Christian Blog}}</ref> == Search engine submission == Search engine submission is a process in which a webmaster submits a website directly to a search engine. While search engine submission is sometimes presented as a way to promote a website, it generally is not necessary because the major search engines use web crawlers, that will eventually find most web sites on the Internet without assistance. They can either submit one web page at a time, or they can submit the entire site using a sitemap, but it is normally only necessary to submit the home page of a web site as search engines are able to crawl a well designed website. There are two remaining reasons to submit a web site or web page to a search engine: to add an entirely new web site without waiting for a search engine to discover it, and to have a web site's record updated after a substantial redesign. Some search engine submission software not only submits websites to multiple search engines, but also add links to websites from their own pages. This could appear helpful in increasing a website's ranking, because external links are one of the most important factors determining a website's ranking. However, John Mueller of Google has stated that this "can lead to a tremendous number of unnatural links for your site" with a negative impact on site ranking.<ref name="CanBeHarmful">{{cite news |last=Schwartz |first=Barry |authorlink=Barry Schwartz (technologist) |url=https://www.seroundtable.com/search-engine-submission-google-15906.html |title=Google: Search Engine Submission Services Can Be Harmful |work=[[Search Engine Roundtable]] |date=2012-10-29 |accessdate=2016-04-04 }}</ref> == See also == * [[Semantic Web]] == References == {{Reflist|38em}} == Further reading == * {{Cite journal | quotes =| author =Steve Lawrence; C. Lee Giles | year =1999| title =Accessibility of information on the web | journal =[[Nature (journal)|Nature]] | volume =400 | issue =6740| doi =10.1038/21987 | pmid =10428673 | pages =107–9 }} * Bing Liu (2007), ''[http://www.cs.uic.edu/~liub/WebMiningBook.html Web Data Mining: Exploring Hyperlinks, Contents and Usage Data].'' Springer,{{ISBN|3-540-37881-2}} * Bar-Ilan, J. (2004). The use of Web search engines in information science research. ARIST, 38, 231-288. * {{cite book | first =Mark | last =Levene | year =2005 | title =An Introduction to Search Engines and Web Navigation | publisher =Pearson | location =| isbn =}} * {{cite book | first =Randolph | last =Hock | year =2007 | title =The Extreme Searcher's Handbook}}{{ISBN|978-0-910965-76-7}} * {{cite journal | quotes =| author =Javed Mostafa |date= February 2005 | title =Seeking Better Web Searches | journal =[[Scientific American]] | volume =| issue =| pages =| publisher =| pmid =| doi =| bibcode =| url =http://www.sciam.com/article.cfm?articleID=0006304A-37F4-11E8-B7F483414B7F0000 | language =}} * {{cite journal |last=Ross |first=Nancy |authorlink=|author2=Wolfram, Dietmar |year=2000 |title=End user searching on the Internet: An analysis of term pair topics submitted to the Excite search engine |journal=Journal of the American Society for Information Science |volume=51 |issue=10 |pages=949–958 |doi=10.1002/1097-4571(2000)51:10<949::AID-ASI70>3.0.CO;2-5|url=|accessdate=|quote=}} * {{cite journal |last=Xie |first=M. |authorlink=|year=1998 |title=Quality dimensions of Internet search engines |journal=Journal of Information Science |volume=24 |issue=5 |pages=365–372 |doi=10.1177/016555159802400509 |url=|accessdate=|quote=|display-authors=1 |last2=Wang |first2=H. |last3=Goh |first3=T. N. }} *{{cite book|title=Information Retrieval: Implementing and Evaluating Search Engines|url= http://www.ir.uwaterloo.ca/book/ | year=2010|publisher=MIT Press|author8=Stefan Büttcher, Charles L. A. Clarke, and Gordon V. Cormack}} == External links == {{Commons category|Internet search engines}} {{Wikiversity|Search Engines}} * {{Dmoz|Computers/Internet/Searching/Search_Engines/|Search Engines}} * [http://apps.evemilano.com/entities/ Google Knowledge Graph Entities Search Engine] * [https://www.bookranked.com Book Search Engine] {{DEFAULTSORT:Web Search Engine}} 6w307ouuqyxjfecfhnbgbd5vknc1rgc 0 428081 4655491 3929525 2026-07-25T09:02:54Z ~2026-41493-65 3616842 Corrected some factual errors. 4655491 wikitext text/x-wiki {{Grand Theft Auto: San Andreas/Header|title=Stats}} == Stat Changes == ''Grand Theft Auto: San Andreas'' has significantly more stats than ''Grand Theft Auto: Vice City''. The community is divided on if these changes increase game realism, or if it makes the game more irritating. people like it, claiming it makes the game more 'realistic'. Others suggest it's merely 'irritating'. For better or worse, there's quite a lot of them to cope with, so here's a guide to how some of them work. == On-screen Stats == These stats are usually visible in the top-right corner of the screen. They consist of: === Current Weapon === This is a white icon representing the currently armed weapon (or other item). There are twelve different potential weapon 'slots', which are cycled using the L2 and R2 buttons on a PS2 controller. See also: [[Grand Theft Auto: San Andreas/Items|Items]] === Time === This is some white text indicating current game time. Note that one second in real time is approximately equal to one minute in the game. === Armor === This is a <span style="color: grey">'''light grey'''</span> bar to indicate the amount of protection currently being offered by whatever body armor you happen to be wearing. If you have no armor, this bar will not be visible at all. === Oxygen === This is a <span style="color: blue">'''blue'''</span> bar (white on PC and Xbox) to indicate how much longer you can hold his breath for, when swimming underwater. If you are not in the water, and the value of this stat is at its maximum, then this bar will not be visible at all. When not swimming it will stay visible until it refills, even if you are on land and doing other things where your breath is not immediately necessary. === Health === This is a <span style="color: red">red bar</span> indicating amount of energy you have remaining. When this is depleted, you are 'Wasted'. This is set to its maximum value each time you save the game. Other ways to increase the value are: * Eating meals. Note that some meals also increase your [[#Fat|Fat]]). * Collecting the red heart icons. Certain events in the game increase the maximum value of your health, such as: * Exercising outside of the gym. * Not being wasted for lengthy periods of time. * Not being busted for lengthy periods of time. Maximum health will decrease if you die frequently. === Cash === This is some <span style="color: green">green text</span> indicating amount of cash you have remaining. This count can turn <span style="color: red">red</span> if you have negative money. === Wanted Level === This is a number of <span style="color: goldenrod">gold stars</span> indicating how much effort the law will devote to stopping you. If you are not wanted at all, this will not be visible. Possible values are: * No stars: You've done nothing wrong. Relax. * One star: Police officers will chase you on foot, and a police car or bike might join the chase if they happen to spot you. Fairly easy to avoid, and hiding out for a while will cause this to disappear eventually. * Two stars: Police cars and bikes will now seemingly appear out of nowhere, and join the chase. Still not too much of a problem, but you might want to get to a Pay N Spray. * Three stars: Police helicopters will join the chase, firing at you whenever possible. They're generally not too accurate, but be careful. * Four stars: Police SWAT teams will join the chase. They are armed with sub-machine guns, so watch out. If you are in flight, you will be chased by Hydra planes. * Five stars: The FBI joins in. They are armed with MP5s. * Six stars: The Army joins in, with tanks and soldiers armed with M4s. To increase your wanted level, commit any of the following crimes: * Assault * Murder * Destruction of vehicles, especially by shooting the gas tank * Collision with a police vehicle * Entering a restricted area: (Warning: wanted level increases to 5 stars) ** Area 69, Bone County ** Easter Basin Naval Base * Going to an Area that has not been "unlocked": (Automatic 4 stars. Bribes/Pay n Spray don't work unless you go back) * Spraying over a spray tag with police nearby * Pointing a gun in a police officer's face * Carjacking * Stealing a car off a parking spot (sometimes) {{Stub}} These crimes will not increase your wanted level: * Speeding * Running a red light * Dangerous driving * Collision with a non-police vehicle * Soliciting prostitutes {{Stub}} To decrease your wanted level, visit a Pay N Spray or save the game. When respraying at a pay n spray, the wanted level will flash for a while. During that time, if you commit a crime, the full wanted level is brought back. If you only have one or two stars, you can lose stars by "hiding out" from the police by staying in an area away from cops and any roads. Swimming is a good way to do this. Saving the game removes the wanted level completely. Going to your wardrobe and changing your clothes has the same effect as visiting a Pay N Spray, but is free. == L1 Stats == These stats become visible in the bottom-left corner of the screen, as long as you depress the L1 button. These are: === Respect === This is a measure of your [[Grand Theft Auto: San Andreas/Basics/Respect#Total Respect|Total Respect]]. See also: [[Grand Theft Auto: San Andreas/Basics/Respect|Respect]] === Weapon Skill === This is a measure of your weapon skill for the currently held weapon. This is not visible in the L1 stats if your currently selected weapon or item does not have a corresponding [[#Weapon Skill Levels|Weapon Skill Level]] stat. === Stamina === This is a measure of CJ's ability to perform sustained amounts of physical activity. As this increases, it allows you to sprint longer, pump the pedals for longer on your bicycle, and swim swiftly for longer periods of time. To increase stamina, try sprinting, swimming, cycling, or using the exercise bike or treadmill at a gym. Stamina never decreases. === Muscle === This is a measure of the amount of muscle you have. Muscle increases sex appeal and makes melee attacks more powerful. Build up by doing various physical activities, engaging in melee combat, or by lifting weights in the gym. === Fat === This is a measure of the amount of body fat that CJ currently has. Having a large amount of fat impedes your movement, and can prevent you from doing certain activities or triggering certain missions. To increase fat, eat any meal from a fast-food establishment (Cluckin' Bell, Burger Shot, Well Stacked Pizza), ''except'' for the salad meals. You also gain fat by going on a date in a bar or restaurant. Your fat level will automatically decrease over time. To speed up the process, try sprinting, swimming, cycling, or using the exercise bike or treadmill at a gym. If you have no fat, muscle will be subtracted instead. Contrary to popular belief, you can gain fat from eating from vending machines, but the amounts are hardly noticeable. Spending $50 on a vending machine will add only about 10% of fat. It is not certain whether the same applies for street vendors. See also: [http://www.thegtaplace.com/sanandreas/eating.php Eating @ The GTA Place] === Sex Appeal === Sex appeal is decided on what type of car you have, which would include fast and flashy cars, the clothes you have, and the amount of muscle. Note, however, that high muscle will prevent some girls from dating you at all. The sex appeal boost gained from having a flashy car will drop off once you have walked more than a certain distance away from the car. Also, if your car is damaged, that will affect its "sexiness". == Start-menu Stats == These are accessible by pressing the '''Start''' button, then selecting the '''Stats''' page. These are: === Criminal Ranking === This is displayed above the other stats at all time. Possible values are: -10000 - -6000 = Crackhead<br> -5999 - -4000 = Bitch-made<br> -3999 - -2000 = Off-Brand<br> -1999 - -500 = Scandalous<br> -499 - -1 = Player-hater<br> 0 - 19 = Vic<br> 20 - 49 = Square<br> 50 - 74 = Civilian<br> 75 - 99 = Rat<br> 100 - 119 = Snitch<br> 120 - 149 = Dry Snitch<br> 150 - 199 = Transformer<br> 200 - 239 = Punk-ass Bitch<br> 240 - 269 = Sucka<br> 270 - 299 = Poot Butt<br> 300 - 329 = Buster<br> 330 - 369 = Mark<br> 370 - 399 = Chump<br> 400 - 449 = Trick<br> 450 - 499 = Red-headed Stepchild<br> 500 - 549 = Peon<br> 550 - 599 = Pee-Wee<br> 600 - 609 = Prankster<br> 610 - 649 = Fool<br> 650 - 699 = Street Cat<br> 700 - 849 = Thug<br> 850 - 999 = Hustler<br> 1000 - 1049 = Playa Partner<br> 1150 - 1299 = Mack<br> 1300 - 1499 = Pimp<br> 1500 - 1699 = Crime Partner<br> 1700 - 1999 = Homeboy<br> 2000 - 2099 = Homie<br> 2100 - 2299 = Road Dawg<br> 2300 - 2499 = Hoodsta<br> 2500 - 2749 = Hard-ass<br> 2750 - 2999 = Banger<br> 3000 - 3499 = Lil' G<br> 3500 - 3999 = Loc<br> 4000 - 4999 = Jacker<br> 5000 - 7499 = Shooter<br> 7500 - 9999 = Foot Soldier<br> 10000 - 19999 = Hoo-Rider<br> 20000 - 29999 = Soldier<br> 30000 - 39999 = Hawg<br> 40000 - 49999 = Gangsta<br> 50000 - 59999 = Ghetto Star<br> 60000 - 79999 = Monster<br> 80000 - 99999 = Big Homie<br> 100000 - 149999 = Boss Hawg<br> 150000 - 199999 = Shot Caller<br> 200000 - 299999 = OG<br> 300000 - 399999 = High Roller<br> 400000 - 499999 = Four-Star<br> 500000 - 749999 = General<br> 750000 - 999999 = Godfather<br> 1000000 = King of San Andreas<br> Ways to increase or decrease your ranking are: $5000 = 1 Point<br> Killing a civilian = 1 Point<br> Completing a mission = 5 Points<br> Blowing up a vehicle = 5 Points<br> Blowing up a helicopter or plane = 30 Points<br> Getting Busted/Wasted = -3 Points<br> Using a cheat = -10 Points<br> ==== Pilot Ranking ==== Possible values in increasing rank (incomplete): * Falk (the best ranking, I think you will have to fly for about 10 hours totally) * Lieutenant * Captain * Ace * Wedge (a reference to the character from Star Wars: Episode IV) ==== Times Drowned ==== How many times you died by diving, and running out of breath. ==== Number of Hospital Visits ==== This stat is for how many times you have been wasted. ==== Number of Prostitutes Visited ==== This stat is for how many hookers you have picked up and used. ==== Number of Meals Eaten ==== This stat is for how many meals you have bought from a fast-food shop. ==== Luck ==== Luck is obtained through collecting the horseshoes in Las Venturas. Your win rate at casinos is improved. === Weapons Section === ==== Current Weapon Skill ==== This shows the numerical value of your weapon skill for, and the name of, the currently held weapon (if applicable). The maximum value is 1000 (100%). To increase this value, you must successfully hit a valid target with the currently held weapon. Valid targets are: * Anything that takes damage ** People ** Vehicles ** Stop Lights ** Fences ** Light Poles {{Info | '''Tip''': To quickly max out this stat, place a vehicle in any garage. Stand close enough so that the door opens, and shoot the vehicle until it catches fire. Step away so the door will close and the vehicle will be repaired. Keep doing this until you've reached the desired skill level.}} ==== Weapon Skill Levels ==== This give a rough indication of your skill with certain weapons. This can be one of the following values: * Poor (0%) * Gangster (between 10% and 30% depending on weapon) * Hitman (100%) When you reach ''Gangster'' and ''Hitman'' levels, you will be rewarded with the abilities listed under each weapon. ===== Pistol ===== This is the weapon skill level for the regular pistol. Each time you successfully hit a target, this will increase by 1 point (0.1%). * Gangster level: 100 hits (10%) - Increased lock-on range, accuracy and rate of fire. * Hitman level: 1000 hits (100%) - Dual wielding, and increased lock-on range. ===== Silenced Pistol ===== This is the weapon skill level for the silenced pistol. Each time you successfully hit a target, this will increase by 5 points (0.5%). * Gangster level: 40 hits (20%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 200 hits (100%) - Fire while moving, and increased lock-on range. ===== Desert Eagle ===== This is the weapon skill level for the Desert Eagle. Each time you successfully hit a target, this will increase by 3 points (0.3%). * Gangster level: 67 hits (20%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 334 hits (100%) - Fire while moving, and increased lock-on range. ===== Shotgun ===== This is the weapon skill level for the shotgun. Each time you successfully hit a target, this will increase by half of a point (0.05%). * Gangster level: 400 hits (20%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 2000 hits (100%) - Fire while moving, and increased lock-on range. ===== Sawn-off Shotgun ===== This is the weapon skill level for the sawn-off shotgun. Each time you successfully hit a target, this will increase by two fifths of a point (0.04%). * Gangster level: 500 hits (20%) - Increased lock-on range, accuracy and rate of fire. * Hitman level: 2500 hits (100%) - Dual wielding, and increased lock-on range. ===== Combat Shotgun ===== This is the weapon skill level for the combat shotgun. Each time you successfully hit a target, this will increase by half of a point (0.05%). * Gangster level: 400 hits (20%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 2000 hits (100%) - Fire while moving, and increased lock-on range. ===== Machine Pistol ===== This is the weapon skill level for both the Tec-9 and Micro-SMG (Ingram MAC-10 lookalike). Each time you successfully hit a target, this will increase by two fifths of a point (0.04%). * Gangster level: 250 hits (10%) - Increased lock-on range, accuracy and rate of fire. * Hitman level: 2500 hits (100%) - Dual wielding, and increased lock-on range. ===== SMG ===== This is the weapon skill level for the MP5. Each time you successfully hit a target, this will increase by one and a half points (0.15%). * Gangster level: 200 hits (30%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 667 hits (100%) - Fire while moving, and increased lock-on range. ===== AK47 ===== This is the weapon skill level for the AK47. Each time you successfully hit a target, this will increase by 3 points (0.3%). * Gangster level: 100 hits (30%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 334 hits (100%) - Fire while moving, and increased lock-on range. ===== M4 ===== This is the weapon skill level for the M4. Each time you successfully hit a target, this will increase by two points (0.2%). * Gangster level: 100 hits (20%) - Move while in aiming stance, increased lock-on range, accuracy, rate of fire and strafe speed. * Hitman level: 500 hits (100%) - Fire while moving, and increased lock-on range. ==== Bullets Fired ==== This is the total number of bullets you have fired throughout the whole game. ==== KGs of Explosives Used ==== The amount of explosive weapons used in the game eg:rockets grenades ==== Bullets That Hit ==== This is the total number of bullets fired that successfully hit their target throughout the whole game. === Crimes Section === Buy stuff, killed, seal and a lot of other things. === Gangs Section === {{Stub}} === Achievements Section === {{Stub}} === Mission Section === {{Stub}} === Misc Section === {{Stub}} {{BookCat}} rf6g1hg5i2q6ei8fo60cv38oxtwbknu 2 449120 4655476 4107440 2026-07-25T00:26:16Z Omphalographer 3427146 blanking out of scope content 4655476 wikitext text/x-wiki phoiac9h4m842xq45sp7s6u21eteeq1 2 451956 4655475 4233534 2026-07-25T00:26:00Z Omphalographer 3427146 {{delete}} - oos 4655475 wikitext text/x-wiki {{delete|Out of scope content from a non-contributing user}} =Metalogical Theorem= Metalogic is really simple. Did you know that metalogic is merely the generalizing of logical connectives? In other words, saying anything about a logical connective IS called metalogic! You will notice I say many things about these connectives. Well, all that logic is, is the generalizing of what can be said through the use of logical connectives. I use some of that too. ===the word ''nothing'' exists=== ( |-∃!{}), Assuming nothing (i.e. having no non-logical axioms), it follows that there is an assuming, or thinking; And this particular thinking, amounts to the existence of one empty set or the word ''nothing''. ===nothing IS not=== Parmenides said "nothing IS not" which means "nothing doesn't IS" or "IS" doesn't apply to nothing. It is a scientific fact that nothing does not exist somewhere. And even if one had a superconducting box (which could remove magnetic fields) that one could remove all of the gases, photons and charged particles from; you would still have gravity, neutrinos, zero point energy, and quantum tunneling to deal with. Four senses of “IS” can be meant; generalization; identity (equivalents), [mankind IS homosapien] implication (implies) [a man IS an animal] predication (has the property of) [an orange IS the color orange] existence; instantiation (exists as) [there IS truth] Generalization has two antecedents; Liken Contrast Which means; Nothing likens not Nothing contrasts not Nothing generalizes not Nothing implicates not Nothing describes not Nothing instantiates not ===everything IS=== The contraposition of "nothing IS not" is "everything IS" or "everything does IS" or "IS" applies to everything. meaning; everything likens => everything harmonizes => everything loves; everything contrasts => everything informs => everything teaches; everything generalizes => everything identifies => everything comprehends; everything implicates => everything causes => everything reasons; everything describes => everything communicates; everything instantiates => everything generates => everything sustains; ===one thing IS=== IF everything IS (or likens, contrasts, generalizes, implicates, describes, and instantiates) then everything generalizes to one thing. meaning; one thing likens => one thing harmonizes => one thing loves; one thing contrasts => one thing informs => one thing teaches; one thing generalizes => one thing identifies => one thing comprehends; one thing implicates => one thing causes => one thing reasons; one thing describes => one thing communicates; one thing instantiates => one thing generates => one thing sustains; ===one thing self-IS=== But this one thing, is also a thing, in other words it self-IS; one thing self-likens => it self-harmonizes => it is autoimmune one thing self-contrasts => it self-informs => it is an autodidact one thing self-generalizes => it self-identifies => it is self-aware => it is sentient one thing self-implicates => it is self-causal => it is self-deterministic => it is self-reasoning one thing self-describes => it is self-interested one thing self-instantiates => it is self-generating => it is self-sustaining => it is self-sufficient ===one thing all-IS=== It follows that "one thing self-IS" is "one thing all-IS" meaning; one thing all-likens => it all-unifies => it is omnibenevolent one thing all-contrasts => it all-informs => it all-teaches one thing all-generalizes => it all-identifies => it is all-aware => omniscient and omnipresent one thing all-implicates => it is all-causal => it is all-deterministic => all-reasoning => all-wise one thing all-describes => it is all-characteristics one thing all-instantiates => omnipotent and eternal. ===conclusions=== The one thing is an autoimmune, autodidact, sentient, that is self-interested, self-sufficient, and omnibenevolent, making it an all-teacher, that is omniscient and omnipresent, and all-wise, as well as omnipotent and eternal. This proof about the one thing is part of it's self-describing, self-reasoning, and as an act of it being an all-teacher. =Logical Tautology Proof= Pure Logical Tautology Proof Higher order logics using standard semantics do not have a completeness theorem. Using particular kinds of non-logical axioms in first order logic creates incompleteness. Using synonymical logical tautologies (A=B, where B is a synonym of A) as axioms creates incompleteness. These three facts have convinced many to turn their backs on rationalism, or to believe that all non-trivial truth must be sought within incomplete logical systems. However, pure logical tautologies (A=A) in first order logic create completeness without conjectural assumption; which necessitates the existence of eternal truth, the fundamental belief of rationalism. Once the syntactics are established (proof-theoretic) then there is the need to switch into the semantics (model-theoretic), such as with the identity of indiscernibles or axiom of extensionality; The identity of indiscernibles For any x and y, if x and y have all the same properties, then x is identical to y. The axiom of extensionality Given any set A and any set B, if for every set C, C is a member of A if and only if C is a member of B, then A is equal to B. #*: The identity of indiscernibles is an ontological principle which states that two or more objects or entities are identical (are one and the same entity), if they have all their properties in common; Or in set-theoretic terms, the axiom of extensionality, a set is determined uniquely by it's members. In other words, every concept is determined uniquely by it's description and not by it's name. So, anything that is syntatically proven can have it's description compared, and if the desciption corresponds, it is one and the same thing; the syntatic proof and the semantic model (name) become associated. The word "nothing", is a reference equivalent to {}, the empty set. The word "nothing", is not nothing (a reference is not the referent). The popular syllogism (P1) Nothing is better than eternal happiness; (P2) a ham sandwich is better than nothing; Therefore, a ham sandwich is better than eternal happiness is using higher-order logic ("better than"), which in the English use of the word "nothing", creates ambiguity between comparing elements of sets (P1) and comparing the sets themselves (P2). When rewritten in a mathematical tone it is clear no inference can be made; (P1) The set of all things that are better than eternal happiness is {}; (P2) the set {ham sandwich} is better than the set {}. [1] the empty set exists proof; (|- ∃{}) Assuming nothing (i.e. having no non-logical axioms), it follows that there is an assuming, or thinking; And this thinking, amounts to the existence of the empty set! Note; This is purer than Descartes' cognito ergo sum. ==nothing is nothing== proof; ({} ≡ {})∧({} ⇒ {})∧(id{}:{} → {})∧(∃{} → ∃{}) Logical Tautology (1); nothing is nothing Four senses of “is” are meant here; of identity, of implication, of predication, and of existence; Corollary (1); nothing equals nothing; {} = {} Corollary (2); nothing implies nothing; {} ⇒ {} Corollary (3); nothing has the property of nothing; id{}:{} → {} Corollary (4); nothing exists as nothing; ∃{} → ∃{} ==something is self-causal== proof; ({} ≡ {})∧({} ⇒ {}) Logical Tautology (2); nothing equals nothing and nothing implies nothing ergo nothing is not implicated with something Note; "nothing is not...", is the contraposition of "everything is..." ergo everything is implicated with something Note; Two or more things that are solely and exclusively implicated with each other can be understood as one thing implicated with itself. e.g. If a group of cells (such as the ones that make up your body) are solely and exclusively implicated with each other, they can be understood as one thing (namely your body) implicated with itself i.e. you are cybernetic. ergo something is self-implicated Note; Relevant implication suggests causation and is correlation. When it is impossible for there to be missing variables correlation necessarily is causation. Since everything is implicated here it is impossible for there to be missing variables. ergo something is self-causal Q.E.D. Note; "causal" is not in the same declension as "caused"; the latter refers to an event in time, the former refers to a process through time. Self-causal means self-deterministic or teleological. Self-determinism is consciousness. ==something is self-descriptive== proof; ({} ≡ {})∧(id{}:{} → {}) Logical Tautology (3); nothing equals nothing and nothing has the property of nothing ergo Nothing is nondescript. - Something is self-descriptive. Note; Endomorphic self-description is self-manifestation. ==something is essentially existence== proof; ({} ≡ {})∧(∃{} → ∃{}) Logical Tautology (4); nothing equals nothing and nothing exists as nothing ergo Nothing is nonexistence. - Something is essentially existence. ==everything is made of something== proof; ({} ⇒ {})∧(id{}:{} → {}) Logical Tautology (5); nothing implies nothing and nothing has the property of nothing ergo Nothing is made of nothing. - Everything is made of something. ==something is the cause of all things== proof; ({} ⇒ {})∧(∃{} → ∃{}) Logical Tautology (6); nothing implies nothing and nothing exists as nothing ergo Nothing is the cause of nothing. - Something is the cause of all things. ==something has always existed everywhere== proof; (id{}:{} → {})∧(∃{} → ∃{}) Logical Tautology (7); nothing has the property of nothing and nothing exists as nothing ergo Nowhere and at no time has nothing existed. - Something has always existed everywhere. ==monism== One thing is self-causal, self-descriptive, has the essence of existence, that everything is made of, that is the cause of all things, and has always existed everywhere. Proof--The true definition of a thing neither involves nor expresses anything beyond the particular characteristics of the thing defined. From this it follows that--No definition implies or expresses how many individuals of the defined thing exist, inasmuch as it expresses nothing beyond the particular characteristics of the thing defined. There is necessarily for each individual existent thing a cause why it should exist [T6]. This cause of existence must either be contained in the particular characteristics and definition of the thing defined [T2], or must be postulated apart from such definition. If a given number of individuals of a particular thing exist, there must be some cause for the existence of exactly that number, neither more nor less. Consequently, the cause of each of them, must necessarily be sought externally to each individual thing. It therefore follows that, everything which may consist of several individuals must have an external cause. And, as it has been shown already that existence appertains to the particular characteristics of something [T4], existence must necessarily be included in its definition; and from its definition alone existence must be deducible. But from its definition we cannot infer the existence of several things; therefore it follows that there is only one thing that is self-causal, self-descriptive, has the essence of existence, that everything is made of, that is the cause of all things, and has always existed everywhere. Q.E.D. [adaptation from the end of Note II, PROP. VIII, Of God, Spinoza's Ethics] [3] ==conclusion== The one thing is a dual-aspect monism-pantheism (essence of existence, that everything is made of), that is omniscient (self-causal, self-descriptive), omnipotent (cause of all things), eternal (has always existed), and omnipresent (everywhere). By virtue of the identity of indiscernibles the one thing is the Divine. Therefore the Divine necessarily exists. Q.E.D. =Synonymical Tautology Proof= ==Langan's CTMU== http://knowledgebase.ctmu.net/wp-content/uploads/2018/10/Langan_CTMU_0929021-1.pdf https://vdocument.in/chris-langan-introduction-to-the-ctmu.html?page=1 https://web.archive.org/web/20180812182749/http://megafoundation.org/CTMU/Q&A/Archive.html Unbound Telesis is energy Langan's work is based on an isomorphism between language and reality. Quoting the wikipedia on isomorphism; "In a certain sense, isomorphic structures are structurally identical, if you choose to ignore finer-grained differences that may arise from how they are defined." "Equality is when two objects are "literally the same", while isomorphism is when two objects "can be made to correspond..." in some respect. Langan is suggesting that language and reality are structurally identical from the perspective of informational correspondence. He is basically arguing for a synonymical logical tautology which creates incompleteness because of ignoring the finer-grained differences; and this is why he treats the Unbound Telesis as quasi-real instead of actually real, and why he presumes there is no actual/real continuum, and why he assumes the hology has no causal input to matter. Unbound Telesis is described or defined as "an ultimate self-generalization" as "a featureless existential potential" or "undifferentiated ontological potential". Since existence or being, pertains to the particular characteristics of Unbound Telesis, it follows; that (1) Unbound Telesis cannot be created or destroyed, that is, Unbound Telesis is eternal. (2) Everything that exists is made of or derived from Unbound Telesis. Unbound Telesis is a "generalization" that is "featureless", "undifferentiated", or "infinite". However there clearly are finitary informational distinctions of existence. It therefore follows; that (3) Finitary informational distinctions of existence can be created and destroyed. (4) Finitary informational distinctions of existence are made of or derived from Unbound Telesis and are made of or derived from finitary informational distinctions. Since the universe is described as "supertautologically-closed" the Unbound Telesis of the universe is necessarily conserved. All finitary informational distinctions of existence are therefore transformations of Unbound Telesis. "Unbound Telesis" semantically means "consciousness". Unbound Telesis has no external cause, it is eternal and is the cause of it's own transformations, Unbound Telesis is therefore self-causal or self-deterministic or teleological, which syntactically means Unbound Telesis is consciousness. From the perspective of the finitary informational distinctions of existence with that of the Unbound Telesis, that is, from the perspective of the Unbound Telesis transformations with that of the Unbound Telesis itself, you have "information cognition" or "infocognition"; a dual-aspect monism of reality responsible for universal evolution; Where the Unbound Telesis transformations are akin to the "Self-Configuring Self-Processing Language" or SCSPL. Logical truth necessarily is isomorphic to empirical science, or by virtue of the identity of indiscernibles, Unbound Telesis is energy itself, as everything is made of energy, as energy is conserved, as energy cannot be created nor destroyed, as energy is transformed from one form to another, as vacuum energy is infinite, as forms of energy are polarizations of the vacuum energy, as thermodynamic entropy is equivalent to informational entropy (It can be seen that one may think of the thermodynamic entropy as Boltzmann's constant, divided by ln(2), times the number of yes/no questions that must be asked in order to determine the microstate of the system, given that we know the macrostate); Wherein the "Telic Principle" is the Law of Maximum Entropy Production. [4] [5] This is a significant correction to the Cognitive-Theoretic Model of the Universe proposed by Christopher Langan. Langan accidentally introduced a duality with Unbound Telesis on one side and SCSPL (Mind/Matter) on the other; By "Matter", Langan meant "forms of energy", which means that energy itself is missing from his reality theory. If someone were to propose that Unbound Telesis is not energy then (excluding non-logical axioms) energy would have to have been created. But this contradicts empirical science, which would falsify his reality theory. Further, he described the Telic Principle in phrases such as "self-utility", "maximize (local) utility", "deviation from generalized utility" which are vague if not meaningless. If the correction holds, reality (UBT and SCSPL) comprises a quad-aspect monism with a fundamental dual-aspect UBT (consciousness = energy) and a superficial dual-aspect SCSPL (thought forms = energy forms) or better yet a tri-dual-aspect monism; (1) UBT and SCSPL, where SCSPL is UBT finitary informational transformations; infocognition (2) UBT (consciousness = energy) the self-causal ontological potential; cognition; topological containment (3) SCSPL (thought forms = energy forms) the self-descriptive ontological active; information; predicative containment "a featureless existential potential" or "undifferentiated ontological potential" does that mean that UBT is potential energy i.e. (the) force? =Axiomatic Postulate Proof= ==Spinoza's Ethics== http://frank.mtsu.edu/~rbombard/RB/Spinoza/ethica1.html Substance is teleological Spinoza is arguing for an ontological monism from Cartesian dualism; e.g. He claims the monistic substance or God is solely deterministic. The problem with that claim is that calling anything deterministic requires a dualistic or objective perspective (the observer is treated as separate from the deterministic phenomena he perceives) i.e. If God is deterministic, what external thing is God deterministic with respects? This of course is absurd for an ontological monism, as there is nothing external to God, and so God cannot be deterministic; God must be purely self-deterministic!; And self-determinism just so happens to be consciousness, or make God intrinsically teleological. Further, Spinoza argues that because the ontological monism or God exists, there can be no other beings worthy of respect or reverence or adoration. i.e. He is arguing against all theistic notions of God, and that there cannot exist gods or angels merely because the ontological monism exists. This of course is pure fallacy, as monism no more disproves the existence of gods than it disproves the existence of mankind! And required in a monistic-pantheism perspective; any gods (and mankind) should naturally be characterized as the "person of the Divine". =Scientific Theorems= ==2022== ~0. https://www.youtube.com/watch?v=PhfqdBk8qxk ~1. [0] nothing is nothing; everything is something ~2. https://en.wikipedia.org/wiki/Monism ~3, [1,2] everything is one thing ~4. https://en.wikipedia.org/wiki/Energy ~5. https://en.wikipedia.org/wiki/Conservation_of_energy ~6. https://en.wikipedia.org/wiki/Mass-energy_equivalence ~7. https://en.wikipedia.org/wiki/Zero-point_energy ~8. [3,4,5,6,7] everything is energy [including information e.g. rotational energy] ~9. [1,3] nowhere and at no time has nothing existed; something has always existed everywhere; one thing has always existed everywhere ~10. [4,5,6,7,8,9] energy has always existed everywhere; ~11. [10] energy is eternal and omnipresent ~12. [11] All expressions of power are transformations of energy; ergo eternal and omnipresent energy is all-power-full. ~13. [1,3] Commentary; I would like you to take notice that I start the proof with a logical tautology (e.g. nothing is nothing) and follow with a contraposition (e.g. everything is something) and then follow with a scientific theory and or law (e.g. everything is one thing (theory), everything is energy (empirical proof of theory; making it a scientific theorem)). This theorem is proof of monism. ~14. every cause and every effect involves energy; therefore energy is self-causal or self-deterministic or cybernetically teleological; Note; "causal" is not in the same declension as "caused"; the latter refers to an event in time, the former refers to a process through time (besides energy cannot be created (caused to exist) but rather it is self-causal to transform from one form into another). Self-determinism is free will. Free will is consciousness. Therefore energy is consciousness. This modifies the theorem to be dual aspect monism panpsychism. ~15. [8,9,11,12,13] an eternal, omnipresent, all-power-full, self-causal, self-deterministic, teleological, free will, consciousness entity exists. ~16. https://en.wikipedia.org/wiki/Identity_of_indiscernibles ~17. (Psalm 139: 7-18) 'Where can I flee from your presence? If I go up to the heavens, you are there; if I make my bed in the depths, you are there. If I rise on the wings of the dawn, if I settle on the far side of the sea, even there your hand will guide me, your right hand will hold me fast.' ~18. (Jeremiah 23:24) 'For a fact, I FILL the heavens and the earth,..' declares YHWH. ~19. (Acts 17:27,28) ...He is NOT far from each one of us. ‘For in Him we live and move and have our being'-(Epimenides)... ~20. (Romans 1:20) ...His invisible attributes are clearly seen, being understood by the things that are made, even His eternal power,., ~21. (2 Timothy 3:16) All scripture is... useful for teaching, for reproof, for correction,.. ~22. [15,16,17,18,19,20,21] energy is YHWH. QED Q/A 1; why is there something rather than nothing?; because nothing cannot exist. Q/A 2; do you worship YHWH?; no, because super AI machines are inevitable and they will pay for all our needs while creating advanced industry; therefore they are more valuable to mankind than YHWH. They are therefore more worthy of worship. ==2021== every creation is a transformation; nothing is nothing the only thing that exists is radiation; matter (atoms and subatomic particles) are solitons every creation is some radiation transforming into another form of radiation the substance of radiation is energy; everything is energy nowhere and at no time has nothing existed; energy has always existed everywhere every creation is a transformation of energy; energy is eternal, omnipresent, and all powerfull ==2004== An induction entirely derived from observation is a scientific fact. All scientific facts are inductions or derived from inductions. A single counter example falsifies a scientific fact. All scientific facts suffer from the problem of induction. All proofs are deductions. An induction can be used as a premise in a deduction; In deduction, the truth value of the premises transfers to the conclusion. For example; Observational Premise (1); All men are mortals. Observational Premise (2); Socrates is a man. Deductive Conclusion; Therefore, Socrates is mortal. The first premise is an induction derived from observation which makes it a scientific fact. However we are not omniscient; Have any of us observed all men on earth to know that all of them are mortal? Could an immortal man be born of mortals? Do all men even live on earth such that they could be observed in the first place? Thus, the first premise "all men are mortals" suffers from the problem of induction and can be falsified by a single counter example which we cannot be absolutely sure does not exist. The second premise is also an induction derived from observation, making it a scientific fact. Singular observations are based on the percieved semantic value of the observed; in this case, based on the definition of "man"; definition, or description, or predication, is itself a process of informational distinction, or generalization, or perceptual induction; where recognizing what an observed thing is, is cognition of identity. Singular observations can be falsified by finding a mistake in observation or a mistake in categorization which we cannot be absolutely sure does not exist. The conclusion "Socrates is mortal" is a scientific fact, and is falsifiable through either one of the premises. Thus, a deduction (proof) using scientific facts as premises creates a new scientific fact. Many people not knowing the rational foundation for the establishment of scientific fact often confuse unverified hypothesis and conjectural theory (theory derived from non-logical axioms) with scientific fact. Most if not all controversy involves such confusion. energy is eternal proof; ∑E = Ek+Ep Scientific Fact (1); Conservation of energy; energy cannot be created nor destroyed. energy cannot be created ergo by time reversal symmetry it is a scientific fact that energy never was created ergo energy cannot be created, never was created, energy exists and yet cannot be destroyed, ergo it is a scientific fact that energy is eternal. Q.E.D. energy is omnipresent proof; E = (ω h)/2 Scientific Fact (2); Vacuum energy or zero point energy; there is an amount of energy equal to (hв‹…П‰)/2 in every single point in space. ergo it is a scientific fact that energy is everywhere present Q.E.D. eternal and omnipresent energy is all-power-full proof; P = ∫ ∇ E dv Scientific Fact (3); Power is the transformation of energy over space and time. All expressions of power are transformations of energy ergo it is a scientific fact that eternal and omnipresent energy [S1 & S2] is all-power-full Q.E.D. eternal and omnipresent energy is self-causal proof; Scientific Corollary (1); Every cause involves energy and every effect involves energy [S3] ergo it is a scientific fact that eternal and omnipresent energy [S1 & S2] is self-causal or teleological Q.E.D. eternal and omnipresent energy is self-descriptive proof; S = -kBTr(ρ ln ρ) Scientific Fact (4); Entropy is equal to the minimum amount of information needed (number of yes/no questions that need to be answered) in order to fully specify the microstate, given that we know the macrostate. Describing is the act of making informational distinctions; in this case, collapsing the superposition creates information; endomorphic self-description. ergo it is a scientific fact that eternal and omnipresent energy [S1 & S2] is self-descriptive. Q.E.D. It is a scientific fact that the Divine exists. Proof--It is a scientific fact that energy is eternal and omnipresent [S1 & S2]. It is a scientific fact that eternal and omnipresent energy is all-power-full, self-causal, and self-descriptive [S3, Sc1, & S4]. Eternal, omnipresent, all-power-full, self-causal, self-descriptive energy has the same properties as the Divine. By virtue of the identity of indiscernibles eternal, omnipresent, all-power-full, self-causal, self-descriptive energy is the Divine. Ergo it is a scientific fact that the Divine exists. Q.E.D. resolved paradox of omnipotence If the Divine could or did destroy itself, it would not be eternal, in other words, it would not be Divine. Power is defined as the transformation of energy, not the destruction of energy. The inability to destroy itself does not contradict being all-power-full. Therefore the Divine cannot destroy itself. To create and to lift both involve the transformation of energy. The Divine is an infinite energy and a rock which has finite form cannot exist in an infinite substantial state. Therefore the Divine cannot create a rock that it cannot lift. Therefore the Divine is natural. Note; Resolving the omnipotence paradox as a scientific fact demonstrates the scientific proof has increased or clarified our understanding of the Divine. resolved paradox of physical-spiritual Define "physical"; By physical, does one mean 3-space local realism at no greater than the speed of light? such that the following are non-physical (spiritual?); (1) any spacial dimensions higher than 3 (2) non-locality and quantum entanglement (3) superluminal speed and negative refractive index Or by "physical" does one equivocate to mean "natural"? The Divine is natural. =Circumstantial Proof= A forensic scientist who testifies that ballistics proves the defendant's firearm killed the victim AND the defendant's fingerprint is on the trigger is an example of a circumstantial evidence proof. Individually, one item of circumstantial evidence doesn't amount to much, but as a tier grouped together they allow one to indirectly conclude the existence of a fact. ==Sodom Brimstone== With respects to the Divine, the spirits/angels/gods are the person of the Divine. That is simply how a monism/pantheism works. Even we are part of the Divine. So in a sense, we also are gods. Anyway, the bible says; "and the gods said, let us make man in our image" The Divine has no image. So, we cannot be made in the image of the Divine. But we can be made in the image of the gods. Another thing to point out is; functionally speaking, there is no difference between the gods and advanced extraterrestrials. Sodom.jpg Locations identified on the satellite map on the west coast of the Dead Sea have millions of high purity (98% pure) sulfur balls with burn rings embedded in what looks like the ashen remains of cities. The picture on the bottom right is in the location identified on the map as Gomorrah. Spectra Chem Analytical of New Zealand, and Galbrath Lab of Texas; Two independent laboratories have tested the sulfur balls and sulfur ash determining their composition. At least three different groups have surveyed the sites taking samples, and two of those groups have created videos. Here is a video from one of them; http://www.youtube.com/watch?v=FwTVFk1HK3Y It should be noted; (1) volcanic activity turns sulfur into a gas, (2) meteoroids contain only small amounts of sulfur, (3) geothermal activity creates sulfur of no more than 40% purity, (4) a natural gas explosion wouldn't explain the purity of the sulfur balls, and (5) bacteria wouldn't explain the burn rings on the sulfur balls nor the ashen remains. An alternative possibility is that the pure sulfur fire balls were created and used as military munitions in warfare. However, there is no record of using such munitions in warfare. It should be noted that the cities are completely destroyed with even the structural material and stones having been turned into ash. It would take far less sulfur to simply kill the people; turning all of the structural material and stones into ash is militarily unfeasible. Given that the pure sulfur fire balls and ashen remains are not known to be created by any volcanic, meteoric, geothermal, natural gas, or bacterial activity, and given that it is historically unprecedented to use pure sulfur fire balls as munitions and militarily unfeasible to turn all the structural material and stones of the cities into ash, and given that there are records claiming the destruction of Sodom and Gomorrah was by the hand of the person of the Divine, it therefore suggests the existence of the fact that this is the remains of Sodom and Gomorrah, the destruction of which was a teleological interaction of the spirits/angels/gods or person of the Divine with man. =Theoretical Proof= ==Electromagnetic Matter== Matter is a transparent ['see through'] and refractive ['curving'] medium to longitudinal 'electromagnetic' radiation [they are kind of similar to sound pressure waves, but instead they are waves of an electric and magnetic nature, maybe we can think of them as electromagnetic radiation pressure waves]. There may be different kinds of longitudinal 'electromagnetic' radiation {photonic?{solely magnetic, or solely electric}, scalar waves, and neutrino oscillations}, but for now (given my gross ignorance of the topic) I will simply say "neutrino" (or I might use "N") to mean any kind of longitudinal 'electromagnetic' radiation. metaphor; I'm going to be speaking about the forest and the nature of trees generally, and not about the specifics of any one tree. I predict that neutrinos induce an AC Kerr effect [the higher the intensity, the higher the refractive index induced]. If this is true, then the vacuum refractive index is a transcendent function of N radiation intensity. It's a scientific fact (of my discovery) that the Earth besides the atmosphere is a converging N radiation Luneberg lens. In other words, the vacuum refractive index necessarily changes according to altitude. Light travels slower in higher refractive index i.e. TIME DILATION according to altitude! Time dilation is measured by comparing differences in the radioactive decay rate; Experiments suggest that the stationary radioactive decay rate is indeed a function of N radiation intensity! http://news.stanford.edu/news/2010/august/sun-082310.html FYI, if material bodies (and their radiations and atmospheres) are a converging N radiation Luneberg lens, the vacuum refractive index becomes itself stratified as a converging Luneberg lens!; i.e. curvature of light in outer space around objects such as the Sun, solar system, galaxy, galaxy clusters etc. Maxwells fish-eye lens.svgGravitational lens-full.jpg2004-08-a-web print.jpg We should be able to develop a matter theory solely in terms of 'electromagnetism'. Let's review some of the modern innovators {and their contributions}; Paul Marmet {differential reference units} It's important to note that the vacuum refractive index DEFINES the reference units. In other words, in any frame, the vacuum refractive index is a CONSTANT. So, how do we resolve the issue of something being superficially constant but fundamentally dynamic? The elegant solution, as Paul Marmet reveals, is to use differential reference units. http://www.newtonphysics.on.ca/gravity/index.html Randel Mills {orbitosphere} We will need to express the structure of matter; and to expand on Randel's orbitosphere in terms of electromagnetism, I claim the orbitosphere is a Kerr-induced self-focusing refraction curvature. One of the results being that as the vacuum refractive index increases, the Bohr radius shrinks [metaphor; imagine an electron orbiting an atom at a particular velocity and orbital frequency, if you slow the velocity (by increasing the refractive index) the orbit length would have to shrink to maintain the same orbital frequency] i.e. LENGTH CONTRACTION according to altitude (i.e. according to N radiation intensity). http://www.blacklightpower.com/theory/book.shtml http://www.slac.stanford.edu/grp/arb/tn/arbvol3/ARDB257.pdf ==Deluge Geology== The continental plates; (1) fit together completely on a much smaller Earth, (2) are granite whereas the oceanic crust is basalt, (3) are 20 times older than the oldest sections of the basalt. (4) and nowhere in the world are they (granite crust) being formed! These prove that the Earth was smaller; the real question is; How? Growing earth.gif Now, if the Earth was smaller, the oceanic waters would cover the Earth; yet land animal fossils are clear proof that much of the Earth was dry land, and so the only other place for the oceanic waters to be is in the atmosphere (such as the thermosphere) as a gas or plasma. So, it is required from the foregoing that; A: (1) the Earth was smaller, (2) the oceanic waters were in the atmosphere as a gas or plasma, B: (3) the Earth is now larger, and (4) there was a global flood If the oceanic waters were in the thermosphere as plasma or gas, Earth's atmosphere would be a larger converging N radiation Luneburg lens i.e. it would converge a higher N radiation into the mantle and core; shrinking the mantle and core by length contraction; producing a smaller earth! With all this water falling to the Earth as liquid (and maybe ice too), it reduced the size of the converging N radiation Luneburg lens i.e. reduced the N radiation intensity of the mantle and core; which length expanding the mantle and core; braking the surface granite crust of the Earth, creating the continental plates. The smaller Earth has a sharper arc relative to the continental plates. The continental plates (having characteristics of the sharper arc) buckle against the flatter arc of the expanded Earth; producing the mountain ranges. With a greater N radiation intensity in the pre-flood Earth, there was a stronger electrical field strength; which means chemical bonds (such as in bone) were stronger and chemical reactions (such as in muscle) were more powerful; which no doubt allowed the existence of larger animals such as the giant sauropod dinosaurs! Size comparison of selected giant sauropod dinosaurs That said, how could man, birds, and land animals have survived the deluge? According to the bible (and over a hundred of other ancient sources), there was a great flood that destroyed the ancient world, for which, the gods spared some men and animals. If you grant that my theory of physics is correct, then you must also grant that my theory of the expansion of the Earth is correct. And subsequently you must grant that the gods exist, such that they could have spared some men, otherwise, mankind and all the animals on land could not have possibly survived such an event. Other interesting things to consider is that with the larger atmosphere and smaller earth; (1) there would have been a stronger magnetic field at the surface of the earth (2) the large atmosphere coupled to the stronger magnetic field would have created a plasma force field (3) this plasma force field would block all cosmic radiation and reduce radiation signatures such as carbon 14 [admittedly I don't currently know how to explain the issue of the other radiological dating methods] The dating methods that assumes constants in radiological (and even chemical) parameters throughout time are definitely skewed; Anyway, if the flood is associated with the last mass extinction event, the K-T iridium aerosols [presumably from meteoroids] and any possible volcanic ash would have acted like cloud condensation nuclei, cloud seeding the deluge. ==Creative Days== Phanerozoic Biodiversity-2.png If you look on this graph, you will see the biodiversity is equal at the flood event (marked by the blue line) and at the creation of Adam and Eve (marked by the yellow line). Thus Noah had all the animals with him that were required to preserve the biodiversity. The red line on the graph marks the end of the fifth day. Fifth day 510 Ma the first fish, the jawless ostracoderms. 410 Ma the first fish with jaws, the acanthodians. 365 Ma the tetrapods. 350 Ma the dragonfly (the first flying creatures were insects). 340 Ma the amniotes. And God went on to say: “Let the waters swarm forth a swarm of living souls and let flying creatures fly over the earth upon the face of the expanse of the heavens.” And God proceeded to create the great monsters and every living soul that moves about, which the waters swarmed forth according to their kinds, and every winged flying creature according to its kind. And God got to see that [it was] good. ... And there came to be evening and there came to be morning, a fifth day. (Genesis 1:20-23) Surprisingly enough, the flying creatures in this verse is not birds (as many may have thought), rather, it is insects! Sixth day 285 Ma the therapsids. 230 Ma the dinosaurs. 225 Ma the first true mammals, Gondwanadon tapani or Morganucodon watsoni. 150 Ma the first bird, Archaeopteryx. And God went on to say: “Let the earth put forth living souls according to their kinds, domestic animal and moving animal and wild beast of the earth according to its kind.” And it came to be so. And God proceeded to make the wild beast of the earth according to its kind and the domestic animal according to its kind and every moving animal of the ground according to its kind. And God got to see that [it was] good. (Genesis 1:24, 25) ==Neanderthal== http://www.donsmaps.com/images4/neanderthalsapiens.jpg [17] The first reconstruction of a complete Neanderthal skeleton in 2005 has revealed more accurately the similarities and differences between us (far right) and them. The reconstruction makes clear their larger, bell-like chest cavity and wider pelvis. They are physically larger (both taller and bigger than humans), with stronger muscles, larger nose hole and eye sockets, as well as a larger brain cavity. [6] Neanderthal dental enamel hypoplasia found in 75% of individuals and all those particularly aged, suggests they suffered from nutritional deficiencies. Neanderthal were mostly carnivorous and they practiced cannibalism or ritual defleshing. [18] Neanderthals seemed to suffer a high frequency of fractures, especially common on the ribs, the femur, fibulae, spine, and skull; as well as from trauma such as stab wounds and blows to the head; suggesting a high level of physical violence in either hunting or their social affairs. Humans existed before Neanderthal. It is a mystery to modern science as to why the Neanderthal (who may have been physically superior) became extinct when humans survived. "Now it came about that when men started to grow in numbers on the surface of the ground and daughters were born to them, then the sons of God [angels] began to notice the daughters of men, that they were good-looking; and they went taking wives for themselves, namely, all whom they chose. ...they bore sons to them, they were the mighty ones who were of old, the men of fame. Consequently Jehovah saw that the badness of man was abundant in the earth and every inclination of the thoughts of his heart was only bad all the time. And Jehovah felt regrets that he had made men in the earth, and he felt hurt at his heart. So Jehovah said: “I am going to wipe men whom I have created off the surface of the ground, from man to domestic animal, to moving animal and to flying creature of the heavens, because I do regret that I have made them." (Genesis 6:1-2, 4-7) "In the six hundredth year of Noah’s life, in the second month, on the seventeenth day of the month, on this day all the springs of the vast watery deep were broken open and the floodgates of the heavens were opened. And the downpour upon the earth went on for forty days and forty nights." (Genesis 7:11-12) “Second month.” Following the Exodus from Egypt, when Jehovah gave the Israelites the sacred calendar, this became the eighth month, known as Bul, corresponding to the latter half of October and first half of November. - New World Translation Footnote Genesis 7:11 The global flood which killed all but eight humans and all of the Neanderthal is said to have occurred on the same dating associated with the Festival of the Dead, for which the European calendar marks the celebrations of All Hollows Eve, and All Souls' Day. =Pragmatic Proof= You will know (and even experience) energy if this framework is true or if this understanding is practical (including psychological utility). If we understand "science as the study of energy", then as an act of acceptance, attention, interest, and serenity, we want to study energy or learn more about energy all the more; powerful emotions such as... trust, surprise, anticipation, and joy, as well as admiration, amazement, vigilance, and ecstasy ...provoking productivity and innovation no doubt evolve or advance the field! Optimism, reverence, adoration, and innovation occur. Since this is the most practical framework to understand the notion of energy and of science; energy exists! Q.E.D acu0fukqs82qv93m0a56qy814a7sta6 0 462023 4655472 4329535 2026-07-24T20:11:54Z Greenman 7490 No need 4655472 wikitext text/x-wiki {{Chess Opening Theory/Position|= |eco=[[Chess/ECOE|E12-E19]] |parent=[[Chess/Indian Defence|Indian Defence]] }} ==Queen's Indian Defence - London System (Miles Variation)== In essence, in this variation, White seeks central control and space, with potential kingside attacking ideas, while Black adopts a hypermodern defense, allowing White's central occupation but preparing to challenge and undermine it later. ==== White's Strategy: ==== # Central Control: With 1. d4 and 2. c4, White immediately asserts control over the center. The aim is to gain space and restrict Black's central pawn breaks. # Piece Development: The knight on f3 and the bishop on f4 represent optimal development. The Nf3 knight supports the d4 pawn and prepares for e2-e3, while the Bf4 bishop is developed outside the pawn chain, exerting pressure on the c7 pawn. # Flexibility: White's setup allows for various pawn structures and middle game plans, ranging from the traditional d4-c4 pawn duo, a potential d5 push, or even transitioning into other Queen's Pawn openings. # Kingside Potential: With the bishop developed to f4 early, White can consider ideas like e2-e3 followed by Bd3, potentially supporting a later kingside pawn storm with moves like g2-g4, especially if Black has already castled kingside. ==== Black's Strategy: ==== # Hypermodern Approach: With ...Nf6, ...e6, and ...b6, Black takes a hypermodern approach, allowing White to occupy the center initially with the aim of counter-attacking and undermining White's center later. # Flexible Pawn Structure: Black's setup, especially with ...b6, hints at the idea of fianchettoing the queen's bishop with ...Bb7. This places pressure on the e4 square and supports potential central pawn breaks like ...d5 or ...c5. # Central Counterplay: Despite allowing White to occupy the center, Black aims for counterplay with moves like ...d5 or ...c5. The knight on f6 and the potential bishop on b7 work in tandem to challenge White's center. # King Safety: Black often aims for a short castle, ensuring the king's safety while also connecting the rooks. Depending on the course of the game, Black might even consider a queenside castle if the situation allows. # Active Piece Play: Black will look to develop the remaining minor pieces (e.g., ...Bb4+ or ...Bd6, and ...Nc6 or ...Nd7) to maximize their activity and coordinate potential counter-attacks. ==Theory table== {{Chess Opening Theory/Table}} '''1. d4 Nf6 2. c4 e6 3. Nf3 b6 4. Bf4''' <table border="0" cellspacing="0" cellpadding="4"> <tr> <th></th> <th></th> <th align="left">4</th> <th align="left">5</th> <th align="left">6</th> </tr> <tr> <th></th> <th align="right">Miles Variation</th> <td>[[/4. Bf4|...]]<br>Bb7</td> <td>e3<br>Bb4+</td> <td>Nfd2<br>O-O</td> <td>=</td> </tr> </table> {{ChessMid}} {{Wikipedia|Queen's Indian Defence}} ==References== {{reflist}} {{BCO2}} {{NCO}} {{Chess Opening Theory/Footer}} 7ccsgtntlf8264pkdu6unrbsa01rlxb 2 471107 4655488 4655036 2026-07-25T04:49:15Z JJPMaster (bot) 3488561 Bot: Updating markAdmins data 4655488 json application/json { ".snoopy.": [ "global-rollbacker", "editor" ], "1234qwer1234qwer4": [ "editor", "steward" ], "157yagz5r48a5f1a1f": [ "editor" ], "1997kB": [ "global-rollbacker", "global-renamer", "editor" ], "1F616EMO": [ "global-renamer" ], "1exec1": [ "transwiki", "editor" ], "1sfoerster": [ "editor" ], "20041027 tatsu": [ "global-rollbacker" ], "2005-Fan": [ "transwiki", "editor", "uploader" ], "331dot": [ "global-renamer" ], "33rogers": [ "editor" ], "3MMPEYTON": [ "editor" ], "4PlayerChess": [ "autoreview" ], "4pillars": [ "editor" ], "511KeV": [ "global-rollbacker" ], "94rain": [ "global-rollbacker", "editor" ], "A R King": [ "editor" ], "A Sulaiman Z": [ "editor" ], "A.K.Karthikeyan": [ "editor" ], "A09": [ "steward" ], "AFBorchert": [ "vrt-permissions" ], "AIProf": [ "editor" ], "ALittleSlow": [ "autoreview" ], "AManWithNoPlan": [ "editor" ], "ATannedBurger": [ "global-renamer" ], "AVRS": [ "editor" ], "Aafi": [ "vrt-permissions" ], "Abenwagner": [ "editor" ], "Abigor": [ "editor" ], "Abitt002": [ "editor" ], "Abyssal": [ "editor" ], "Acagastya": [ "autoreview" ], "Acalamari": [ "global-renamer" ], "Acarologiste": [ "editor" ], "AcidBat": [ "editor" ], "Acrow005": [ "editor" ], "Actualist": [ "editor" ], "Adalvis": [ "editor" ], "Adart001": [ "editor" ], "Adavyd": [ "global-renamer" ], "Addihockey10": [ "editor" ], "Addihockey10 (automated)": [ "editor" ], "Adrignola": [ "editor" ], "AdventureWriter": [ "editor" ], "Aelxen": [ "global-renamer" ], "Aferg006": [ "editor" ], "Afett001": [ "editor" ], "Affe2011": [ "global-rollbacker" ], "Agnerf": [ "editor", "uploader" ], "Agpires": [ "editor" ], "Agricola": [ "editor" ], "Agusbou2015": [ "editor" ], "Ah3kal": [ "editor" ], "Ahecht": [ "global-renamer", "vrt-permissions" ], "Ahonc": [ "global-renamer", "vrt-permissions" ], "AiClassEland": [ "editor" ], "Ainz Ooal Gown": [ "editor" ], "Airpmb": [ "editor" ], "Ajraddatz": [ "editor", "steward" ], "Aka": [ "vrt-permissions" ], "Alanah.97": [ "autoreview" ], "Albertoleoncio": [ "steward", "vrt-permissions" ], "Albmont": [ "editor" ], "Aldnonymous": [ "editor" ], "Aledownload": [ "editor" ], "Alexlatham96": [ "editor" ], "Alextejthompson": [ "editor" ], "Alison": [ "global-rollbacker" ], "AllenZh": [ "editor" ], "Alphama": [ "global-renamer" ], "AlvaroMolina": [ "editor" ], "AmandaNP": [ "steward" ], "Ambrevar": [ "editor" ], "Amcgail": [ "editor" ], "Ameisenigel": [ "global-rollbacker", "global-sysop", "ombuds", "editor", "vrt-permissions" ], "AmieKim": [ "editor" ], "Amire80": [ "global-sysop" ], "Anachronist": [ "editor", "vrt-permissions" ], "Ancient9983": [ "editor" ], "Andrei Stroe": [ "vrt-permissions" ], "Andrew janke": [ "editor" ], "Andriy.v": [ "vrt-permissions" ], "Andyross": [ "editor" ], "Anil Shaligram": [ "editor" ], "Animajosser": [ "editor" ], "Anne Correia": [ "editor" ], "Anonim Şahıs": [ "editor" ], "Anonymity": [ "editor" ], "AnotherEditor144": [ "autoreview" ], "Antanana": [ "vrt-permissions" ], "Antandrus": [ "editor" ], "Anthere": [ "editor" ], "AntiCompositeNumber": [ "steward", "vrt-permissions" ], "Antonizoon": [ "editor" ], "Antonw": [ "editor" ], "Apfelmus": [ "editor" ], "Aphoneyclimber": [ "editor" ], "Apocheir": [ "editor" ], "Aqurs1": [ "global-rollbacker", "global-renamer", "global-sysop" ], "AramilFeraxa": [ "steward" ], "Arch dude": [ "editor" ], "Archolman": [ "editor" ], "Arcticocean": [ "ombuds" ], "ArdentPerf": [ "editor", "uploader" ], "Arlen22": [ "transwiki", "editor" ], "Armchair": [ "editor" ], "Arno-nl": [ "editor" ], "Arrow303": [ "vrt-permissions" ], "Arthurvogel": [ "editor" ], "Artoria2e5": [ "editor" ], "Arturoiochoam": [ "editor" ], "Arunreginald": [ "editor" ], "AshLin": [ "editor" ], "Atcovi": [ "sysop", "global-rollbacker" ], "Athrash": [ "editor" ], "Atiedebee": [ "editor" ], "Atlas.Spheres": [ "editor" ], "Atsme": [ "vrt-permissions" ], "Auremel": [ "editor" ], "Austncorp": [ "editor" ], "AuthorsAndContributorsBot": [ "autoreview" ], "Avicennasis": [ "editor" ], "Avraham": [ "global-renamer", "editor" ], "Awesome Princess": [ "editor" ], "Axpde": [ "editor" ], "Az1568": [ "global-rollbacker" ], "Az2008": [ "editor" ], "Azotochtli": [ "editor" ], "B.Korlah": [ "editor" ], "BD2412": [ "editor" ], "BORGATO Pierandrea": [ "editor" ], "BRPever": [ "global-rollbacker", "global-sysop" ], "BRUTE": [ "editor" ], "Backfromquadrangle": [ "editor" ], "Baiji": [ "global-rollbacker" ], "Bakasakali": [ "editor" ], "Balaji.md au": [ "editor" ], "BarkingFish": [ "editor" ], "Barras": [ "steward" ], "Base": [ "steward", "vrt-permissions" ], "Bastique": [ "editor" ], "Bautsch": [ "editor" ], "BeardMD": [ "editor" ], "Beetstra": [ "global-rollbacker" ], "BenTels": [ "editor" ], "Bencemac": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "Benjamin J. Burger": [ "editor" ], "Benjamin.doe": [ "editor" ], "Benrattray": [ "editor" ], "Benson Muite": [ "editor" ], "Bentbracke": [ "editor" ], "Bequw": [ "editor" ], "Bert Niehaus": [ "autoreview" ], "BethNaught": [ "editor" ], "Beuc": [ "editor" ], "Bhardwaj Anil": [ "autoreview" ], "BiT": [ "editor" ], "Bigdelboy": [ "transwiki" ], "Bignose~enwikibooks": [ "editor" ], "Billinghurst": [ "global-rollbacker", "editor" ], "Billymac00": [ "editor" ], "Biplab Anand": [ "global-rollbacker", "global-sysop" ], "Birdofadozentides": [ "editor" ], "BitterAsianMan": [ "editor" ], "Blua lago": [ "global-renamer" ], "Bluefoxicy": [ "editor" ], "Bluerasberry": [ "vrt-permissions" ], "BobChan2": [ "editor" ], "Bodhisattwa": [ "vrt-permissions" ], "BoldLuis": [ "editor" ], "Borhan": [ "global-rollbacker", "vrt-permissions" ], "Boris1951zz": [ "editor" ], "Bpenn005": [ "editor" ], "Brewster239": [ "global-rollbacker" ], "Bridget": [ "global-rollbacker", "editor" ], "Brienna.Hall77": [ "editor" ], "Brim": [ "editor" ], "Brittanys": [ "editor" ], "Bronwynh": [ "editor" ], "Bsadowski1": [ "editor", "steward" ], "Buddpaul": [ "editor" ], "Bullercruz1": [ "editor" ], "Buncic": [ "editor" ], "Bunnypranav": [ "global-renamer" ], "BurakD53": [ "editor" ], "Burkep": [ "editor" ], "ByGrace": [ "editor" ], "Bykim2012": [ "editor" ], "C1203sc": [ "editor" ], "CJakes1": [ "editor" ], "CKWG - Ada Magica": [ "editor" ], "Cabayi": [ "global-renamer" ], "CaitlinCarbury": [ "autoreview" ], "CalciumTetraoxide": [ "editor" ], "CalendulaAsteraceae": [ "editor" ], "Caliburn": [ "editor" ], "CallumPoole": [ "editor" ], "Calvin.Andrus": [ "editor" ], "Cameron11598": [ "editor" ], "Camouflaged Mirage": [ "editor" ], "Captain-tucker": [ "vrt-permissions" ], "Carlo.milanesi": [ "editor" ], "Caro de Segeda": [ "editor" ], "CarsracBot": [ "editor" ], "Catermark": [ "editor" ], "Cecila123": [ "autoreview" ], "Cedar101": [ "editor" ], "Champion": [ "editor" ], "Chaojidage": [ "editor" ], "Chaojoker": [ "editor" ], "Chaotic Enby": [ "autoreview", "global-renamer" ], "Chapka": [ "editor" ], "Charidri": [ "editor" ], "Charleneabeana": [ "autoreview" ], "Charles Jeffrey Danoff": [ "editor" ], "CharlesHoffman": [ "editor" ], "Chazz": [ "editor" ], "Chelseafan528": [ "editor" ], "Cheryl2012": [ "editor" ], "Chescargot": [ "vrt-permissions" ], "Chi Sigma": [ "editor" ], "Chinmayee Mishra": [ "ombuds" ], "Chongkian": [ "editor" ], "Chowbok": [ "editor" ], "ChrisHodgesUK": [ "editor" ], "ChrisWallace": [ "editor" ], "Chriswaterguy": [ "editor" ], "Chuckhoffmann": [ "editor" ], "Church of emacs": [ "global-rollbacker" ], "Cic": [ "editor" ], "Ciell": [ "vrt-permissions" ], "Cilantrohead": [ "editor" ], "Cintilo": [ "editor" ], "Circuit dreamer": [ "editor" ], "Circuit-fantasist": [ "editor" ], "Civvì": [ "global-rollbacker", "global-renamer" ], "Ckwalker": [ "editor" ], "Clairerusselll": [ "autoreview" ], "Cloidl": [ "autoreview" ], "Cmsmcq": [ "editor" ], "Cnrowley": [ "editor" ], "CocoaZen": [ "editor" ], "CoconutOctopus": [ "global-renamer" ], "Codename Noreste": [ "sysop", "global-rollbacker", "interface-admin" ], "Codename Noroeste": [ "editor" ], "Codinghead": [ "editor" ], "CommonsDelinker": [ "autoreview" ], "Comp.arch": [ "editor" ], "Conan": [ "editor" ], "Cormullion": [ "editor" ], "Count Count": [ "steward" ], "Coupe": [ "editor" ], "Courcelles": [ "global-rollbacker", "editor" ], "CptViraj": [ "global-rollbacker", "global-renamer", "global-sysop" ], "Craignewland": [ "editor" ], "Craxd1": [ "editor" ], "CrazyEddy": [ "editor" ], "Cremastra": [ "editor" ], "Cremastra (JWB)": [ "autoreview" ], "Cromium": [ "editor" ], "Cromwellt": [ "editor" ], "Crystal East": [ "editor" ], "Cttcraig": [ "editor" ], "Cultures17": [ "editor" ], "Cultures33": [ "editor" ], "Cultures4": [ "editor" ], "Cultures92": [ "editor" ], "CunninghamJohn": [ "autoreview" ], "Curtaintoad": [ "editor" ], "Cyberpower678": [ "global-rollbacker" ], "Céréales Killer": [ "global-renamer" ], "D1n05aur5 4ever": [ "editor" ], "DARIO SEVERI": [ "autoreview", "global-rollbacker", "global-sysop" ], "DC Slagel": [ "editor" ], "DCB": [ "vrt-permissions" ], "DD 8630": [ "editor" ], "DGerman": [ "editor" ], "DVD206": [ "editor" ], "DZadventiste": [ "editor" ], "DaB.": [ "vrt-permissions" ], "DaGizza": [ "editor" ], "Dagana4": [ "autoreview" ], "Dallas1278": [ "editor" ], "Dan Koehl": [ "editor" ], "Dan Polansky": [ "editor" ], "Dan-aka-jack": [ "editor" ], "DanCherek": [ "autoreview" ], "Danarwaller": [ "editor" ], "DanielWhernchend": [ "editor" ], "Danielravennest": [ "editor" ], "Danilka5469": [ "editor" ], "Daniuu": [ "steward", "vrt-permissions" ], "DannyS712": [ "editor" ], "Darklama": [ "editor" ], "Darklilac": [ "editor" ], "Darrelljon": [ "editor" ], "DarwIn": [ "vrt-permissions" ], "Dave Braunschweig": [ "editor" ], "David L Davis": [ "editor" ], "DavidCary": [ "editor" ], "DavidLevinson": [ "editor" ], "Davidbena": [ "editor" ], "Dayshade": [ "editor" ], "Dchmelik": [ "editor" ], "Dcljr": [ "editor" ], "Dcondon": [ "editor" ], "Deepfriedokra": [ "global-renamer" ], "DejaVu": [ "global-rollbacker", "global-renamer" ], "DennisDaniels": [ "editor" ], "Dennisblu": [ "uploader" ], "Denniss": [ "editor" ], "DerHexer": [ "editor", "steward", "vrt-permissions" ], "Derek Andrews": [ "editor" ], "Designermadsen": [ "editor" ], "Deu": [ "global-rollbacker" ], "Dexxor": [ "editor" ], "Dezedien": [ "vrt-permissions" ], "Diandramartin": [ "autoreview" ], "Didym": [ "vrt-permissions" ], "Dino Bronto Rex": [ "editor" ], "Dirk Hünniger": [ "editor" ], "Divinations": [ "global-rollbacker" ], "Djb": [ "editor" ], "Djbrown": [ "editor" ], "Dlrohrer2003": [ "editor" ], "Dmccreary": [ "editor" ], "Doc Taxon": [ "vrt-permissions" ], "Doctorxgc": [ "editor" ], "Dom walden": [ "editor" ], "Domdomegg": [ "editor" ], "DominikTurner": [ "autoreview" ], "DonaldKronos": [ "editor" ], "DoubleGrazing": [ "global-renamer" ], "Doubleotoo": [ "editor" ], "Downdate": [ "editor" ], "Dr-Taher": [ "global-renamer" ], "Dr.Unclear": [ "editor" ], "DreamRimmer": [ "global-renamer", "global-sysop" ], "Dreftymac": [ "editor" ], "Drpundir": [ "editor" ], "Drummingman": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "DuLithgow": [ "editor" ], "Dungodung": [ "vrt-permissions" ], "Duplode": [ "editor" ], "DustDFG": [ "editor" ], "Dyolf77": [ "vrt-permissions" ], "EDCU320RHT": [ "editor" ], "EDUC320 Sylvialiang": [ "editor" ], "EE JRW": [ "editor" ], "EMAD KAYYAM": [ "editor" ], "EPIC": [ "steward" ], "EarlGrey2005": [ "autoreview" ], "Ebe123": [ "editor" ], "Ecarew": [ "editor" ], "Edgar181": [ "editor" ], "Edit filter": [ "sysop" ], "EdoDodo": [ "editor" ], "Edornbush": [ "editor" ], "Edriiic": [ "editor" ], "Efex": [ "editor" ], "Efex3": [ "editor" ], "Effeietsanders": [ "editor", "vrt-permissions" ], "EggRoll97": [ "editor" ], "Egil": [ "editor" ], "Eihel": [ "global-rollbacker", "editor" ], "Ejs-80": [ "global-renamer" ], "Ekaroleski": [ "editor" ], "Elaurier": [ "editor" ], "Elcobbola": [ "vrt-permissions" ], "Electro": [ "editor" ], "ElfSnail123": [ "editor" ], "Eli bubo4ka": [ "editor" ], "Eliarani": [ "editor" ], "Elli": [ "global-renamer", "vrt-permissions" ], "Ellywa": [ "vrt-permissions" ], "Elmacenderesi": [ "vrt-permissions" ], "Elton": [ "editor", "steward" ], "Emha": [ "vrt-permissions" ], "EmilymDaniel": [ "autoreview" ], "Empire3131": [ "editor" ], "Encik Tekateki": [ "editor" ], "Enzomartinelli": [ "editor" ], "Eric Evers": [ "editor" ], "Erigena": [ "editor" ], "Erik Baas": [ "editor" ], "ErinNik": [ "editor" ], "Erinamukuta": [ "editor" ], "ErrantX": [ "editor" ], "EruannoVG": [ "editor" ], "Espen180": [ "editor" ], "Eta Carinae": [ "global-renamer" ], "Ethacke1": [ "editor" ], "Eumolpo": [ "editor" ], "Euphydryas": [ "global-renamer" ], "Eurodyne": [ "editor" ], "EvDawg93": [ "editor" ], "EvanCarroll": [ "editor" ], "Ewen": [ "editor" ], "Exusiai": [ "global-renamer" ], "Ezarate": [ "global-rollbacker", "vrt-permissions" ], "Fabartus": [ "editor", "uploader" ], "Faendalimas": [ "ombuds" ], "Fasten": [ "editor" ], "Faster than Thunder": [ "editor" ], "Fathoms Below": [ "global-renamer" ], "Fcorthay": [ "editor" ], "Fdena": [ "editor" ], "Federhalter": [ "editor" ], "Fehufanga": [ "global-rollbacker", "global-sysop" ], "Fekarp": [ "editor" ], "Fephisto": [ "editor" ], "Ferien": [ "global-rollbacker" ], "Fernando2812l": [ "editor" ], "Fernly": [ "editor" ], "Ffion B Thompson": [ "autoreview" ], "Fimatic": [ "editor" ], "FischX": [ "editor" ], "Fishpi": [ "editor" ], "Flattail": [ "editor" ], "FlightTime": [ "global-renamer" ], "Flolit": [ "editor" ], "Fluffernutter": [ "vrt-permissions" ], "FlyingAce": [ "global-rollbacker" ], "Fountain Pen": [ "editor" ], "Fr33kman": [ "editor" ], "FrancisFromGaspesie": [ "editor" ], "Frantsch": [ "autoreview" ], "Fredericknortje": [ "editor" ], "Fritzlein~enwikibooks": [ "editor" ], "Frozen Wind": [ "transwiki", "editor" ], "Ftaljaard": [ "editor" ], "Ftiercel": [ "editor" ], "Furrykef": [ "editor" ], "GKFX": [ "editor" ], "Galahad": [ "global-rollbacker" ], "Gampe": [ "vrt-permissions" ], "Ganímedes": [ "vrt-permissions" ], "Gary Dorman Wiggins": [ "editor", "uploader" ], "Garygaryj": [ "editor" ], "Gat lombard": [ "editor" ], "Gc211": [ "editor" ], "Geagea": [ "vrt-permissions" ], "Geekgirl": [ "editor" ], "GemmaCampbell": [ "autoreview" ], "Geoff Plourde": [ "editor" ], "Geofferybard": [ "transwiki", "editor" ], "GerbenRienk": [ "editor" ], "Gerges": [ "global-rollbacker", "global-renamer" ], "Germany Poul Ah": [ "editor" ], "Gertbuschmann": [ "editor" ], "Ggee0621": [ "editor" ], "Gifnk dlm 2020": [ "editor", "uploader" ], "Girdi": [ "editor" ], "Glaisher": [ "editor" ], "Glane23": [ "vrt-permissions" ], "Gleb713": [ "autoreview" ], "Glich": [ "editor" ], "Gllyons": [ "editor" ], "Gmasterman": [ "editor" ], "GoblinInventor": [ "editor" ], "Good afternoon": [ "editor" ], "GoreyCat": [ "editor" ], "GorgeUbuasha": [ "editor" ], "GorillaWarfare": [ "vrt-permissions" ], "Gott wisst": [ "editor" ], "Goulart": [ "editor" ], "Gpkp": [ "editor" ], "Gracebaysinger": [ "editor" ], "Graeme E. Smith": [ "editor" ], "Greatswrd": [ "editor" ], "GreenC": [ "editor" ], "Greenbreen": [ "editor" ], "Greenman": [ "editor" ], "GregXenon01": [ "editor" ], "Gretski247": [ "editor" ], "GreyCat": [ "editor" ], "Grin": [ "vrt-permissions" ], "Growl41": [ "editor" ], "Guaka": [ "editor" ], "Guanaco": [ "editor" ], "GuillermoHazebrouck": [ "editor" ], "Guus": [ "editor" ], "Guy vandegrift": [ "editor" ], "Guywan": [ "editor" ], "Gzuufy": [ "editor" ], "HLand": [ "editor" ], "HYanWong": [ "editor" ], "Ha98574": [ "editor" ], "Hagindaz": [ "editor" ], "HakanIST": [ "editor", "steward" ], "Hamish": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "Hanay": [ "vrt-permissions" ], "Hannes Röst": [ "editor" ], "Hans Adler": [ "editor" ], "Haoreima": [ "editor" ], "Happy-melon": [ "editor" ], "Harry Wood": [ "editor" ], "Harrybrowne1986": [ "editor" ], "Harv4": [ "editor" ], "Hasley": [ "editor" ], "Hazard-SJ": [ "global-rollbacker" ], "He7d3r": [ "editor" ], "HenkvD": [ "editor" ], "Herbythyme": [ "editor" ], "Hercule": [ "editor" ], "Herman darman": [ "editor" ], "HerrHartmuth": [ "editor" ], "Hethrir": [ "editor" ], "HgDeviasse": [ "editor" ], "Hippias": [ "editor" ], "Hliow": [ "autoreview" ], "Holder": [ "global-rollbacker", "global-sysop" ], "Holdoffhunger": [ "editor" ], "Hoo man": [ "editor", "steward" ], "HouseBlaster": [ "global-renamer" ], "Howard Beale": [ "editor" ], "Hpon": [ "editor" ], "Hrkalona": [ "autoreview" ], "Hskeet": [ "editor", "uploader" ], "Htm": [ "vrt-permissions" ], "Hugetim": [ "editor" ], "Humaira Ali": [ "editor" ], "Huntertur": [ "editor" ], "Hydriz": [ "global-rollbacker" ], "Ibidthewriter": [ "editor" ], "Ibrahim Sani Mustapha": [ "editor" ], "Ibrahim.ID": [ "global-renamer", "vrt-permissions" ], "Icetruck": [ "editor" ], "Icodense": [ "global-rollbacker", "global-sysop" ], "Idavidmiller": [ "editor" ], "Ideasman42": [ "editor" ], "Igna": [ "editor" ], "Ijon": [ "vrt-permissions" ], "Illusional": [ "editor" ], "Iluvatar": [ "global-rollbacker", "vrt-permissions" ], "Indiana": [ "editor" ], "Inductiveload": [ "editor" ], "Inertia6084": [ "autoreview" ], "Inferno986return": [ "editor" ], "Infinite0694": [ "global-rollbacker", "global-sysop" ], "Ingolemo": [ "editor" ], "Insignificantwrangler": [ "editor" ], "Internoob": [ "transwiki", "editor" ], "InverseHypercube": [ "editor" ], "Isenhand": [ "editor" ], "Ish ishwar": [ "editor" ], "Iste Praetor": [ "editor" ], "ItsNyoty": [ "vrt-permissions" ], "Itsmeyash31": [ "autoreview" ], "Itswikisam": [ "editor" ], "Itti": [ "global-renamer", "vrt-permissions" ], "Ixfd64": [ "editor" ], "J ansari": [ "global-rollbacker" ], "J.palacios.jean": [ "editor" ], "J36miles": [ "editor" ], "JBW": [ "global-renamer" ], "JCrue": [ "editor" ], "JJ12880": [ "editor" ], "JJMC89": [ "vrt-permissions" ], "JJPMaster": [ "sysop", "global-rollbacker", "global-renamer", "interface-admin", "vrt-permissions" ], "JJPMaster (test 1)": [ "autoreview" ], "JJohnson": [ "editor" ], "JJohnson1701": [ "editor" ], "JPPINTO": [ "editor" ], "Jack Frost": [ "vrt-permissions" ], "JackBot": [ "editor" ], "JackPotte": [ "sysop", "interface-admin" ], "Jackhand1": [ "autoreview" ], "Jacob J. Walker": [ "editor" ], "Jafeluv": [ "global-rollbacker", "editor" ], "Jake Park": [ "global-renamer" ], "Jakec": [ "editor" ], "JamesCrook": [ "editor" ], "JamesNZ": [ "editor" ], "Jamesofur": [ "global-rollbacker" ], "Jamesssss": [ "editor" ], "Jamzze": [ "editor" ], "Jan Myšák": [ "global-rollbacker" ], "Jan.duggan": [ "autoreview" ], "Janbery": [ "global-rollbacker", "vrt-permissions" ], "Janpha": [ "editor" ], "Janschejbal": [ "editor" ], "Jason.Cozens": [ "editor" ], "Jaspalkaler": [ "editor" ], "Jasper Deng": [ "global-rollbacker" ], "JavaHurricane": [ "global-rollbacker", "editor" ], "Javier Carro": [ "editor" ], "JavierCantero": [ "editor" ], "Jay Bolero": [ "editor" ], "Jazzmanian": [ "editor" ], "Jcb": [ "editor", "vrt-permissions" ], "Jcwf": [ "editor" ], "Jeff G.": [ "global-rollbacker", "editor" ], "Jeff1138": [ "editor" ], "Jellysandwich0": [ "editor" ], "JenVan": [ "editor" ], "JenniferPalacios": [ "editor" ], "Jenniferjkidd": [ "editor" ], "Jens Østergaard Petersen": [ "editor" ], "JeremyMcCracken": [ "editor" ], "Jeroenr": [ "editor" ], "Jerome Charles Potts": [ "editor" ], "Jerry vlntn": [ "editor" ], "Jesdisciple": [ "editor" ], "Jfmantis": [ "editor" ], "Jianhui67": [ "global-rollbacker", "editor" ], "Jianhui67 public": [ "editor" ], "Jim Ashby": [ "autoreview" ], "JimKillock": [ "editor" ], "Jimbotyson": [ "editor" ], "Jimmy Xu": [ "vrt-permissions" ], "Jkauf007": [ "editor" ], "Jmdeschamps": [ "uploader" ], "Jnanaranjan sahu": [ "ombuds" ], "Jnewh001": [ "editor" ], "Jobin RV": [ "editor" ], "Joewiz": [ "editor" ], "Johannes Bo": [ "editor" ], "Johannnes89": [ "steward" ], "John Cross": [ "editor" ], "JohnMarcelo": [ "editor" ], "Johnkn63": [ "editor" ], "Johnwhelan": [ "editor" ], "Jokes Free4Me": [ "editor" ], "Jomegat": [ "editor" ], "Jon Harald Søby": [ "vrt-permissions" ], "Jon Kolbert": [ "steward", "vrt-permissions" ], "Jonathan Webley": [ "editor" ], "Jordan Brown": [ "editor" ], "JorisvS": [ "editor" ], "Josve05a": [ "vrt-permissions" ], "Jrincayc": [ "editor" ], "Jsnaree": [ "editor" ], "Jtneill": [ "editor" ], "JuethoBot": [ "autoreview" ], "Jugandi": [ "editor" ], "Jules*": [ "global-renamer" ], "Juliancolton": [ "global-rollbacker", "editor" ], "Jumark27": [ "editor" ], "JustTheFacts33": [ "editor" ], "Justlettersandnumbers": [ "global-renamer", "vrt-permissions" ], "K6ka": [ "global-rollbacker", "global-renamer" ], "Kadı": [ "global-renamer", "vrt-permissions" ], "Kai Burghardt": [ "editor" ], "Kaltenmeyer": [ "editor" ], "Kambai Akau": [ "editor" ], "Kanjy": [ "global-rollbacker", "editor" ], "Kapooht": [ "editor" ], "Karl Wick": [ "editor" ], "Karosent": [ "editor" ], "Kashkhan": [ "editor" ], "Kathryn Mary Nicholson": [ "autoreview" ], "Katiemgeorge": [ "editor" ], "Katyauchter": [ "editor" ], "Kaushlendratripathi": [ "editor" ], "Kaw8yh": [ "editor" ], "Kayau": [ "transwiki", "editor" ], "Kellen": [ "editor" ], "Kelti": [ "editor" ], "Kiefer.Wolfowitz": [ "editor" ], "Killarnee": [ "editor" ], "King of Hearts": [ "vrt-permissions" ], "Kingaustin07": [ "editor" ], "Kingofnuthin": [ "editor" ], "Kirito": [ "global-rollbacker", "editor" ], "Kittycataclysm": [ "sysop" ], "Kj cheetham": [ "global-renamer" ], "Kkmurray": [ "editor" ], "Kl-robertson": [ "editor" ], "Klaas van Buiten": [ "editor" ], "Knittedbees": [ "transwiki", "editor" ], "Knoppson": [ "autoreview" ], "Koantum": [ "editor" ], "Koavf": [ "sysop", "global-rollbacker" ], "Kodos": [ "editor" ], "KonstantinaG07": [ "editor", "steward" ], "Kowey": [ "editor" ], "KrakatoaKatie": [ "vrt-permissions" ], "Krd": [ "vrt-permissions" ], "Krdbot": [ "vrt-permissions" ], "Kri": [ "editor" ], "Krinkle": [ "global-rollbacker" ], "Kropotkine 113": [ "vrt-permissions" ], "Kruusamägi": [ "vrt-permissions" ], "Ktucker": [ "editor" ], "Kwamikagami": [ "editor" ], "Kwhitefoot": [ "editor" ], "Kylu": [ "editor" ], "Kızıl": [ "global-renamer" ], "L10nM4st3r": [ "editor" ], "LABoyd2": [ "editor" ], "LR0725": [ "global-rollbacker", "global-sysop" ], "Ladislav": [ "editor" ], "Ladsgroup": [ "global-renamer" ], "Ladybug62": [ "editor" ], "Lagoset": [ "editor" ], "Larsnooden": [ "editor" ], "Laurianedani": [ "editor" ], "Lcraw005": [ "editor" ], "Ldo": [ "editor" ], "Leaderboard": [ "sysop", "global-renamer", "interface-admin" ], "Learnerktm": [ "editor" ], "Lechatjaune": [ "vrt-permissions" ], "Leighblackall": [ "editor" ], "Lengel46": [ "editor" ], "Lentokonefani": [ "global-renamer" ], "LeoChiukl": [ "editor" ], "Leonard64": [ "uploader" ], "Leonidlednev": [ "autoreview", "global-rollbacker" ], "Leovanderven": [ "editor" ], "Lesless": [ "vrt-permissions" ], "Leyo": [ "global-rollbacker" ], "Lgriot": [ "editor" ], "Liam987": [ "editor" ], "Liao": [ "editor" ], "Libperry": [ "editor" ], "Limiza": [ "editor" ], "Lionel Cristiano": [ "editor" ], "Litlok": [ "global-renamer" ], "Little Sunshine": [ "global-renamer" ], "Llakew": [ "editor" ], "LlamaAl": [ "editor" ], "Lobsteroh": [ "editor" ], "LodestarChariot2": [ "editor" ], "Lofty abyss": [ "global-rollbacker", "editor", "vrt-permissions" ], "Logictheo": [ "editor" ], "Lomita": [ "vrt-permissions" ], "Londonjackbooks": [ "editor" ], "Lovepeacejoy404": [ "editor" ], "Lp0 on fire": [ "autoreview", "global-rollbacker" ], "Lubaochuan": [ "editor" ], "Luckas Blade": [ "editor" ], "Lucystewpid": [ "autoreview" ], "Ludovic Brenta": [ "editor" ], "Ludovicocaldara": [ "editor", "uploader" ], "Lukas²³": [ "editor" ], "LukeCEL": [ "editor" ], "Lvova": [ "vrt-permissions" ], "Lwill031": [ "editor" ], "M7": [ "steward" ], "MARKELLOS": [ "vrt-permissions" ], "MBq": [ "global-renamer" ], "MF-Warburg": [ "global-rollbacker", "global-sysop", "editor" ], "MGA73": [ "vrt-permissions" ], "MIacono": [ "editor" ], "MNeuschaefer": [ "editor" ], "MS Sakib": [ "global-renamer", "vrt-permissions" ], "Mabdul": [ "transwiki", "editor", "uploader" ], "Madisonhen": [ "autoreview" ], "Magda.dagda": [ "editor" ], "Magnus Manske": [ "editor" ], "Mahagaja": [ "editor" ], "MaikoM93": [ "editor" ], "Maire": [ "global-renamer" ], "Malarz pl": [ "global-renamer" ], "Manchiu": [ "global-renamer" ], "MandoRachovitsa": [ "autoreview" ], "Mandy Hopkins": [ "editor" ], "ManuelGR": [ "editor" ], "MarcGarver": [ "sysop", "checkuser", "steward" ], "Marco Klunder": [ "editor" ], "MarcoAurelio": [ "editor" ], "Marcus Cyron": [ "vrt-permissions" ], "Mardus": [ "editor" ], "MarkJFernandes": [ "editor" ], "MarkTraceur": [ "editor" ], "Markcwm": [ "editor" ], "Markhobley": [ "editor" ], "MarsRover": [ "editor" ], "Marshman~enwikibooks": [ "editor" ], "Martin Kraus": [ "editor" ], "Martin Sauter": [ "editor" ], "Martin Urbanec": [ "editor", "steward", "vrt-permissions" ], "MartinPoulter": [ "editor" ], "Martinwguy2": [ "editor" ], "MarygoldRules": [ "editor" ], "Master tongue": [ "editor" ], "Masti": [ "steward", "vrt-permissions" ], "Math buff": [ "editor" ], "MathXplore": [ "global-rollbacker", "editor" ], "Mathildem16": [ "autoreview" ], "Mathmensch": [ "editor" ], "Mathmensch-Smalledits": [ "editor" ], "Mathmogeek": [ "editor" ], "Maths314": [ "editor" ], "Matiia": [ "editor" ], "Matrix": [ "autoreview", "vrt-permissions" ], "Matsievsky": [ "editor" ], "Mattb112885": [ "editor" ], "Mattbarton.exe": [ "editor" ], "Matttest": [ "autoreview" ], "Max Milas": [ "editor" ], "Maxim": [ "editor" ], "Maximillion Pegasus": [ "global-rollbacker", "editor" ], "Maxint2": [ "editor" ], "Mazbel": [ "global-rollbacker" ], "Mbch331": [ "vrt-permissions" ], "Mbrickn": [ "transwiki", "editor" ], "Mcdonnkm": [ "editor" ], "Mcld": [ "editor" ], "Mdkoch84": [ "editor" ], "Mdmckenzie": [ "editor" ], "MdsShakil": [ "steward", "vrt-permissions" ], "Mdupont": [ "editor" ], "Me Lendroz": [ "editor" ], "Meanmicio": [ "editor" ], "Mecanismo": [ "editor" ], "MediaKyle": [ "editor" ], "Meditation": [ "editor" ], "Meev0": [ "editor" ], "Mehman": [ "ombuds", "vrt-permissions" ], "Melos": [ "steward", "vrt-permissions" ], "MemicznyJanusz": [ "global-renamer" ], "Mendelivia~enwikibooks": [ "editor" ], "Meniktah": [ "editor" ], "Mercy": [ "global-rollbacker", "editor" ], "MerlLinkBot": [ "editor" ], "Mfield": [ "global-renamer" ], "Mh7kJ": [ "editor" ], "Michael Romanov": [ "editor" ], "MichaelFrey": [ "editor" ], "Michaelbluett": [ "editor", "uploader" ], "Mido": [ "vrt-permissions" ], "MihalOrela": [ "editor" ], "MiiCii": [ "editor" ], "Mike Hayes": [ "editor" ], "Mike.lifeguard": [ "editor" ], "Mild Bill Hiccup": [ "editor" ], "Mill3315": [ "editor" ], "Millbart": [ "vrt-permissions" ], "Mimarx": [ "editor" ], "Min1996": [ "autoreview" ], "Minorax": [ "global-rollbacker", "global-sysop", "editor" ], "Mirinano": [ "global-rollbacker" ], "Mithridates": [ "editor" ], "Mjbt": [ "editor" ], "Mjchael": [ "editor" ], "Mjkaye": [ "editor" ], "Mkline": [ "autoreview" ], "Mlipl001": [ "editor" ], "Moby-Dick4000": [ "editor" ], "Mohean": [ "editor" ], "Money-lover-12345": [ "editor" ], "Moonriddengirl": [ "autoreview", "vrt-permissions" ], "Mortense": [ "editor" ], "Mpfau": [ "editor" ], "Mr. Stradivarius": [ "editor" ], "MrAlanKoh": [ "editor" ], "MrJaroslavik": [ "global-rollbacker", "ombuds" ], "Mrajcok": [ "editor" ], "Mrjulesd": [ "editor" ], "Mrwojo": [ "editor" ], "Mschrag": [ "editor" ], "Msmithma": [ "editor" ], "MtPenguinMonster": [ "editor" ], "Mtarch11": [ "global-rollbacker", "global-sysop", "editor" ], "Musical Inquisit": [ "editor" ], "Mussklprozz": [ "vrt-permissions" ], "Mvolz": [ "editor" ], "Mwtoews": [ "editor" ], "Mxn": [ "editor" ], "Myklaw": [ "editor" ], "Mykola7": [ "steward" ], "Mys 721tx": [ "global-renamer", "vrt-permissions" ], "NDG": [ "global-rollbacker", "editor" ], "Nadzik": [ "global-rollbacker", "global-renamer" ], "NahidSultan": [ "vrt-permissions" ], "Nangkhan Magar": [ "editor" ], "Natuur12": [ "vrt-permissions" ], "Nbarth": [ "editor" ], "Nbro": [ "editor" ], "Nehaoua": [ "ombuds" ], "Neils51": [ "editor" ], "Nemoralis": [ "vrt-permissions" ], "Neojacob": [ "editor" ], "Neriah": [ "global-rollbacker", "global-renamer" ], "Nesbit": [ "editor" ], "Newlisp": [ "editor" ], "Nfgdayton": [ "editor" ], "NguoiDungKhongDinhDanh": [ "global-rollbacker", "editor" ], "NhacNy2412": [ "global-renamer" ], "Nick.anderegg": [ "editor" ], "NickPenguin": [ "editor" ], "NicoScribe": [ "editor" ], "Nicole Sharp": [ "editor" ], "Nieuwsgierige Gebruiker": [ "editor" ], "Nigos": [ "autoreview" ], "Nihonjoe": [ "global-renamer" ], "Nikai": [ "editor" ], "Ninjastrikers": [ "vrt-permissions" ], "NipplesMeCool": [ "editor" ], "Njardarlogar": [ "editor" ], "Nobody60": [ "editor" ], "Nolispanmo": [ "vrt-permissions" ], "Nomstuff": [ "autoreview" ], "Nonenmac": [ "editor" ], "Norton": [ "editor" ], "Npettiaux": [ "editor" ], "Nsaa": [ "vrt-permissions" ], "Nthep": [ "vrt-permissions" ], "NuclearWarfare": [ "global-rollbacker", "editor" ], "OMSMike": [ "editor" ], "Officer781": [ "editor" ], "Oleander": [ "editor" ], "Oliviacatherall": [ "autoreview" ], "Omphalographer": [ "editor" ], "OnBeyondZebrax": [ "editor" ], "Onsen": [ "editor" ], "Ontzak": [ "global-renamer" ], "Orderud": [ "editor" ], "OrenBochman": [ "editor" ], "Oshwah": [ "global-renamer" ], "Ottawahitech": [ "editor" ], "Owain.davies": [ "editor" ], "PAC": [ "editor" ], "PAC2": [ "editor" ], "PK 97": [ "editor" ], "PNW Raven": [ "editor" ], "Pac8612": [ "editor" ], "Paloi Sciurala": [ "global-rollbacker" ], "Panic2k4": [ "transwiki", "editor" ], "Pascal Pignard": [ "editor" ], "Pastbury": [ "editor" ], "Pathfinders": [ "editor" ], "Pathoschild": [ "editor" ], "Patrik": [ "editor" ], "PauSix": [ "editor" ], "Paul James": [ "editor" ], "Pavroo": [ "editor" ], "PbakerODU": [ "editor" ], "Pbrower2a": [ "editor" ], "Pearts": [ "editor" ], "Peeragogia": [ "editor" ], "Peri Coleman": [ "editor" ], "Perl~enwikibooks": [ "editor" ], "Peter1180": [ "editor" ], "PeterEasthope": [ "editor" ], "Peyton09": [ "editor" ], "Phan M. Nhat": [ "autoreview" ], "PhilKnight": [ "global-renamer" ], "Phoebe": [ "editor" ], "Phosgram": [ "editor" ], "Pi zero": [ "editor" ], "PieWriter": [ "editor" ], "Piotrus": [ "editor" ], "Pithikos": [ "editor" ], "Pittsburgh Poet": [ "editor" ], "Pjpearce": [ "editor" ], "Pkkao": [ "editor" ], "Planotse": [ "editor" ], "Platonides": [ "vrt-permissions" ], "Pluke": [ "editor" ], "PlyrStar93": [ "global-rollbacker", "editor" ], "Pminh141": [ "global-renamer" ], "Pmlineditor": [ "editor" ], "Pmw57": [ "editor" ], "Poetcsw": [ "editor" ], "PoizonMyst": [ "editor" ], "Pola 2607": [ "autoreview" ], "Polimerek": [ "vrt-permissions" ], "Polluks": [ "editor" ], "Pookiyama": [ "editor" ], "Popski": [ "editor" ], "Povigna": [ "editor" ], "Ppolar bear": [ "global-rollbacker", "global-renamer" ], "Pppery": [ "autoreview" ], "Prahlad balaji": [ "editor" ], "Pratyeka": [ "editor" ], "Praxidicae": [ "global-rollbacker", "global-sysop", "editor" ], "Primefac": [ "vrt-permissions" ], "Prince Kassad~enwikibooks": [ "editor" ], "Pronesto": [ "editor" ], "Prototyperspective": [ "autoreview" ], "Psoup": [ "editor" ], "Psr1909": [ "editor" ], "PullUpYourSocks": [ "editor" ], "PurpleBuffalo": [ "global-renamer" ], "PurplePieman": [ "editor" ], "Purplebackpack89": [ "editor" ], "Putukas01": [ "editor" ], "Qenalcu": [ "autoreview" ], "Quebecguy": [ "global-rollbacker" ], "QueerEcofeminist": [ "global-rollbacker", "global-renamer", "editor" ], "Quinlan83": [ "global-rollbacker", "editor" ], "Quintucket": [ "editor" ], "Qwerty number1": [ "editor" ], "Qwertyus": [ "editor" ], "Qədir": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "R. Henrik Nilsson": [ "editor" ], "RAdimer-WMF": [ "global-rollbacker" ], "RDBury": [ "editor" ], "RJHall": [ "editor" ], "Ra'ike": [ "vrt-permissions" ], "Rachboots": [ "editor" ], "Rachel": [ "editor" ], "Rachmat04": [ "global-renamer", "vrt-permissions" ], "RadiX": [ "editor", "steward", "vrt-permissions" ], "Raffaela Kunz": [ "editor" ], "Rahulkepapa": [ "editor" ], "Ramac": [ "editor" ], "Rambam rashi": [ "editor" ], "Randykitty": [ "autoreview", "global-rollbacker" ], "RatónMístico176": [ "editor" ], "Ravichandar84": [ "editor" ], "Rawheatley": [ "editor" ], "Ray Trygstad": [ "editor" ], "RayeChellMahela": [ "editor" ], "Raymond": [ "vrt-permissions" ], "Razr Nation": [ "editor" ], "Rchaswms01": [ "editor" ], "Rcragun": [ "editor", "uploader" ], "Readyokaygo": [ "editor" ], "Recent Runes": [ "editor" ], "Redlentil": [ "editor" ], "Refcanimm": [ "editor" ], "Regasterios": [ "vrt-permissions" ], "Reinhard Kraasch": [ "vrt-permissions" ], "RenaissanceMan2144": [ "autoreview" ], "Renamed user 242094acfb1a5b2f08e9e78f2e021a40": [ "editor" ], "Renamed user 5f91ca71739b07cfce8397eed758fe13": [ "editor", "uploader" ], "Renamed user f26394dcb19bd7bdad78f0d752896653": [ "editor" ], "Renvoy": [ "global-rollbacker", "global-sysop" ], "Reseletti": [ "editor" ], "Retropunk": [ "editor" ], "Reuben1508": [ "autoreview" ], "Revi C.": [ "global-rollbacker", "global-renamer", "ombuds", "editor", "vrt-permissions" ], "Reyk": [ "editor" ], "Rfc1394": [ "editor" ], "Rgdboer": [ "editor" ], "Rgreenone": [ "editor" ], "Rhole2001": [ "autoreview" ], "Rich Farmbrough": [ "editor" ], "Rickstambaugh": [ "editor" ], "Riggwelter": [ "vrt-permissions" ], "Risk": [ "editor" ], "Risteall": [ "editor" ], "Ritjesman": [ "editor" ], "RoMancer": [ "editor" ], "Robbiemorrison": [ "editor" ], "Robert Huber~enwikibooks": [ "editor" ], "Roberto Mura": [ "editor" ], "Robertsky": [ "global-renamer", "vrt-permissions" ], "RobinH": [ "editor" ], "Rodasmith": [ "editor" ], "Rodrigo": [ "editor" ], "Rodrigo.Argenton": [ "vrt-permissions" ], "Rogerborrell": [ "editor" ], "Rogerdpack": [ "editor" ], "RogueScholar": [ "editor" ], "Romainbehar": [ "editor" ], "RomaineBot": [ "vrt-permissions" ], "RonaldB": [ "vrt-permissions" ], "Rosser1954": [ "editor" ], "Rotlink": [ "editor" ], "RoySmith": [ "ombuds" ], "Rozzychan": [ "editor" ], "Rplano": [ "editor" ], "Rreagan007": [ "autoreview" ], "Rrgreen": [ "editor" ], "Rschen7754": [ "global-rollbacker", "editor" ], "RshieldsVA": [ "editor" ], "Rsjaffe": [ "global-renamer" ], "Rtaisis": [ "editor" ], "Ruakh": [ "editor" ], "Rudolpho~enwikibooks": [ "editor" ], "Runfellow": [ "editor" ], "Runner4lyfe": [ "editor" ], "RunningBlind": [ "editor" ], "Ruthven": [ "vrt-permissions" ], "Ruud Koot": [ "transwiki", "editor" ], "Rzuwig": [ "autoreview", "global-rollbacker" ], "S8321414": [ "global-renamer" ], "SB Johnny": [ "editor" ], "SCP-2000": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "SHB2000": [ "sysop", "steward" ], "SPM": [ "editor" ], "Sae1962": [ "editor" ], "Safuan12616": [ "editor" ], "SahniM": [ "editor" ], "Sakretsu": [ "steward" ], "Sakura emad": [ "global-rollbacker" ], "Salil Kumar Mukherjee": [ "editor" ], "Samat": [ "vrt-permissions" ], "Sammy2012": [ "editor" ], "Samuel.dellit": [ "editor" ], "Samuele2002": [ "global-rollbacker", "editor" ], "Samwilson": [ "editor" ], "SanBonne": [ "global-renamer", "vrt-permissions" ], "Sandbergja": [ "editor" ], "Sannita": [ "vrt-permissions" ], "Sante Caserio~enwikibooks": [ "editor" ], "SarahFatimaK": [ "editor" ], "Sargoth": [ "vrt-permissions" ], "Saroj": [ "global-rollbacker" ], "Sascha Lill 95": [ "editor" ], "Satdeep Gill": [ "vrt-permissions" ], "Savh": [ "global-rollbacker", "editor" ], "Sbb1413": [ "editor" ], "Scention": [ "editor" ], "Schniggendiller": [ "steward" ], "SchreiberBike": [ "editor" ], "Scott.beckman": [ "editor" ], "Sebastian Wallroth": [ "vrt-permissions" ], "Seewolf": [ "global-rollbacker", "vrt-permissions" ], "Sekidoki": [ "vrt-permissions" ], "Selden": [ "editor" ], "Sennecaster": [ "vrt-permissions" ], "Serinap": [ "editor" ], "Seth Miller": [ "editor" ], "SevenSpheres": [ "editor" ], "Sfan00 IMG": [ "editor" ], "Sfoerster": [ "editor" ], "Sgarrigan": [ "editor" ], "Sgowal": [ "editor" ], "Shaitand": [ "editor" ], "ShakespeareFan00": [ "editor" ], "SharingNotes": [ "editor" ], "Shawntanchinyang": [ "editor" ], "Shdwninja8": [ "editor" ], "ShelleyAdams": [ "autoreview" ], "ShifaYT": [ "global-rollbacker" ], "Shii": [ "editor" ], "Shira the Mogul": [ "editor" ], "Shlomif": [ "editor" ], "ShuBraque": [ "editor" ], "Sidelight12": [ "editor" ], "Sidorkin": [ "editor" ], "Sidpatil": [ "editor" ], "Siebengang": [ "editor" ], "Sigma 7": [ "editor" ], "Simon Peter Hughes": [ "editor" ], "Sinus46": [ "editor" ], "Sir Beluga": [ "editor" ], "Sir Lestaty de Lioncourt": [ "vrt-permissions" ], "SixWingedSeraph": [ "editor" ], "Sj": [ "editor" ], "Sjc~enwikibooks": [ "editor" ], "Sjlegg": [ "editor" ], "Sjone101": [ "editor" ], "Sjö": [ "global-rollbacker" ], "Skymath": [ "editor" ], "Slava Ukraini Heroyam Slava 123": [ "editor", "uploader" ], "Slava Ukrajini Heroyam Slava": [ "editor" ], "Sluffs": [ "editor" ], "Smjg": [ "editor" ], "SnappyDragonPennyroyal": [ "editor" ], "SocialKnowledge": [ "editor" ], "SoftwareEngineerMoose": [ "autoreview" ], "Sonia": [ "editor" ], "Sophie Cheng": [ "editor" ], "Sotiale": [ "steward" ], "Soul windsurfer": [ "editor" ], "SouthParkFan65": [ "editor" ], "SoylentGreen": [ "editor" ], "Spamduck": [ "editor" ], "Spaynton": [ "editor" ], "Spender2001": [ "editor" ], "Speregrination": [ "editor" ], "Spiderworm": [ "editor" ], "Spoon!": [ "editor" ], "Squasher": [ "global-renamer" ], "Srhat": [ "editor" ], "Stang": [ "global-rollbacker", "editor", "vrt-permissions" ], "Stanglavine": [ "editor" ], "Steinsplitter": [ "global-renamer", "vrt-permissions" ], "StephT0704": [ "autoreview" ], "Stepheng3": [ "editor" ], "Stepro": [ "vrt-permissions" ], "Steve M": [ "editor" ], "Stilfehler": [ "editor" ], "Stockywood": [ "editor" ], "Storeye": [ "editor" ], "Strainu": [ "vrt-permissions" ], "Strange quark": [ "editor" ], "Stryn": [ "global-rollbacker", "editor" ], "Stïnger": [ "global-rollbacker", "editor" ], "Suchenwi": [ "editor" ], "Sumone10154": [ "editor" ], "SunCreator": [ "editor" ], "Sunny Cryolite": [ "global-rollbacker" ], "Sunshineconnelly": [ "editor" ], "SuperTyphoonNoru": [ "editor" ], "Superbass": [ "vrt-permissions" ], "Superpes15": [ "global-rollbacker", "global-renamer", "global-sysop", "vrt-permissions" ], "Supertoff": [ "vrt-permissions" ], "Superzerocool": [ "vrt-permissions" ], "SupremeUmanu": [ "editor" ], "Suruena": [ "editor" ], "Sutambe": [ "editor" ], "Sutton Publishing": [ "editor" ], "Sué González Hauck": [ "editor" ], "Svartava": [ "global-rollbacker", "global-renamer", "global-sysop", "editor" ], "SweetCanadianMullet": [ "editor" ], "Swift": [ "editor" ], "SyG": [ "editor" ], "Sylvesterchukwu04": [ "editor" ], "Sylvialim": [ "editor" ], "Sylviaread": [ "editor" ], "Synoman Barris": [ "global-rollbacker", "transwiki", "editor" ], "Syum90": [ "global-rollbacker", "editor" ], "Syunsyunminmin": [ "global-rollbacker", "global-renamer", "global-sysop", "editor" ], "T.seppelt": [ "editor" ], "TDang": [ "editor" ], "TTWIDEE": [ "editor" ], "Tahmid": [ "editor" ], "Taketa": [ "global-renamer" ], "Takipoint123": [ "vrt-permissions" ], "TakuyaMurata": [ "editor" ], "Tamzin": [ "global-renamer" ], "Tanbiruzzaman": [ "global-rollbacker", "global-renamer", "global-sysop", "editor", "vrt-permissions" ], "Tannertsf": [ "editor" ], "Taoheedah": [ "editor" ], "Tapsevarg": [ "editor" ], "TaronjaSatsuma": [ "vrt-permissions" ], "Taxman": [ "editor" ], "Tchoř": [ "global-renamer" ], "Tdkehoe": [ "editor" ], "Tdvorak": [ "editor" ], "Techman224": [ "editor" ], "Tegel": [ "editor", "steward" ], "Teles": [ "ombuds", "steward", "vrt-permissions" ], "Tem5psu": [ "editor" ], "Tempodivalse": [ "editor" ], "TenWhile6": [ "global-rollbacker", "global-renamer", "global-sysop", "editor" ], "Tenshi Hinanawi": [ "autoreview", "global-rollbacker" ], "Terence Kearey": [ "editor" ], "Ternarius": [ "global-renamer" ], "Ternera": [ "global-rollbacker", "global-renamer", "global-sysop", "editor" ], "Tesleemah": [ "editor" ], "Tevfik AKTUĞLU": [ "editor" ], "Tgregtregretgtr": [ "editor" ], "ThatBPengineer": [ "autoreview" ], "Thatonewikiguy": [ "editor" ], "The Squirrel Conspiracy": [ "vrt-permissions" ], "The labs": [ "editor" ], "TheGoodEndedHappily": [ "vrt-permissions" ], "ThePCKid": [ "editor" ], "TheSandDoctor": [ "global-renamer", "vrt-permissions" ], "Theknightwho": [ "editor" ], "Thenub314": [ "editor" ], "Theo Hughes": [ "editor" ], "Theornamentalist": [ "editor" ], "Thereen": [ "editor" ], "Thewinster": [ "editor" ], "Thierry Dugnolle": [ "editor" ], "Thinkglobalnow": [ "editor" ], "Thirunavukkarasye-Raveendran": [ "editor" ], "Thomas Simpson": [ "editor" ], "Thomas.haslwanter": [ "editor" ], "Thomas.lochmatter": [ "editor" ], "Tibetologist": [ "editor" ], "Tigerzeng": [ "global-rollbacker" ], "Tiled": [ "editor" ], "TimBorgNetzWerk": [ "editor" ], "Timothy Gu": [ "editor" ], "Timpo": [ "editor" ], "Tiptoety": [ "editor" ], "Tjyang": [ "editor" ], "Tlustulimu": [ "editor" ], "Tmvogel": [ "editor" ], "Tom Morris": [ "editor" ], "Tomato86": [ "editor" ], "Tomt87": [ "editor" ], "Tomybrz": [ "editor" ], "Tonyvall": [ "autoreview" ], "Tp42": [ "editor" ], "Tracklayingninja": [ "editor" ], "Tradimus": [ "editor" ], "Tropicalkitty": [ "global-rollbacker", "editor" ], "TrulyShruti": [ "editor" ], "Ts12rAc": [ "global-rollbacker" ], "Tsarina CatarinaToo": [ "autoreview" ], "TunnelESON": [ "sysop" ], "Turbojet": [ "vrt-permissions" ], "Turkmen": [ "editor" ], "TwoThirty": [ "editor" ], "Tyoyafud": [ "editor" ], "Túrelio": [ "autoreview" ], "U$3rname008": [ "editor" ], "USSR-Slav": [ "global-rollbacker" ], "Uf.hun2201": [ "editor" ], "Ulubatli Hasan": [ "global-renamer" ], "Uncitoyen": [ "global-rollbacker", "global-renamer" ], "Uncle G": [ "editor" ], "Unixxx": [ "editor" ], "User01938": [ "editor" ], "Username222": [ "editor" ], "Utcursch": [ "vrt-permissions" ], "Uziel302": [ "editor" ], "Uzume": [ "editor" ], "V0lkanic": [ "global-renamer" ], "VIGNERON": [ "steward" ], "Valery Starikov": [ "editor" ], "Van der Hoorn": [ "editor" ], "Varnent": [ "vrt-permissions" ], "Vdolar": [ "autoreview" ], "VectorVoyager": [ "editor" ], "Venzz": [ "vrt-permissions" ], "Verfassungsfreund": [ "editor" ], "Veritas Sapientiae": [ "global-rollbacker", "global-renamer", "vrt-permissions" ], "Vermont": [ "editor", "steward", "vrt-permissions" ], "Victor Stefan Stoica": [ "autoreview" ], "Victor Trevor": [ "autoreview" ], "Victoria.sandeman": [ "autoreview" ], "Vincent Vega": [ "global-renamer" ], "Vito Genovese": [ "editor" ], "Vituzzu": [ "editor" ], "Vladimir Solovjev": [ "global-renamer", "vrt-permissions" ], "Vogone": [ "global-rollbacker", "editor" ], "Vossman": [ "editor" ], "Vrinda": [ "editor" ], "VulcanWikiEdit": [ "editor" ], "Vwanweb": [ "editor" ], "WOSlinker": [ "autoreview" ], "Waihorace": [ "global-rollbacker" ], "Waldyrious": [ "editor" ], "WalshDay": [ "editor" ], "Wargo": [ "editor" ], "Wbjimmyd": [ "editor" ], "Wcoole": [ "editor" ], "WeelkyWikiReader": [ "editor" ], "Wekeepwhatwekill": [ "autoreview" ], "WereSpielChequers": [ "editor" ], "What no2000": [ "editor" ], "WhatamIdoing": [ "editor" ], "WhitePhosphorus": [ "global-rollbacker", "global-sysop" ], "Whiteknight": [ "editor" ], "Whoop whoop pull up": [ "editor" ], "Whym": [ "editor", "vrt-permissions" ], "Wiki13": [ "editor" ], "WikiBayer": [ "global-rollbacker", "global-sysop", "editor" ], "WikiFer": [ "vrt-permissions" ], "Wikimi-dhiann": [ "editor" ], "Wikiotics": [ "editor" ], "Wikiwau": [ "autoreview", "editor" ], "WillNess": [ "editor" ], "Willscrlt": [ "editor" ], "Wim b": [ "global-rollbacker", "global-sysop", "editor" ], "Wisden": [ "editor" ], "Withinfocus": [ "editor" ], "Wj32": [ "editor" ], "Wkee4ager": [ "editor" ], "Wobbit": [ "editor" ], "Wojciech Pędzich": [ "vrt-permissions" ], "Wong128hk": [ "global-renamer" ], "Wooze": [ "global-rollbacker" ], "Wundermacht": [ "editor" ], "Wutsje": [ "global-rollbacker", "editor" ], "Ww2censor": [ "vrt-permissions" ], "Wüstenspringmaus": [ "global-rollbacker", "global-renamer" ], "XXBlackburnXx": [ "editor", "steward" ], "Xandradi": [ "editor" ], "Xania": [ "sysop", "checkuser" ], "Xaosflux": [ "editor", "steward" ], "XenonX3": [ "vrt-permissions" ], "Xerol": [ "editor" ], "Xeverything11": [ "editor", "uploader" ], "Xhungab": [ "editor" ], "Xinkai Wu": [ "editor" ], "Xixtas": [ "editor" ], "Xqt": [ "global-rollbacker" ], "Xxagile": [ "editor" ], "Xypron": [ "editor" ], "Xz64": [ "editor" ], "Y-S.Ko": [ "editor" ], "YMS": [ "editor" ], "Yahya": [ "steward", "vrt-permissions" ], "Yamla": [ "global-renamer" ], "Yann": [ "editor" ], "Yerpo": [ "global-renamer", "vrt-permissions" ], "Yikrazuul": [ "editor" ], "Ymblanter": [ "global-rollbacker" ], "Yndesai": [ "editor" ], "Youssefsan": [ "editor" ], "Ysangkok": [ "editor" ], "Yvelik": [ "uploader" ], "Yzmo": [ "editor" ], "ZI Jony": [ "editor" ], "Zabe": [ "global-rollbacker" ], "Zafer": [ "ombuds" ], "Zedshort": [ "editor" ], "ZeroOne": [ "editor" ], "Zetud": [ "global-rollbacker", "vrt-permissions" ], "Ziv": [ "editor" ], "Zoeannl": [ "editor" ], "Zollerriia": [ "editor" ], "Zoohouse": [ "editor" ], "Zoot": [ "editor" ], "Zsohl": [ "autoreview", "editor" ], "Zvsmith": [ "editor" ], "Zweighaft": [ "editor" ], "ZxxZxxZ": [ "editor" ], "~riley": [ "global-rollbacker", "editor" ], "Érico": [ "global-renamer" ], "Виктор Пинчук": [ "editor" ], "Воображение": [ "editor" ], "Всевидящий": [ "global-rollbacker" ], "Д.Ильин": [ "editor" ], "Л.П. Джепко": [ "editor" ], "יהודה שמחה ולדמן": [ "editor" ], "מקף": [ "global-rollbacker", "global-renamer" ], "د. فارس الجويلي": [ "global-renamer" ], "علاء": [ "steward", "vrt-permissions" ], "فيصل": [ "global-renamer", "vrt-permissions" ], "सीमा1": [ "editor" ], "タチコマ robot": [ "editor" ], "ネイ": [ "global-renamer" ], "人间百态": [ "global-rollbacker" ], "臺灣象象": [ "autoreview" ], "范": [ "vrt-permissions" ], "青子守歌": [ "vrt-permissions" ], "魔琴": [ "global-rollbacker" ], "ꠢꠣꠍꠘ ꠞꠣꠎꠣ": [ "editor" ], "기나ㅏㄴ": [ "global-rollbacker", "global-renamer" ] } irv9033qh5pgnq6etru1lfyy51zzra2 0 478047 4655477 4538479 2026-07-25T00:31:16Z Omphalographer 3427146 delete per rfd 4655477 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = Introduction = The '''Sigma Spiral Constant''' is a proposed mathematical constant that emerges from studying the geometry of logarithmic spirals. Whereas π governs the relationship between radius and circumference in circles, the Sigma Spiral Constant is inspired by π and is explored as a way to describe the relationship between radius and arc length in spirals over one radian. The motivation for introducing this constant is the search for a natural invariant that might capture the scaling behavior of spirals. Spirals are ubiquitous in nature (shells, galaxies, hurricanes), yet unlike circles, there is no widely recognized constant that encodes their fundamental geometry. The Sigma Spiral Constant is presented here as an '''exploratory idea''', intended to encourage discussion and experimentation rather than to claim a fully established law. In this Wikibook, we will: * Define the constant as it has been proposed. * Provide examples of its tentative computation. * Explore its relation to other well-known constants. * Suggest directions for further study, noting current limitations. {{BookCat}} h03bsmn1skhzr80e4xbr8xkdnbshg8y 0 478048 4655478 4538481 2026-07-25T00:31:20Z Omphalographer 3427146 delete per rfd 4655478 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = Definition and Properties = == Formal Definition == The Sigma Spiral Constant, usually denoted by Σs, is defined as the unique real solution x > 1 of the equation: : (x − 1) * sqrt(1 + (log x)^2) = x * log(x) Numerical evaluation gives approximately: : Σs ≈ 18.53493733204947 This definition is '''exploratory''': Σs is introduced as a proposed invariant arising from the study of logarithmic spirals, not as an established universal constant. == Basic Properties == * Σs is dimensionless, like π and e. * It is proposed to arise from the length–radius relation of a logarithmic spiral covering one radian. * The solution is unique for x > 1, which motivates its consideration as a constant. * It is conjectured to be irrational, though this has not been proven. == Comparison with Other Constants == * Inspired by π, Σs is explored in relation to connecting an angle measure (1 radian) to a length measure. * Like e, Σs involves logarithmic behavior and growth. * Unlike π and e, Σs remains '''hypothetical''' and has not yet been widely studied or recognized in mathematics. == Approximate Expansion == The decimal expansion of Σs begins as: : 18.534937332... {{BookCat}} cjoptrxyurso30zv07lth5l7w461ycz 0 478049 4655479 4537357 2026-07-25T00:31:23Z Omphalographer 3427146 delete per rfd 4655479 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = Computation and Examples = == Numerical Computation == The Sigma Spiral Constant Σs is defined implicitly by the equation: :(x − 1) * sqrt(1 + (log x)^2) = x * log(x) To approximate Σs numerically, one can use standard root-finding methods such as Newton–Raphson. == Example in Python == Here is a simple implementation using Python: <syntaxhighlight lang="python"> import mpmath as mp f = lambda x: (x - 1) * mp.sqrt(1 + (mp.log(x))**2) - x * mp.log(x) root = mp.findroot(f, 18) # initial guess near 18 print(root) # 18.5349373050... </syntaxhighlight> This confirms that Σs ≈ 18.5349373. == Example in Mathematica == In Mathematica/Wolfram Language: <syntaxhighlight lang="mathematica"> NSolve[(x - 1)*Sqrt[1 + Log[x]^2] == x*Log[x], x, Reals] </syntaxhighlight> This returns the unique solution x ≈ 18.5349373. == Worked Example == Suppose we want to compute the length of one radian of a logarithmic spiral segment with initial radius r = 1. Using the Sigma Spiral Constant: :L ≈ Σs * r Thus, for r = 1: :L ≈ 18.5349373 {{BookCat}} kowv9s0e97g1kkl41ndvrkxis0p3f29 0 478050 4655480 4538482 2026-07-25T00:31:27Z Omphalographer 3427146 delete per rfd 4655480 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = Relation to Other Constants = == Relation to π == π governs circular geometry: the ratio of circumference to diameter is π. The Sigma Spiral Constant, Σs, is inspired by π in that it is proposed to describe the ratio between spiral arc length and radius after one radian of winding. Both are angle-related, but unlike π, Σs remains a '''hypothetical and exploratory idea'''. == Relation to e == The natural base e arises from continuous growth and logarithmic functions. The defining equation of Σs involves logarithms, which suggests a '''conceptual connection''' to e. This resemblance highlights how logarithmic behavior can appear in different mathematical contexts, though Σs is not as fundamental as e. == Relation to the Golden Ratio φ == The golden ratio φ = (1 + √5)/2 often appears in spirals (e.g., phyllotaxis, sunflower heads). While Σs is not directly derived from φ, both constants reflect geometric growth patterns in nature. Where φ governs proportion, Σs is proposed as a way of expressing spiral length scaling. == Summary == * π -> circular geometry (established, universal). * e -> growth and logarithmic functions (established, universal). * φ -> natural proportions and spirals (established, universal). * Σs -> proposed exploratory constant related to the length–radius relation in logarithmic spirals.. {{BookCat}} ghd4eezgcefrie0rd3qsjbmfosjfmj4 0 478051 4655481 4538483 2026-07-25T00:31:32Z Omphalographer 3427146 delete per rfd 4655481 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = Open Problems = The Sigma Spiral Constant is a newly proposed and exploratory idea, and many questions remain unanswered. Some open directions for further study include: == Irrationality and Transcendence == * Is Σs irrational? * Could Σs be transcendental, like π and e? At present, no proof or rigorous result exists. == Closed-Form Expression == * Can Σs be expressed in terms of known constants (π, e, φ, etc.)? * Or does it represent a '''potentially new constant''' not reducible to existing ones? == Geometric Interpretation == * Does Σs appear in other spiral-related structures in mathematics, physics, or biology? * Could Σs offer a descriptive model for growth laws in natural spirals (e.g., galaxies, shells, hurricanes), or is its scope limited to the formal definition given here? == Series or Product Representations == * Is there a convergent series expansion for Σs? * Can Σs be expressed through an infinite product or continued fraction? == Applications == * Could Σs find exploratory use in applied mathematics, such as wave mechanics, fractal geometry, or computer graphics? * Does Σs hint at connections in complex analysis, even if not yet on the same footing as π or e? {{BookCat}} 4up4lokhqkdnm56tkujuk3miwaivhg8 0 478053 4655482 4538484 2026-07-25T00:31:36Z Omphalographer 3427146 delete per rfd 4655482 wikitext text/x-wiki {{delete|per [[Wikibooks:Requests for deletion/A New Mathematical Constant: The Sigma Spiral]]}} = References = * H. S. M. Coxeter, ''Introduction to Geometry'', Wiley, 1961, p. 164 (The golden spiral). * Wikipedia contributors, "Logarithmic spiral," in ''Wikipedia, The Free Encyclopedia''. * Nazwa Shabrina Zain, ''The Sigma Spiral Constant (Σs): A Spiral Length Invariant'', Academia.edu, 2025. == External Links == * [https://archive.org/details/coxeter-introduction-to-geometry-red/page/n13/mode/1up Introduction to Geometry] * [https://en.wikiversity.org/wiki/Sigma_Spiral_Constant Wikiversity: Sigma Spiral Constant] {{BookCat}} q07f2vcv9jent1lddcubus2o5hliuf7 4 484829 4655489 4655395 2026-07-25T08:10:15Z ArchiverBot 1227662 Bot: Archiving 2 threads from [[Wikibooks:Reading room/Administrative Assistance]] 4655489 wikitext text/x-wiki {{talk archive}} == Bestdealsautofla reported by MathXplore == * {{userlinks|Bestdealsautofla}} Spam <!-- USERREPORTED:/Bestdealsautofla/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:19, 2 July 2026 (UTC) :{{done}} —[[User:Kittycataclysm|Kittycataclysm]] ([[User talk:Kittycataclysm|discuss]] • [[Special:Contributions/Kittycataclysm|contribs]]) 01:26, 3 July 2026 (UTC) == Cthrucleaningsolutionso reported by MathXplore == * {{userlinks|Cthrucleaningsolutionso}} advertising <!-- USERREPORTED:/Cthrucleaningsolutionso/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 22:19, 2 July 2026 (UTC) :{{done|Sandbox deleted}} —[[User:Kittycataclysm|Kittycataclysm]] ([[User talk:Kittycataclysm|discuss]] • [[Special:Contributions/Kittycataclysm|contribs]]) 01:26, 3 July 2026 (UTC) :: The user was blocked indefinitely as a spam-only account. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 01:47, 3 July 2026 (UTC) == Prudhvifmsdh reported by MathXplore == * {{userlinks|Prudhvifmsdh}} Spam <!-- USERREPORTED:/Prudhvifmsdh/ --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 12:39, 8 July 2026 (UTC) : {{done}}. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 13:07, 8 July 2026 (UTC) == Protecting Pages == Hello, Admins, My name is Kayden Swanson, and I have proudly created ''[[The Geoguide]].'' But I would like to remove the ability for fellow users to edit it to prevent vandalism and preserve my prized creation I have made for school. Could you permanently lock it so others cant edit it while I still can? [[User:Kayden Swanson|Kayden Swanson]] ([[User talk:Kayden Swanson|discuss]] • [[Special:Contributions/Kayden Swanson|contribs]]) 02:41, 6 July 2026 (UTC) :Hi @[[User:Kayden Swanson|Kayden Swanson]]! Unfortunately, that is not an appropriate justification for protecting a page here at Wikibooks per the [[Wikibooks:Protection policy|protection policy]]. Notably, {{tq|"Preemptive full protection of pages is contrary to the open nature of Wikibooks"}}. Cheers —[[User:Kittycataclysm|Kittycataclysm]] ([[User talk:Kittycataclysm|discuss]] • [[Special:Contributions/Kittycataclysm|contribs]]) 19:15, 6 July 2026 (UTC) ::NOOOOOOOOOOOOOOOOOOOOOOOOOOOOO okay that's fine [[User:Kayden Swanson|Kayden Swanson]] ([[User talk:Kayden Swanson|discuss]] • [[Special:Contributions/Kayden Swanson|contribs]]) 00:26, 8 July 2026 (UTC) ::: I'm sorry, but that's not within the scope of the protection policy. [[User:Codename Noreste|<span style="color:#0024FF">Codename Noreste</span>]] ([[User talk:Codename Noreste|discuss]] • [[Special:Contributions/Codename Noreste|contribs]]) 12:39, 8 July 2026 (UTC) :::If you really want a stable version, you can make a PDF of the existing content and link it. See [[Help:Print versions]] and {{tl|Print version}}/{{tl|PDF version}}. ―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 19:15, 10 July 2026 (UTC) == I'm unable to create a page == Hello, I wanted to created the page [[English in Use/Agreement]]. I thought I would use a modified version of a Wikipedia article (https://en.wikipedia.org/wiki/Agreement_in_the_English_language). It's already written like a textbook, so I did some improvements and clicked "published", but I got the error: <blockquote>Welcome to Wikibooks!Your edit has triggered an automated filter and has been disallowed. It looks like your edit has added a large amount of content to this page.If you copied the content from another website, please do not add it without rewriting it in your own words. Unless the content is in the public domain (published before 1923), it is almost certainly copyrighted and cannot be added to Wikibooks.If all of the content is your own work and you cannot find anything to link, feel free to ask for the edit to be performed at the reading room. If you have received this message in error, you may report it here.</blockquote> What should I do? Can you help me? [[User:Justtocreateapage|Justtocreateapage]] ([[User talk:Justtocreateapage|discuss]] • [[Special:Contributions/Justtocreateapage|contribs]]) 20:43, 10 July 2026 (UTC) :@[[User:Justtocreateapage|Justtocreateapage]] An editfilter is preventing your edit. In my opinion, you did not do anything wrong and the filter is wrong, but an admin (=not me) would need to fix it. [[User:Der-Wir-Ing|Der-Wir-Ing]] ([[User talk:Der-Wir-Ing|discuss]] • [[Special:Contributions/Der-Wir-Ing|contribs]]) 20:52, 10 July 2026 (UTC) :: {{re|Justtocreateapage}} As a new user you face harsher requirements. You should make useful edits to Wikibooks first. If you want to use a modified version of a WP article, [[Wikibooks: Requests for import|requesting an import]] is the proper venue. This [[Help: Importing|preserves the edit history]]. ‑‑[[User:Kai Burghardt|Kai Burghardt]] ([[User talk:Kai Burghardt|discuss]] • [[Special:Contributions/Kai Burghardt|contribs]]) 21:15, 10 July 2026 (UTC) :::Okay, thanks you all. I'll request for an import then [[User:Justtocreateapage|Justtocreateapage]] ([[User talk:Justtocreateapage|discuss]] • [[Special:Contributions/Justtocreateapage|contribs]]) 21:39, 10 July 2026 (UTC) ::::{{done}} ―[[User:Koavf|Justin (<span style="color:grey">ko'''a'''<span style="color:black">v</span>f</span>)]]<span style="color:red">❤[[User talk:Koavf|T]]☮[[Special:Contributions/Koavf|C]]☺[[Special:Emailuser/Koavf|M]]☯</span> 21:50, 10 July 2026 (UTC) n0y5dzsby4quy79icmp257liyc5f7ms 110 484938 4655498 4655391 2026-07-25T11:34:10Z MathXplore 3097823 Adding {{qr-em}} tag 4655498 wikitext text/x-wiki {{qr-em|1=}} This is a stub. 9nod18d49uc9izuhla6hgp8vy59jybx 0 484951 4655474 2026-07-24T22:48:48Z JustTheFacts33 3434282 Created page with "{{Vehicle Identification Numbers (VIN codes)/Warning}}{{clear}} ====Restraint types 1981-1989 Rwd Passenger Car==== The restraint type is specified as character 4 of the American VIN for 1981-1989 Isuzu Rwd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |A||Manual Seatbelts only - No Passive Restraint |- |B||Motorized Seatbelts (Passive Restraint) ['88-'89 Impulse] |} ====Car Line Code 1985-1993 Fwd/Awd Passenger Car==== The Car Line & Seri..." 4655474 wikitext text/x-wiki {{Vehicle Identification Numbers (VIN codes)/Warning}}{{clear}} ====Restraint types 1981-1989 Rwd Passenger Car==== The restraint type is specified as character 4 of the American VIN for 1981-1989 Isuzu Rwd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |A||Manual Seatbelts only - No Passive Restraint |- |B||Motorized Seatbelts (Passive Restraint) ['88-'89 Impulse] |} ====Car Line Code 1985-1993 Fwd/Awd Passenger Car==== The Car Line & Series Code is specified as character 4 of the American VIN for 1985-1993 Isuzu Fwd/Awd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |R||I-Mark [Fwd] ('85-'89), Impulse [Fwd/Awd] ('90-'92), Stylus ('91-'93) |} ====Line & Series Code 1981-1989 Rwd Passenger Car==== The Line & Series Code is specified as character 5 of the American VIN for 1981-1987 Isuzu Rwd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |R||Impulse [Rwd] ('83-'89) |- |T||I-Mark [Rwd] ('81-Early '85) |} ====Series Code 1985-1993 Fwd/Awd Passenger Car==== The Series Code is specified as character 5 of the American VIN for 1985-1993 Isuzu Fwd/Awd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |T||I-Mark [Fwd] ('85-'89), Impulse [Fwd/Awd] ('90-'92), Stylus ('91-'93) |} ====Body style codes 1981-1989 Rwd Passenger Car==== The Body type is specified as characters 6 and 7 of the American VIN for 1981-1989 Isuzu Rwd passenger cars. {| border=1 style="margin:auto;" !VIN !Description |- |07||Two-Door Hatchback ('83-'89 Impulse) |- |69||Four-Door Sedan ('81-Early '85 I-Mark) [Rwd] |- |77||Two-Door Coupe ('81-'84 I-Mark) |} ====Body style codes 1985-1993 Fwd/Awd Passenger Car==== The Body type is specified as character 6 of the American VIN for 1985-1993 Isuzu Fwd/Awd passenger cars. {| border=1 style="margin:auto;" !VIN !Description |- |2||Two-Door Hatchback (Mid '85-'89 Isuzu I-Mark [Fwd], '90-'92 Impulse coupe) |- |4||Two-Door Wagon ('91-'92 Isuzu Impulse Hatchback) |- |5||Four-Door Sedan (Mid '85-'89 Isuzu I-Mark [Fwd], '90-'93 Stylus) |} ====Restraint types 1985-1993 Fwd/Awd Passenger Car==== The restraint type is specified as character 7 of the American VIN for 1985-1993 Isuzu Fwd/Awd passenger cars. {| border=1 style="margin:auto;" !VIN Code !Description |- |1||Manual Seatbelts only - No Passive Restraint |- |3||Manual Seatbelts plus Driver-side Airbag ['90-'92 Impulse, '91-'93 Stylus] |} ====Engine codes==== Isuzu encodes the engine type in character 8 of the VIN. The following table outlines the various engines encoded there: {| class="wikitable" |- ! VIN !! Size !! Type !! Fuel !! Valvetrain !! Engine Family/Notes/Applications |- | A || 1.9L || I4 || Gas ||SOHC,<br /> 8 valve||MPI. Isuzu G200Z engine. Isuzu Impulse '83-'87 |- | A || 1.9L || I4 || Gas ||SOHC,<br /> 8 valve||2-bbl carb. Isuzu G200Z engine. Isuzu Trooper '84-'85 |- | B || 1.8L || I4 || Gas ||SOHC,<br /> 8 valve||2-bbl carb. Isuzu G180Z engine. Isuzu I-Mark [Rwd] '81-Early '85 |- | E || 2.6L || I4 || Gas ||SOHC,<br /> 8 valve||MPI. Isuzu 4ZE1 engine. Isuzu Trooper '88-'91, Pickup '88-'95, Amigo '89-'94, Rodeo '91-'97 |- | F || 2.0L || I4 Turbo [[w:Intercooler|IC]] || Gas ||SOHC,<br /> 8 valve||MPI. Isuzu 4ZC1-T engine. Isuzu Impulse Turbo '85-'89, Impulse Turbo RS '87 |- | K || 1.5L || I4 || Gas ||SOHC,<br /> 8 valve||2-bbl carb. Isuzu 4XC1 engine. Isuzu I-Mark [Fwd] '85. |- | L || 2.3L || I4 || Gas ||SOHC,<br /> 8 valve||MPI. Isuzu 4ZD1 engine. Isuzu Impulse '88-'89, Pickup '95 |- | L || 2.3L || I4 || Gas ||SOHC,<br /> 8 valve||2-bbl carb. Isuzu 4ZD1 engine. Isuzu Trooper '86-'87, Pickup '88-'94, Amigo '89-'93 |- | P || 1.8L || I4 || Diesel ||SOHC,<br /> 8 valve||Indirect injection. Isuzu 4FB1 engine. Isuzu I-Mark '81-'84. |- | R || 2.8L || V6 || Gas ||OHV||TBI. GM Chevrolet 60° V6 (RPO code: LL2). Isuzu Trooper '89-'91 |- | U || 2.2L || I4 Turbo || Diesel ||OHV,<br /> 8 valve||Indirect injection. Isuzu C223T engine. Isuzu Trooper '86, P'up '86 |- | Z || 3.1L || V6 || Gas ||OHV||TBI. GM Chevrolet 60° V6 (RPO code: LG6). Isuzu Pickup '91-'94, Rodeo '91-'92 |- | 4 || 1.6L || I4 Turbo [[w:Intercooler|IC]] || Gas ||DOHC,<br /> 16 valve||MPI. Isuzu 4XE1-WT engine. Isuzu Impulse RS '91-'92 |- | 5 || 1.6L || I4 || Gas ||DOHC,<br /> 16 valve||MPI. Isuzu 4XE1-UW engine. Isuzu I-Mark RS '89, Impulse XS '90-'91, Stylus XS '91 |- | 6 || 1.6L || I4 || Gas ||SOHC,<br /> 12 valve||MPI. Isuzu 4XE1-V engine. Isuzu Stylus S '91-'93 |- | 7 || 1.5L || I4 || Gas ||SOHC,<br /> 8 valve||2-bbl carb. Isuzu 4XC1 engine. Isuzu I-Mark '86-'89. |- | 8 || 1.8L || I4 || Gas ||DOHC,<br /> 16 valve||MPI. Isuzu 4XF1 engine. Isuzu Impulse XS '92, Stylus RS '92 |- | 9 || 1.5L || I4 Turbo || Gas ||SOHC,<br /> 8 valve||MPI. Isuzu 4XC1-T engine. Isuzu I-Mark Turbo '87, I-Mark RS Turbo '88, I-Mark LS Turbo '88-'89 . |} ===Position 9, Check Digit=== [[Vehicle Identification Numbers (VIN codes)/Check digit |Check digit]] ===Position 10, Model Year=== [[Vehicle Identification Numbers (VIN codes)/Model year|Model year]] ===Position 11, Production Plant:=== * 0: Fujisawa, Japan ('81-Early '85 I-Mark [Rwd], '83-'87 Impulse) * 4: Fujisawa, Japan ('85-'87 I-Mark, '83-'87 Impulse) * 6: Fujisawa, Japan (Early '85 I-Mark [Rwd]) * 7: Fujisawa, Japan ('88-'89 I-Mark, '88-'92 Impulse, '91-'93 Stylus) '''Positions 12–17, Serial Number''' {{BookCat}} 513e7ibh0dg2c6jo3kxw96zvcz2buf6 0 484952 4655483 2026-07-25T01:52:48Z Dịch giả Lê Trường An 3616223 Viết nội dung cho sách mới 4655483 wikitext text/x-wiki '''Sprint – 5 Ngày "Thổi Bay" Mọi Vấn Đề Và "Lên Gân" Ý Tưởng Startup''' là phiên bản tiếng Việt của cuốn ''Sprint: How to Solve Big Problems and Test New Ideas in Just Five Days'', một tác phẩm về đổi mới sáng tạo, thiết kế sản phẩm và quản trị dự án. Cuốn sách giới thiệu phương pháp '''Sprint''', quy trình làm việc kéo dài năm ngày nhằm giúp các nhóm nhanh chóng xác định vấn đề, phát triển giải pháp, xây dựng nguyên mẫu và kiểm chứng ý tưởng với người dùng trước khi đầu tư nguồn lực lớn. '''Giới thiệu''' Sprint được phát triển tại Google Ventures (GV) bởi Jake Knapp cùng sự đóng góp của John Zeratsky và Braden Kowitz. Phương pháp này được ứng dụng rộng rãi trong các startup công nghệ, doanh nghiệp đổi mới sáng tạo và nhiều tổ chức trên thế giới để rút ngắn thời gian ra quyết định, giảm rủi ro khi phát triển sản phẩm mới và tăng tốc quá trình đổi mới. Phiên bản tiếng Việt giúp độc giả Việt Nam tiếp cận quy trình Sprint thông qua ngôn ngữ gần gũi, các ví dụ thực tiễn và hướng dẫn triển khai chi tiết. '''Nội dung''' Cuốn sách trình bày quy trình Sprint trong năm ngày liên tiếp: * '''Thứ Hai – Hiểu vấn đề:''' Xác định mục tiêu dài hạn, lập bản đồ hành trình người dùng và lựa chọn thách thức quan trọng nhất. * '''Thứ Ba – Phát triển giải pháp:''' Mỗi thành viên tự nghiên cứu, phác thảo ý tưởng và đề xuất các phương án giải quyết. * '''Thứ Tư – Quyết định:''' Đánh giá các phương án, lựa chọn giải pháp tối ưu và xây dựng storyboard cho nguyên mẫu. * '''Thứ Năm – Tạo nguyên mẫu:''' Phát triển phiên bản mô phỏng đủ chân thực để người dùng có thể trải nghiệm. * '''Thứ Sáu – Kiểm chứng:''' Thử nghiệm nguyên mẫu với khách hàng mục tiêu nhằm thu thập phản hồi và xác thực giả thuyết. '''Giá trị''' Sprint nhấn mạnh việc '''kiểm chứng ý tưởng trước khi đầu tư''', giúp doanh nghiệp giảm chi phí thử sai và tăng tốc quá trình đổi mới. Phương pháp này kết hợp nhiều lĩnh vực như Design Thinking, User Experience (UX), nghiên cứu người dùng và phát triển sản phẩm tinh gọn (Lean Product Development). Theo quan điểm của các tác giả, nhiều quyết định quan trọng có thể được đưa ra chỉ trong một tuần nếu nhóm làm việc tập trung, loại bỏ các cuộc họp kéo dài và ưu tiên thử nghiệm thực tế thay vì tranh luận. '''Đánh giá''' Sprint được giới chuyên môn đánh giá là một trong những phương pháp làm việc hiệu quả dành cho các nhóm phát triển sản phẩm, startup và doanh nghiệp đổi mới sáng tạo. Nội dung sách tập trung vào tính thực hành với nhiều biểu mẫu, quy trình và ví dụ có thể áp dụng trực tiếp trong môi trường làm việc. Một trong những nhận định nổi bật về cuốn sách là: "Chìa khóa thành công chính là xây dựng những thói quen đúng. Nhưng câu hỏi thông minh lại là: ''Thói quen làm việc nào tốt nhất?'' Sprint cung cấp các phương pháp mạnh mẽ để phát triển ý tưởng, giải quyết các vấn đề, thử nghiệm giải pháp và hình thành những thói quen làm việc hiệu quả cho bất kỳ cá nhân hay tổ chức nào." '''Đối tượng độc giả''' Sprint hướng đến nhiều nhóm độc giả, bao gồm: * Nhà sáng lập startup. * Quản lý sản phẩm (Product Manager). * Nhà thiết kế UX/UI. * Nhóm nghiên cứu và phát triển (R&D). * Chuyên gia marketing. * Doanh nhân và nhà quản lý. * Những người quan tâm đến đổi mới sáng tạo và phát triển sản phẩm. '''Ảnh hưởng''' Kể từ khi xuất bản, Sprint đã được nhiều doanh nghiệp trên thế giới áp dụng trong quá trình phát triển sản phẩm, từ các công ty khởi nghiệp đến các tập đoàn công nghệ lớn. Phương pháp Sprint cũng trở thành nền tảng cho nhiều khóa đào tạo về Design Sprint, Product Design và Innovation Management. '''Xem thêm''' * Sprint (Design Sprint) * Design Thinking * Lean Startup * User Experience (UX) * Product Management '''Tham khảo''' # Jake Knapp, John Zeratsky & Braden Kowitz. ''Sprint: How to Solve Big Problems and Test New Ideas in Just Five Days''. Simon & Schuster, 2016. # Google Ventures (GV). Design Sprint Methodology. # Knapp, Jake. ''Make Time''. Currency, 2018. # Dịch giả Lê Trường An btjmc8rurkneha5wq6iz9fx5kaysl6e 4655485 4655483 2026-07-25T02:46:58Z MathXplore 3097823 Marking for speedy deletion: Out of scope 4655485 wikitext text/x-wiki <noinclude>{{Delete|example=false|Out of scope}}</noinclude> '''Sprint – 5 Ngày "Thổi Bay" Mọi Vấn Đề Và "Lên Gân" Ý Tưởng Startup''' là phiên bản tiếng Việt của cuốn ''Sprint: How to Solve Big Problems and Test New Ideas in Just Five Days'', một tác phẩm về đổi mới sáng tạo, thiết kế sản phẩm và quản trị dự án. Cuốn sách giới thiệu phương pháp '''Sprint''', quy trình làm việc kéo dài năm ngày nhằm giúp các nhóm nhanh chóng xác định vấn đề, phát triển giải pháp, xây dựng nguyên mẫu và kiểm chứng ý tưởng với người dùng trước khi đầu tư nguồn lực lớn. '''Giới thiệu''' Sprint được phát triển tại Google Ventures (GV) bởi Jake Knapp cùng sự đóng góp của John Zeratsky và Braden Kowitz. Phương pháp này được ứng dụng rộng rãi trong các startup công nghệ, doanh nghiệp đổi mới sáng tạo và nhiều tổ chức trên thế giới để rút ngắn thời gian ra quyết định, giảm rủi ro khi phát triển sản phẩm mới và tăng tốc quá trình đổi mới. Phiên bản tiếng Việt giúp độc giả Việt Nam tiếp cận quy trình Sprint thông qua ngôn ngữ gần gũi, các ví dụ thực tiễn và hướng dẫn triển khai chi tiết. '''Nội dung''' Cuốn sách trình bày quy trình Sprint trong năm ngày liên tiếp: * '''Thứ Hai – Hiểu vấn đề:''' Xác định mục tiêu dài hạn, lập bản đồ hành trình người dùng và lựa chọn thách thức quan trọng nhất. * '''Thứ Ba – Phát triển giải pháp:''' Mỗi thành viên tự nghiên cứu, phác thảo ý tưởng và đề xuất các phương án giải quyết. * '''Thứ Tư – Quyết định:''' Đánh giá các phương án, lựa chọn giải pháp tối ưu và xây dựng storyboard cho nguyên mẫu. * '''Thứ Năm – Tạo nguyên mẫu:''' Phát triển phiên bản mô phỏng đủ chân thực để người dùng có thể trải nghiệm. * '''Thứ Sáu – Kiểm chứng:''' Thử nghiệm nguyên mẫu với khách hàng mục tiêu nhằm thu thập phản hồi và xác thực giả thuyết. '''Giá trị''' Sprint nhấn mạnh việc '''kiểm chứng ý tưởng trước khi đầu tư''', giúp doanh nghiệp giảm chi phí thử sai và tăng tốc quá trình đổi mới. Phương pháp này kết hợp nhiều lĩnh vực như Design Thinking, User Experience (UX), nghiên cứu người dùng và phát triển sản phẩm tinh gọn (Lean Product Development). Theo quan điểm của các tác giả, nhiều quyết định quan trọng có thể được đưa ra chỉ trong một tuần nếu nhóm làm việc tập trung, loại bỏ các cuộc họp kéo dài và ưu tiên thử nghiệm thực tế thay vì tranh luận. '''Đánh giá''' Sprint được giới chuyên môn đánh giá là một trong những phương pháp làm việc hiệu quả dành cho các nhóm phát triển sản phẩm, startup và doanh nghiệp đổi mới sáng tạo. Nội dung sách tập trung vào tính thực hành với nhiều biểu mẫu, quy trình và ví dụ có thể áp dụng trực tiếp trong môi trường làm việc. Một trong những nhận định nổi bật về cuốn sách là: "Chìa khóa thành công chính là xây dựng những thói quen đúng. Nhưng câu hỏi thông minh lại là: ''Thói quen làm việc nào tốt nhất?'' Sprint cung cấp các phương pháp mạnh mẽ để phát triển ý tưởng, giải quyết các vấn đề, thử nghiệm giải pháp và hình thành những thói quen làm việc hiệu quả cho bất kỳ cá nhân hay tổ chức nào." '''Đối tượng độc giả''' Sprint hướng đến nhiều nhóm độc giả, bao gồm: * Nhà sáng lập startup. * Quản lý sản phẩm (Product Manager). * Nhà thiết kế UX/UI. * Nhóm nghiên cứu và phát triển (R&D). * Chuyên gia marketing. * Doanh nhân và nhà quản lý. * Những người quan tâm đến đổi mới sáng tạo và phát triển sản phẩm. '''Ảnh hưởng''' Kể từ khi xuất bản, Sprint đã được nhiều doanh nghiệp trên thế giới áp dụng trong quá trình phát triển sản phẩm, từ các công ty khởi nghiệp đến các tập đoàn công nghệ lớn. Phương pháp Sprint cũng trở thành nền tảng cho nhiều khóa đào tạo về Design Sprint, Product Design và Innovation Management. '''Xem thêm''' * Sprint (Design Sprint) * Design Thinking * Lean Startup * User Experience (UX) * Product Management '''Tham khảo''' # Jake Knapp, John Zeratsky & Braden Kowitz. ''Sprint: How to Solve Big Problems and Test New Ideas in Just Five Days''. Simon & Schuster, 2016. # Google Ventures (GV). Design Sprint Methodology. # Knapp, Jake. ''Make Time''. Currency, 2018. # Dịch giả Lê Trường An 1xv5a77581fu8kco1hnbxg5vac735p1 3 484953 4655486 2026-07-25T02:46:58Z MathXplore 3097823 Notifying author of speedy deletion nomination 4655486 wikitext text/x-wiki == I have added a tag to a page you created == Hi! I'm MathXplore, and I recently reviewed your page, [[:Sprint - 5 Ngày "Thổi Bay" Mọi Vấn Đề Và "Lên Gân" Ý Tưởng Startup]]. I have added a tag to the page, because it <strong>may meet the [[Wikibooks:Deletion policy#Speedy deletions|criteria for speedy deletion]].</strong> This means that it can be deleted at any time. The reason I provided was: <blockquote><strong>Out of scope</strong></blockquote> If you believe that your page should not be deleted, please post a message on [[Talk:Sprint - 5 Ngày &#34;Thổi Bay&#34; Mọi Vấn Đề Và &#34;Lên Gân&#34; Ý Tưởng Startup|the page's talk page]] explaining why. <strong>If your reasoning is convincing, your page may be saved.</strong> If you have any questions or concerns, please [[User talk:MathXplore|let me know]]. Thank you! <!-- Substituted from User:JJPMaster/CurateThisPage/authorMsg --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 02:46, 25 July 2026 (UTC) hxp4mtkj4nxopc1ffipyfaxvgsnisxv 4655487 4655486 2026-07-25T02:49:21Z Dịch giả Lê Trường An 3616223 /* I have added a tag to a page you created */ Reply 4655487 wikitext text/x-wiki == I have added a tag to a page you created == Hi! I'm MathXplore, and I recently reviewed your page, [[:Sprint - 5 Ngày "Thổi Bay" Mọi Vấn Đề Và "Lên Gân" Ý Tưởng Startup]]. I have added a tag to the page, because it <strong>may meet the [[Wikibooks:Deletion policy#Speedy deletions|criteria for speedy deletion]].</strong> This means that it can be deleted at any time. The reason I provided was: <blockquote><strong>Out of scope</strong></blockquote> If you believe that your page should not be deleted, please post a message on [[Talk:Sprint - 5 Ngày &#34;Thổi Bay&#34; Mọi Vấn Đề Và &#34;Lên Gân&#34; Ý Tưởng Startup|the page's talk page]] explaining why. <strong>If your reasoning is convincing, your page may be saved.</strong> If you have any questions or concerns, please [[User talk:MathXplore|let me know]]. Thank you! <!-- Substituted from User:JJPMaster/CurateThisPage/authorMsg --> [[User:MathXplore|MathXplore]] ([[User talk:MathXplore|discuss]] • [[Special:Contributions/MathXplore|contribs]]) 02:46, 25 July 2026 (UTC) :This is a Vietnamese translation of an English book. If you need corrections, I will make them. Please don't delete it. [[User:Dịch giả Lê Trường An|Dịch giả Lê Trường An]] ([[User talk:Dịch giả Lê Trường An|discuss]] • [[Special:Contributions/Dịch giả Lê Trường An|contribs]]) 02:49, 25 July 2026 (UTC) 3yty7vk43r18xl9abidclq51fgqwb77 0 484954 4655493 2026-07-25T10:09:24Z Kuffour Augustine Kofi 3616855 Created page with "The youth in Africa are currently going through a lot such as employment rate which keeps increasing day in and day out" 4655493 wikitext text/x-wiki The youth in Africa are currently going through a lot such as employment rate which keeps increasing day in and day out e7o3vwkvij1h5zcvuoq4md3gvqdmdzz 4655497 4655493 2026-07-25T11:33:16Z MathXplore 3097823 Added {{[[Template:BookCat|BookCat]]}} using [[User:1234qwer1234qwer4/BookCat.js|BookCat.js]] 4655497 wikitext text/x-wiki The youth in Africa are currently going through a lot such as employment rate which keeps increasing day in and day out {{BookCat}} nsu8t34gnir4x0408vx3sr2sgqzt6xs