Keyhold
PayPal sandbox. Test money only.PayPal sandbox. Test money only.

PayPal sandbox. Every order, hold, capture and refund here uses PayPal sandbox test money.

Typo in sshd_config

Final

Fixed. Charged $9.00.

Charged only after the owner's server answered SSH and the web check twice, at 07:08:03 and 07:08:18 UTC.

  1. Quote (done) $9.00 fixed
  2. Hold (done) approved 07:06:34
  3. Keyboard (done) locked: agent finished
  4. Probe (done) 2 of 2 passed
  5. Charged $9.00 warranty passed

Done · Charged $9.00, warranty passed

Keyboard locked: rescue doneagent finished at 07:08:02 UTC · 5 PayPal checks

Charged

$9.00captured, final

1 min 45 sfrom hold to charge

7agent turns

24 of 24warranty checks passed

How your $9.00 moved

  1. Quote: $9.00, fixed before any key

    A free look at the screen found: sshd will not start, or listens on the wrong port, because of its configuration. Screenshots only.

  2. Hold: the owner approved, PayPal held $9.00

    Nothing charged yet.

    Authorization 68M239…7322 · CREATED $9.00

  3. Keyboard: lent, then locked

    Claude typed for 7 turns while PayPal said the hold was live. Then the keyboard locked: agent finished.

  4. Probe: the owner's own check passed twice

    07:08:03 and 07:08:18, no failure between.

    ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches

  5. Charged: PayPal captured $9.00

    1 min 45 s after the hold.

    Capture 7WP611…644E · COMPLETED $9.00

  6. Warranty: 24 of 24 checks passed

    Re-checked every minute, 24 times (compressed for the demo: each minute stands in for an hour).

PayPal, read live

Read from the PayPal sandbox at 04:27:59 UTC

PayPal objects for this rescue, with PayPal's status and what it means
ObjectStatusWhat it meansAmountPayPal answeredWebhook
Order9DX392…063W COMPLETED The owner approved the hold in PayPal. $9.00 07:01:43 none for this call
Authorization68M239…7322 CAPTURED The hold became the charge. $9.00 07:06:3407:08:19 capture not yet
Capture7WP611…644E COMPLETED Charged $9, after the owner's check passed twice. $9.00 07:08:19final not yet
Full log 64 rows
  1. Quotesshd_config_error T1 $9.00
  2. Quotediagnosis: sshd will not start because of an error in /etc/ssh/sshd_config. Quote T1, $9.00.
  3. PayPalcreate_order with PayPal-Request-Id order-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d
  4. PayPalorder 9DX392958A657063W PAYER_ACTION_REQUIRED
  5. StateQuote ready → Waiting for your PayPal approval
  6. PayPalauthorize with PayPal-Request-Id auth-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d
  7. PayPalauthorization 68M23905BN0687322 CREATED $9.00
  8. StateWaiting for your PayPal approval → Hold approved, lending the keyboard
  9. LockPayPal authorization 68M23905BN0687322 CREATED $9.00: keyboard allowed
  10. StateHold approved, lending the keyboard → Agent at the keyboard: keyboard lent to the agent
  11. AgentThe screen is showing a login prompt for "keyhold-demo," and I need to sign in as root with the password I've been given. My instructions say to enter the password only when a password prompt appears, and this one comes right after the username, so I'll type it now.
  12. Agenttyped: root ↵
  13. Agenttyped: [console password] ↵
  14. LockPayPal authorization 68M23905BN0687322 CREATED $9.00: keyboard allowed
  15. Agenttyped: systemctl status ssh.service --no-pager | cat; journalctl -u ssh -b --no-pager | tail -n 30; sshd -t; echo DONE-T ↵
  16. AgentI'm checking line 3 of sshd_config, where "PermitRootLogn" is misspelled, and I plan to back up the file first. Rather than guess the intended value, I'll look at the file before changing it to "PermitRootLogin". I also want to check the web page on port 80 later.
  17. Agenttyped: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.keyhold-bak; head -n 6 /etc/ssh/sshd_config | cat -A | cut -c1-120; grep -n -i '^[^#]' /etc/ssh/sshd_config | cat; echo DONE-V ↵
  18. LockPayPal authorization 68M23905BN0687322 CREATED $9.00: keyboard allowed
  19. AgentI'm correcting the typo on line 3 from "PermitRootLogn" to "PermitRootLogin", keeping the value "no" as it is. Then I'll test, restart, and verify the config. PasswordAuthentication stays "no" since the owner logs in with keys, so I'm leaving that line alone.
  20. Agenttyped: sed -i '3s/^PermitRootLogn no$/PermitRootLogin no/' /etc/ssh/sshd_config && sed -n 3p /etc/ssh/sshd_config && sshd -t && echo SSHD-T-OK; systemctl reset-failed ssh.service; systemctl start ssh.service; systemctl is-active ssh; systemctl status ssh.service --no-pager | cat | head -n 12; ss -ltnp | cat; systemctl is-active demo-page.socket demo-page.service; echo DONE-F ↵
  21. LockPayPal authorization 68M23905BN0687322 CREATED $9.00: keyboard allowed
  22. AgentI'm checking why the sed edit didn't take: the pattern expected "PermitRootLogn no" at the start and end of the line, but the line seems to match. I'm wondering if there's hidden whitespace or a carriage return, since I'd earlier looked at the line with cat -A. I'm now looking at the sshd output more closely: the status shows the service active with ExecStartPre returning 0, which seems inconsistent with the "Missing privilege separation directory" message from sshd -t. I'm also trying to reconcile which line in the head output actually reads "PermitRootLogn no". I'm checking why the sed ...
  23. Agenttyped: grep -n 'PermitRoot' /etc/ssh/sshd_config | cat -A; sshd -t; echo "rc=$?"; ls -ld /run/sshd; curl -sS -m 5 http://localhost/ | head -n 5; echo DONE-G ↵
  24. LockPayPal authorization 68M23905BN0687322 CREATED $9.00: keyboard allowed
  25. AgentThe sed edit does look applied now: line 3 reads "PermitRootLogin no", and sshd's config test passed. SSH is running and listening on port 22, and the web page is serving content. Next I'll confirm the ssh service is active with systemctl.
  26. Agenttyped: systemctl is-active ssh; systemctl --failed --no-pager | cat; echo DONE-H ↵
  27. AgentRoot cause: /etc/ssh/sshd_config line 3 had a misspelled directive "PermitRootLogn no", so sshd exited with "Bad configuration option" and ssh.service failed to start. I backed up the file to /etc/ssh/sshd_config.keyhold-bak, corrected line 3 to "PermitRootLogin no" (value unchanged), reset the failed state and started ssh. Verified: sshd -t exits 0, systemctl is-active ssh reports active, sshd listens on 0.0.0.0:22 and [::]:22, no failed units, and http://localhost/ serves the demo page ("keyhold-demo: the page is being served."). Nothing else was changed.
  28. Lockkeyboard locked: the agent session ended (done)
  29. Agentdone: Root cause: /etc/ssh/sshd_config line 3 had a misspelled directive "PermitRootLogn no", so sshd exited with "Bad configuration option" and ssh.service failed to start. I backed up the file to /etc/ssh/sshd_config.keyhold-bak, corrected line 3 to "PermitRootLogin no" (value unchanged), reset the failed state and started ssh. Verified: sshd -t exits 0, systemctl is-active ssh reports active, sshd listens on 0.0.0.0:22 and [::]:22, no failed units, and http://localhost/ serves the demo page ("keyhold-demo: the page is being served."). Nothing else was changed.
  30. StateAgent at the keyboard → Checking your server: the agent called finished; the owner probe decides
  31. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  32. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  33. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  34. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  35. Probestable: 2 passes 14.6841 s apart, no failure between
  36. PayPalcapture with PayPal-Request-Id cap-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d
  37. PayPalcapture 7WP61145AR824644E COMPLETED $9.00
  38. StateChecking your server → Fixed and charged: probe passed
  39. WarrantyWarranty (judge mode, compressed): re-probed every minute for 24 minutes; each minute stands in for an hour. Two failed checks in a row refund the full capture.
  40. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  41. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  42. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  43. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  44. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  45. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  46. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  47. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  48. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  49. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  50. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  51. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  52. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  53. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  54. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  55. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  56. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  57. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  58. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  59. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  60. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  61. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  62. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  63. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  64. StateFixed and charged → Warranty passed: window ended: 24 checks, never 2 failures in a row
Audit details full ids, PayPal-Request-Ids, invoice, quote, owner probe, ledger checks, timing

Ids

Rescue
53f4549c-b4f5-4d51-8a7f-ea9b779ce79d
State
WARRANTY_OK
Invoice id
keyhold-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d
Order
9DX392958A657063W · intent AUTHORIZE
Authorization
68M23905BN0687322 · expires 2026-12-07 07:06:33 UTC
Capture
7WP61145AR824644E
Refund
—
Ending
window ended: 24 checks, never 2 failures in a row

PayPal-Request-Ids: two ticks per money call

Each call is written to the outbox with its PayPal-Request-Id before it is sent, so a retry never moves money twice. PayPal's synchronous answer is the first tick; the verified webhook is the second.

Money calls and their confirmations
CallPayPal-Request-IdAPI answerWebhook
Orderorder-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d ✓ 07:01:43 none for this call
Authorizationauth-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d ✓ 07:06:34 waiting
Capturecap-53f4549c-b4f5-4d51-8a7f-ea9b779ce79d ✓ 07:08:19 waiting

Ledger checks

ok captured ≤ authorized ≤ quote, one capture at most, no void after capture, refund ≤ captured.

Diagnosis and plan

sshd will not start, or listens on the wrong port, because of its configuration

  • [FAILED] Failed to start ssh.service - OpenBSD Secure Shell server.
  • See 'systemctl status ssh.service' for details.

1. Run 'systemctl status ssh.service' and 'journalctl -u ssh -b --no-pager | tail -n 30' to read the exact error sshd logs when it fails to start. 2. Run 'sshd -t' to test /etc/ssh/sshd_config and print the line number of any syntax error. 3. If the error is in sshd_config, correct that line to a valid directive or restore the stock file from /usr/share/openssh/sshd_config or a backup copy. 4. Run 'sshd -t' again and confirm it prints no errors. 5. Run 'systemctl start ssh.service' then 'systemctl status ssh.service' to confirm it is active. 6. If the logs show missing host keys instead, stop and re-classify as ssh_host_keys_missing.

Quote

Fault class
sshd_config_error
Tier
T1 · $9.00
Quote hash
1cc95eb9d9ce7b6d67f26f9352e54fb98cd8ac60e4d9a172e062e3a848d0a7db

Owner probe, fixed at checkout

A capture happens only after this check passes twice, far enough apart, with no failure between.

SSH login
as probe on port 32827, with a key only the probe holds
Probe key
SHA256:CcgWuPvbHnBojBASpsq+D15PKuJPkuBo/cq0ROAmp4M
Page
HTTP GET / on port 32824: the page body has sha256 429d6e1517d7805977c57314076c608c7acf30e52b93b0b5103ae57152669bc8
Spec hash
faf6a1592a0a5823dda9f3d6b4a2da8bbccc52695cfce6d861bc4793d8d5aadc
Sent as the order's custom_id.

Timing and cost

Created
2026-11-08 06:59:01 UTC
Model cost
about $0.0032
Timing
Judge mode, compressed timing. Capture after two passes at least 10 s apart, with no failure between. Warranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
Warranty
re-checked every minute, 24 times (compressed for the demo: each minute stands in for an hour)
Full console screen