Keyhold
PayPal sandbox. Test money only.PayPal sandbox. Test money only.

PayPal sandbox. Every order, hold, capture and refund here uses PayPal sandbox test money.

Typo in sshd_config

Final

Fixed. Charged $9.00.

Charged only after the owner's server answered SSH and the web check twice, at 16:40:05 and 16:40:20 UTC.

  1. Quote (done) $9.00 fixed
  2. Hold (done) approved 16:39:01
  3. Keyboard (done) locked: agent finished
  4. Probe (done) 2 of 2 passed
  5. Charged $9.00 warranty passed

Done · Charged $9.00, warranty passed

Keyboard locked: rescue doneagent finished at 16:40:05 UTC · 4 PayPal checks

Charged

$9.00captured, final

1 min 20 sfrom hold to charge

7agent turns

6 of 6warranty checks passed

How your $9.00 moved

  1. Quote: $9.00, fixed before any key

    A free look at the screen found: sshd will not start, or listens on the wrong port, because of its configuration. Screenshots only.

  2. Hold: the owner approved, PayPal held $9.00

    Nothing charged yet.

    Authorization 177128…8918 · CREATED $9.00

  3. Keyboard: lent, then locked

    Claude typed for 7 turns while PayPal said the hold was live. Then the keyboard locked: agent finished.

  4. Probe: the owner's own check passed twice

    16:40:05 and 16:40:20, no failure between.

    ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches

  5. Charged: PayPal captured $9.00

    1 min 20 s after the hold.

    Capture 1FM029…573H · COMPLETED $9.00

  6. Warranty: 6 of 6 checks passed

    Re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks).

PayPal, read live

Read from the PayPal sandbox at 04:28:19 UTC

PayPal objects for this rescue, with PayPal's status and what it means
ObjectStatusWhat it meansAmountPayPal answeredWebhook
Order01G487…361U COMPLETED The owner approved the hold in PayPal. $9.00 16:38:20 none for this call
Authorization177128…8918 CAPTURED The hold became the charge. $9.00 16:39:0116:40:21 capture 16:40:48
Capture1FM029…573H COMPLETED Charged $9, after the owner's check passed twice. $9.00 16:40:21final 16:40:41
Full log 47 rows
  1. Quotesshd_config_error T1 $9.00
  2. Quotediagnosis: sshd will not start because of an error in /etc/ssh/sshd_config. Quote T1, $9.00.
  3. PayPalcreate_order with PayPal-Request-Id order-8cf5a71c-9f39-4747-9f67-7a61b8694311
  4. PayPalorder 01G48719H6433361U PAYER_ACTION_REQUIRED
  5. StateQuote ready → Waiting for your PayPal approval
  6. PayPalauthorize with PayPal-Request-Id auth-8cf5a71c-9f39-4747-9f67-7a61b8694311
  7. PayPalauthorization 17712837C59118918 CREATED $9.00
  8. StateWaiting for your PayPal approval → Hold approved, lending the keyboard
  9. LockPayPal authorization 17712837C59118918 CREATED $9.00: keyboard allowed
  10. StateHold approved, lending the keyboard → Agent at the keyboard: keyboard lent to the agent
  11. AgentI'll log in at the console first. The password is in the goal, and I can only type it at a password prompt, so I'll enter root at the "keyhold-demo login:" prompt and then wait for the password prompt before typing it.
  12. Agenttyped: root ↵
  13. Agenttyped: [console password] ↵
  14. LockPayPal authorization 17712837C59118918 CREATED $9.00: keyboard allowed
  15. Agenttyped: journalctl -u ssh -n 50 --no-pager | cat; sshd -t; echo RC=$? ↵
  16. AgentI'm checking line 3 of the config, where "PermitRootLogn" looks like a typo. I'll look at the first few lines with cat -A first, after making a backup.
  17. Agenttyped: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.keyhold-bak; sed -n '1,6p' /etc/ssh/sshd_config | cat -n; grep -n Port /etc/ssh/sshd_config ↵
  18. LockPayPal authorization 17712837C59118918 CREATED $9.00: keyboard allowed
  19. AgentI'm fixing the typo on line 3, changing "PermitRootLogn" to "PermitRootLogin," and I'll use sed on that line alone. Line 15 is a commented-out "#Port 22," which is already the default, so I'll leave it untouched.
  20. Agenttyped: sed -i '3s/^PermitRootLogn no$/PermitRootLogin no/' /etc/ssh/sshd_config; sed -n '3p' /etc/ssh/sshd_config; sshd -t; echo RC=$? ↵
  21. AgentI've got a missing privilege separation directory for sshd, and creating /run/sshd with mkdir -p is a safe fix that destroys no data. I also want to glance at the demo-page.socket web page, which may be fine, and then restart ssh.
  22. Agenttyped: mkdir -p /run/sshd && chmod 0755 /run/sshd; sshd -t; echo RC=$?; systemctl restart ssh.service; systemctl is-active ssh; ss -ltnp | cat ↵
  23. LockPayPal authorization 17712837C59118918 CREATED $9.00: keyboard allowed
  24. AgentSSH is running and listening on port 22, and port 80 is also open via the systemd demo-page socket. I'll check the web page quickly with curl.
  25. Agenttyped: curl -s http://127.0.0.1/ | head -5; systemctl is-active ssh demo-page.socket ↵
  26. AgentRoot cause: /etc/ssh/sshd_config line 3 had a typo, 'PermitRootLogn no', which made sshd refuse to start. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and corrected only that line to 'PermitRootLogin no'. sshd -t then flagged a missing privilege-separation directory, so I created /run/sshd (mode 0755). I restarted ssh: it is active, listening on 0.0.0.0:22 and [::]:22, and sshd -t passes. Port 22 was not changed. The demo web page on port 80 answers locally with its expected content, and demo-page.socket is active.
  27. Lockkeyboard locked: the agent session ended (done)
  28. Agentdone: Root cause: /etc/ssh/sshd_config line 3 had a typo, 'PermitRootLogn no', which made sshd refuse to start. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and corrected only that line to 'PermitRootLogin no'. sshd -t then flagged a missing privilege-separation directory, so I created /run/sshd (mode 0755). I restarted ssh: it is active, listening on 0.0.0.0:22 and [::]:22, and sshd -t passes. Port 22 was not changed. The demo web page on port 80 answers locally with its expected content, and demo-page.socket is active.
  29. StateAgent at the keyboard → Checking your server: the agent called finished; the owner probe decides
  30. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  31. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  32. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  33. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  34. Probestable: 2 passes 14.7094 s apart, no failure between
  35. PayPalcapture with PayPal-Request-Id cap-8cf5a71c-9f39-4747-9f67-7a61b8694311
  36. PayPalcapture 1FM0294205526573H COMPLETED $9.00
  37. StateChecking your server → Fixed and charged: probe passed
  38. WarrantyWarranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
  39. WebhookPAYMENT.CAPTURE.COMPLETED WH-8CD46955L1203104F-9CF33043L6501013J: verified, applied
  40. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  41. WebhookPAYMENT.AUTHORIZATION.CREATED WH-9PX35014YD0908637-9NW68572R4117523V: verified, applied
  42. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  43. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  44. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  45. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  46. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  47. StateFixed and charged → Warranty passed: window ended: 6 checks, never 2 failures in a row
Audit details full ids, PayPal-Request-Ids, invoice, quote, owner probe, ledger checks, timing

Ids

Rescue
8cf5a71c-9f39-4747-9f67-7a61b8694311
State
WARRANTY_OK
Invoice id
keyhold-8cf5a71c-9f39-4747-9f67-7a61b8694311
Order
01G48719H6433361U · intent AUTHORIZE
Authorization
17712837C59118918 · expires 2026-12-07 16:39:01 UTC
Capture
1FM0294205526573H
Refund
—
Ending
window ended: 6 checks, never 2 failures in a row

PayPal-Request-Ids: two ticks per money call

Each call is written to the outbox with its PayPal-Request-Id before it is sent, so a retry never moves money twice. PayPal's synchronous answer is the first tick; the verified webhook is the second.

Money calls and their confirmations
CallPayPal-Request-IdAPI answerWebhook
Orderorder-8cf5a71c-9f39-4747-9f67-7a61b8694311 ✓ 16:38:20 none for this call
Authorizationauth-8cf5a71c-9f39-4747-9f67-7a61b8694311 ✓ 16:39:01 ✓ 16:40:48
Capturecap-8cf5a71c-9f39-4747-9f67-7a61b8694311 ✓ 16:40:21 ✓ 16:40:41

Ledger checks

ok captured ≤ authorized ≤ quote, one capture at most, no void after capture, refund ≤ captured.

Diagnosis and plan

sshd will not start, or listens on the wrong port, because of its configuration

  • [FAILED] Failed to start ssh.service - OpenBSD Secure Shell server.
  • See 'systemctl status ssh.service' for details.

1. Log in at the console and run 'systemctl status ssh.service' and 'journalctl -u ssh -n 50 --no-pager' to read the exact sshd startup error and confirm it names a config line. 2. If the error points to /etc/ssh/sshd_config, run 'sshd -t' to list the bad directive and line number. 3. Correct or revert that line in /etc/ssh/sshd_config, using the lines the error names as the guide. 4. Run 'sshd -t' again until it reports no errors. 5. Run 'systemctl restart ssh.service' and confirm it shows active (running). 6. If the error instead says host keys are missing, stop and re-classify as ssh_host_keys_missing before changing anything.

Quote

Fault class
sshd_config_error
Tier
T1 · $9.00
Quote hash
96b7553301b3cde4b9f182848ecb33960b1462308e81afcf1455c85356527f13

Owner probe, fixed at checkout

A capture happens only after this check passes twice, far enough apart, with no failure between.

SSH login
as probe on port 32843, with a key only the probe holds
Probe key
SHA256:CcgWuPvbHnBojBASpsq+D15PKuJPkuBo/cq0ROAmp4M
Page
HTTP GET / on port 32840: the page body has sha256 429d6e1517d7805977c57314076c608c7acf30e52b93b0b5103ae57152669bc8
Spec hash
518abcb986d2b3802661955bdeb4059f10df482cca36b37336aeae113dccc716
Sent as the order's custom_id.

Timing and cost

Created
2026-11-08 16:38:08 UTC
Model cost
about $0.0023
Timing
Judge mode, compressed timing. Capture after two passes at least 10 s apart, with no failure between. Warranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
Warranty
re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks)
Full console screen