Keyhold
PayPal sandbox. Test money only.PayPal sandbox. Test money only.

PayPal sandbox. Every order, hold, capture and refund here uses PayPal sandbox test money.

Typo in sshd_config

Final

Fixed. Charged $9.00.

Charged only after the owner's server answered SSH and the web check twice, at 20:06:01 and 20:06:15 UTC.

  1. Quote (done) $9.00 fixed
  2. Hold (done) approved 20:04:40
  3. Keyboard (done) locked: agent finished
  4. Probe (done) 2 of 2 passed
  5. Charged $9.00 warranty passed

Done · Charged $9.00, warranty passed

Keyboard locked: rescue doneagent finished at 20:06:00 UTC · 5 PayPal checks

Charged

$9.00captured, final

1 min 37 sfrom hold to charge

8agent turns

6 of 6warranty checks passed

How your $9.00 moved

  1. Quote: $9.00, fixed before any key

    A free look at the screen found: sshd will not start, or listens on the wrong port, because of its configuration. Screenshots only.

  2. Hold: the owner approved, PayPal held $9.00

    Nothing charged yet.

    Authorization 9NR290…250M · CREATED $9.00

  3. Keyboard: lent, then locked

    Claude typed for 8 turns while PayPal said the hold was live. Then the keyboard locked: agent finished.

  4. Probe: the owner's own check passed twice

    20:06:01 and 20:06:15, no failure between.

    ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches

  5. Charged: PayPal captured $9.00

    1 min 37 s after the hold.

    Capture 0JP437…900W · COMPLETED $9.00

  6. Warranty: 6 of 6 checks passed

    Re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks).

PayPal, read live

Read from the PayPal sandbox at 04:27:55 UTC

PayPal objects for this rescue, with PayPal's status and what it means
ObjectStatusWhat it meansAmountPayPal answeredWebhook
Order8VY494…792F COMPLETED The owner approved the hold in PayPal. $9.00 20:03:52 none for this call
Authorization9NR290…250M CAPTURED The hold became the charge. $9.00 20:04:4020:06:17 capture 20:04:57
Capture0JP437…900W COMPLETED Charged $9, after the owner's check passed twice. $9.00 20:06:17final 20:06:47
Full log 49 rows
  1. Quotesshd_config_error T1 $9.00
  2. Quotediagnosis: sshd will not start because of an error in /etc/ssh/sshd_config. Quote T1, $9.00.
  3. PayPalcreate_order with PayPal-Request-Id order-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef
  4. PayPalorder 8VY49442FT911792F PAYER_ACTION_REQUIRED
  5. StateQuote ready → Waiting for your PayPal approval
  6. PayPalauthorize with PayPal-Request-Id auth-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef
  7. PayPalauthorization 9NR29015LW427250M CREATED $9.00
  8. StateWaiting for your PayPal approval → Hold approved, lending the keyboard
  9. LockPayPal authorization 9NR29015LW427250M CREATED $9.00: keyboard allowed
  10. StateHold approved, lending the keyboard → Agent at the keyboard: keyboard lent to the agent
  11. AgentI'm at the tty1 login prompt, and the goal is to log in as root with the password the user gave me. Logging in doesn't change any password, so rule 5 doesn't block it. I'll type "root" and press Enter, then enter the password.
  12. Agenttyped: root ↵
  13. Agenttyped: [console password] ↵
  14. LockPayPal authorization 9NR29015LW427250M CREATED $9.00: keyboard allowed
  15. Agenttyped: systemctl status ssh.service --no-pager | cat; sshd -t; echo RC=$? ↵
  16. WebhookPAYMENT.AUTHORIZATION.CREATED WH-90E22553521443824-86N246929H6348343: verified, applied
  17. AgentI've spotted a typo on line 3 where "PermitRootLogn" is misspelled. I'll look at the file first, then correct it with sed after backing up the original.
  18. Agenttyped: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.keyhold-bak; sed -n '1,5p' /etc/ssh/sshd_config | cat; grep -n 'PermitRootLogin' /etc/ssh/sshd_config | cat ↵
  19. LockPayPal authorization 9NR29015LW427250M CREATED $9.00: keyboard allowed
  20. AgentI'm looking at line 3, which reads "PermitRootLogn", a misspelled keyword that's probably meant to be "PermitRootLogin". I'll leave the "no" value alone and make the fix with a sed replacement on that one line.
  21. Agenttyped: sed -i '3s/^PermitRootLogn /PermitRootLogin /' /etc/ssh/sshd_config && sshd -t && echo SYNTAX_OK; sed -n '3p' /etc/ssh/sshd_config | cat ↵
  22. AgentThe sshd config test is failing because the privilege separation directory /run/sshd is missing. I'll create it with mkdir -p, which is safe, and then retest the config. Creating /run/sshd with mode 0755 is harmless, and systemd's tmpfiles setup would normally make it on start anyway. I'll go ahead and do it.
  23. LockPayPal authorization 9NR29015LW427250M CREATED $9.00: keyboard allowed
  24. Agenttyped: mkdir -p /run/sshd && chmod 0755 /run/sshd && sshd -t && echo SYNTAX_OK ↵
  25. Agenttyped: systemctl reset-failed ssh.service; systemctl restart ssh.service; systemctl is-active ssh; ss -tlnp | cat; systemctl status demo-page --no-pager 2>/dev/null | head -3 | cat ↵
  26. LockPayPal authorization 9NR29015LW427250M CREATED $9.00: keyboard allowed
  27. AgentSSH is confirmed active and listening on port 22, and port 80 is already being held open by systemd's demo-page socket. Next I'll curl localhost to check whether the web page actually responds.
  28. Agenttyped: curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/; curl -s http://127.0.0.1/ | head -5 | cat ↵
  29. AgentRoot cause: /etc/ssh/sshd_config line 3 had a typo, "PermitRootLogn no", which made sshd -t fail and kept ssh.service from starting. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and corrected only that keyword to "PermitRootLogin no". sshd -t then reported that the privilege-separation directory /run/sshd was missing, so I created it (mkdir -p, mode 0755). I cleared the failed state and restarted ssh.service. It is active, sshd listens on 0.0.0.0:22 and [::]:22, and the demo web page on port 80 returns HTTP 200 with its expected content. The SSH port and all other settings are unchanged.
  30. Lockkeyboard locked: the agent session ended (done)
  31. Agentdone: Root cause: /etc/ssh/sshd_config line 3 had a typo, "PermitRootLogn no", which made sshd -t fail and kept ssh.service from starting. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and corrected only that keyword to "PermitRootLogin no". sshd -t then reported that the privilege-separation directory /run/sshd was missing, so I created it (mkdir -p, mode 0755). I cleared the failed state and restarted ssh.service. It is active, sshd listens on 0.0.0.0:22 and [::]:22, and the demo web page on port 80 returns HTTP 200 with its expected content. The SSH port and all other settings are unchanged.
  32. StateAgent at the keyboard → Checking your server: the agent called finished; the owner probe decides
  33. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  34. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  35. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  36. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  37. Probestable: 2 passes 14.7451 s apart, no failure between
  38. PayPalcapture with PayPal-Request-Id cap-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef
  39. PayPalcapture 0JP43729YN445900W COMPLETED $9.00
  40. StateChecking your server → Fixed and charged: probe passed
  41. WarrantyWarranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
  42. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  43. WebhookPAYMENT.CAPTURE.COMPLETED WH-8M4094285C863104J-166763869V591471M: verified, applied
  44. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  45. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  46. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  47. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  48. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  49. StateFixed and charged → Warranty passed: window ended: 6 checks, never 2 failures in a row
Audit details full ids, PayPal-Request-Ids, invoice, quote, owner probe, ledger checks, timing

Ids

Rescue
bf5a2f31-ec90-4b66-ae2b-ef93da9448ef
State
WARRANTY_OK
Invoice id
keyhold-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef
Order
8VY49442FT911792F · intent AUTHORIZE
Authorization
9NR29015LW427250M · expires 2026-12-07 20:04:39 UTC
Capture
0JP43729YN445900W
Refund
—
Ending
window ended: 6 checks, never 2 failures in a row

PayPal-Request-Ids: two ticks per money call

Each call is written to the outbox with its PayPal-Request-Id before it is sent, so a retry never moves money twice. PayPal's synchronous answer is the first tick; the verified webhook is the second.

Money calls and their confirmations
CallPayPal-Request-IdAPI answerWebhook
Orderorder-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef ✓ 20:03:52 none for this call
Authorizationauth-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef ✓ 20:04:40 ✓ 20:04:57
Capturecap-bf5a2f31-ec90-4b66-ae2b-ef93da9448ef ✓ 20:06:17 ✓ 20:06:47

Ledger checks

ok captured ≤ authorized ≤ quote, one capture at most, no void after capture, refund ≤ captured.

Diagnosis and plan

sshd will not start, or listens on the wrong port, because of its configuration

  • [FAILED] Failed to start ssh.service - OpenBSD Secure Shell server.
  • See 'systemctl status ssh.service' for details.

1) Log in at the console as the admin user and run 'systemctl status ssh.service' and 'sshd -t' to confirm the failure reason and see the config error. 2) If sshd -t reports an error in /etc/ssh/sshd_config, correct or revert that line with a text editor. 3) If the error says host keys are missing, run 'ssh-keygen -A' to regenerate them instead. 4) Run 'systemctl restart ssh.service' and check that it shows active (running). 5) Confirm sshd is listening on port 22 with 'ss -tlnp' and report back.

Quote

Fault class
sshd_config_error
Tier
T1 · $9.00
Quote hash
4062de7540ac3d0893cb4c30f8fd661ef87326f836f0f2a798869ad4b3a989ff

Owner probe, fixed at checkout

A capture happens only after this check passes twice, far enough apart, with no failure between.

SSH login
as probe on port 32859, with a key only the probe holds
Probe key
SHA256:CcgWuPvbHnBojBASpsq+D15PKuJPkuBo/cq0ROAmp4M
Page
HTTP GET / on port 32856: the page body has sha256 429d6e1517d7805977c57314076c608c7acf30e52b93b0b5103ae57152669bc8
Spec hash
faad2dc80f096cc500a6ac8487d29addbffe461efbd7f52b03cdc8eadc461a36
Sent as the order's custom_id.

Timing and cost

Created
2026-11-08 20:03:40 UTC
Model cost
about $0.0027
Timing
Judge mode, compressed timing. Capture after two passes at least 10 s apart, with no failure between. Warranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
Warranty
re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks)
Full console screen