Keyhold
PayPal sandbox. Test money only.PayPal sandbox. Test money only.

PayPal sandbox. Every order, hold, capture and refund here uses PayPal sandbox test money.

Typo in sshd_config

Final

Fixed. Charged $9.00.

Charged only after the owner's server answered SSH and the web check twice, at 19:56:32 and 19:56:46 UTC.

  1. Quote (done) $9.00 fixed
  2. Hold (done) approved 19:55:32
  3. Keyboard (done) locked: agent finished
  4. Probe (done) 2 of 2 passed
  5. Charged $9.00 warranty passed

Done · Charged $9.00, warranty passed

Keyboard locked: rescue doneagent finished at 19:56:31 UTC · 4 PayPal checks

Charged

$9.00captured, final

1 min 16 sfrom hold to charge

6agent turns

6 of 6warranty checks passed

How your $9.00 moved

  1. Quote: $9.00, fixed before any key

    A free look at the screen found: sshd will not start, or listens on the wrong port, because of its configuration. Screenshots only.

  2. Hold: the owner approved, PayPal held $9.00

    Nothing charged yet.

    Authorization 1YU612…582V · CREATED $9.00

  3. Keyboard: lent, then locked

    Claude typed for 6 turns while PayPal said the hold was live. Then the keyboard locked: agent finished.

  4. Probe: the owner's own check passed twice

    19:56:32 and 19:56:46, no failure between.

    ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches

  5. Charged: PayPal captured $9.00

    1 min 16 s after the hold.

    Capture 4EU408…880G · COMPLETED $9.00

  6. Warranty: 6 of 6 checks passed

    Re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks).

PayPal, read live

Read from the PayPal sandbox at 04:28:11 UTC

PayPal objects for this rescue, with PayPal's status and what it means
ObjectStatusWhat it meansAmountPayPal answeredWebhook
Order0DG956…7446 COMPLETED The owner approved the hold in PayPal. $9.00 19:54:43 none for this call
Authorization1YU612…582V CAPTURED The hold became the charge. $9.00 19:55:3219:56:48 capture 19:55:46
Capture4EU408…880G COMPLETED Charged $9, after the owner's check passed twice. $9.00 19:56:48final 19:57:08
Full log 45 rows
  1. Quotesshd_config_error T1 $9.00
  2. Quotediagnosis: sshd will not start because of an error in /etc/ssh/sshd_config. Quote T1, $9.00.
  3. PayPalcreate_order with PayPal-Request-Id order-e1d7502e-89e1-46c6-8db2-2c644f331226
  4. PayPalorder 0DG95640986187446 PAYER_ACTION_REQUIRED
  5. StateQuote ready → Waiting for your PayPal approval
  6. PayPalauthorize with PayPal-Request-Id auth-e1d7502e-89e1-46c6-8db2-2c644f331226
  7. PayPalauthorization 1YU61255K8247582V CREATED $9.00
  8. StateWaiting for your PayPal approval → Hold approved, lending the keyboard
  9. LockPayPal authorization 1YU61255K8247582V CREATED $9.00: keyboard allowed
  10. StateHold approved, lending the keyboard → Agent at the keyboard: keyboard lent to the agent
  11. AgentThe screen is showing a login prompt, so I'll log in as root with the password the user gave me. Since it's the owner's console credentials, using them here is fine. I'll type it only at the password prompt and start with the login.
  12. Agenttyped: root ↵
  13. Agenttyped: [console password] ↵
  14. LockPayPal authorization 1YU61255K8247582V CREATED $9.00: keyboard allowed
  15. WebhookPAYMENT.AUTHORIZATION.CREATED WH-8LY0551836155025R-89E63372BG5848807: verified, applied
  16. Agenttyped: systemctl status ssh.service --no-pager | cat; sshd -t; echo RC=$? ↵
  17. AgentI'm checking line 3 of the config, where "PermitRootLogn" is a typo for PermitRootLogin. I'll view that line first, then use sed to fix only line 3, and only if it matches exactly.
  18. Agenttyped: cp /etc/ssh/sshd_config /etc/ssh/sshd_config.keyhold-bak; sed -n '1,5p' /etc/ssh/sshd_config | cat -A | cut -c1-80 ↵
  19. LockPayPal authorization 1YU61255K8247582V CREATED $9.00: keyboard allowed
  20. Agenttyped: sed -i '3s/^PermitRootLogn /PermitRootLogin /' /etc/ssh/sshd_config; sshd -t; echo RC=$?; systemctl restart ssh.service; systemctl is-active ssh.service; ss -ltnp | grep -E ':22 |:80 ' ↵
  21. AgentSshd -t is reporting a missing /run/sshd privilege separation directory and exiting 255, yet the restart went through and sshd is listening on 22 with pid 644. That looks contradictory, so I'm wondering whether pid 644 is a leftover process from before the restart, or whether the directory is only created by ExecStartPre and the test runs without it. The /run/sshd directory may simply be absent, so I'll check whether creating it or inspecting the systemctl status clears up the mismatch. I also want to confirm the web page on port 80 with a quick curl to localhost.
  22. LockPayPal authorization 1YU61255K8247582V CREATED $9.00: keyboard allowed
  23. Agenttyped: ls -ld /run/sshd; systemctl status ssh.service --no-pager | head -12 | cat; curl -s -m 5 http://localhost/ | head -5; echo; systemctl is-active ssh.service ↵
  24. AgentSSH is up now: the ExecStartPre config test passed. The earlier sshd -t failure came from running before the service created /run/sshd, which it does now. The web page is being served too, so that's everything done.
  25. AgentRoot cause: /etc/ssh/sshd_config line 3 had a typo, 'PermitRootLogn', which made sshd -t fail with 'Bad configuration option' and stopped ssh.service. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and changed only that word to 'PermitRootLogin'. Restarted ssh.service: it is active (running), its ExecStartPre sshd -t check passed, and it listens on 0.0.0.0:22 and [::]:22. The demo web page on port 80 is served again (curl localhost returns the keyhold-demo page). The earlier 'Missing privilege separation directory /run/sshd' message came from running sshd -t by hand before the service had created /run/sshd; the service handles that itself. Console left at a root shell.
  26. Lockkeyboard locked: the agent session ended (done)
  27. Agentdone: Root cause: /etc/ssh/sshd_config line 3 had a typo, 'PermitRootLogn', which made sshd -t fail with 'Bad configuration option' and stopped ssh.service. I backed up the file to /etc/ssh/sshd_config.keyhold-bak and changed only that word to 'PermitRootLogin'. Restarted ssh.service: it is active (running), its ExecStartPre sshd -t check passed, and it listens on 0.0.0.0:22 and [::]:22. The demo web page on port 80 is served again (curl localhost returns the keyhold-demo page). The earlier 'Missing privilege separation directory /run/sshd' message came from running sshd -t by hand before the service had created /run/sshd; the service handles that itself. Console left at a root shell.
  28. StateAgent at the keyboard → Checking your server: the agent called finished; the owner probe decides
  29. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  30. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  31. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  32. Probepass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  33. Probestable: 2 passes 14.7046 s apart, no failure between
  34. PayPalcapture with PayPal-Request-Id cap-e1d7502e-89e1-46c6-8db2-2c644f331226
  35. PayPalcapture 4EU4081387193880G COMPLETED $9.00
  36. StateChecking your server → Fixed and charged: probe passed
  37. WarrantyWarranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
  38. WebhookPAYMENT.CAPTURE.COMPLETED WH-5MY52953C34387629-3T84790591258881Y: verified, applied
  39. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  40. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  41. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  42. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  43. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  44. Warrantypass: SSH ok, page ok. ssh ok: logged in as probe; http ok: HTTP 200, sha256 matches
  45. StateFixed and charged → Warranty passed: window ended: 6 checks, never 2 failures in a row
Audit details full ids, PayPal-Request-Ids, invoice, quote, owner probe, ledger checks, timing

Ids

Rescue
e1d7502e-89e1-46c6-8db2-2c644f331226
State
WARRANTY_OK
Invoice id
keyhold-e1d7502e-89e1-46c6-8db2-2c644f331226
Order
0DG95640986187446 · intent AUTHORIZE
Authorization
1YU61255K8247582V · expires 2026-12-07 19:55:31 UTC
Capture
4EU4081387193880G
Refund
—
Ending
window ended: 6 checks, never 2 failures in a row

PayPal-Request-Ids: two ticks per money call

Each call is written to the outbox with its PayPal-Request-Id before it is sent, so a retry never moves money twice. PayPal's synchronous answer is the first tick; the verified webhook is the second.

Money calls and their confirmations
CallPayPal-Request-IdAPI answerWebhook
Orderorder-e1d7502e-89e1-46c6-8db2-2c644f331226 ✓ 19:54:43 none for this call
Authorizationauth-e1d7502e-89e1-46c6-8db2-2c644f331226 ✓ 19:55:32 ✓ 19:55:46
Capturecap-e1d7502e-89e1-46c6-8db2-2c644f331226 ✓ 19:56:48 ✓ 19:57:08

Ledger checks

ok captured ≤ authorized ≤ quote, one capture at most, no void after capture, refund ≤ captured.

Diagnosis and plan

sshd will not start, or listens on the wrong port, because of its configuration

  • [FAILED] Failed to start ssh.service - OpenBSD Secure Shell server.
  • See 'systemctl status ssh.service' for details.

1. Run 'systemctl status ssh.service' and read the reason sshd gave for failing, to confirm the class. 2. Run 'sshd -t' to test /etc/ssh/sshd_config and note the reported file and line. 3. Correct the bad directive in /etc/ssh/sshd_config. If the error says host keys are missing, run 'ssh-keygen -A' instead. 4. Run 'sshd -t' again until it reports no errors, then run 'systemctl restart ssh.service'. 5. Confirm with 'systemctl is-active ssh.service' that it shows active, then log out of the console.

Quote

Fault class
sshd_config_error
Tier
T1 · $9.00
Quote hash
67e95515f8080eb251e9d940dd2f3bf0a5f7d6cde7abf8485b6a8e168525fb42

Owner probe, fixed at checkout

A capture happens only after this check passes twice, far enough apart, with no failure between.

SSH login
as probe on port 32855, with a key only the probe holds
Probe key
SHA256:CcgWuPvbHnBojBASpsq+D15PKuJPkuBo/cq0ROAmp4M
Page
HTTP GET / on port 32852: the page body has sha256 429d6e1517d7805977c57314076c608c7acf30e52b93b0b5103ae57152669bc8
Spec hash
2cf58be7144c36406a54c727a8204c4fe25d034b869d6e112f4d8aa000e58ac2
Sent as the order's custom_id.

Timing and cost

Created
2026-11-08 19:54:26 UTC
Model cost
about $0.0023
Timing
Judge mode, compressed timing. Capture after two passes at least 10 s apart, with no failure between. Warranty (judge mode, compressed): re-probed every 20 seconds, 6 times (2 minutes in all); the real plan is 24 hourly checks. Two failed checks in a row refund the full capture.
Warranty
re-checked every 20 s, 6 times (compressed for the demo; the real plan is 24 hourly checks)
Full console screen