--- sshd_config.5.orig	2026-10-10 10:05:08.883799000 -0700
+++ sshd_config.5	2026-10-10 10:08:51.181289000 -0700
@@ -844,7 +844,9 @@ This was formerly named HostbasedAcceptedKeyTypes.
 .Qq ssh -Q HostbasedAcceptedAlgorithms .
 This was formerly named HostbasedAcceptedKeyTypes.
 .It Cm HostbasedAuthentication
-Specifies whether rhosts or /etc/hosts.equiv authentication together
+Specifies whether rhosts or
+.Pa /etc/hosts.equiv
+authentication together
 with successful public key client host authentication is allowed
 (host-based authentication).
 The default is
@@ -1551,7 +1553,7 @@ The default is
 or
 .Cm no .
 The default is
-.Cm prohibit-password .
+.Cm no .
 .Pp
 If this option is set to
 .Cm prohibit-password
@@ -1597,6 +1599,15 @@ The default is
 .Cm ethernet .
 The default is
 .Cm no .
+Note that if
+.Cm ChallengeResponseAuthentication
+is
+.Cm yes ,
+the root user may be allowed in with its password even if
+.Cm PermitRootLogin is set to
+.Cm prohibit-password
+or
+.Cm without-password .
 .Pp
 Independent of this setting, the permissions of the selected
 .Xr tun 4
@@ -2156,12 +2167,19 @@ The default is
 .Xr sshd 8
 as a non-root user.
 The default is
+.Cm yes ,
+unless
+.Nm sshd
+was built without PAM support, in which case the default is
 .Cm no .
 .It Cm VersionAddendum
 Optionally specifies additional text to append to the SSH protocol banner
 sent by the server upon connection.
 The default is
-.Cm none .
+.Cm %%SSH_VERSION_FREEBSD_PORT%% .
+The value
+.Cm none
+may be used to disable this.
 .It Cm WarnWeakCrypto
 Controls whether warnings are logged when the cryptographic algorithms
 negotiated for the connection are weak or otherwise recommended against.