sshd

What it does

How to write it

sshd [-46DdeGiqTtV] [-C SPEC] [-c CERT] [-E LOG] [-f CONFIG] [-g TIME] [-h KEY] [-o OPTION] [-p PORT]

Main parts

Port N

Listen port.

PermitRootLogin yes|prohibit-password|no|forced-commands-only

How root may log in.

PasswordAuthentication yes|no

Allow passwords.

PubkeyAuthentication yes|no

Allow keys.

AllowUsers, AllowGroups, DenyUsers, DenyGroups

Who may log in.

MaxAuthTries N

Tries per connection.

ClientAliveInterval S, ClientAliveCountMax N

Keepalive and idle timeout.

X11Forwarding, AllowTcpForwarding

Forwarding.

Banner FILE

Text before login.

Match User|Group|Address …

Settings for some users or networks.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Test the config

   #sshd -t

   No output = fine. Always run before a reload.

2. 2Show the effective settings

   #sshd -T | grep -iE '^(port|permitrootlogin|passwordauthentication|allowgroups)'
   port 2022
   permitrootlogin no

   What really applies after all files.

3. 3Settings for one user and address

   #sshd -T -C user=lisa,addr=192.168.122.1,host=client | grep -i allowtcp

   Tests Match blocks.

4. 4Reload after a change

   #systemctl reload sshd

   Existing sessions stay.

5. 5Debug a failing login

   #/usr/sbin/sshd -d -p 2222

   One test connection on port 2222 with full debug output: ssh -p 2222 user@host.

6. 6Status and logs

   #systemctl status sshd
   #journalctl -u sshd --since -1h

   Failed logins and errors.

7. 7New port: SELinux and firewall

   #semanage port -a -t ssh_port_t -p tcp 2022
   #firewall-cmd --add-port=2022/tcp --permanent; firewall-cmd --reload

   Without these, sshd cannot use or expose the port.

8. 8Different rules for a network

   #cat /etc/ssh/sshd_config.d/40-match.conf
   Match Address 192.168.122.0/24
       PasswordAuthentication yes

   Passwords only from the admin network.

9. 9Host key fingerprints (tell users)

   #for k in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$k"; done

   Users compare these at the first connection.

10. 10Audit the SSH config (security)

    #sshd -T | grep -E '^(permitrootlogin|passwordauthentication|x11forwarding|maxauthtries|permitemptypasswords)'

    Quick hardening check against your policy.

Nothing matches this filter.

Files

/etc/ssh/sshd_config

Main config.

/etc/ssh/sshd_config.d/*.conf

Drop-ins (read first; first value wins).

/etc/ssh/ssh_host_*_key

Host keys.

~/.ssh/authorized_keys

Allowed keys per user.

Exit codes