sshd_config Analyzer

How do I check an sshd_config for security problems?

Read it the way sshd does: keywords are case-insensitive, the first value sshd reads for a keyword is the one it uses, a Match block lasts until the next Match line, and any keyword you leave out takes the OpenSSH default. This analyzer applies those rules to the file you paste, so it reports what the server actually does, not what a line further down appears to say.

On the server itself, sudo sshd -T prints the values sshd resolved, includes and defaults applied. Use it to confirm the result after a change.

How sshd reads the file

The rules below come from sshd_config(5) and were checked against sshd -T from OpenSSH 9.6p1, the version in Ubuntu 24.04:

• The first value wins. If line 10 says PermitRootLogin yes and line 40 says PermitRootLogin no, root can log in. The analyzer reports each ignored duplicate. A few keywords differ: Port, ListenAddress, HostKey, AllowUsers, DenyUsers, AllowGroups, DenyGroups and AcceptEnv add up, and MaxStartups keeps the last value.
• Match blocks. Lines after Match User backup apply only to connections that match, until the next Match line or the end of the file, whatever the indentation. A global setting added at the bottom of a file that ends in a Match block silently becomes part of it. Match all ends a block.
• Include. Include /etc/ssh/sshd_config.d/*.conf reads those files at that point. Debian and Ubuntu put it on the first line, so a drop-in's value beats the same keyword anywhere in the main file. This tool cannot open those files; paste them in place of the Include line.
• Syntax. Keyword value and Keyword=value are equal, a # after a space ends the line, CRLF line endings are fine. A typo, an unknown value such as true, a keyword not allowed inside Match, or a byte-order mark from a Windows editor makes sshd -t fail, and sshd will not restart.

Defaults: what an absent line means

Absent keywords are judged by OpenSSH 9.x defaults: PermitRootLogin prohibit-password, PasswordAuthentication yes, KbdInteractiveAuthentication yes, PubkeyAuthentication yes, PermitEmptyPasswords no, MaxAuthTries 6, LoginGraceTime 120, X11Forwarding no, AllowTcpForwarding yes, AllowAgentForwarding yes, UsePAM no and ClientAliveInterval 0.

Distributions change some of them in the file they ship. Ubuntu 24.04's stock sshd_config sets KbdInteractiveAuthentication no, UsePAM yes and X11Forwarding yes, and leaves password login at the default, yes. Ubuntu cloud images add /etc/ssh/sshd_config.d/60-cloudimg-settings.conf with PasswordAuthentication no, but cloud-init can write 50-cloud-init.conf with PasswordAuthentication yes, which sorts first and wins.

What it checks

One pairing catches people out: PasswordAuthentication no does not cover keyboard-interactive login, and with UsePAM yes that method asks for the account password. Turn both off. Weak algorithms are named exactly, for example 3des-cbc, the aes*-cbc modes, hmac-md5, hmac-sha1-96, diffie-hellman-group1-sha1 and ssh-dss; arcfour, blowfish-cbc and cast128-cbc are gone from OpenSSH entirely, so a line naming them stops sshd from starting.

Applying the fixes without locking yourself out

# Keep this session open until a new login works.
sudo nano /etc/ssh/sshd_config.d/00-hardening.conf
sudo sshd -t                                   # prints nothing when the files are valid
sudo sshd -T | grep -Ei '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication)'
sudo systemctl reload ssh                      # the unit is sshd on RHEL, Fedora and Arch
ssh -o PreferredAuthentications=publickey deploy@your-server   # from a second terminal

The 00- file name only wins when the main file includes sshd_config.d before its own settings; otherwise put the lines at the top of sshd_config, above any Match. Before turning off passwords, copy your key with ssh-copy-id and log in with it once. After changing Port on Ubuntu 22.10 or later, also run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, and allow the new port in the firewall first.

Common errors and how to fix them

• Bad configuration option. A misspelt keyword, such as PasswordAuthentcation; the analyzer suggests the keyword you meant.
• Directive is not allowed within a Match block. A global keyword such as Port or Ciphers sits under a Match line. Move it above the first one.
• unsupported option. A value sshd does not take, such as true, or no#comment, where the missing space makes the comment part of the value.
• The change has no effect. An earlier line or an included drop-in sets the same keyword first. Check with sudo sshd -T.

Shipown and SSH access

Shipown creates dedicated deploy users on a server, each with its own SSH key and scoped sudo rules, so nobody needs to log in as root. Its fail2ban setup bans addresses that keep failing to log in, and always keeps the address your own session comes from in the ignore list.