Home / server / Questions / 884594
In Process
Tom Hale
Asked: 2017-11-22 21:59:16 +0800 CST

Best practices: editing sshd_config over ssh

  • 772

I've recently needed to update my sshd_config file as the hmac-ripemd160 MAC is no longer supported as of sshd version 7.6.

I edited the file then ran:

sshd -t

to test the config.

When that returned null output and exit code 0, I reloaded the config via:

kill -HUP $(pgrep -f /usr/bin/sshd)

(The man page says sshd rereads its configuration file when it receives a hangup signal, SIGHUP)

What are the best practices when changing a server's sshd configuration over an ssh connection?

ssh

2 Answers

  1. Make sure you can log in after making changes before dropping privilege and logging out is my best practice.

    • 1

  2. As @Oldskool says, ensure you have another way of accessing the machine (console, NX, teamviewer).

    Instead of editing the default config file, make a copy and then run:

    sshd -t -f <new-config-file-name>

    to test the new configutation.

    Try the configuration on an unused port (thanks to @gf_ for this tip):

        sshd -f <new-config-file-name> -p <unused-port>

    Note that -p overrides Port configuration, but ListenAddress config will override -p.

    When you can login, copy the new config over the old (after making a backup).

    Then have the server reload config:

    kill -HUP <PID of sshd>
    • 1