4

Where can i check/verify which config file sshd is using? I know you can change the config file to use by using -f command, but is there a way to echo which config file is currently being used or is there a file I can view to check this?

  • 2
    If there is no -f in sshd's command line then it is the default file. Is that not enough for you? Do you want to be able to detect whether your sshd has be compiled with different defaults? You may run sshd through strace: strace -o /root/sshd.strace -e trace=file sshd ... – Hauke Laging Jan 16 '15 at 5:16
  • what do you mean by if there is no -f in sshd's command line? for my question, say i want to debug a couple configs files and i go back and forth, how could i view which config file sshd is currently using? – jes516 Jan 16 '15 at 5:27
  • Check the sshd process command line: pgrep -fa sshd or pgrep -fl sshd. If it doesn't have a -f, then it's the default, for which you can use strace. – muru Jan 16 '15 at 7:04
8

Based on @Hauke Laging's comment. When you run strace on the sshd binary it outputs debugging information on how the program starts and what files it tries to access. From which we can use grep to list the /etc/ files which it tries to access.

$ sudo strace -e trace=file /usr/sbin/sshd |& grep '^open('|grep '/etc/'
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/etc/ssh/sshd_config", O_RDONLY|O_LARGEFILE) = 3
open("/etc/gai.conf", O_RDONLY)         = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/ssh/ssh_host_rsa_key", O_RDONLY|O_LARGEFILE) = 3
open("/etc/ssh/blacklist.RSA-2048", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
open("/etc/ssh/ssh_host_dsa_key", O_RDONLY|O_LARGEFILE) = 3
open("/etc/ssh/blacklist.DSA-1024", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY|O_LARGEFILE) = 3
open("/etc/ssh/blacklist.ECDSA-256", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)

From the above strace output /etc/ssh/sshd_config is used as ssh configuration.

  • 1
    "When you run strace on the sshd binary it outputs debugging information on how the program starts and what files it tries to access." That's not really accurate. strace outputs the system calls made by the traced program. In particular, with the -e trace=file the ones which involve file manipulation. – edmz Jan 16 '15 at 11:59
0

In addition to the answers given:

  1. Debug mode might be helpful: [root@ip-10-41-162-92 ~]# /usr/sbin/sshd -df /etc/ssh/sshd_config.test debug1: sshd version OpenSSH_6.7, OpenSSL 1.0.1j 15 Oct 2014 ... debug1: rexec_argv[0]='/usr/sbin/sshd' debug1: rexec_argv[1]='-df' debug1: rexec_argv[2]='/etc/ssh/sshd_config.test' ...

The output tells what file was used (if -f flag was given).

  1. Pretty obvious but still, if you're debugging configuration, remember that stderr is printed to /var/log/messages when running sshd, so errors like
    /etc/ssh/sshd_config line 91: Unsupported option GSSAPIAuthentication /etc/ssh/sshd_config line 93: Unsupported option GSSAPICleanupCredentials tell which file you're using

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.