Lesson 4.7: SSH hardening: trust the effective configuration

An SSH server's configuration is spread over a main file, drop-in files and Match blocks, and OpenSSH uses the first value it reads for most settings. A hardening file can therefore say 'no passwords' while the server still accepts them. The only reliable view is the effective configuration: sshd -T prints what the server will really do, and sshd -T -C does it for a specific connection. In the lab you prove a bastion host still allows password logins, find out why, fix the file order, and remove a forgotten exception that allowed root logins with a password from one subnet.

17 min

You will learn to

Explain how sshd reads its configuration
Use sshd -T to see effective settings
Explain 'first value wins' and drop-in order
Test Match blocks with sshd -T -C
Validate with sshd -t before reloading

Key terms

Bastion (jump) host: A hardened host that is the single entry point to a protected network.
Drop-in (sshd_config.d): Extra files pulled in by an Include line, read in name order.
First value wins: For most sshd keywords, the first value read is used and later ones are ignored.
Match block: Settings that apply only to connections matching a user, group, address or host.
sshd -T / -t: Print the effective configuration / test it for errors.
Brute force / password spraying: Trying many passwords / a few common passwords against many accounts.

← IPv6: the next generation of addresses · All lessons · Hardening SSH →