OpenSSH Server Admin Cheat Sheet

sshd -t

# Validate sshd_config syntax before restart.

sshd -T

# Dump effective server configuration values.

sshd -T -C user=deploy,host=server.example.com,addr=203.0.113.10

# Evaluate Match blocks for a chosen user and source address.

sudo systemctl restart sshd

# Restart the SSH daemon on systemd-based Linux hosts.

sudo systemctl status sshd

# Inspect the daemon status on systemd-based hosts.

sudo journalctl -u sshd -f

# Follow SSH daemon logs via journald.

sudo /usr/sbin/sshd -D -d -p 2222

# Start a test daemon without detaching, useful for troubleshooting.

PasswordAuthentication no

# Require key-based authentication on the server.

PermitRootLogin no

# Prevent direct root SSH sessions.

AllowUsers deploy ops

# Restrict which user accounts may log in.

AllowGroups sshusers admins

# Restrict logins to group members.

PubkeyAuthentication yes

# Ensure public key authentication is on.

AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

# Point to one or more authorized_keys paths.

KbdInteractiveAuthentication no

# Turn off interactive password-style auth methods.

ClientAliveInterval 60
ClientAliveCountMax 3

# Drop dead sessions after missed keepalive responses.

Match Group sftpusers
  ChrootDirectory /srv/sftp/%u
  ForceCommand internal-sftp
  X11Forwarding no
  AllowTcpForwarding no

# Apply options only to members of a specific group.

sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''

# Create an Ed25519 host key for sshd.

ssh-keygen -t ed25519 -f ~/.ssh/ca_user -C 'user CA'

# Create a key pair for signing user certificates.

ssh-keygen -s ~/.ssh/ca_user -I alice@example.com -n alice -V +52w ~/.ssh/id_ed25519.pub

# Create a short-lived user certificate from a CA.

TrustedUserCAKeys /etc/ssh/trusted_user_ca_keys.pub

# Allow user certificates signed by a trusted CA.

@cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...

# Trust host certificates signed by a CA.