TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

The order of files in /etc/ssh/sshd_config.d/ matters

254 pointsby NGRhodesabout 1 month ago

18 comments

egberts1about 1 month ago
Purpose of first-define is the rule: In placing configuration files higher than user-defined configuration but Only with SSH client, can want user to have control from their config files: Remove from config files Place a couple under Match&#x2F;MatchGroup using deny&#x2F;accept.<p>SSHD (server&#x2F;non-client) still support admin-defined by having system-wide settings done firstly. For those who have multi-file SSHD configurations, breakdown of the many config file locations and scopes here as it covers default user, system-wide, specific user:<p><a href="https:&#x2F;&#x2F;egbert.net&#x2F;blog&#x2F;articles&#x2F;ssh-openssh-options-ways.html" rel="nofollow">https:&#x2F;&#x2F;egbert.net&#x2F;blog&#x2F;articles&#x2F;ssh-openssh-options-ways.ht...</a><p>Also I broken out each and every SSHD and SSH options along with their ordering by execution by using file name and numbering as well as its various state machine, dispatch, CLI equivalence, network context, and function nesting, all in:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;egberts&#x2F;easy-admin&#x2F;tree&#x2F;main&#x2F;490-net-ssh">https:&#x2F;&#x2F;github.com&#x2F;egberts&#x2F;easy-admin&#x2F;tree&#x2F;main&#x2F;490-net-ssh</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;egberts&#x2F;easy-admin&#x2F;blob&#x2F;main&#x2F;490-net-ssh&#x2F;sshd_config.d&#x2F;410-protocol-auth-methods.conf">https:&#x2F;&#x2F;github.com&#x2F;egberts&#x2F;easy-admin&#x2F;blob&#x2F;main&#x2F;490-net-ssh&#x2F;...</a><p>Disclaimer: I do regular code reviews of OpenSSH and my employer authorizes me to release them (per se contract and NDA)<p>Also this showed how to properly mix and match authentication types using OR and AND logic(s) in<p><a href="https:&#x2F;&#x2F;serverfault.com&#x2F;a&#x2F;996992" rel="nofollow">https:&#x2F;&#x2F;serverfault.com&#x2F;a&#x2F;996992</a><p>It is my dump mess so wade &#x27;em and enjoy.
评论 #43601714 未加载
评论 #43598960 未加载
评论 #43598953 未加载
评论 #43602350 未加载
0xbadcafebeeabout 1 month ago
This is perhaps old sysadmin knowledge, but different tools have very different heuristics about how they parse configuration, and you have to check every time and not assume. Among the consequences to not checking are gaping security holes.
评论 #43600121 未加载
wruzaabout 1 month ago
That&#x27;s why I erase sshd_config and put what I really meant there. You may say &quot;but isn&#x27;t it better to patch it properly?&quot;. It is not. Yet another vps hoster –&gt; yet another &#x2F;etc&#x2F;ssh directory template that may have all sorts of access issues in it. Better to replace it and make it do exactly what you have planned.
评论 #43599224 未加载
eadmundabout 1 month ago
Yeah, first-wins is definitely surprising. Off the top of my head, it feels like one would have to go out of one’s way to write a parser that does that (by storing an extra bit of state for each configuration item, and then checking it before setting the configuration item and toggling the state, rather than just applying the configuration item each time it is encountered).<p>Is there a good reason for this design? I can’t think of one, again off the top of my head, but of course I could be missing something.
评论 #43598789 未加载
评论 #43601659 未加载
评论 #43598808 未加载
评论 #43603366 未加载
评论 #43598858 未加载
drpixieabout 1 month ago
There is a nice sshd option (-T) that tells you what it&#x27;s really doing. Just run<p><pre><code> sudo sshd -T | grep password</code></pre>
评论 #43599579 未加载
评论 #43599606 未加载
thereinabout 1 month ago
The only time I hear or see anything about cloudinit, it is always a problem. Nobody ever said &quot;we don&#x27;t need worry about that, cloudinit takes care of it&quot;.<p>What good does cloudinit do really?
评论 #43599661 未加载
评论 #43599032 未加载
评论 #43599136 未加载
eaprivabout 1 month ago
Of course the order matters, that’s why the file names have numbers in them.
评论 #43600443 未加载
评论 #43600179 未加载
评论 #43599835 未加载
samlinnferabout 1 month ago
I&#x27;ve made a big stink about this last time: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=42133181">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=42133181</a><p>They&#x27;ve updated the documentation on &#x2F;etc&#x2F;ssh&#x2F;sshd_config <a href="https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;cloud-init&#x2F;+bug&#x2F;2088207" rel="nofollow">https:&#x2F;&#x2F;bugs.launchpad.net&#x2F;ubuntu&#x2F;+source&#x2F;cloud-init&#x2F;+bug&#x2F;20...</a>
immibisabout 1 month ago
I don&#x27;t like these systems where configuration is built from a million separate files. They&#x27;re unpleasant to work with.<p>The best reason to do it this way seems to be that files are the unit of package management. Perhaps we need a smarter package manager.<p>My nginx.conf life got better when I deleted sites-available and sites-enabled and defined my sites inline in nginx.conf.<p>The only thing worse is when the configuration is actually a program that generates the configuration, like in ALSA.<p>And the only thing worse than ALSA style is Xorg style, with a default configuration generated by C code and you can only apply changes to it without seeing it. Xorg also has this weird indirection thing where the options are like Option &quot;Foo&quot; &quot;Bar&quot; instead of Foo &quot;Bar&quot;, but that&#x27;s a nitpick in comparison.
评论 #43599849 未加载
jmclnxabout 1 month ago
Curious, since when is directory &quot;&#x2F;etc&#x2F;ssh&#x2F;sshd_config.d&#x2F;&quot; a thing ?<p>I checked on my OpenBSD (7.6) System and Slackware (15.0) and that directory does not exist. I checked the man page for sshd and there is no mention of that dir.<p>Is this a new thing&#x2F;patch Linux people came up with ?
评论 #43601622 未加载
评论 #43601723 未加载
评论 #43605017 未加载
noufalibrahimabout 1 month ago
This is weird. I&#x27;ve been hitting funny problems while trying to get ssh to authenticate (using passwords) via. a keycloak instance. I&#x27;ve been trying to do using PAM script but have been pretty unsuccessful till now. Apparently, they don&#x27;t play nice together.
czernobogabout 1 month ago
This is interesting, usually it&#x27;s the latter because the config is ran line by line<p>Also, if it&#x27;s not too much trouble, would someone help me understand why such files are required to start with numbers? In this case it&#x27;s 10-no-password.conf.<p>I have noticed similar structure for apt and many more packages
评论 #43599559 未加载
评论 #43599569 未加载
teknopaulabout 1 month ago
It&#x27;s a pet gripe with cli apps that do first wins as well.<p>You should be able to set<p><pre><code> alias foo=&#x27;foo -p 80&#x27; </code></pre> And still write<p><pre><code> foo -p 81 </code></pre> espeak suffers this affliction
sneakabout 1 month ago
Same if you use ~&#x2F;.ssh&#x2F;conf.d&#x2F;.<p>I have been bitten by this before. :(
barotalomeyabout 1 month ago
Hence the tradition of numeric file naming in *.d directories.
NikkiAabout 1 month ago
this is true of all &#x27;config.d&#x27; schemes, and why most such schemes suggest&#x2F;use number-name.ext style filenames to deal with sorting.
N2yhWNXQN3k9about 1 month ago
title could use a clean up
pdimitarabout 1 month ago
Yikes. What a nasty surprise. These tools really should be phased out in their current form.
评论 #43599578 未加载