Your browser does not allow storing cookies. We recommend enabling them.



sshd-check-conf — checks what your configuration allows or denies based on the incoming user name and/or host name


sshd-check-conf [-d debug_level] [-v] [-V] [-h] [-f config_file] [[user@]host...]


sshd-check-conf checks how sshd2 will react to an incoming user, based on the user name and the remote host name given as parameters. Currently, the parameters AllowHosts, DenyHosts, AllowSHosts, DenySHosts, AllowUsers, DenyUsers, AllowGroups, DenyGroups, ChRootUsers, ChRootGroups, AllowTcpForwardingForUsers, DenyTcpForwardingForUsers, AllowTcpForwardingForGroups, and DenyTcpForwardingForGroups are checked.


The following options are available:

-d debug_level_spec

Debug mode. The debugging level is either a number or a comma-separated list of assignments of the format ModulePattern=debug_level, for example "*=10,sshd2=2".


Enables verbose mode. Displays verbose debugging messages. Equivalent to -d 2.


Displays version string.


Displays a short help on command-line options.

-f configuration_file

Specifies the name of the configuration file. The default is /opt/tectia/etc/sshd2_config or $HOME/.ssh2/sshd2_config, depending on who is running the program, root or normal user.


Any non-options given on the command line will be regarded as [user@]host patterns (that is, the user part is optional). If the host part is a valid IP address, it is looked up from DNS. Otherwise it is interpreted as a host name and the corresponding IP addresses will be queried from DNS.

You can specify multiple patterns on the command line.

If no patterns are specified on the command line, sshd-check-conf will go into interactive mode where the patterns can be given one at a time and they will be checked.

You may also specify one command in interactive mode, "dump". This command dumps the configuration (with subconfigurations amended) for the previous pattern.


% sshd-check-conf -f /opt/tectia/etc/sshd2_config

% sshd-check-conf -f /opt/tectia/etc/sshd2_config

% sshd-check-conf




What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.

    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH

    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now