>

Validate sshd_config Before Restarting with sshd -t

Dry-run the SSH daemon configuration so a typo can't kill your remote access — the standard habit before every systemctl reload sshd.

LinuxsshdopensshvalidationconfigMedium risk
Run sudo sshd -t to syntax-check /etc/ssh/sshd_config (silent output means valid), and sudo sshd -T to dump the fully effective configuration.

01Command

Command
$ sudo sshd -t
sudo sshd -T | grep -i permitrootlogin

02What it does

sshd -t parses the config file and checks host keys, exiting non-zero with a clear message on any invalid directive — catching the misspelled option that would otherwise leave the daemon dead after a reload. The extended mode sshd -T prints the complete effective configuration after applying Match blocks, which is how you confirm PermitRootLogin or a port override actually took effect. Make it part of the edit → test → reload cycle.

03Risk

RiskMedium risk
Requirementsopenssh-server; run as root since sshd requires host key access
!Warning: sshd -t checks syntax, not lockout logic: a valid config with PermitRootLogin no plus a wrong AllowUsers line can still lock you out — test from a second session before closing the current one.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • sshd(8) — Linux manual page
    man7.org · technical · 2026-09-17
    Evidence: sshd man page: '-t Test mode. Only check the validity of the configuration file and sanity of the keys' and '-T extended test mode printing effective config'.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

View and Override Unit Files with systemctl cat/edit
Linuxservicessystemdconfig

systemctl cat reveals a service's unit file plus every drop-in override; systemctl edit creates overrides without touching vendor files.

Medium risk ✓ 2026-09-17