sshd_config & ssh_config Analyzer
Check an sshd_config or ssh_config for risky settings: root and password login, weak ciphers, forwarding, host key checking. Shows the effective values with Match and Host blocks applied.
Runs in your browser Your input never leaves your device.
Paste an sshd_config (server) or ssh_config / ~/.ssh/config (client). It is read in your browser and nothing is uploaded. Included files (Include) are not followed because the page cannot open them.
User, host and address decide which Match and Host blocks apply to the effective values. Leave them empty to see only the settings outside blocks.
Findings
Effective values
| Setting | Value | Where |
|---|
What is checked
Server: root login, password and empty-password login, keyboard-interactive with PAM, weak ciphers, MACs, key exchanges and host key algorithms (after applying the + - ^ list syntax to the OpenSSH defaults), X11, TCP, agent and tunnel forwarding, GatewayPorts, MaxAuthTries, LoginGraceTime, PermitUserEnvironment, StrictModes, host-based trust, .rhosts, log level, session limits, idle timeouts, Match blocks that loosen settings (root login, passwords, empty passwords, forwarding, tunnels and more). Client: host key checking off, known_hosts discarded, agent and X11 forwarding (especially under Host *), weak algorithms, LocalCommand, ProxyCommand metacharacters, ControlPath in /tmp, re-enabled ssh-rsa, identity files offered to every host. Plus problems in the file itself: unknown or misplaced keywords, bad values, repeated settings that are ignored, keywords OpenSSH no longer uses.
Values and defaults come from the OpenSSH 9.6 package of Ubuntu 24.04 (read from the real programs), which differs a little from upstream (for example ForwardX11Trusted defaults to yes). Other versions differ too; sshd -T and ssh -G on your machine are the final word. Findings describe the text you pasted, not your servers.
Report a problem with this tool
About this tool
Most SSH incidents trace back to a few settings: root login, passwords, old algorithms, forwarding and disabled host key checking. This tool reads an sshd_config (server) or ssh_config (client, also ~/.ssh/config) in your browser and reports them. It parses the file the way OpenSSH does: keywords are case-insensitive, arguments may be quoted or follow an equals sign, the first value of a keyword wins, Match and Host blocks apply only to the user, host and address you give, and Ciphers, MACs, KexAlgorithms and the key algorithm lists understand the + - ^ prefixes applied to the OpenSSH 9.6 defaults (the Ubuntu 24.04 package). The effective-values table shows what the real program would use and which line set it. A numbered ruleset flags risky values, and problems in the file itself: unknown or misplaced keywords, keywords not allowed inside Match, bad values, repeated settings that are ignored and keywords that OpenSSH no longer uses. The parser, the Match and Host logic and the effective values of the common keywords (switches, numbers and times, root login, log level, host key checking, forwarding, algorithm lists, multi-valued lists such as AllowUsers) were compared with sshd -T and ssh -G on hundreds of random and hand-picked files; less common keywords are checked for name and Match placement only. Include files are not followed, and the defaults are those of the Ubuntu 24.04 build of OpenSSH 9.6, which differ slightly from upstream.
How to use it
- Paste the file, or load it. The type is detected, or choose it.
- Optionally enter a user, host and address so the right Match blocks apply.
- Read the findings, then the effective values and the line each came from.
- Copy the Markdown summary into your notes or report.
Common problems
- A setting seems ignored
- OpenSSH keeps the first value of a keyword, so a later line is ignored, and settings after a Match line belong to that block. The findings point out repeated settings.
- The effective values differ from my machine
- This page uses the defaults of OpenSSH 9.6 and does not read Include files. Compare with sshd -T or ssh -G on the machine.
- A Match block is listed as not evaluated
- Its condition (for example Match Group, exec or localnetwork) needs information this page does not have. Settings in it are not part of the effective values.