{"id":14008344,"url":"https://github.com/stackbuilders/sshd-lint","last_synced_at":"2025-07-14T02:30:48.270Z","repository":{"id":26429266,"uuid":"29879757","full_name":"stackbuilders/sshd-lint","owner":"stackbuilders","description":"Checks a sshd_config file for adherence to security best practices","archived":false,"fork":false,"pushed_at":"2015-09-08T14:16:21.000Z","size":276,"stargazers_count":7,"open_issues_count":1,"forks_count":0,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-04-07T21:51:31.203Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Haskell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stackbuilders.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-01-26T20:21:33.000Z","updated_at":"2022-11-08T19:11:50.000Z","dependencies_parsed_at":"2022-08-29T02:30:52.779Z","dependency_job_id":null,"html_url":"https://github.com/stackbuilders/sshd-lint","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stackbuilders/sshd-lint","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackbuilders%2Fsshd-lint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackbuilders%2Fsshd-lint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackbuilders%2Fsshd-lint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackbuilders%2Fsshd-lint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stackbuilders","download_url":"https://codeload.github.com/stackbuilders/sshd-lint/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackbuilders%2Fsshd-lint/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265233753,"owners_count":23731825,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-10T11:01:36.366Z","updated_at":"2025-07-14T02:30:47.974Z","avatar_url":"https://github.com/stackbuilders.png","language":"Haskell","funding_links":[],"categories":["Haskell"],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/stackbuilders/sshd-lint.svg?branch=master)](https://travis-ci.org/stackbuilders/sshd-lint) [![Hackage](https://img.shields.io/hackage/v/sshd-lint.svg)](http://hackage.haskell.org/package/sshd-lint)\n\n# sshd-lint\n\nThe ssh daemon is the front door to your server. It's unfortunate that \nthe parser for `sshd_config` file is unhelpful in detecting incorrectly-entered configuration options or \nsettings that may leave your system open to attackers. `sshd-lint` checks a `sshd_config` file \nfor adherence to security best practices. It warns about repeated configuration \nlines, contradictory settings in the same file, and settings that don't adhere to best practices.\n\nIt can be run from the command line to show suggestions for your `sshd_config`\nfile, or an option can be provided to emit nagios-compatible output so that \nany changes deviating from best practices will be detected by a monitoring \nsystem.\n\n## Wat? Weird things happen in ssh config file parsing.\n\nLike [in JavaScript](https://www.destroyallsoftware.com/talks/wat),\ntrying to understand how sshd reads your configuration file leads to\nseveral \"Wat?\" moments.\n\n### Wat #1 - Earliest option wins for some settings\n\nsshd has two checking modes, -t and -T. Neither one alerts if config\ndirectives are repeated, regardless of whether the value being\nassigned is the same or different.\n\nIf you have two different values for some config file value, the\n*first* one takes effect (wat?). So the following allows cleartext\npasswords, but putting the directives in the other order turns off\ncleartext passwords. Again, there is no warning nor error from sshd\nabouth the duplicate lines.\n\n```\nPasswordAuthentication yes\nPasswordAuthentication no\n```\n\nsshd-lint takes the weird sshd parsing into account and makes sure\nthat settings adhere to best practices. It also lets you know if there\nare duplicated lines which may lead to unexpected behavior from the\nSSH daemon.\n\n### Wat #2 - No warning for contradictory settings\n\nsshd allows contradictory settings. Fortunately, for certain options\nlike AllowUser, AllowGroup, DenyUser and DenyGroup, the most\nrestrictive option takes effect. Still, it's a bit unexpected that if\nyou add user 'joe' to both AllowUser and DenyUser, joe is Denied\nwithout any warning that you told sshd to use contradictory settings.\n\nsshd-lint considers contradictory settings to be an error.\n\n## Installation\n\nIf you don't have the Haskell platform installed, you'll need to\ninstall it. On Ubuntu, `apt-get install haskell-platform`. On Mac OS,\nyou can install haskell-platform with homebrew or from\n[the pkg file](https://www.haskell.org/platform/mac.html).\n\nThen, install sshd-lint from [Hackage](http://hackage.haskell.org/).\n\nTo install `sshd-lint` in your `~/.cabal/bin` directory:\n\n```\ncabal update \u0026\u0026 cabal install sshd-lint\n```\n\nThis will install `sshd-lint` in your `~/.cabal/bin`, which you should\nadd to your PATH. Alternatively you can install in `/usr/local/bin` by\nusing the --global option on `cabal install`.\n\n## Usage\n\nInvoking `sshd-lint` without any arguments defaults to checking\n`/etc/ssh/sshd_config`, which should be present on most systems\nrunning OpenSSH. You can run `sshd_lint` on any configuration file\nby specifying it after the `-f` argument, eg:\n\n```\nsshd-lint -f /tmp/new_sshd_config\n```\n\n`sshd_lint` supports a Nagios output mode, which can be enabled with\nthe `-n` flag.\n\nOther options can be seen by invoking `sshd_lint` with the `-h` flag.\n\n## sshd-lint's Best Practices\n\nThere should be no duplicate lines present in the ssh config file\n(with the exception of the HostKey configuration option, which we\nignore). Currently the following settings are considered best\npractices by `sshd-lint`.\n\n```\nPermitEmptyPasswords no\nPasswordAuthentication no\nHostbasedAuthentication no\nPermitRootLogin no\nIgnoreRhosts yes\nProtocol 2\nStrictModes yes\nUsePrivilegeSeparation yes\n```\n\n## Output\n\nIf sshd-lint has any suggestions they will be printed to standard\noutput. The return value of the program will be `1` if there are\nsuggestions.\n\nThe output of sshd-lint will be \"No suggestions\" if there are no\nsuggestions, and the return value will be `0`.\n\n**The format of sshd-lint may change while the project is still young,\nso it is suggested that scripts using sshd-lint depend on the return\nvalue, but not necessarily the exact formatting of output until the\nproject matures.**\n\n## Other Reading\n\nMany of the sshd best practices come from the article, [Top 20 OpenSSH\nServer Best Security\nPractices](http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html).\n\n\n## Author\n\nJustin Leitgeb\n\n## License\n\nMIT\n\n## Copyright\n\n(C) 2015 Stack Builders Inc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackbuilders%2Fsshd-lint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstackbuilders%2Fsshd-lint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackbuilders%2Fsshd-lint/lists"}