背景

Linux sshd没有提供显示当前sshd的配置的接口，所以当我们需要了解它的配置时，怎么办呢？

另外我们还不知道sshd已经加载的配置文件名，这有从何下手呢？

本文将结合openssh的源码，给大家一种取得当前sshd配置的方法。

sshd将要加载哪些配置文件

调用sshd进程，并且通过strace输出open file。

就可以从中得知sshd将要打开的配置文件。

# strace -e open -ostrace.out /usr/sbin/sshd

查看strace的结果

# cat strace.out 
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libfipscheck.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libwrap.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libpam.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcrypto.so.10", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libldap-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libutil.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libsasl2.so.3", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libssl3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libsmime3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnss3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnssutil3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libplds4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libplc4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnspr4.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libfreebl3.so", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/proc/filesystems", O_RDONLY)     = 3
open("/etc/pki/tls/openssl.cnf", O_RDONLY) = 3
open("/dev/null", O_RDWR)               = 3
open("/etc/ssh/sshd_config", O_RDONLY)  = 3      // 找到你了
open("/dev/urandom", O_RDONLY)          = 3
open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3
open("/etc/group", O_RDONLY|O_CLOEXEC)  = 4
open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_rsa_key.pub", O_RDONLY) = 3
open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3
open("/etc/group", O_RDONLY|O_CLOEXEC)  = 4
open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3
open("/etc/ssh/ssh_host_ecdsa_key.pub", O_RDONLY) = 3
+++ exited with 0 +++

open("/etc/ssh/sshd_config", O_RDONLY) = 3 // 找到你了

注意，这是将要打开的，已经启动的sshd读过哪个配置文件，哪些配置，不得而知，那么怎么知道当前sshd的配置呢？

查看sshd的当前配置

因为sshd没有提供接口，所以我们需要用gcore把进程的内存dump出来，到内存中查看它的配置。

# ps -ewf|grep sshd
root     25202     1  0 Jul21 ?        00:00:00 /usr/sbin/sshd -D

使用gcore 将pid的memory dump出来

# gcore 25202

使用gdb 分析

# gdb -core=core.25202  /usr/sbin/sshd

由于没有按照debuginfo包，会提示按照，否则没有符号表信息。

Missing separate debuginfos, use: debuginfo-install openssh-server-6.4p1-8.el7.x86_64

按照缺失的debuginfo包

# debuginfo-install openssh-server-6.4p1-8.el7.x86_64

# gdb -core=core.25202  /usr/sbin/sshd

Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.26-20.el7_2.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 nspr-4.10.6-1.el7_0.x86_64 nss-3.16.2-7.el7_0.x86_64 nss-softokn-freebl-3.16.2-2.el7_0.x86_64 nss-util-3.16.2-2.el7_0.x86_64 pcre-8.32-15.el7_2.1.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64

# debuginfo-install cyrus-sasl-lib-2.1.26-20.el7_2.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 nspr-4.10.6-1.el7_0.x86_64 nss-3.16.2-7.el7_0.x86_64 nss-softokn-freebl-3.16.2-2.el7_0.x86_64 nss-util-3.16.2-2.el7_0.x86_64 pcre-8.32-15.el7_2.1.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64

重新gdb

# gdb -core=core.25202  /usr/sbin/sshd

那么我怎么知道配置对应的变量呢？
在这个openssh的源码文件中搜索到了 /etc/ssh/sshd_config 里的配置项
/usr/src/debug/openssh-6.4p1/servconf.c

/* Initializes the server options to their default values. */

void
initialize_server_options(ServerOptions *options)
{
        memset(options, 0, sizeof(*options));

        /* Portable-specific options */
        options->use_pam = -1;

        /* Standard Options */
        options->num_ports = 0;
        options->ports_from_cmdline = 0;
        options->listen_addrs = NULL;
        options->address_family = -1;
        options->num_host_key_files = 0;
        options->num_host_cert_files = 0;
        options->host_key_agent = NULL;
        options->pid_file = NULL;
        options->server_key_bits = -1;
        options->login_grace_time = -1;
        options->key_regeneration_time = -1;
        options->permit_root_login = PERMIT_NOT_SET;
        options->ignore_rhosts = -1;
        options->ignore_user_known_hosts = -1;
        options->print_motd = -1;
        options->print_lastlog = -1;
        options->x11_forwarding = -1;
        options->x11_display_offset = -1;
        options->x11_use_localhost = -1;
        options->xauth_location = NULL;
        options->strict_modes = -1;
        options->tcp_keep_alive = -1;
        options->log_facility = SYSLOG_FACILITY_NOT_SET;
        options->log_level = SYSLOG_LEVEL_NOT_SET;
        options->rhosts_rsa_authentication = -1;
        options->hostbased_authentication = -1;
        options->hostbased_uses_name_from_packet_only = -1;
        options->rsa_authentication = -1;
        options->pubkey_authentication = -1;
        options->kerberos_authentication = -1;
        options->kerberos_or_local_passwd = -1;
        options->kerberos_ticket_cleanup = -1;
        options->kerberos_get_afs_token = -1;
        options->gss_authentication=-1;
        options->gss_keyex = -1;
        options->gss_cleanup_creds = -1;
        options->gss_strict_acceptor = -1;
        options->gss_store_rekey = -1;
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
        options->challenge_response_authentication = -1;
        options->permit_empty_passwd = -1;
        options->permit_user_env = -1;
        options->use_login = -1;
        options->compression = -1;
        options->rekey_limit = -1;
        options->rekey_interval = -1;
        options->allow_tcp_forwarding = -1;
        options->allow_agent_forwarding = -1;
        options->num_allow_users = 0;
        options->num_deny_users = 0;
        options->num_allow_groups = 0;
        options->num_deny_groups = 0;
        options->ciphers = NULL;
        options->macs = NULL;
        options->kex_algorithms = NULL;
        options->protocol = SSH_PROTO_UNKNOWN;
        options->gateway_ports = -1;
        options->num_subsystems = 0;
        options->max_startups_begin = -1;
        options->max_startups_rate = -1;
        options->max_startups = -1;
        options->max_authtries = -1;
        options->max_sessions = -1;
        options->banner = NULL;
        options->show_patchlevel = -1;
        options->use_dns = -1;
        options->client_alive_interval = -1;
        options->client_alive_count_max = -1;
        options->num_authkeys_files = 0;
        options->num_accept_env = 0;
        options->permit_tun = -1;
        options->num_permitted_opens = -1;
        options->adm_forced_command = NULL;
        options->chroot_directory = NULL;
        options->authorized_keys_command = NULL;
        options->authorized_keys_command_user = NULL;
        options->zero_knowledge_password_authentication = -1;
        options->revoked_keys_file = NULL;
        options->trusted_user_ca_keys = NULL;
        options->authorized_principals_file = NULL;
        options->ip_qos_interactive = -1;
        options->ip_qos_bulk = -1;
        options->version_addendum = NULL;
        options->use_kuserok = -1;
}

所以要查看当前sshd进程的配置，打印options即可

# gdb -core=core.25202  /usr/sbin/sshd
(gdb) print options

$1 = {num_ports = 1, ports_from_cmdline = 0, ports = {22, 0 <repeats 255 times>}, listen_addr = 0x0, listen_addrs = 0x7f1e39bcba40, address_family = 2, host_key_files = {0x7f1e39bcf760 "/etc/ssh/ssh_host_rsa_key", 
    0x7f1e39bcf790 "/etc/ssh/ssh_host_ecdsa_key", 0x0 <repeats 254 times>}, num_host_key_files = 2, host_cert_files = {0x0 <repeats 256 times>}, num_host_cert_files = 0, host_key_agent = 0x0, 
  pid_file = 0x7f1e38e413c8 "/var/run/sshd.pid", server_key_bits = 1024, login_grace_time = 120, key_regeneration_time = 3600, permit_root_login = 3, ignore_rhosts = 1, ignore_user_known_hosts = 0, print_motd = 1, print_lastlog = 1, 
  x11_forwarding = 1, x11_display_offset = 10, x11_use_localhost = 1, xauth_location = 0x7f1e38e413da "/usr/bin/xauth", strict_modes = 1, tcp_keep_alive = 1, ip_qos_interactive = 16, ip_qos_bulk = 8, ciphers = 0x0, macs = 0x0, 
  kex_algorithms = 0x0, protocol = 4, gateway_ports = 0, log_facility = SYSLOG_FACILITY_LOCAL0, log_level = SYSLOG_LEVEL_INFO, rhosts_rsa_authentication = 0, hostbased_authentication = 0, hostbased_uses_name_from_packet_only = 0, 
  rsa_authentication = 1, pubkey_authentication = 1, kerberos_authentication = 0, kerberos_or_local_passwd = 1, kerberos_ticket_cleanup = 1, kerberos_get_afs_token = 0, gss_authentication = 1, gss_keyex = 0, gss_cleanup_creds = 1, 
  gss_strict_acceptor = 1, gss_store_rekey = 0, password_authentication = 1, kbd_interactive_authentication = 0, challenge_response_authentication = 0, zero_knowledge_password_authentication = 0, permit_empty_passwd = 0, 
  permit_user_env = 0, use_login = 0, compression = 2, allow_tcp_forwarding = 3, allow_agent_forwarding = 1, num_allow_users = 0, allow_users = {0x0 <repeats 256 times>}, num_deny_users = 0, deny_users = {0x0 <repeats 256 times>}, 
  num_allow_groups = 0, allow_groups = {0x0 <repeats 256 times>}, num_deny_groups = 0, deny_groups = {0x0 <repeats 256 times>}, num_subsystems = 1, subsystem_name = {0x7f1e39bcb9c0 "sftp", 0x0 <repeats 255 times>}, subsystem_command = {
    0x7f1e39bcb9e0 "/usr/libexec/openssh/sftp-server", 0x0 <repeats 255 times>}, subsystem_args = {0x7f1e39bcba10 "/usr/libexec/openssh/sftp-server", 0x0 <repeats 255 times>}, num_accept_env = 16, accept_env = {0x7f1e39bcf7e0 "LANG", 
    0x7f1e39bcb7e0 "LC_CTYPE", 0x7f1e39bcb800 "LC_NUMERIC", 0x7f1e39bcb820 "LC_TIME", 0x7f1e39bcb840 "LC_COLLATE", 0x7f1e39bcb860 "LC_MONETARY", 0x7f1e39bcb880 "LC_MESSAGES", 0x7f1e39bcb8a0 "LC_PAPER", 0x7f1e39bcb8c0 "LC_NAME", 
    0x7f1e39bcb8e0 "LC_ADDRESS", 0x7f1e39bcb900 "LC_TELEPHONE", 0x7f1e39bcb920 "LC_MEASUREMENT", 0x7f1e39bcb940 "LC_IDENTIFICATION", 0x7f1e39bcb960 "LC_ALL", 0x7f1e39bcb980 "LANGUAGE", 0x7f1e39bcb9a0 "XMODIFIERS", 
    0x0 <repeats 240 times>}, max_startups_begin = 10, max_startups_rate = 30, max_startups = 100, max_authtries = 6, max_sessions = 10, banner = 0x0, show_patchlevel = 0, use_dns = 0, client_alive_interval = 0, 
  client_alive_count_max = 3, num_authkeys_files = 1, authorized_keys_files = {0x7f1e39bcf7c0 ".ssh/authorized_keys", 0x0 <repeats 255 times>}, adm_forced_command = 0x0, use_pam = 1, permit_tun = 0, num_permitted_opens = -1, 
  use_kuserok = 1, chroot_directory = 0x0, revoked_keys_file = 0x0, trusted_user_ca_keys = 0x0, authorized_principals_file = 0x0, authorized_keys_command = 0x0, authorized_keys_command_user = 0x0, rekey_limit = 0, rekey_interval = 0, 
  version_addendum = 0x7f1e39bcba90 "", num_auth_methods = 0, auth_methods = {0x0 <repeats 256 times>}}

在这里我们看到了当前sshd进程的配置。

例如

max_startups_begin = 10, max_startups_rate = 30, max_startups = 100, max_authtries = 6, max_sessions = 10  

我们看看修改配置后，重新dump看看是不是会发生变化
修改前面使用strace跟踪到的配置文件

# vi /etc/ssh/sshd_config
MaxStartups 1000:30:3000

检查配置文件是否正确

# sshd -T

使得配置文件生效

service sshd reload

or 

kill -s SIGHUP $sshd_pid   // 从man sshd中得到的

     sshd can be configured using command-line options or a configuration file (by default sshd_config(5)); 
     command-line options override values specified in the configuration file.  
     sshd rereads its configuration file when it receives a hangup signal, SIGHUP, 
     by executing itself with the name and options it was started with, e.g. /usr/sbin/sshd.


我这里使用发信号的方式  
kill -s SIGHUP 25202

重新gcore

# gcore 25202

分析

# gdb -core=core.25202  /usr/sbin/sshd
(gdb) print options

$1 = {num_ports = 1, ports_from_cmdline = 0, ports = {22, 0 <repeats 255 times>}, listen_addr = 0x0, listen_addrs = 0x7f83e31d5a60, address_family = 2, host_key_files = {0x7f83e31d9770 "/etc/ssh/ssh_host_rsa_key", 
    0x7f83e31d97a0 "/etc/ssh/ssh_host_ecdsa_key", 0x0 <repeats 254 times>}, num_host_key_files = 2, host_cert_files = {0x0 <repeats 256 times>}, num_host_cert_files = 0, host_key_agent = 0x0, 
  pid_file = 0x7f83e229c3c8 "/var/run/sshd.pid", server_key_bits = 1024, login_grace_time = 120, key_regeneration_time = 3600, permit_root_login = 3, ignore_rhosts = 1, ignore_user_known_hosts = 0, print_motd = 1, print_lastlog = 1, 
  x11_forwarding = 1, x11_display_offset = 10, x11_use_localhost = 1, xauth_location = 0x7f83e229c3da "/usr/bin/xauth", strict_modes = 1, tcp_keep_alive = 1, ip_qos_interactive = 16, ip_qos_bulk = 8, ciphers = 0x0, macs = 0x0, 
  kex_algorithms = 0x0, protocol = 4, gateway_ports = 0, log_facility = SYSLOG_FACILITY_LOCAL0, log_level = SYSLOG_LEVEL_INFO, rhosts_rsa_authentication = 0, hostbased_authentication = 0, hostbased_uses_name_from_packet_only = 0, 
  rsa_authentication = 1, pubkey_authentication = 1, kerberos_authentication = 0, kerberos_or_local_passwd = 1, kerberos_ticket_cleanup = 1, kerberos_get_afs_token = 0, gss_authentication = 1, gss_keyex = 0, gss_cleanup_creds = 1, 
  gss_strict_acceptor = 1, gss_store_rekey = 0, password_authentication = 1, kbd_interactive_authentication = 0, challenge_response_authentication = 0, zero_knowledge_password_authentication = 0, permit_empty_passwd = 0, 
  permit_user_env = 0, use_login = 0, compression = 2, allow_tcp_forwarding = 3, allow_agent_forwarding = 1, num_allow_users = 0, allow_users = {0x0 <repeats 256 times>}, num_deny_users = 0, deny_users = {0x0 <repeats 256 times>}, 
  num_allow_groups = 0, allow_groups = {0x0 <repeats 256 times>}, num_deny_groups = 0, deny_groups = {0x0 <repeats 256 times>}, num_subsystems = 1, subsystem_name = {0x7f83e31d59e0 "sftp", 0x0 <repeats 255 times>}, subsystem_command = {
    0x7f83e31d5a00 "/usr/libexec/openssh/sftp-server", 0x0 <repeats 255 times>}, subsystem_args = {0x7f83e31d5a30 "/usr/libexec/openssh/sftp-server", 0x0 <repeats 255 times>}, num_accept_env = 16, accept_env = {0x7f83e31d57e0 "LANG", 
    0x7f83e31d5800 "LC_CTYPE", 0x7f83e31d5820 "LC_NUMERIC", 0x7f83e31d5840 "LC_TIME", 0x7f83e31d5860 "LC_COLLATE", 0x7f83e31d5880 "LC_MONETARY", 0x7f83e31d58a0 "LC_MESSAGES", 0x7f83e31d58c0 "LC_PAPER", 0x7f83e31d58e0 "LC_NAME", 
    0x7f83e31d5900 "LC_ADDRESS", 0x7f83e31d5920 "LC_TELEPHONE", 0x7f83e31d5940 "LC_MEASUREMENT", 0x7f83e31d5960 "LC_IDENTIFICATION", 0x7f83e31d5980 "LC_ALL", 0x7f83e31d59a0 "LANGUAGE", 0x7f83e31d59c0 "XMODIFIERS", 
    0x0 <repeats 240 times>}, max_startups_begin = 1000, max_startups_rate = 30, max_startups = 3000, max_authtries = 6, max_sessions = 10, banner = 0x0, show_patchlevel = 0, use_dns = 0, client_alive_interval = 0, 
  client_alive_count_max = 3, num_authkeys_files = 1, authorized_keys_files = {0x7f83e31d97d0 ".ssh/authorized_keys", 0x0 <repeats 255 times>}, adm_forced_command = 0x0, use_pam = 1, permit_tun = 0, num_permitted_opens = -1, 
  use_kuserok = 1, chroot_directory = 0x0, revoked_keys_file = 0x0, trusted_user_ca_keys = 0x0, authorized_principals_file = 0x0, authorized_keys_command = 0x0, authorized_keys_command_user = 0x0, rekey_limit = 0, rekey_interval = 0, 
  version_addendum = 0x7f83e31d5ab0 "", num_auth_methods = 0, auth_methods = {0x0 <repeats 256 times>}}

可以看到刚才修改的配置已生效

max_startups_begin = 1000, max_startups_rate = 30, max_startups = 3000

祝大家玩得开心，欢迎随时来 阿里云促膝长谈 业务需求 ，恭候光临。

阿里云的小伙伴们加油，努力做 最贴地气的云数据库 。