本文共 15770 字，大约阅读时间需要 52 分钟。
Linux sshd没有提供显示当前sshd的配置的接口，所以当我们需要了解它的配置时，怎么办呢？
另外我们还不知道sshd已经加载的配置文件名，这有从何下手呢？
本文将结合openssh的源码，给大家一种取得当前sshd配置的方法。
调用sshd进程，并且通过strace输出open file。
就可以从中得知sshd将要打开的配置文件。
# strace -e open -ostrace.out /usr/sbin/sshd
查看strace的结果
# cat strace.out open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libfipscheck.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libwrap.so.0", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libaudit.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libpam.so.0", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libcrypto.so.10", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libldap-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/liblber-2.4.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libutil.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libsasl2.so.3", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libssl3.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libsmime3.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libnss3.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libnssutil3.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libplds4.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libplc4.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libnspr4.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libfreebl3.so", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3open("/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3open("/proc/filesystems", O_RDONLY) = 3open("/etc/pki/tls/openssl.cnf", O_RDONLY) = 3open("/dev/null", O_RDWR) = 3open("/etc/ssh/sshd_config", O_RDONLY) = 3 // 找到你了open("/dev/urandom", O_RDONLY) = 3open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3open("/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3open("/etc/group", O_RDONLY|O_CLOEXEC) = 4open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_rsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_rsa_key.pub", O_RDONLY) = 3open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3open("/etc/group", O_RDONLY|O_CLOEXEC) = 4open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_ecdsa_key", O_RDONLY) = 3open("/etc/ssh/ssh_host_ecdsa_key.pub", O_RDONLY) = 3+++ exited with 0 +++ open("/etc/ssh/sshd_config", O_RDONLY) = 3 // 找到你了
注意，这是将要打开的，已经启动的sshd读过哪个配置文件，哪些配置，不得而知，那么怎么知道当前sshd的配置呢？
因为sshd没有提供接口，所以我们需要用gcore把进程的内存dump出来，到内存中查看它的配置。
# ps -ewf|grep sshdroot 25202 1 0 Jul21 ? 00:00:00 /usr/sbin/sshd -D
使用gcore 将pid的memory dump出来
# gcore 25202
使用gdb 分析
# gdb -core=core.25202 /usr/sbin/sshd
由于没有按照debuginfo包，会提示按照，否则没有符号表信息。
Missing separate debuginfos, use: debuginfo-install openssh-server-6.4p1-8.el7.x86_64
按照缺失的debuginfo包
# debuginfo-install openssh-server-6.4p1-8.el7.x86_64# gdb -core=core.25202 /usr/sbin/sshdMissing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.26-20.el7_2.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 nspr-4.10.6-1.el7_0.x86_64 nss-3.16.2-7.el7_0.x86_64 nss-softokn-freebl-3.16.2-2.el7_0.x86_64 nss-util-3.16.2-2.el7_0.x86_64 pcre-8.32-15.el7_2.1.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64# debuginfo-install cyrus-sasl-lib-2.1.26-20.el7_2.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 nspr-4.10.6-1.el7_0.x86_64 nss-3.16.2-7.el7_0.x86_64 nss-softokn-freebl-3.16.2-2.el7_0.x86_64 nss-util-3.16.2-2.el7_0.x86_64 pcre-8.32-15.el7_2.1.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64
重新gdb
# gdb -core=core.25202 /usr/sbin/sshd
那么我怎么知道配置对应的变量呢？
在这个openssh的源码文件中搜索到了 /etc/ssh/sshd_config 里的配置项 /usr/src/debug/openssh-6.4p1/servconf.c/* Initializes the server options to their default values. */voidinitialize_server_options(ServerOptions *options){ memset(options, 0, sizeof(*options)); /* Portable-specific options */ options->use_pam = -1; /* Standard Options */ options->num_ports = 0; options->ports_from_cmdline = 0; options->listen_addrs = NULL; options->address_family = -1; options->num_host_key_files = 0; options->num_host_cert_files = 0; options->host_key_agent = NULL; options->pid_file = NULL; options->server_key_bits = -1; options->login_grace_time = -1; options->key_regeneration_time = -1; options->permit_root_login = PERMIT_NOT_SET; options->ignore_rhosts = -1; options->ignore_user_known_hosts = -1; options->print_motd = -1; options->print_lastlog = -1; options->x11_forwarding = -1; options->x11_display_offset = -1; options->x11_use_localhost = -1; options->xauth_location = NULL; options->strict_modes = -1; options->tcp_keep_alive = -1; options->log_facility = SYSLOG_FACILITY_NOT_SET; options->log_level = SYSLOG_LEVEL_NOT_SET; options->rhosts_rsa_authentication = -1; options->hostbased_authentication = -1; options->hostbased_uses_name_from_packet_only = -1; options->rsa_authentication = -1; options->pubkey_authentication = -1; options->kerberos_authentication = -1; options->kerberos_or_local_passwd = -1; options->kerberos_ticket_cleanup = -1; options->kerberos_get_afs_token = -1; options->gss_authentication=-1; options->gss_keyex = -1; options->gss_cleanup_creds = -1; options->gss_strict_acceptor = -1; options->gss_store_rekey = -1; options->password_authentication = -1; options->kbd_interactive_authentication = -1; options->challenge_response_authentication = -1; options->permit_empty_passwd = -1; options->permit_user_env = -1; options->use_login = -1; options->compression = -1; options->rekey_limit = -1; options->rekey_interval = -1; options->allow_tcp_forwarding = -1; options->allow_agent_forwarding = -1; options->num_allow_users = 0; options->num_deny_users = 0; options->num_allow_groups = 0; options->num_deny_groups = 0; options->ciphers = NULL; options->macs = NULL; options->kex_algorithms = NULL; options->protocol = SSH_PROTO_UNKNOWN; options->gateway_ports = -1; options->num_subsystems = 0; options->max_startups_begin = -1; options->max_startups_rate = -1; options->max_startups = -1; options->max_authtries = -1; options->max_sessions = -1; options->banner = NULL; options->show_patchlevel = -1; options->use_dns = -1; options->client_alive_interval = -1; options->client_alive_count_max = -1; options->num_authkeys_files = 0; options->num_accept_env = 0; options->permit_tun = -1; options->num_permitted_opens = -1; options->adm_forced_command = NULL; options->chroot_directory = NULL; options->authorized_keys_command = NULL; options->authorized_keys_command_user = NULL; options->zero_knowledge_password_authentication = -1; options->revoked_keys_file = NULL; options->trusted_user_ca_keys = NULL; options->authorized_principals_file = NULL; options->ip_qos_interactive = -1; options->ip_qos_bulk = -1; options->version_addendum = NULL; options->use_kuserok = -1;} 所以要查看当前sshd进程的配置，打印options即可
# gdb -core=core.25202 /usr/sbin/sshd(gdb) print options$1 = {num_ports = 1, ports_from_cmdline = 0, ports = {22, 0 }, listen_addr = 0x0, listen_addrs = 0x7f1e39bcba40, address_family = 2, host_key_files = {0x7f1e39bcf760 "/etc/ssh/ssh_host_rsa_key", 0x7f1e39bcf790 "/etc/ssh/ssh_host_ecdsa_key", 0x0 }, num_host_key_files = 2, host_cert_files = {0x0 }, num_host_cert_files = 0, host_key_agent = 0x0, pid_file = 0x7f1e38e413c8 "/var/run/sshd.pid", server_key_bits = 1024, login_grace_time = 120, key_regeneration_time = 3600, permit_root_login = 3, ignore_rhosts = 1, ignore_user_known_hosts = 0, print_motd = 1, print_lastlog = 1, x11_forwarding = 1, x11_display_offset = 10, x11_use_localhost = 1, xauth_location = 0x7f1e38e413da "/usr/bin/xauth", strict_modes = 1, tcp_keep_alive = 1, ip_qos_interactive = 16, ip_qos_bulk = 8, ciphers = 0x0, macs = 0x0, kex_algorithms = 0x0, protocol = 4, gateway_ports = 0, log_facility = SYSLOG_FACILITY_LOCAL0, log_level = SYSLOG_LEVEL_INFO, rhosts_rsa_authentication = 0, hostbased_authentication = 0, hostbased_uses_name_from_packet_only = 0, rsa_authentication = 1, pubkey_authentication = 1, kerberos_authentication = 0, kerberos_or_local_passwd = 1, kerberos_ticket_cleanup = 1, kerberos_get_afs_token = 0, gss_authentication = 1, gss_keyex = 0, gss_cleanup_creds = 1, gss_strict_acceptor = 1, gss_store_rekey = 0, password_authentication = 1, kbd_interactive_authentication = 0, challenge_response_authentication = 0, zero_knowledge_password_authentication = 0, permit_empty_passwd = 0, permit_user_env = 0, use_login = 0, compression = 2, allow_tcp_forwarding = 3, allow_agent_forwarding = 1, num_allow_users = 0, allow_users = {0x0 }, num_deny_users = 0, deny_users = {0x0 }, num_allow_groups = 0, allow_groups = {0x0 }, num_deny_groups = 0, deny_groups = {0x0 }, num_subsystems = 1, subsystem_name = {0x7f1e39bcb9c0 "sftp", 0x0 }, subsystem_command = { 0x7f1e39bcb9e0 "/usr/libexec/openssh/sftp-server", 0x0 }, subsystem_args = {0x7f1e39bcba10 "/usr/libexec/openssh/sftp-server", 0x0 }, num_accept_env = 16, accept_env = {0x7f1e39bcf7e0 "LANG", 0x7f1e39bcb7e0 "LC_CTYPE", 0x7f1e39bcb800 "LC_NUMERIC", 0x7f1e39bcb820 "LC_TIME", 0x7f1e39bcb840 "LC_COLLATE", 0x7f1e39bcb860 "LC_MONETARY", 0x7f1e39bcb880 "LC_MESSAGES", 0x7f1e39bcb8a0 "LC_PAPER", 0x7f1e39bcb8c0 "LC_NAME", 0x7f1e39bcb8e0 "LC_ADDRESS", 0x7f1e39bcb900 "LC_TELEPHONE", 0x7f1e39bcb920 "LC_MEASUREMENT", 0x7f1e39bcb940 "LC_IDENTIFICATION", 0x7f1e39bcb960 "LC_ALL", 0x7f1e39bcb980 "LANGUAGE", 0x7f1e39bcb9a0 "XMODIFIERS", 0x0 }, max_startups_begin = 10, max_startups_rate = 30, max_startups = 100, max_authtries = 6, max_sessions = 10, banner = 0x0, show_patchlevel = 0, use_dns = 0, client_alive_interval = 0, client_alive_count_max = 3, num_authkeys_files = 1, authorized_keys_files = {0x7f1e39bcf7c0 ".ssh/authorized_keys", 0x0 }, adm_forced_command = 0x0, use_pam = 1, permit_tun = 0, num_permitted_opens = -1, use_kuserok = 1, chroot_directory = 0x0, revoked_keys_file = 0x0, trusted_user_ca_keys = 0x0, authorized_principals_file = 0x0, authorized_keys_command = 0x0, authorized_keys_command_user = 0x0, rekey_limit = 0, rekey_interval = 0, version_addendum = 0x7f1e39bcba90 "", num_auth_methods = 0, auth_methods = {0x0 }} 在这里我们看到了当前sshd进程的配置。
例如
max_startups_begin = 10, max_startups_rate = 30, max_startups = 100, max_authtries = 6, max_sessions = 10
我们看看修改配置后，重新dump看看是不是会发生变化
修改前面使用strace跟踪到的配置文件# vi /etc/ssh/sshd_configMaxStartups 1000:30:3000
检查配置文件是否正确
# sshd -T
使得配置文件生效
service sshd reloador kill -s SIGHUP $sshd_pid // 从man sshd中得到的 sshd can be configured using command-line options or a configuration file (by default sshd_config(5)); command-line options override values specified in the configuration file. sshd rereads its configuration file when it receives a hangup signal, SIGHUP, by executing itself with the name and options it was started with, e.g. /usr/sbin/sshd.我这里使用发信号的方式 kill -s SIGHUP 25202
重新gcore
# gcore 25202
分析
# gdb -core=core.25202 /usr/sbin/sshd(gdb) print options$1 = {num_ports = 1, ports_from_cmdline = 0, ports = {22, 0 }, listen_addr = 0x0, listen_addrs = 0x7f83e31d5a60, address_family = 2, host_key_files = {0x7f83e31d9770 "/etc/ssh/ssh_host_rsa_key", 0x7f83e31d97a0 "/etc/ssh/ssh_host_ecdsa_key", 0x0 }, num_host_key_files = 2, host_cert_files = {0x0 }, num_host_cert_files = 0, host_key_agent = 0x0, pid_file = 0x7f83e229c3c8 "/var/run/sshd.pid", server_key_bits = 1024, login_grace_time = 120, key_regeneration_time = 3600, permit_root_login = 3, ignore_rhosts = 1, ignore_user_known_hosts = 0, print_motd = 1, print_lastlog = 1, x11_forwarding = 1, x11_display_offset = 10, x11_use_localhost = 1, xauth_location = 0x7f83e229c3da "/usr/bin/xauth", strict_modes = 1, tcp_keep_alive = 1, ip_qos_interactive = 16, ip_qos_bulk = 8, ciphers = 0x0, macs = 0x0, kex_algorithms = 0x0, protocol = 4, gateway_ports = 0, log_facility = SYSLOG_FACILITY_LOCAL0, log_level = SYSLOG_LEVEL_INFO, rhosts_rsa_authentication = 0, hostbased_authentication = 0, hostbased_uses_name_from_packet_only = 0, rsa_authentication = 1, pubkey_authentication = 1, kerberos_authentication = 0, kerberos_or_local_passwd = 1, kerberos_ticket_cleanup = 1, kerberos_get_afs_token = 0, gss_authentication = 1, gss_keyex = 0, gss_cleanup_creds = 1, gss_strict_acceptor = 1, gss_store_rekey = 0, password_authentication = 1, kbd_interactive_authentication = 0, challenge_response_authentication = 0, zero_knowledge_password_authentication = 0, permit_empty_passwd = 0, permit_user_env = 0, use_login = 0, compression = 2, allow_tcp_forwarding = 3, allow_agent_forwarding = 1, num_allow_users = 0, allow_users = {0x0 }, num_deny_users = 0, deny_users = {0x0 }, num_allow_groups = 0, allow_groups = {0x0 }, num_deny_groups = 0, deny_groups = {0x0 }, num_subsystems = 1, subsystem_name = {0x7f83e31d59e0 "sftp", 0x0 }, subsystem_command = { 0x7f83e31d5a00 "/usr/libexec/openssh/sftp-server", 0x0 }, subsystem_args = {0x7f83e31d5a30 "/usr/libexec/openssh/sftp-server", 0x0 }, num_accept_env = 16, accept_env = {0x7f83e31d57e0 "LANG", 0x7f83e31d5800 "LC_CTYPE", 0x7f83e31d5820 "LC_NUMERIC", 0x7f83e31d5840 "LC_TIME", 0x7f83e31d5860 "LC_COLLATE", 0x7f83e31d5880 "LC_MONETARY", 0x7f83e31d58a0 "LC_MESSAGES", 0x7f83e31d58c0 "LC_PAPER", 0x7f83e31d58e0 "LC_NAME", 0x7f83e31d5900 "LC_ADDRESS", 0x7f83e31d5920 "LC_TELEPHONE", 0x7f83e31d5940 "LC_MEASUREMENT", 0x7f83e31d5960 "LC_IDENTIFICATION", 0x7f83e31d5980 "LC_ALL", 0x7f83e31d59a0 "LANGUAGE", 0x7f83e31d59c0 "XMODIFIERS", 0x0 }, max_startups_begin = 1000, max_startups_rate = 30, max_startups = 3000, max_authtries = 6, max_sessions = 10, banner = 0x0, show_patchlevel = 0, use_dns = 0, client_alive_interval = 0, client_alive_count_max = 3, num_authkeys_files = 1, authorized_keys_files = {0x7f83e31d97d0 ".ssh/authorized_keys", 0x0 }, adm_forced_command = 0x0, use_pam = 1, permit_tun = 0, num_permitted_opens = -1, use_kuserok = 1, chroot_directory = 0x0, revoked_keys_file = 0x0, trusted_user_ca_keys = 0x0, authorized_principals_file = 0x0, authorized_keys_command = 0x0, authorized_keys_command_user = 0x0, rekey_limit = 0, rekey_interval = 0, version_addendum = 0x7f83e31d5ab0 "", num_auth_methods = 0, auth_methods = {0x0 }} 可以看到刚才修改的配置已生效
max_startups_begin = 1000, max_startups_rate = 30, max_startups = 3000
祝大家玩得开心，欢迎随时来 阿里云促膝长谈 业务需求 ，恭候光临。
阿里云的小伙伴们加油，努力做 最贴地气的云数据库 。
转载地址：http://ciozx.baihongyu.com/