3 ms·
Also: processes / running programs should provide a straightforward way to show their configuration. While "sshd -T" shows the effective configuration from all
by Eduard 3y ago
Also: processes / running programs should provide a straightforward way to show their configuration.
While "sshd -T" shows the effective configuration from all configuration file parsing, there is no straightforward way to see the configuration of the/a currently running sshd process.
This has footgun potential, as someone could think their sshd is secured and hardened by checking with "sshd -T", while the actually running sshd process still uses old configurations.
Apache also makes it needlessly hard to find out its effective (and active / currently running) configuration. I don't know of any better way then awkwardly using mod_info ( https://httpd.apache.org/docs/2.4/mod/mod_info.html https://httpd.apache.org/docs/2.4/mod/mod_info.html ) to get such insights.
- mike_hock 3y agoNot sure I get the reasoning here. That requires you to actually go and proofread the configuration of each and every running process, at which point it's easier to just verify the effective configuration on disk and restart the service. SSH is a special case because it leaves active sessions alive when it restarts, but that doesn't generalize to other daemons. Just restart if in doubt.