8

How can I get the ssh server to re-read its configuration file (/etc/sshd_config), without killing existing ssh connections?

EDIT: If I run kill -HUP <SSHD_PID> I kill the connection.

  • Have you tried sending a hangup signal: kill -HUP <PID of sshd>? According to man sshd: sshd rereads its configuration file when it receives a hangup signal, SIGHUP. (You can find the PID of sshd with ps -ef|grep sshd. If there's more than one sshd process, send HUP to all of them.) – jaume Apr 12 '13 at 17:18
  • (see my latest edit) – kjo Apr 12 '13 at 17:37
  • 6
    Yes, you are right, if you HUP an sshd process that has an open connection, sshd terminates. However, sending a HUP signal to the main sshd, that is, the parent sshd that forks a new daemon for each incoming connection, will have the desired effect. On OS X, though, there's no main sshd: sshd is started by launchd through launchproxy with option -i, which tells sshd that it's run from inetd and started on demand, when launchd receives a request. With this setup, every SSH connection gets a freshly started sshd configured with the newest version of its config file. – jaume Apr 20 '13 at 19:03
5

sshd doesn't "re-read" it's configuration file, it restarts itself (refer to man sshd(8)), however, it shouldn't kill the child/connections if you sent the SIGHUP to the PARENT of them all. That is when you are talking about sshd that binds to port 22, as in the "usual" with Linux/FreeBSD/etc. [there are exceptions and sysadmin reasons why to follow the MacOSX type route]

HOWEVER MacOSX have launchd as the one that listens to and handles port 22 (from my 10.10.4 machine):

BlackYos:~ hvisage$ sudo lsof -i :22
Password:
COMMAND  PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
launchd    1    root   57u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)
launchd    1    root   58u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)
launchd    1    root   62u  IPv6 0xdb59a664c78cd671      0t0  TCP *:ssh (LISTEN)
launchd    1    root   66u  IPv4 0xdb59a664c78d2e21      0t0  TCP *:ssh (LISTEN)
launchd    1    root   67u  IPv6 0xdb59a664c78cd671      0t0  TCP *:ssh (LISTEN)
launchd    1    root   68u  IPv4 0xdb59a664c78d2e21      0t0  TCP *:ssh (LISTEN)
ssh     1262 hvisage    3u  IPv4 0xdb59a664e59313b1      0t0  TCP blackyos:51628->hvs:ssh (ESTABLISHED)
sshd    1272    root    4u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)
sshd    1272    root    5u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)
sshd    1274 hvisage    4u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)
sshd    1274 hvisage    5u  IPv4 0xdb59a664e4b34941      0t0  TCP blackyos:ssh->hvs:39093 (ESTABLISHED)

It is launchd that might need to be "restarted" on macosx, or told about different ports to listen on for sshd, as launchd will spawn a new sshd for each port 22 connection that comes in.

check the following:

BlackYos:~ hvisage$ sudo ps -ef |grep -i ssh
  501  1263     1   0  6:46PM ??         0:00.06 /usr/bin/ssh-agent -l
    0  1272     1   0  6:46PM ??         0:00.40 sshd: hvisage [priv]
  501  1274  1272   0  6:46PM ??         0:00.03 sshd: hvisage@ttys004
  501  1262   570   0  6:46PM ttys001    0:00.05 ssh -v hvs
  501  1303  1275   0  6:50PM ttys004    0:00.00 grep -i ssh
BlackYos:~ hvisage$

I've ssh'd to my router and back to demonstrate the issue, and you'll notice that the two processes are already "owned" by me. Compare this to a Linux system (my roouter) where you'll notice the third "real" sshd that is owned by root:

hvisage@hvs:~$ ps -ef |grep -i ssh
root      4053     1  0 Jul11 ?        00:04:22 /usr/sbin/sshguard -i /var/run/sshguard.pid -l /var/log/auth.log -w /etc/sshguard/whitelist -a 40 -p 420 -s 1200
root     16244 30219  0 18:46 ?        00:00:00 sshd: hvisage [priv]
hvisage  16249 16244  0 18:46 ?        00:00:00 sshd: hvisage@pts/0
hvisage  16563 16250  0 18:52 pts/0    00:00:00 grep -i ssh
root     30219     1  0 Aug09 ?        00:00:00 /usr/sbin/sshd
hvisage@hvs:~$
1

Following line checks the configuration first and gets the PID of the main process keeping all others (tested in Linux, zsh):

if /usr/sbin/sshd -t; then kill -HUP `ps aux | grep "/usr/sbin/sshd" | grep -v grep | awk '{ print $2 }'`; fi
  • Does NOT work on macOS... There is no sshd process. – Per Lundberg Dec 22 '17 at 14:39
-2

Simply:

~# kill -HUP $(pidof sshd)
  • Does NOT work on macOS... There is no sshd process. – Per Lundberg Dec 22 '17 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .