7.1. Starting and Stopping OpenSSH

Problem

You installed OpenSSH, and you configured it to start or not start at boot, according to your preference. Now, you want to know how to start and stop it manually, and how to get it to reread its configure file without restarting.

Solution

The answer, as usual, lies in /etc/init.d.

On Fedora, use these commands:

	# /etc/init.d/sshd {start|stop|restart|condrestart|reload|status}

On Debian systems, use these:

	# /etc/init.d/ssh {start|stop|reload|force-reload|restart}

If you elected to not have the SSH daemon run automatically after installing OpenSSH on Debian, you will need to rename or delete /etc/ssh/sshd_not_to_be_run before it will start up. Or, you can run dpkg-reconfigure ssh.

The OpenSSH configuration file, sshd.conf, must be present, or OpenSSH will not start.

Discussion

Port 22, the default SSH port, is a popular target for attack. The Internet is infested with automated attack kits that pummel away at random hosts. Check your firewall logs—you'll see all kinds of garbage trying to brute-force port 22. So, some admins prefer to start up the SSH daemon only when they know they'll need it. Some run it on a nonstandard port, which is configurable in /etc/ssh/ssh_config, for example:

	Port 2022

Check /etc/services to make sure you don't use an already-used port, and make an entry for any nonstandard ports you are using. Using a nonstandard port does not fool determined portscanners, but it will alleviate the pummeling a lot and lighten the load on your logfiles. A nice tool for heading off these attacks is the DenyHosts utility; see Recipe 7.15.

Red Hat's condrestart, or conditional restart, restarts a service only if it is already running. If it isn't, it fails silently.

The reload command tells the service to reread its configuration file, instead of completely shutting down and starting up again. This is a nice, nondisruptive way to activate changes.

If you like commands such as condrestart that are not included with your distribution, you may copy them from systems that use them and tweak them for your system. Init scripts are just shell scripts, so they are easy to customize.

See Also