SSH Daemon Config Invalid: Fix in 30 Seconds to 15 Minutes

What Happened and Why

You tried to restart SSH, and got something like this:

systemctl restart sshd
Job for sshd.service failed because the control process exited with error code.

Or maybe you saw this in the logs:

sshd: fatal: /etc/ssh/sshd_config line 42: Bad configuration option

This happens when you edit /etc/ssh/sshd_config, make a typo, or use an option your version of OpenSSH doesn't understand. I've seen this a hundred times—usually someone copied a config from an old server or a different OS version.

The fix is almost always in the config file itself. Let me walk you through it, from the fastest check to the full rebuild.

Simplest Fix (30 Seconds) — Syntax Check

Before you do anything else, run this command:

sudo sshd -t

This checks your config file for errors without starting the service. After you run it, you'll see one of two things:

• Nothing — no output at all. That means the config is fine. Your issue is something else (maybe a port conflict or SELinux).
• An error message — like /etc/ssh/sshd_config line 42: Bad configuration option. That tells you exactly where the problem is.

If you get an error, open the config file:

sudo nano /etc/ssh/sshd_config

Go to the line number it mentioned. Look for typos—common ones are PermitRootLogin misspelled as PermitRootLogin (missing 't'), or PubkeyAuthentication instead of PubkeyAuthentication. Also look for options your version doesn't support, like UsePrivilegeSeparation in newer OpenSSH (it's been removed).

Fix the line, save the file, then run sudo sshd -t again. If it's clean, restart the service:

sudo systemctl restart sshd

If the service starts, you're done. If not, move to the next step.

Moderate Fix (5 Minutes) — Find the Bad Line

Maybe the error message wasn't clear, or the line number doesn't match what you see. Here's what I do: I copy the output of sudo sshd -t and check each option manually.

First, let's see which options are valid for your version:

sshd -T | head -50

This dumps all currently active options. Compare them to your config. If you see something in the config that's not in this list, that's your problem.

Another trick: comment out half the config. Backup first:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Then comment out all lines that aren't comments. Use # at the start of each line. Then run:

sudo sshd -t

If it passes, uncomment half the lines and test again. Repeat until you find the bad line. This is called binary search, and it works fast because you cut the search space in half each time.

Once you find the bad line, fix it or remove it. Then restart SSH.

Advanced Fix (15+ Minutes) — Rebuild the Config from Scratch

If nothing above works, or you have so many options that hunting them down takes forever, start fresh. Here's how I do it.

First, check the default config that came with your system:

cat /etc/ssh/sshd_config.dpkg-dist   # Debian/Ubuntu
cat /etc/ssh/sshd_config.rpmnew     # RHEL/CentOS

If neither exists, you can generate a minimal one:

sudo sshd -T 2>/dev/null | grep -E '^(port|protocol|permit|listen|hostkey|password)' | head -20

This gives you the active settings your daemon is actually using. But to rebuild the config file properly, do this:

1. Backup your current config: sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.old
2. Create a new empty file: sudo touch /etc/ssh/sshd_config
3. Open it in an editor: sudo nano /etc/ssh/sshd_config
4. Paste in the defaults below. These work on Ubuntu 22.04, Debian 12, RHEL 9, and most modern distros:

# Minimal default config
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 2048
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin prohibit-password
StrictModes yes
MaxAuthTries 3
MaxSessions 3
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding no
PrintMotd no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

Save the file. Then test it:

sudo sshd -t

If it passes, restart SSH:

sudo systemctl restart sshd

Now you need to add back any custom settings you need. Only add them one at a time, testing each after adding. Common additions:

• AllowUsers — to restrict which users can log in
• Match User — for per-user rules
• ClientAliveInterval — to drop idle connections

The key is: add one, test, restart, test login. If it breaks, you know exactly which option caused it.

One More Thing — Wrong File Ownership

I've seen cases where the config was fine, but the file permissions were wrong. SSH is picky about this. Run:

sudo chown root:root /etc/ssh/sshd_config
sudo chmod 600 /etc/ssh/sshd_config
sudo sshd -t

If permissions were the issue, this fixes it immediately.

Real-world trigger: This happens most often when you copy an sshd_config from a FreeBSD server to Ubuntu. FreeBSD uses different option names like PermitRootLogin yes (works) vs PermitRootLogin without-password (same meaning, but older format). Your distro's man page is your friend: man sshd_config.

That's it. Start with the 30-second syntax check. If that doesn't reveal it, do the binary search. If you're still stuck, rebuild from scratch. In 15 years of doing this, I've never seen a case where these three steps didn't fix it.