I had to change the IP address of a server, but now i can't ssh to it. if i do a ps aux|grep ssh all i get back is my grep command. any ideas?

/etc/ssh/sshd_config has the old IP!! do i even need ListenAddress configured really?

You dont really need it. Most daemons default to listen on all interfaces on all IP's if no special options is set. Thats the magic 0.0.0.0:number thing you'll see in the output of netstat -tulpn.

So in case you only have one IP address and one interface you don't need to set ListenAddress. But for the case where you have a gateway with two interfaces and two ip's you might want to only have ssh listen on the internal site to be more on the safe side.

1 members found this post helpful.

If ListenAddress isn't specified then sshd will listen on all available IPs. If your server only has one static IP address at a time it's unnecessary to specify it (you should be able to just comment the line out and leave it to this default behavior). Otherwise, you should specify it only if your goal is to restrict it to only one of the server's IP addresses (this would mainly be for security purposes). You can also explicitly set

if you want to just want to clarify the default behavior for your own reference. Whatever the case you can verify your configuration by checking

which for me shows that sshd listens on every IP I have (which happens to be just one). As a final note, I have a few tips to safely update sshd configuration you may find useful:

1. Before changing your sshd_config make sure to keep a read-only backup of the current working version:
   
   Code:

   cp sshd_config sshd_config.original
   chmod 400 sshd_config.original

2. Code:

   sshd -t

   this will test your sshd_config and report any errors it finds without actually launching the daemon
3. If you reload your sshd for a configuration update, stay logged in with that ssh session and try to open a fresh one to the same server before you exit the original session used to update the configuration
4. You can also write a script to reload the configuration and after a set amount of time, say 60 seconds, copy the working backup configuration and reload again in case you got locked out (this is especially useful for iptables updates). You can either run the script with
   Code:

   nohup /path/to/script.sh &

   or run it in screen/tmux.

1 members found this post helpful.

Thanks guys. I never actually configured that setting before, as most my servers just have one active NIC, and figured it was mostly to enhance security. Thanks for all the explanations, real helpful.