sysop@hub:~/tools/config-reviewer$
config-reviewer
Configuration files are inherited, copied from a tutorial, or written under time pressure, and then they run for years. Paste one here and get the risky lines pointed out: what the line allows, why that matters, and what to write instead. It reads the OpenSSH server configuration, nginx, and Docker Compose files. The text is read by your browser and never uploaded.
getting the file
| What | Best input | Why |
|---|---|---|
| OpenSSH server | sudo sshd -T, or the file /etc/ssh/sshd_config | sshd -T prints the settings really in force, with every included file and every default filled in. The plain file works too, and then the page tells you where it had to assume a default. |
| nginx | sudo nginx -T, or one file from sites-enabled or conf.d | nginx -T prints the main file and all included ones in one piece. A single server block or a few locations work as well, with fewer checks. |
| Docker Compose | docker-compose.yml or compose.yaml | Paste the file as it is. Passwords the page finds are masked in the result and in the report. |
what it checks
| File | Looks for |
|---|---|
| sshd_config | Passwords accepted, by a line or by default. Direct root sign-in. Empty passwords. Passwords that still work through keyboard-interactive. Host-based trust and .rhosts. Permission checks switched off. Outdated ciphers, MACs and key exchange. A keyword set twice, where the second line has no effect. Exceptions in Match blocks. No AllowUsers or AllowGroups. Logging switched off. Obsolete and unknown keywords. |
| nginx | Old TLS versions and broken ciphers. Sites and password prompts without encryption. An alias that lets requests climb out of its folder. PHP locations that run uploaded files. $uri in redirects and headers. A proxy target taken from the request. add_header in a location that drops the headers from above. Directory listings, open status pages, hidden files such as .git and .env. Workers running as root. Missing security headers, missing proxy headers, no default server, the version in the Server header. |
| Docker Compose | Privileged containers. The Docker socket mounted into a container. System folders of the host mounted. Host network, process and IPC namespaces. Far-reaching capabilities, seccomp and AppArmor switched off. Database and admin ports published on every interface. Passwords in the file, and guessable ones. Databases without a password. Images without a fixed version. Hardening options that are not used. |
The page reads a file, it does not test a server. It cannot see included files, what a variable is filled with, or what the firewall in front allows. The readers for nginx and YAML were written for this page and cover the usual syntax, not every corner of it: YAML anchors are not expanded. Where a line is missing, the default of the current upstream version is assumed, and your distribution may differ. Treat the result as a second pair of eyes, and test every change before you close your session: sshd -t, nginx -t, docker compose config. Related: SSH cheat sheet, nginx and Apache cheat sheet, Docker cheat sheet, firewall rule reviewer, server hardening checklist.