3 locations for SSHd configuration So I want to harden my SSH daemon when Remote Login is enabled.

So far I've found:


/private/etc/ssh/sshd_config
/System/Library/LaunchDaemons/ssh.plist -> protected by SIP
/etc/ssh/sshd_config


Why are there 3 locations, and what is the difference?
If you look at the specific files you'll see that there are actually only two files (/etc/ssh/sshd_config and /private/etc/ssh/sshd_config is the same file unless your setup is non-standard).


/System/Library/LaunchDaemons/ssh.plist is used by the system to start sshd, usually you don't need to change this
/private/etc/ssh/sshd_config is the global configuration file for sshd, and the place where you need to change whatever is required to harden SSH on your Mac.