{
  "api": "v1",
  "kind": "static",
  "name": "envsh",
  "version": "2.4.0",
  "updated": "2026-10-12",
  "count": 16,
  "snippets": [
    {
      "slug": "vps-preflight",
      "title": "Know your server before changing it",
      "titleZh": "动手之前，先看一眼服务器",
      "description": "Inspect the distribution, kernel, memory, and disk without changing the system.",
      "descriptionZh": "只读查看系统版本、内核、内存和磁盘，先确认自己连对了机器。",
      "category": "commands",
      "tags": [
        "linux",
        "vps",
        "system",
        "disk"
      ],
      "updated": "2026-10-30",
      "order": 0,
      "command": "hostname\ncat /etc/os-release\nuname -r\nfree -h\ndf -h /",
      "why": "A few read-only commands give you context for every next decision. Check the host and available resources before following any installation recipe.",
      "whyZh": "先确认主机和资源，再判断后面的方案适不适合。系统版本、可用内存和磁盘空间，比一份通用优化清单更有用。",
      "steps": [
        {
          "title": "Identify the host and distribution",
          "titleZh": "确认主机和发行版",
          "command": "hostname\ncat /etc/os-release\nuname -r",
          "risk": "safe"
        },
        {
          "title": "Check memory and free disk space",
          "titleZh": "查看内存和磁盘余量",
          "command": "free -h\ndf -h /",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/vps-preflight/"
    },
    {
      "slug": "service-health",
      "title": "Check services and listening ports",
      "titleZh": "看看服务有没有正常运行",
      "description": "List failed systemd units, listening ports, and recent errors.",
      "descriptionZh": "列出失败的 systemd 服务、监听端口和本次启动的错误日志。",
      "category": "commands",
      "tags": [
        "systemd",
        "ports",
        "logs",
        "linux"
      ],
      "updated": "2026-10-30",
      "order": 5,
      "command": "systemctl --failed --no-pager\nsudo ss -lntp\nsudo journalctl -p err -b -n 30 --no-pager",
      "why": "Look at actual service state before restarting things. A port conflict or a clear error log often explains a failed deployment.",
      "whyZh": "先看实际状态，再决定要不要重启。端口冲突和明确的错误日志，通常比盲目重装更能说明问题。",
      "steps": [
        {
          "title": "Find failed services",
          "titleZh": "找出失败的服务",
          "command": "systemctl --failed --no-pager",
          "risk": "safe"
        },
        {
          "title": "Inspect TCP listeners",
          "titleZh": "查看 TCP 监听端口",
          "command": "sudo ss -lntp",
          "risk": "safe"
        },
        {
          "title": "Read recent boot errors",
          "titleZh": "读取本次启动的错误",
          "command": "sudo journalctl -p err -b -n 30 --no-pager",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/service-health/"
    },
    {
      "slug": "port-unreachable",
      "title": "A port you cannot reach from outside",
      "titleZh": "端口从外面连不上",
      "description": "Check the listener, the bind address, UFW, Docker, and the cloud security group, in that order.",
      "descriptionZh": "按顺序检查：有没有在监听、监听在哪个地址、UFW、Docker，最后是云安全组。",
      "category": "commands",
      "tags": [
        "ports",
        "firewall",
        "ufw",
        "firewalld",
        "docker"
      ],
      "updated": "2026-10-30",
      "order": 6,
      "command": "PORT=25774\nss -lntp | grep \":$PORT \"\ncurl -sS -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:$PORT\"\ndocker ps --format 'table {{.Names}}\\t{{.Ports}}'\nif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then firewall-cmd --list-all; elif command -v ufw >/dev/null 2>&1; then ufw status verbose; else echo \"no host firewall tool active\"; fi",
      "why": "Most \"port not open\" problems are one of four layers: nothing listening, listening only on 127.0.0.1, a host firewall, or the provider security group. Check from the inside out so each step rules out one layer.",
      "whyZh": "“端口不通”几乎都出在这四层之一：没在监听、只监听 127.0.0.1、主机防火墙、云厂商安全组。从里往外查，每一步排除一层。",
      "steps": [
        {
          "title": "Is anything listening, and on which address?",
          "titleZh": "有没有在监听？监听在哪个地址？",
          "command": "PORT=25774\nss -lntp | grep \":$PORT \"",
          "risk": "safe"
        },
        {
          "title": "Does it answer locally?",
          "titleZh": "本机能访问吗？",
          "command": "curl -sS -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:$PORT\"",
          "risk": "safe"
        },
        {
          "title": "Container port mapping",
          "titleZh": "容器端口映射",
          "command": "docker ps --format 'table {{.Names}}\\t{{.Ports}}'",
          "risk": "safe"
        },
        {
          "title": "Host firewall",
          "titleZh": "主机防火墙",
          "command": "if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then firewall-cmd --list-all; elif command -v ufw >/dev/null 2>&1; then ufw status verbose; else echo \"no host firewall tool active\"; fi",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/port-unreachable/"
    },
    {
      "slug": "disk-full",
      "title": "The disk is full",
      "titleZh": "磁盘满了",
      "description": "Find what takes the space, then clear logs, apt caches, and unused Docker images.",
      "descriptionZh": "先找出谁占了空间，再清理日志、apt 缓存和不用的 Docker 镜像。",
      "category": "commands",
      "tags": [
        "disk",
        "docker",
        "logs",
        "linux"
      ],
      "updated": "2026-10-30",
      "order": 7,
      "command": "df -h /\ndu -xh / --max-depth=2 2>/dev/null | sort -h | tail -n 15\njournalctl --disk-usage\ndocker system df\njournalctl --vacuum-size=200M\napt-get clean\ndocker image prune -a\ndocker builder prune",
      "why": "On small VPS disks the usual culprits are the systemd journal, Docker images and build cache, and container logs. Measure first so you only remove what is actually large.",
      "whyZh": "小硬盘 VPS 上常见的元凶是 systemd 日志、Docker 镜像和构建缓存、容器日志。先量一量，只清真正大的。",
      "steps": [
        {
          "title": "Which directories are largest",
          "titleZh": "哪些目录最大",
          "command": "df -h /\ndu -xh / --max-depth=2 2>/dev/null | sort -h | tail -n 15",
          "risk": "safe"
        },
        {
          "title": "Journal and Docker usage",
          "titleZh": "日志和 Docker 占用",
          "command": "journalctl --disk-usage\ndocker system df",
          "risk": "safe"
        },
        {
          "title": "Shrink the journal and apt cache",
          "titleZh": "压缩日志、清 apt 缓存",
          "command": "journalctl --vacuum-size=200M\napt-get clean",
          "risk": "caution"
        },
        {
          "title": "Remove unused Docker data",
          "titleZh": "清理不用的 Docker 数据",
          "command": "docker image prune -a\ndocker builder prune",
          "risk": "caution"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/disk-full/"
    },
    {
      "slug": "container-logs",
      "title": "Where a service writes its logs",
      "titleZh": "服务日志在哪看",
      "description": "Read logs for containers and systemd services, and follow them live.",
      "descriptionZh": "查看容器和 systemd 服务的日志，并实时跟踪。",
      "category": "commands",
      "tags": [
        "logs",
        "docker",
        "systemd"
      ],
      "updated": "2026-10-30",
      "order": 8,
      "command": "docker ps -a --format 'table {{.Names}}\\t{{.Status}}'\ndocker logs --tail 100 komari\njournalctl -u ssh -n 50 --no-pager",
      "why": "Containers log to Docker, system services log to the journal. Knowing which one to ask saves guessing, and the first error line usually names the cause.",
      "whyZh": "容器的日志在 Docker 里，系统服务的日志在 journal 里。找对地方就不用猜，第一条报错通常就说明了原因。",
      "steps": [
        {
          "title": "All containers, including stopped ones",
          "titleZh": "列出所有容器（含已停止）",
          "command": "docker ps -a --format 'table {{.Names}}\\t{{.Status}}'",
          "risk": "safe"
        },
        {
          "title": "Recent container logs",
          "titleZh": "容器最近的日志",
          "command": "docker logs --tail 100 komari",
          "risk": "safe"
        },
        {
          "title": "Logs for a systemd service",
          "titleZh": "systemd 服务的日志",
          "command": "journalctl -u ssh -n 50 --no-pager",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/container-logs/"
    },
    {
      "slug": "cert-failed",
      "title": "Why a certificate request fails",
      "titleZh": "证书申请失败排查",
      "description": "Check DNS, port 80 reachability, and CDN proxying before retrying a Let’s Encrypt request.",
      "descriptionZh": "重试 Let’s Encrypt 之前，先查 DNS、80 端口是否可达，以及 CDN 代理。",
      "category": "commands",
      "tags": [
        "https",
        "dns",
        "ports",
        "nginx"
      ],
      "updated": "2026-10-30",
      "order": 9,
      "command": "DOMAIN=example.com\ndig +short A \"$DOMAIN\"\ncurl -4 -s https://api.ipify.org; echo\nss -lntp | grep -E ':(80|443) '\ncurl -sI \"http://$DOMAIN/\" | head -n 1",
      "why": "The default HTTP-01 challenge asks Let’s Encrypt to fetch a file from http://YOUR_DOMAIN/ on port 80. It fails when DNS points elsewhere, port 80 is blocked, or a CDN answers instead of your server.",
      "whyZh": "默认的 HTTP-01 验证会让 Let’s Encrypt 从 80 端口访问 http://你的域名/。DNS 指向别处、80 端口被挡、或 CDN 代替你的服务器应答时，都会失败。",
      "steps": [
        {
          "title": "Does DNS point to this server?",
          "titleZh": "DNS 指向这台服务器了吗？",
          "command": "DOMAIN=example.com\ndig +short A \"$DOMAIN\"\ncurl -4 -s https://api.ipify.org; echo",
          "risk": "safe"
        },
        {
          "title": "Is port 80 served by the proxy?",
          "titleZh": "80 端口由反向代理接管了吗？",
          "command": "ss -lntp | grep -E ':(80|443) '\ncurl -sI \"http://$DOMAIN/\" | head -n 1",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/cert-failed/"
    },
    {
      "slug": "nala-fetch",
      "title": "Let nala rank apt mirrors",
      "titleZh": "用 nala 给 apt 镜像测速",
      "description": "Interactive nala command that ranks apt mirrors before you confirm a change.",
      "descriptionZh": "用 nala 给 apt 镜像测速；你确认之后才会改源。",
      "category": "commands",
      "tags": [
        "nala",
        "apt",
        "mirror"
      ],
      "updated": "2026-10-28",
      "order": 10,
      "command": "nala fetch",
      "why": "Prefer an interactive rank over a silent mirror rewrite. You see the numbers before apt sources change. Third-party “one-click mirror” scripts stay optional and off by default on this site.",
      "whyZh": "宁可交互测速，也不要静默改源。你先看到数字，再动 apt。本站默认不打开第三方「一键换源」脚本。",
      "steps": [
        {
          "title": "Rank mirrors and pick one",
          "titleZh": "测速并选择镜像",
          "command": "nala fetch",
          "risk": "caution"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/nala-fetch/"
    },
    {
      "slug": "chattr-resolv",
      "title": "Stop cloud-init from rewriting resolv.conf",
      "titleZh": "锁住 resolv.conf",
      "description": "Write resolvers, then make resolv.conf immutable so DHCP cannot overwrite them.",
      "descriptionZh": "写入 DNS，再用 chattr 锁住 resolv.conf，避免被 DHCP 盖掉。",
      "category": "commands",
      "tags": [
        "dns",
        "chattr",
        "resolv.conf"
      ],
      "updated": "2026-10-28",
      "order": 20,
      "command": "readlink -f /etc/resolv.conf\nsystemctl is-active systemd-resolved\nprintf '%s\\n' 'nameserver 1.1.1.1' 'nameserver 1.0.0.1' | tee /etc/resolv.conf\nchattr +i /etc/resolv.conf",
      "why": "Locking resolv.conf is a last resort on cloud images that keep stomping DNS. It is not the default advice: immutable files surprise the next person who edits the box. Write first, lock only when the rewrite already bit you.",
      "whyZh": "锁 resolv.conf 是云镜像反复盖 DNS 时的下策，不是默认建议。不可变文件会坑到下一个改机器的人。先写进去；真被盖掉了再锁。",
      "steps": [
        {
          "title": "Check who manages resolv.conf first",
          "titleZh": "先看 resolv.conf 归谁管",
          "command": "readlink -f /etc/resolv.conf\nsystemctl is-active systemd-resolved",
          "risk": "safe"
        },
        {
          "title": "Write Cloudflare resolvers",
          "titleZh": "写入 Cloudflare DNS",
          "command": "printf '%s\\n' 'nameserver 1.1.1.1' 'nameserver 1.0.0.1' | tee /etc/resolv.conf",
          "risk": "caution"
        },
        {
          "title": "Make the file immutable",
          "titleZh": "设成不可变",
          "command": "chattr +i /etc/resolv.conf",
          "risk": "caution"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/chattr-resolv/"
    },
    {
      "slug": "xanmod-psabi",
      "title": "See the CPU x86-64-v level",
      "titleZh": "查看 CPU 的 x86-64-v 级别",
      "description": "Download, inspect, and run the upstream CPU check before choosing a supported kernel package.",
      "descriptionZh": "下载、审阅并运行上游 CPU 检测，再选择受支持的内核包。",
      "category": "commands",
      "tags": [
        "xanmod",
        "bbr",
        "cpu"
      ],
      "updated": "2026-10-30",
      "order": 30,
      "command": "wget -qO check_x86-64_psabi.sh https://dl.xanmod.org/check_x86-64_psabi.sh\nless check_x86-64_psabi.sh\nchmod +x check_x86-64_psabi.sh\n./check_x86-64_psabi.sh || true",
      "why": "XanMod is optional. Check the CPU level before you touch a kernel package. Guessing v3 on a v2 host wastes a reboot; this site refuses to install a kernel from a field-note page.",
      "whyZh": "XanMod 是可选项。动内核包之前先看 CPU 级别。v2 机器猜成 v3 等于白重启一次；现场笔记页不会替你装内核。",
      "steps": [
        {
          "title": "Download the check script",
          "titleZh": "下载检测脚本",
          "command": "wget -qO check_x86-64_psabi.sh https://dl.xanmod.org/check_x86-64_psabi.sh",
          "risk": "caution"
        },
        {
          "title": "Review the downloaded script",
          "titleZh": "先审阅下载的脚本",
          "command": "less check_x86-64_psabi.sh",
          "risk": "safe"
        },
        {
          "title": "Make it executable",
          "titleZh": "加上执行权限",
          "command": "chmod +x check_x86-64_psabi.sh",
          "risk": "caution"
        },
        {
          "title": "Print the x86-64-v level",
          "titleZh": "打印 x86-64-v 级别",
          "command": "./check_x86-64_psabi.sh || true",
          "risk": "caution"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/xanmod-psabi/"
    },
    {
      "slug": "bbr-name",
      "title": "BBRv3 still reports bbr",
      "titleZh": "BBRv3 的名字仍是 bbr",
      "description": "Inspect kernel and congestion control; the name bbr alone does not identify its version.",
      "descriptionZh": "查看内核和拥塞控制；仅凭 bbr 这个名字无法确认算法版本。",
      "category": "commands",
      "tags": [
        "bbr",
        "xanmod",
        "sysctl"
      ],
      "updated": "2026-10-30",
      "order": 40,
      "command": "uname -r\nsysctl net.ipv4.tcp_congestion_control",
      "why": "The congestion control name does not encode a version. XanMod currently documents BBRv3, but the running kernel and its exact release determine what your server uses.",
      "whyZh": "拥塞控制名称没有编码版本号。XanMod 当前文档列出 BBRv3，但仍须以机器实际运行的内核及其版本为准。",
      "steps": [
        {
          "title": "Show the running kernel",
          "titleZh": "查看当前内核",
          "command": "uname -r",
          "risk": "safe"
        },
        {
          "title": "Show TCP congestion control",
          "titleZh": "查看拥塞控制算法",
          "command": "sysctl net.ipv4.tcp_congestion_control",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/bbr-name/"
    },
    {
      "slug": "cscli-decisions",
      "title": "List CrowdSec bans",
      "titleZh": "查看 CrowdSec 的封禁",
      "description": "Read-only CrowdSec decisions and metrics without inserting a ban.",
      "descriptionZh": "只读查看 CrowdSec 封禁与指标，不会新增封禁。",
      "category": "commands",
      "tags": [
        "crowdsec",
        "cscli"
      ],
      "updated": "2026-10-28",
      "order": 50,
      "command": "cscli decisions list\ncscli metrics",
      "why": "Verification before mutation. After harden, prove the stack is awake with read-only cscli before you add collections or bans by hand.",
      "whyZh": "先验证，再改动。加固之后用只读的 cscli 确认栈是醒的，再考虑手工加 collection 或封禁。",
      "steps": [
        {
          "title": "List current decisions",
          "titleZh": "列出当前封禁",
          "command": "cscli decisions list",
          "risk": "safe"
        },
        {
          "title": "Show CrowdSec metrics",
          "titleZh": "查看 CrowdSec 指标",
          "command": "cscli metrics",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/cscli-decisions/"
    },
    {
      "slug": "crowdsec-8080",
      "title": "Find who holds port 8080",
      "titleZh": "看谁占用了 8080",
      "description": "Find the process listening on 8080 when CrowdSec local API cannot start.",
      "descriptionZh": "CrowdSec 本地 API 起不来时，先查谁占着 8080。",
      "category": "commands",
      "tags": [
        "crowdsec",
        "8080",
        "ss"
      ],
      "updated": "2026-10-28",
      "order": 60,
      "command": "ss -lptn 'sport = :8080'",
      "why": "CrowdSec failing on a fresh box is often “something else already owns 8080”, not a bad install. Look with ss before you rewrite three YAML files.",
      "whyZh": "新机器上 CrowdSec 起不来，常见是 8080 已被占用，不是安装坏了。先用 ss 看，再去改三处 YAML。",
      "steps": [
        {
          "title": "List listeners on port 8080",
          "titleZh": "列出占用 8080 的进程",
          "command": "ss -lptn 'sport = :8080'",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/crowdsec-8080/"
    },
    {
      "slug": "cloud-kernel-package",
      "title": "Cloud kernel and generic kernel package names",
      "titleZh": "cloud 内核和普通内核的包名",
      "description": "List installed linux-image packages to compare cloud and generic metapackages.",
      "descriptionZh": "列出已装的 linux-image 包，对照 cloud 与普通元包名。",
      "category": "commands",
      "tags": [
        "debian",
        "grub",
        "cloud",
        "kernel"
      ],
      "updated": "2026-10-28",
      "order": 70,
      "command": "dpkg -l 'linux-image-*' | awk '/^ii/{print $2}'",
      "why": "Cloud vs generic is easy to confuse in reinstall flags. Read what dpkg already installed before you pass --no-cloud-kernel or chase the wrong metapackage.",
      "whyZh": "重装参数里 cloud 和普通内核很容易混。先看 dpkg 已经装了什么，再决定要不要 --no-cloud-kernel，别追错元包。",
      "steps": [
        {
          "title": "List installed linux-image packages",
          "titleZh": "列出已安装的 linux-image 包",
          "command": "dpkg -l 'linux-image-*' | awk '/^ii/{print $2}'",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/cloud-kernel-package/"
    },
    {
      "slug": "reinstall-reset",
      "title": "Cancel a reinstall before reboot",
      "titleZh": "重启前取消重装",
      "description": "Cancel a pending bin456789/reinstall before the machine reboots and erases the disk.",
      "descriptionZh": "机器重启清空磁盘之前，取消尚未开始的 reinstall。",
      "category": "commands",
      "tags": [
        "reinstall",
        "dd",
        "reset"
      ],
      "updated": "2026-10-28",
      "order": 80,
      "command": "bash reinstall.sh reset",
      "why": "The only undo that matters is before reboot. This page exists so panic has one short command, not a forum thread. After reboot, stop looking for magic—the disk is gone.",
      "whyZh": "唯一有用的撤销在重启前。这一页就是给慌张时一条短命令，不是论坛长帖。重启之后别找奇迹——盘已经没了。",
      "steps": [
        {
          "title": "Cancel the pending reinstall",
          "titleZh": "取消尚未开始的重装",
          "command": "bash reinstall.sh reset",
          "risk": "caution"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/reinstall-reset/"
    },
    {
      "slug": "fail2ban-or-bouncer",
      "title": "Fail2ban and the CrowdSec bouncer",
      "titleZh": "Fail2ban 和 CrowdSec bouncer",
      "description": "Check whether Fail2ban is active before you add the CrowdSec firewall bouncer.",
      "descriptionZh": "加 CrowdSec 防火墙 bouncer 之前，先看 Fail2ban 是否在跑。",
      "category": "commands",
      "tags": [
        "fail2ban",
        "crowdsec",
        "iptables"
      ],
      "updated": "2026-10-28",
      "order": 90,
      "command": "systemctl is-active fail2ban || true\n# nala remove -y fail2ban",
      "why": "Pick one ban writer. EnvSH prefers CrowdSec when you are starting fresh; if Fail2ban is already healthy, keep it and skip the bouncer. The remove line stays commented on purpose.",
      "whyZh": "封禁写入方只留一个。新机器本站倾向 CrowdSec；若 Fail2ban 已经稳，就留它、别再装 bouncer。卸载那一行故意保持注释。",
      "steps": [
        {
          "title": "Check Fail2ban service state",
          "titleZh": "查看 Fail2ban 服务状态",
          "command": "systemctl is-active fail2ban || true",
          "risk": "safe"
        },
        {
          "title": "Optional remove line stays commented",
          "titleZh": "可选卸载行保持注释",
          "command": "# nala remove -y fail2ban",
          "risk": "destructive"
        }
      ],
      "risk": "caution",
      "url": "https://envsh.com/commands/fail2ban-or-bouncer/"
    },
    {
      "slug": "sshd-config-d",
      "title": "The SSH port that actually wins",
      "titleZh": "真正生效的 SSH 端口",
      "description": "Find every Port line under sshd_config and sshd_config.d before you reload ssh.",
      "descriptionZh": "重载 ssh 前，先找出 sshd_config 与 sshd_config.d 里真正生效的 Port。",
      "category": "commands",
      "tags": [
        "ssh",
        "sshd",
        "port"
      ],
      "updated": "2026-10-30",
      "order": 100,
      "command": "grep -R -n -E '^\\s*Port\\s+' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/\nsudo /usr/sbin/sshd -T | grep '^port '\nsudo ss -lntp",
      "why": "Include directives and service startup options affect the configuration. Port permits multiple values, so do not assume a drop-in simply overrides the main file. Compare the effective configuration with actual listeners.",
      "whyZh": "Include 和服务启动参数都会影响配置。Port 可以设置多次，不能笼统地说 drop-in 一定覆盖主文件。先看有效配置，再核对实际监听。",
      "steps": [
        {
          "title": "Search Port lines in sshd drop-ins",
          "titleZh": "搜索 sshd 配置里的 Port",
          "command": "grep -R -n -E '^\\s*Port\\s+' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/",
          "risk": "safe"
        },
        {
          "title": "Inspect effective configuration and actual listeners",
          "titleZh": "核对有效配置和实际监听",
          "command": "sudo /usr/sbin/sshd -T | grep '^port '\nsudo ss -lntp",
          "risk": "safe"
        }
      ],
      "risk": "safe",
      "url": "https://envsh.com/commands/sshd-config-d/"
    }
  ]
}