Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions promise-types/sshd/README.md
Original file line number Diff line number Diff line change
@@ -1,33 +1,37 @@
# `sshd` promise type

Configures sshd and restarts the service when configuration changes.

## Promiser

The sshd configuration keyword to manage (e.g. `PermitRootLogin`, `AllowUsers`).
Each promise manages a single directive in the drop-in config file.

## Attributes

- `value` (required) — the value for the directive, either a string or an slist

## What the module manages internally

1. **Include directive** — ensures the base `sshd_config` includes the drop-in directory (`sshd_config.d/`) as its first non-comment directive
2. **Drop-in directory** — creates the drop-in directory if it doesn't exist
3. **Drop-in file** — writes directives to `sshd_config.d/00-cfengine.conf`
4. **Service restart** — restarts sshd if configuration was changed and the service is already running
5. **Verification** — verifies the desired directive appears in the effective sshd config (`sshd -T`)

## Conflicting promisers

Having multiple promises with the same sshd keyword is not recommended.
In case of conflicting promisers, the agent will attempt to converge the correct state for each one in the order they are evaluated.
This means the last promise wins and determines the final value in the configuration file.
It will also cause multiple restarts of the sshd service, which may be disruptive.

## What the module does NOT do

- Install sshd — that is a `packages:` promise
- Ensure sshd is running — that is a `services:` promise
- Manage match blocks — those are a policy-level concern

## Policy

```cf3
bundle agent sshd_config
{
Expand Down
Loading