recipe_ssh.ts

Build the hardened sshd_config drop-in text for options.

The hardened baseline: root login disabled, password + keyboard-interactive auth off, X11 forwarding off. Only AllowUsers and the tunables (max_auth_tries, login_grace_time) come from inputs. It leaves UsePAM to the distro: Debian's and Ubuntu's stock sshd_config sets it, and Alpine's sshd is built without PAM and warns on the keyword; with password and keyboard-interactive auth off, PAM authenticates nobody either way.

sshd keeps the first value it reads for most keywords, and the stock sshd_config includes sshd_config.d/*.conf in name order before its own lines. So name the drop-in to sort first (00-hardened.conf): a later drop-in, such as a cloud image's 50-cloud-init.conf setting PasswordAuthentication yes, then can't override it.

Build the verify payload that re-asserts the hardening in sshd's effective config for the allowed user on every plan, from the options ssh_hardening was given: root login, password auth, keyboard-interactive auth, and X11 forwarding off, AllowUsers the user and no one else, and the tunables at their values. Pass both the same options object.

sshd prints each keyword lowercase with its value, one AllowUsers entry per line and LoginGraceTime in seconds. Each assertion but one matches one whole line, fixed-string (grep -qxF), the expected line one single-quoted word, so a value is matched as text. sshd adds up AllowUsers across every file it reads, so a presence check would miss a user another drop-in allows: that one compares every allowusers line together with the one expected (test "$(…)" = '…').

It reads what sshd would run with, not the drop-in's bytes, so it catches a drop-in that sorts earlier and overrides the hardening, a hand edit, or a config that no longer parses. A failing check shows as a pending change and blocks zap deploy's preflight. Spread it into a zap.verify that depends on the ssh service.

The config is read for a connection, sshd -T -C user=<user>,host=…,addr=…,lport=22, so a Match block that applies to the allowed user (Match User, Match Group, Match All, an address list that holds every client) and re-enables password auth fails the verify; without -C, sshd prints only the global values. The client address is 192.0.2.1, a documentation address, so a Match Address block naming one real network (an office, a VPN) isn't exercised: the other users it could admit are refused by AllowUsers, but the allowed user from that network is not checked. Nor are Match LocalAddress and Match RDomain blocks: the connection names no local address or routing domain.

Build the sshd service payload: enabled, running, and reloaded when any of options.reload_on changes. The service name is the one distro-varying value; prefer the debian_ssh_service / alpine_ssh_service wrappers, which pass it.

zap's reload is systemctl try-reload-or-restart on systemd and rc-service --ifstarted <name> reload on OpenRC. Both distros' sshd reload runs sshd -t first and leaves the running sshd untouched when the config is invalid.

The drop-in file's validate command: sshd -t checks the whole config, drop-ins and the body of every Match block included, so a write sshd would reject is rolled back before the service reloads onto it. An unsupported keyword is a warning to it, not an error.

Options for ssh_hardening and ssh_hardening_verify.

user is the per-deploy variation (the account allowed to log in); max_auth_tries and login_grace_time default to the shared baseline.

The service fields the *_ssh_service recipes return (caller supplies id/name/depends_on).

Options for the distro *_ssh_service wrappers.