CDIST-TYPE__SSHD_CONFIG(7)

📦
version 7.0.0 · 8 versions
, in fedora 43, fedora 44

💖 cdist-type__sshd_config — the manual page, but make it cute

okay bestie, so this is cdist-type__sshd_config, part of the cdist manuals (section 7, if you're keeping score 💅). It's the little type that goes in and manages options inside your sshd_config. sshd said "let me be configured" and this type said "say less" 🫶

✨ NAME ✨

cdist-type__sshd_config — manage options in sshd_config 🎀

🦋 DESCRIPTION 🦋

This space intentionally left blank.

no like. literally. that's the whole description. the vibes are immaculate, the words are zero. 💀

👑 REQUIRED PARAMETERS 👑

None. nope. nada. you need nothing to get started, she's low maintenance fr fr ✨

💅 OPTIONAL PARAMETERS 💅

  • file — the path to the sshd_config file you wanna edit. If you don't say anything, she just assumes /etc/ssh/sshd_config. default queen behavior 👑
  • match — restricts this option so it only applies to certain connections. whatever you're allowed to write after a Match keyword in sshd_config is fair game here, like --match 'User anoncvs'.

You can use this one multiple times, and here's the tea: all of the values get ANDed together. every single one. no skipping.

  • option — the name of the option you're manipulating. defaults to __object_id if you don't specify 🫶
  • state — can be either of these two besties:
    • present: make sure a matching config line is there (or the default value is).
    • absent: make sure no matching config line exists. bye bye 👋
  • value — the option's value that gets assigned to the option (when --state present) or removed (when --state absent).

This one is required if --state present. But if you leave it out and you're in --state absent, then all the values for that given option get removed. all of them. wiped. 💀

🌈 BOOLEAN PARAMETERS 🌈

None. no booleans here, we keep it simple ✨

🍓 EXAMPLES 🍓

okay this is the part you actually came for, let's go 🧚

# Disallow root logins with password
__sshd_config PermitRootLogin --value without-password

# Disallow password-based authentication
__sshd_config PasswordAuthentication --value no

# Accept the EDITOR environment variable
__sshd_config AcceptEnv:EDITOR --option AcceptEnv --value EDITOR

# Force command for connections as git user
__sshd_config git@ForceCommand --match 'User git' --option ForceCommand \
    --value 'cd ~git && exec git-shell ${SSH_ORIGINAL_COMMAND:+-c "${SSH_ORIGINAL_COMMAND}"}'

copy them, love them, run them 💖

🦋 SEE ALSO 🦋

sshd_config(5) — go read that one too, iykyk ✨

💀 BUGS 💀

ngl, there's some stuff you should know before you get got:

  • This type assumes a nicely formatted config file, meaning no config options spanning multiple lines. if your config is doing the absolute most, she's not gonna handle it 😭
  • Include directives are ignored. fully. don't come for her.
  • Config options are not added or removed to/from the config file if their value is the default value. if it's already default, she's like "you're fine bestie" and moves on.
  • The explorer will incorrectly report absent if OpenSSH internally transforms one value to another (for example, permitrootlogin prohibit-password gets transformed to permitrootlogin without-password). the workaround? use the value that OpenSSH uses internally. periodt. 💅

🫶 AUTHORS 🫶

Dennis Camera <dennis.camera--@--ssrq-sds-fds.ch> 👑

🎀 COPYING 🎀

Copyright (C) 2020 Dennis Camera. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ungleich GmbH 2021

okay that's the whole page bestie, you ate it up 💅✨ this was version 7.0.0, dated Jul 31, 2022, from the cdist manuals — now go forth and configure your sshd, you main character 🦋💜

📦 where this page comes from