File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 33Configures sshd and restarts the service when configuration changes.
44
55## Promiser
6+
67The sshd configuration keyword to manage (e.g. ` PermitRootLogin ` , ` AllowUsers ` ).
78Each promise manages a single directive in the drop-in config file.
89
910## Attributes
11+
1012- ` value ` (required) — the value for the directive, either a string or an slist
1113
1214## What the module manages internally
15+
13161 . ** Include directive** — ensures the base ` sshd_config ` includes the drop-in directory (` sshd_config.d/ ` ) as its first non-comment directive
14172 . ** Drop-in directory** — creates the drop-in directory if it doesn't exist
15183 . ** Drop-in file** — writes directives to ` sshd_config.d/00-cfengine.conf `
16194 . ** Service restart** — restarts sshd if configuration was changed and the service is already running
17205 . ** Verification** — verifies the desired directive appears in the effective sshd config (` sshd -T ` )
1821
1922## Conflicting promisers
23+
2024Having multiple promises with the same sshd keyword is not recommended.
2125In case of conflicting promisers, the agent will attempt to converge the correct state for each one in the order they are evaluated.
2226This means the last promise wins and determines the final value in the configuration file.
2327It will also cause multiple restarts of the sshd service, which may be disruptive.
2428
2529## What the module does NOT do
30+
2631- Install sshd — that is a ` packages: ` promise
2732- Ensure sshd is running — that is a ` services: ` promise
2833- Manage match blocks — those are a policy-level concern
2934
3035## Policy
36+
3137``` cf3
3238bundle agent sshd_config
3339{
You can’t perform that action at this time.
0 commit comments