From 13d23fe3494e756200733262169e130618aefa57 Mon Sep 17 00:00:00 2001 From: Lars Erik Wik Date: Wed, 1 Apr 2026 14:38:32 +0200 Subject: [PATCH 1/2] sshd/README.md: formatted markdown file Signed-off-by: Lars Erik Wik --- promise-types/sshd/README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/promise-types/sshd/README.md b/promise-types/sshd/README.md index c7eac1b..af2aaa3 100644 --- a/promise-types/sshd/README.md +++ b/promise-types/sshd/README.md @@ -3,13 +3,16 @@ Configures sshd and restarts the service when configuration changes. ## Promiser + The sshd configuration keyword to manage (e.g. `PermitRootLogin`, `AllowUsers`). Each promise manages a single directive in the drop-in config file. ## Attributes + - `value` (required) — the value for the directive, either a string or an slist ## What the module manages internally + 1. **Include directive** — ensures the base `sshd_config` includes the drop-in directory (`sshd_config.d/`) as its first non-comment directive 2. **Drop-in directory** — creates the drop-in directory if it doesn't exist 3. **Drop-in file** — writes directives to `sshd_config.d/00-cfengine.conf` @@ -17,17 +20,20 @@ Each promise manages a single directive in the drop-in config file. 5. **Verification** — verifies the desired directive appears in the effective sshd config (`sshd -T`) ## Conflicting promisers + Having multiple promises with the same sshd keyword is not recommended. In case of conflicting promisers, the agent will attempt to converge the correct state for each one in the order they are evaluated. This means the last promise wins and determines the final value in the configuration file. It will also cause multiple restarts of the sshd service, which may be disruptive. ## What the module does NOT do + - Install sshd — that is a `packages:` promise - Ensure sshd is running — that is a `services:` promise - Manage match blocks — those are a policy-level concern ## Policy + ```cf3 bundle agent sshd_config { From c85e4e1e063baa5d5d05b3ef136de7e5500a33d7 Mon Sep 17 00:00:00 2001 From: Lars Erik Wik Date: Wed, 1 Apr 2026 14:39:02 +0200 Subject: [PATCH 2/2] sshd/README.md: removed markdown header The build.cfengine.com already renderes a header for you. Signed-off-by: Lars Erik Wik --- promise-types/sshd/README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/promise-types/sshd/README.md b/promise-types/sshd/README.md index af2aaa3..7073fa3 100644 --- a/promise-types/sshd/README.md +++ b/promise-types/sshd/README.md @@ -1,5 +1,3 @@ -# `sshd` promise type - Configures sshd and restarts the service when configuration changes. ## Promiser