SSHD

Manages sshd_config through priority-ordered drop-in fragments under /etc/ssh/sshd_config.d/. Each SSHD action lays down one fragment (<priority, zero-padded>-pm-<actionId>.conf) with one or more directives. Multiple SSHD actions can coexist; ordering is controlled by priority.

For "who can SSH at all", use SSH. For "what sshd does globally", use this.

Parameters

Idempotency

The agent generates the fragment content and compares it against the file on disk. Match means no write and no sshd reload. Mismatch rewrites the fragment, validates it with sshd -t (removing the file and failing the action if validation fails), and reloads the sshd service (falling back to the Debian/Ubuntu ssh unit name).

Example

Force protocol 2, disable challenge-response, set a banner:

type: SSHD
directives:
  - { key: Protocol, value: "2" }
  - { key: ChallengeResponseAuthentication, value: "no" }
  - { key: Banner, value: "/etc/issue.net" }
desired_state: PRESENT

Restrict root login to keys only:

type: SSHD
directives:
  - { key: PermitRootLogin, value: "prohibit-password" }
desired_state: PRESENT

Gotchas

• Directive keys and values are written verbatim (control characters are rejected), but the whole fragment is validated with sshd -t before it takes effect. A malformed value never lands: the invalid fragment is removed and the action reports the validation failure.
• priority is assigned by the server at creation time (the count of existing SSHD actions) and preserved across parameter updates — you can't edit it later. To change the load order, delete the action and recreate it in the desired sequence.
• Drop-in files override sshd_config only for directives sshd recognises as overridable. Some directives (Subsystem, certain log settings) take only the first occurrence; check your sshd version.
• No Match block support today. Each entry in directives[] becomes a single key value line, and keys/values containing newlines are rejected outright. A Match directive on its own line — without sub-directives on the lines that follow — isn't valid sshd_config. If you need a conditional block (Match Address, Match User, etc.) drop a raw file with the FILE action instead; expanding SSHD to model Match blocks is parked in the action-extensions backlog.