diff --git a/promise-types/sshd/README.md b/promise-types/sshd/README.md index c7eac1b..7073fa3 100644 --- a/promise-types/sshd/README.md +++ b/promise-types/sshd/README.md @@ -1,15 +1,16 @@ -# `sshd` promise type - Configures sshd and restarts the service when configuration changes. ## Promiser + The sshd configuration keyword to manage (e.g. `PermitRootLogin`, `AllowUsers`). Each promise manages a single directive in the drop-in config file. ## Attributes + - `value` (required) — the value for the directive, either a string or an slist ## What the module manages internally + 1. **Include directive** — ensures the base `sshd_config` includes the drop-in directory (`sshd_config.d/`) as its first non-comment directive 2. **Drop-in directory** — creates the drop-in directory if it doesn't exist 3. **Drop-in file** — writes directives to `sshd_config.d/00-cfengine.conf` @@ -17,17 +18,20 @@ Each promise manages a single directive in the drop-in config file. 5. **Verification** — verifies the desired directive appears in the effective sshd config (`sshd -T`) ## Conflicting promisers + Having multiple promises with the same sshd keyword is not recommended. In case of conflicting promisers, the agent will attempt to converge the correct state for each one in the order they are evaluated. This means the last promise wins and determines the final value in the configuration file. It will also cause multiple restarts of the sshd service, which may be disruptive. ## What the module does NOT do + - Install sshd — that is a `packages:` promise - Ensure sshd is running — that is a `services:` promise - Manage match blocks — those are a policy-level concern ## Policy + ```cf3 bundle agent sshd_config {