# SSH Server Configuration (sshd)


## Extra Configuration
Custom configuration to the sshd config file can be added via the `ssh_server::extra_config` key. The config will be added at the end of the `/etc/ssh/sshd_config` file.

### Force Command

To configure a force command use:
```yaml
# add force command
ssh_server::extra_config:
  'Force command for non root users': |
    Match User *,!root
        ForceCommand /usr/bin/kpasswd

```

## Login Banner
A login banner can be configured as follows:

```yaml
# custom banner message on ssh login-prompt

ssh_server::banner_file: '/etc/sshgw/sshd_message'

files::files:
  /etc/sshgw/sshd_message:
    mode: '0644'
    owner: 'root'
    content: | 
      ----

                                  PAUL SCHERRER INSTITUTE
                                      ________________
                                    |  __  |  ____|  |
                                    |  ____|____  |  |
                                    |_|    |______|__|

      ----

```

## Aliases in SSH Certificate

Puppet installs automatically a ssh certificate for the host key.
See the [user guide](../../../user-guide/ssh_host_key_certificates) on how to configure the corresponding CA on the client side.

If the server is reached using different names/addresses than the hostname, then this aliases can be added to the SSH host key certificate with below Hiera configuration:
```
ssh_server::aliases:
  - 'virtual_host.psi.ch'
  - 'virtual_host'
  - '129.129.187.75'
```


## SFTP Server
How to enable/disable and configure a sftp server please refer to the [SFTP Server](../files/sftp_server) guide.