documentation/docs/admin-guide/configuration/access/sshd_configuration.md

SSH Server Configuration (sshd)

Extra Configuration

Custom configuration to the sshd config file can be added via the ssh_server::extra_config key. The config will be added at the end of the /etc/ssh/sshd_config file.

Force Command

To configure a force command use:

# add force command
ssh_server::extra_config:
  'Force command for non root users': |
    Match User *,!root
        ForceCommand /usr/bin/kpasswd

Login Banner

A login banner can be configured as follows:

# custom banner message on ssh login-prompt

ssh_server::banner_file: '/etc/sshgw/sshd_message'

files::files:
  /etc/sshgw/sshd_message:
    mode: '0644'
    owner: 'root'
    content: | 
      ----

                                  PAUL SCHERRER INSTITUTE
                                      ________________
                                    |  __  |  ____|  |
                                    |  ____|____  |  |
                                    |_|    |______|__|

      ----

Aliases in SSH Certificate

Puppet installs automatically a ssh certificate for the host key. See the user guide on how to configure the corresponding CA on the client side.

If the server is reached using different names/addresses than the hostname, then this aliases can be added to the SSH host key certificate with below Hiera configuration:

ssh_server::aliases:
  - 'virtual_host.psi.ch'
  - 'virtual_host'
  - '129.129.187.75'

SFTP Server

How to enable/disable and configure a sftp server please refer to the SFTP Server guide.