create ssh subdirectory

admin-guide/configuration/ssh/sftp_server.md

@@ -0,0 +1,12 @@
+# SFTP Server
+
+Per default SFTP is enabled in the `sshd` configuration. You may disable it with:
+
+```
+ssh_server::sftp::enable: false
+```
+or change it with e.g.:
+```
+ssh_server::sftp::server: '/usr/libexec/openssh/sftp-server -l INFO'
+```
+which configures more logging.

admin-guide/configuration/ssh/ssh_host_hopping.md

@@ -0,0 +1,25 @@
+# SSH Host Hopping as Root (e.g. between cluster members)
+
+This is to allow the user `root` on a given machine to log in as `root` onto another machine without using a password or a similar authentication.
+
+
+The `ssh_server::root_host_trust` list in Hiera configures from which devices root is allowed to connect without special configuration:
+```
+ssh_server::root_host_trust:
+  - 'lxdev04.psi.ch'
+  - 'lxdev05.psi.ch'
+```
+From security perspective this nodes should have the same or stricter security rules/setup that the target host.
+
+To actually use host trust the client also needs to configure that while connecting, e.g. in Hiera:
+
+```
+ssh_client::try_host_trust: true
+```
+
+or spontaneously on the ssh command line with:
+```
+ssh -o HostbasedAuthentication=yes ...
+```
+or by setting `HostbasedAuthentication yes` in the appropriate place in the ssh configuration (e.g. `~/.ssh/config`).
+

admin-guide/configuration/ssh/sshd_configuration.md

@@ -0,0 +1,45 @@
+# SSH Server Configuration (sshd)
+
+
+## Extra Configuration
+Custom configration to the sshd config file can be added via the `ssh_server::extra_config` key. The config will be added at the end of the `/etc/ssh/sshd_config` file.
+
+### Force Command
+
+To configure a force command use:
+```yaml
+# add force command
+ssh_server::extra_config:
+  'Force command for non root users': |
+    Match User *,!root
+        ForceCommand /usr/bin/kpasswd
+
+```
+
+## Login Banner
+A login banner can be configured as follows:
+
+```yaml
+# custom banner message on ssh login-prompt
+
+ssh_server::banner_file: '/etc/sshgw/sshd_message'
+
+files::files:
+  /etc/sshgw/sshd_message:
+    mode: '0644'
+    owner: 'root'
+    content: | 
+      ----
+
+                                  PAUL SCHERRER INSTITUTE
+                                      ________________
+                                    |  __  |  ____|  |
+                                    |  ____|____  |  |
+                                    |_|    |______|__|
+
+      ----
+
+```
+
+## SFTP Server
+How to enable/disable and configure a sftp server please refer to [sftp_server](sftp_server).