ssh: T8090: add support for config test mode (sshd -t)

Add a safety-net for development to check if the rendered sshd(8) configuration
can be applied at all. If it can't be applied - throw an error.

From https://linux.die.net/man/8/sshd:
  -t    Test mode. Only check the validity of the configuration file and sanity
        of the keys. This is useful for updating sshd reliably as configuration
        options may change.

Explicitly forcing a broken config now results in:

  vyos@vyos# commit
  [ service ssh ]
  Unexpected error with SSH configuration! /run/sshd/sshd_config line 21:
  X11DisplayOffset integer value invalid.
  [[service ssh]] failed
  Commit failed

1 files changed, 6 insertions, 0 deletions

diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py
index dca021d02..d67c1fa3f 100755
--- a/src/conf_mode/service_ssh.py
+++ b/src/conf_mode/service_ssh.py
@@ -29,6 +29,7 @@ from vyos.configverify import verify_pki_openssh_key
 from vyos.defaults import config_files
 from vyos.defaults import SSH_DSA_DEPRECATION_WARNING
 from vyos.utils.process import call
+from vyos.utils.process import rc_cmd
 from vyos.template import render
 from vyos import ConfigError
 from vyos import airbag
@@ -173,6 +174,11 @@ def apply(ssh):
         call(f'systemctl stop {systemd_service_sshguard}')
         return None
 
+    # Verify generated sshd configuration is correct
+    rc, out = rc_cmd(f'/usr/sbin/sshd -t -f {config_file}')
+    if rc:
+        raise ConfigError(f'Unexpected error with SSH configuration! {out}')
+
     if 'dynamic_protection' not in ssh:
         call(f'systemctl stop {systemd_service_sshguard}')
     else: