From 1a753ab95e68c60660d9cd5c7340b5d22a35fafa Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sun, 14 Dec 2025 18:09:40 +0100 Subject: ssh: T8090: add support for config test mode (sshd -t) Add a safety-net for development to check if the rendered sshd(8) configuration can be applied at all. If it can't be applied - throw an error. From https://linux.die.net/man/8/sshd: -t Test mode. Only check the validity of the configuration file and sanity of the keys. This is useful for updating sshd reliably as configuration options may change. Explicitly forcing a broken config now results in: vyos@vyos# commit [ service ssh ] Unexpected error with SSH configuration! /run/sshd/sshd_config line 21: X11DisplayOffset integer value invalid. [[service ssh]] failed Commit failed --- src/conf_mode/service_ssh.py | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/conf_mode') diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py index dca021d02..d67c1fa3f 100755 --- a/src/conf_mode/service_ssh.py +++ b/src/conf_mode/service_ssh.py @@ -29,6 +29,7 @@ from vyos.configverify import verify_pki_openssh_key from vyos.defaults import config_files from vyos.defaults import SSH_DSA_DEPRECATION_WARNING from vyos.utils.process import call +from vyos.utils.process import rc_cmd from vyos.template import render from vyos import ConfigError from vyos import airbag @@ -173,6 +174,11 @@ def apply(ssh): call(f'systemctl stop {systemd_service_sshguard}') return None + # Verify generated sshd configuration is correct + rc, out = rc_cmd(f'/usr/sbin/sshd -t -f {config_file}') + if rc: + raise ConfigError(f'Unexpected error with SSH configuration! {out}') + if 'dynamic_protection' not in ssh: call(f'systemctl stop {systemd_service_sshguard}') else: -- cgit v1.2.3