stripping ssh host keys from build

2026-06-16 12:18:48 +00:00
parent df27be40f1
commit a2e0a3af62
3 changed files with 24 additions and 0 deletions
@@ -278,6 +278,11 @@ build {
      "printf 'PermitRootLogin no\\nPasswordAuthentication no\\nKbdInteractiveAuthentication no\\n' > /etc/ssh/sshd_config.d/50-fleet-hardening.conf",
      "chmod 0644 /etc/ssh/sshd_config.d/50-fleet-hardening.conf",
      "restorecon /etc/ssh/sshd_config.d/50-fleet-hardening.conf",
+      # Guarantee sshd is enabled (it's our ONLY way in once root is locked and
+      # the admin user is key-only). Don't rely on the distro preset. Validate
+      # the full sshd config so a bad drop-in fails the BUILD, not the boot.
+      "systemctl enable sshd.service",
+      "sshd -t",
      # Lock root in the image. Done last; admin access is via the key user.
      "passwd -l root",
      "echo \"root locked; admin user $ADMIN_USER created (wheel + NOPASSWD sudo, key-only).\"",