Feature: ssh
Description
Adds the OpenSSH server (openssh-server) and sshguard to Garden Linux.
What it does
Installs and configures OpenSSH and sshguard (brute-force protection). SSH host keys are removed at build time and regenerated at first boot via ssh-keygen.service. A Diffie-Hellman moduli regeneration service (ssh-moduli.service) generates strong DH parameters. The systemd SSH socket activation is disabled in favor of the traditional daemon mode. sshguard uses nftables (from the firewall feature); it falls back to iptables if available, or disables itself if neither is present.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Disables SSH socket activation preset and configures sshguard. |
file.exclude (ref) | Removes from rootfs: /etc/init.d/ssh, /etc/ssh/ssh_host_*. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
pkg.include (ref) | Installs: openssh-server, openssh-client, sshguard, python3-systemd. |
file.include/etc/ssh/ssh_config (file.include) | SSH client configuration. |
file.include/etc/ssh/sshd_config (file.include) | SSH daemon configuration (cipher suites, authentication methods, hardening). |
file.include/etc/systemd/system/ssh-keygen.service (file.include) | Generates SSH host keys on first boot. |
file.include/etc/systemd/system/ssh-moduli.service (file.include) | Regenerates DH moduli for stronger SSH key exchange. |
file.include/etc/systemd/system-preset/00-sshsocket-disable.preset (file.include) | Disables SSH socket activation in favor of the traditional daemon mode. |
Related features
Includes:
firewall— nftables firewall used bysshguardfor brute-force IP blocking.