From 3798f2b2d5ecf072d941dbc18b4918c025432ab7 Mon Sep 17 00:00:00 2001
From: Andrew Stowell <andrew@digitaladapt.com>
Date: Thu, 15 May 2025 09:14:17 -0400
Subject: [PATCH] added sshd config to setup

---
 setup/3-sshd-config.sh             | 34 ++++++++++++++++++++++++++++++
 setup/config/sshd-include.conf     |  3 +++
 setup/config/sshd-sshd_config.conf | 15 +++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100755 setup/3-sshd-config.sh
 create mode 100644 setup/config/sshd-include.conf
 create mode 100644 setup/config/sshd-sshd_config.conf

diff --git a/setup/3-sshd-config.sh b/setup/3-sshd-config.sh
new file mode 100755
index 0000000..d008ffd
--- /dev/null
+++ b/setup/3-sshd-config.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+script_dir=$(dirname "$0")
+
+# ----------------------------------------------------------
+
+read -p 'Setup secure "sshd_config" file? [y/N]: ' response
+case "${response}" in
+    [Yy]* )
+        mkdir -p "/etc/ssh/sshd_config.d"
+        sudo mv "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.backup"
+        sudo cp "${script_dir}/config/sshd-sshd_config.conf" "/etc/ssh/sshd_config.d/sshd_config.conf"
+        sudo cp "${script_dir}/config/sshd-include.conf" "/etc/ssh/sshd_config"
+        ;;
+    * )
+        echo 'Skipping'
+        ;;
+esac
+echo ''
+
+# ----------------------------------------------------------
+
+read -p 'Restart SSH to use updated config? [y/N]: ' response
+case "${response}" in
+    [Yy]* )
+        sudo systemctl restart ssh.service
+        echo -e "\e[33mremember to test ssh, ensure root login block, ensure user enaled"
+        ;;
+    * )
+        echo 'Skipping'
+        ;;
+esac
+echo ''
+
diff --git a/setup/config/sshd-include.conf b/setup/config/sshd-include.conf
new file mode 100644
index 0000000..2eff23a
--- /dev/null
+++ b/setup/config/sshd-include.conf
@@ -0,0 +1,3 @@
+# comment
+Include /etc/ssh/sshd_config.d/*.conf
+
diff --git a/setup/config/sshd-sshd_config.conf b/setup/config/sshd-sshd_config.conf
new file mode 100644
index 0000000..1903fd2
--- /dev/null
+++ b/setup/config/sshd-sshd_config.conf
@@ -0,0 +1,15 @@
+# comment
+
+AuthenticationMethods publickey
+PubkeyAuthentication yes
+PermitRootLogin no
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+UsePAM yes
+
+LogLevel VERBOSE
+X11Forwarding yes
+PrintMotd no
+AcceptEnv LANG LC_*
+Subsystem	sftp	/usr/lib/openssh/sftp-server
+