# Installed to /etc/buildbox-rescue-door/sshd_config by host-config/apply.sh.
#
# Deliberately NOT under /etc/ssh: everything there is rewritten by
# buildbox-sshd-access, and /etc/ssh/sshd_config Includes sshd_config.d/*.conf, so a
# file in that tree is reachable by the converge this door exists to survive.
#
# Port 2223 rather than 2222 or 22: 2222 is the converged fleet port and 22 on the
# tailnet address belongs to tailscaled's own SSH server.
Port 2223

# Wildcards only. A ListenAddress that stops existing makes sshd exit 255 on the bind,
# which is the failure this door must not share.
ListenAddress 0.0.0.0
ListenAddress ::

# Its own host key, generated on this box at install. /etc/ssh is the tree a bad
# converge writes into; nothing this door needs may live there.
HostKey /etc/buildbox-rescue-door/ssh_host_ed25519_key

# AuthorizedKeysFile is stated because the packaged 20-systemd-userdb.conf drop-in
# replaces it with an AuthorizedKeysCommand, and this door must not depend on userdbctl
# answering. UsePAM stays on: without it sshd does its own shadow check and refuses
# every account whose password field is locked — proven in the danger lab, where the
# door armed correctly and then turned away the only user on the box. /etc/pam.d is
# packaged and no converge in this repo writes there, so it is not the shared state
# this door exists to avoid.
UsePAM yes
UseDNS no
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password

# Socket-activated with -i: sshd never writes a pid file and never owns /run/sshd.
PidFile none

Subsystem sftp internal-sftp
