Keep sshd_config.d drop-ins working and resolve sftp-server per distro

The wholesale sshd_config replacement is intentional, but two side effects
were not:

- The template had no Include line, so reinstalling dropped the
  `Include /etc/ssh/sshd_config.d/*.conf` that update_ssh_banners_config
  appends, leaving the per-user banner drop-in on disk but inert. Add it as
  the last line: OpenSSH uses the first value it obtains for a keyword, so
  the template's own settings still take precedence over any drop-in and
  only the Match blocks become effective.
- The template hardcoded the Debian path for sftp-server. sshd -t does not
  verify that the binary exists, so SFTP broke silently on distributions
  that ship it elsewhere. install.sh now probes the common locations and
  rewrites the Subsystem line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Yasin Demir
2026-09-16 06:23:10 +03:00
co-authored by Claude Opus 5
parent b0a0aa9e3c
commit a0476a7e9c
2 changed files with 26 additions and 0 deletions
+5
View File
@@ -28,3 +28,8 @@ AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
Banner /etc/bannerssh
# Kept last on purpose. OpenSSH uses the first value it obtains for a keyword,
# so everything above still wins over any drop-in; this only lets the Match
# blocks that menu.sh writes to sshd_config.d (per-user banners) take effect.
Include /etc/ssh/sshd_config.d/*.conf