From 4d3c86cd0c14972839f877066c3e36ee19d87429 Mon Sep 17 00:00:00 2001
From: Jenkins Server <jenkins@confdroid.com>
Date: Tue, 14 Apr 2026 13:09:40 +0200
Subject: [PATCH] Recommit for updates in build 33

---
 doc/file.README.html                          |    4 -
 doc/index.html                                |    4 -
 .../confdroid_ssh_3A_3Amain_3A_3Afiles.html   |   34 +-
 .../confdroid_ssh_3A_3Aparams.html            | 1170 +----------------
 4 files changed, 32 insertions(+), 1180 deletions(-)

diff --git a/doc/file.README.html b/doc/file.README.html
index e4add7a..caa9f94 100644
--- a/doc/file.README.html
+++ b/doc/file.README.html
@@ -104,10 +104,6 @@
 <p>(optional) manage firewall</p>
 </li></ul>
 
-<blockquote>
-<p>Note Originally I thought it was a great idea to have a single custom configuration file, which would override the default settings in the sshd_config. But I quickly learned, that this is not a great idea, for it seemed to work out differently on various hosts despite identical settings. For instance gitlab is using SSH not only for remote sessions but also for git operations, which broke with this file in place. So right now this module will only ensure the main default config is available and the service is always running. Custom configurations can be enabled after through testing through the parameters under #sshd section, but can be forced off through the <code>ssh_custom_ensure</code>setting set to <code>absent</code> (default).</p>
-</blockquote>
-
 <h2 id="label-Support">Support</h2>
 <ul><li>
 <p>Rocky 9 (Any RHEL 9 based OS should work but has not been tested)</p>
diff --git a/doc/index.html b/doc/index.html
index 3362646..5b15103 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -104,10 +104,6 @@
 <p>(optional) manage firewall</p>
 </li></ul>
 
-<blockquote>
-<p>Note Originally I thought it was a great idea to have a single custom configuration file, which would override the default settings in the sshd_config. But I quickly learned, that this is not a great idea, for it seemed to work out differently on various hosts despite identical settings. For instance gitlab is using SSH not only for remote sessions but also for git operations, which broke with this file in place. So right now this module will only ensure the main default config is available and the service is always running. Custom configurations can be enabled after through testing through the parameters under #sshd section, but can be forced off through the <code>ssh_custom_ensure</code>setting set to <code>absent</code> (default).</p>
-</blockquote>
-
 <h2 id="label-Support">Support</h2>
 <ul><li>
 <p>Rocky 9 (Any RHEL 9 based OS should work but has not been tested)</p>
diff --git a/doc/puppet_classes/confdroid_ssh_3A_3Amain_3A_3Afiles.html b/doc/puppet_classes/confdroid_ssh_3A_3Amain_3A_3Afiles.html
index 6ffa772..f2f2cae 100644
--- a/doc/puppet_classes/confdroid_ssh_3A_3Amain_3A_3Afiles.html
+++ b/doc/puppet_classes/confdroid_ssh_3A_3Amain_3A_3Afiles.html
@@ -118,23 +118,7 @@
 20
 21
 22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39</pre>
+23</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/files.pp', line 6</span>
@@ -156,22 +140,6 @@ class confdroid_ssh::main::files (
     content  =&gt; template($sshd_config_erb),
     notify   =&gt; Service[$sshd_service],
   }
-
-  if $ssh_manage_config {
-    file { $sshd_custom_conf:
-      ensure   =&gt; $ssh_custom_ensure,
-      path     =&gt; $sshd_custom_conf,
-      owner    =&gt; $sshd_user,
-      group    =&gt; $sshd_user,
-      mode     =&gt; &#39;0640&#39;,
-      selrange =&gt; s0,
-      selrole  =&gt; object_r,
-      seltype  =&gt; etc_t,
-      seluser  =&gt; system_u,
-      content  =&gt; template($sshd_custom_erb),
-      notify   =&gt; Service[$sshd_service],
-    }
-  }
 }</pre>
       </td>
     </tr>
diff --git a/doc/puppet_classes/confdroid_ssh_3A_3Aparams.html b/doc/puppet_classes/confdroid_ssh_3A_3Aparams.html
index 083dcf6..27bcb46 100644
--- a/doc/puppet_classes/confdroid_ssh_3A_3Aparams.html
+++ b/doc/puppet_classes/confdroid_ssh_3A_3Aparams.html
@@ -214,996 +214,6 @@
         &mdash;
         <div class='inline'>
 <p>source range for firewall rule</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_manage_config</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>true</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to manage the configuration</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_address_family</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;any&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>AddressFamily setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_listen_address</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;0.0.0.0&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>ListenAddress setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_root_login</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;prohibit-password&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>PermitRootLogin setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_strict_modes</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>StrictModes setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_max_auth_tries</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;6&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>MaxAuthTries setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_max_sessions</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;10&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>MaxSessions setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_pubkey_auth</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>PubkeyAuthentication setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_auth_key_files</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;.ssh/authorized_keys&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>AuthorizedKeysFile setting for sshd_config</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_authorized_principals_file</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>AuthorizedPrincipalsFile setting for sshd_config. Default is ‘none’ to disable this setting.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_authorized_keys_command</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>AuthorizedKeysCommand setting for sshd_config. Default is ‘none’ to disable this setting.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_authorized_keys_command_user</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;nobody&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>AuthorizedKeysCommandUser setting for sshd_config. Default is ‘nobody’ to use an unpriviledged user.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_use_specific_hostkey</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>false</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to use a specific host key</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_hostkey_type</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;rsa&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>type of host key to use if ssh_use_specific_hostkey is true</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_rekeylimit</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;default none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>RekeyLimit setting for sshd_config. Default is ‘default none’.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_syslog_facility</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;AUTH&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>SyslogFacility setting for sshd_config. Default is ‘AUTH’.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_log_level</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;INFO&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>LogLevel setting for sshd_config. Default is ‘INFO’.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_password_authentication</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>PasswordAuthentication setting for sshd_config. Default is ‘no’, which requires key-based authentication. This is a recommended security setting, so passwords do not show up in logs, but can be set to ‘yes’ if password authentication is desired.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_permit_empty_passwords</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>PermitEmptyPasswords setting for sshd_config. Default is ‘no’, which is a recommended security setting and works in connection with key-based authentication, but can be set to ‘yes’ if password authentication should be allowed and empty passwords should be allowed. Again, this should be used with caution if enabled.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kbd_interactive_auth</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which is a recommended security setting together with password authentication, but can be set to ‘yes’ if keyboard-interactive authentication should be allowed. (not recommended)</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kerberos_authentication</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. Kerberos authentication is not commonly used and requires a lot of other settings, so it is disabled by default, but can be set to ‘yes’ if desired.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kerberos_or_local_passwd</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if Kerberos authentication is enabled, and should be set to ‘yes’ if you want to allow local password authentication as a fallback if Kerberos authentication fails, but can be set to ‘no’ if you want to only allow Kerberos authentication.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kerberos_ticket_cleanup</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if Kerberos authentication is enabled, and should be set to ‘yes’ if you want to enable ticket cleanup, but can be set to ‘no’ if you want to disable it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kerberos_get_afstoken</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if Kerberos authentication is enabled, and should be set to ‘yes’ if you want to enable AFS token retrieval, but can be set to ‘no’ if you want to disable it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_kerberos_use_kuserok</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if Kerberos authentication is enabled, and should be set to ‘yes’ if you want to enable userok with Kerberos, but can be set to ‘no’ if you want to disable it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_use_kerberos</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>false</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to use Kerberos authentication. If true, the relevant Kerberos settings will be included in the sshd_config, otherwise they will be ignored.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_use_gssapi</span>
-      
-      
-        <span class='type'>(<tt>Boolean</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>false</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether to use GSSAPI authentication. If true, GSSAPI authentication will be enabled in sshd_config, otherwise it will be disabled. GSSAPI authentication is not commonly used and requires a lot of other settings, so it is disabled by default, but can be set to true if desired.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_gssapi_authentication</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if GSSAPI authentication is enabled, and should be set to ‘yes’ if you want to enable GSS authentication, but can be set to ‘no’ if you want to disable it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_gssapi_cleanup_credentials</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if GSSAPI authentication is enabled, and should be set to ‘yes’ if you want to enable GSS credential cleanup, but can be set to ‘no’ if you want to disable it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_gssapi_key_exchange</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if GSSAPI authentication is enabled, and should be set to ‘yes’ if you want to enable GSS key exchange.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_gssapi_enablek5users</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. This setting is only relevant if GSSAPI authentication is enabled, and should be set to ‘yes’ if you want to enable GSSAPI for k5users.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_use_pam</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’. PAM is not commonly used for SSH authentication and can introduce security risks if not configured properly, so it is disabled by default. Thi setting is related to PasswordAuthentication and KbdInteractiveAuthentication, and should be set to ‘yes’ only if you want to use PAM for authentication together with those settings.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_allow_agent_forwarding</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which allows SSH agent forwarding, but can be set to ‘no’ if you want to disable this feature for security reasons.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_allow_tcp_forwarding</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which allows TCP forwarding, but can be set to ‘no’ if you want to disable this feature for security reasons.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_gateway_ports</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which means that remote hosts cannot connect to forwarded ports, but can be set to ‘yes’ or ‘clientspecified’ if you want to allow remote hosts to connect to forwarded ports. This setting should be used with caution if enabled, as it can introduce security risks.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_x11_forwarding</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which disables X11 forwarding, but can be set to ‘yes’ if you want to allow X11 forwarding. This setting should be used with caution if enabled.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_x11_display_offset</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;10&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘10’. This setting is only relevant if X11 forwarding is enabled, and specifies the first display number available for X11 forwarding. The default of ‘10’ means that the first forwarded display will be :10, the second will be :11, and so on. This setting can be adjusted if you want to use a different range of display numbers for X11 forwarding.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_x11_use_localhost</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which means that X11 forwarding will only be available on the loopback interface, but can be set to ‘no’ if you want to allow X11 forwarding on all network interfaces.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_permit_tty</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which allows TTY allocation, but can be set to ‘no’ if you want to disable TTY allocation.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_print_motd</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which means that the message of the day will be printed when users log in, but can be set to ‘no’ if you want to disable this feature.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_print_lastlog</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which means that the last login information will be printed when users log in, but can be set to ‘no’ if you want to disable this feature.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_tcp_keepalive</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;yes&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘yes’, which means that TCP keepalive messages will be sent, but can be set to ‘no’ if you want to disable this feature. This setting can be useful to disable if you have issues with dropped connections, but in general it is recommended to keep it enabled.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_permit_user_environment</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which means that user environment variables will not be processed, but can be set to ‘yes’ if you want to allow users to specify environment variables in their ~/.ssh/environment file.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_compression</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;delayed&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘delayed’, which means that compression will be enabled after successful authentication, but can be set to ‘yes’ if you want to enable compression from the start of the connection. The ‘delayed’ setting is a good compromise that allows for faster authentication while still providing the benefits of compression for the rest of the session.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_client_alive_interval</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;0&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘0’, which means that no keepalive messages will be sent by the server, but can be set to a positive integer to specify the interval in seconds between keepalive messages sent by the server to the client. This can be useful to detect and close stale connections, but should be used with caution as it can cause unexpected disconnections if set too aggressively.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_client_alive_count_max</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;3&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘3’. This setting is only relevant if ssh_client_alive_interval is set to a positive integer, and specifies the number of consecutive keepalive messages that can be sent without receiving a response from the client before the server considers the connection to be stale and disconnects it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_use_dns</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which means that the server will not perform DNS lookups on connecting clients, but can be set to ‘yes’ if you want the server to perform DNS lookups. Disabling DNS lookups can improve connection times and reduce the risk of DNS spoofing attacks, so it is generally recommended to keep this setting disabled unless you have a specific need for it.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_pid_file</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;/var/run/sshd.pid&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘/var/run/sshd.pid’, which is the common location for the sshd PID file, but can be set to a different path if desired. This setting specifies the location of the sshd PID file.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_max_startups</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;10:30:100&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘10:30:100’, which means that the server will allow up to 10 concurrent unauthenticated connections, and will start dropping connections with a probability that increases linearly.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_permit_tunnel</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘no’, which means that tunneling is not allowed, but can be set to ‘yes’ if you want to allow tunneling, or ‘point-to-point’ to allow only point-to-point tunneling. This setting should be used with caution if enabled.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_chroot_directory</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘none’, which means that no chroot directory will be used, but can be set to a valid directory path if you want to use chroot for SSH sessions.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_version_addendum</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘none’, which means that no version addendum will be included in the SSH banner, but can be set to a custom string if you want to include additional information in the SSH version banner. This can be used for branding purposes, but should be used with caution as it can potentially leak information about the server that could be useful to attackers.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_banner</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;none&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘none’, which means that no banner will be displayed to users when they connect, but can be set to a valid file path if you want to display a custom banner message to users when they connect. This can be used to display legal notices, security warnings, or other information to users when they connect to the SSH server.</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_login_grace_time</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;2m&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>setting for sshd_config. Default is ‘2m’, which means that users have 2 minutes to successfully authenticate before the server disconnects them, but can be set to a different time interval if desired. This setting can be used to limit the amount of time that attackers have to attempt to brute-force authentication, but should be set to a reasonable value to avoid disconnecting legitimate users who may need more time to log</p>
-</div>
-      
-    </li>
-  
-    <li>
-      
-        <span class='name'>ssh_custom_ensure</span>
-      
-      
-        <span class='type'>(<tt>String</tt>)</span>
-      
-      
-        <em class="default">(defaults to: <tt>&#39;absent&#39;</tt>)</em>
-      
-      
-        &mdash;
-        <div class='inline'>
-<p>whether the custom configuration file should be file or absent.</p>
 </div>
       
     </li>
@@ -1219,98 +229,39 @@
         <pre class="lines">
 
 
-202
-203
-204
-205
-206
-207
-208
-209
-210
-211
-212
-213
-214
-215
-216
-217
-218
-219
-220
-221
-222
-223
-224
-225
-226
-227
-228
-229
-230
-231
-232
-233
-234
-235
-236
-237
-238
-239
-240
-241
-242
-243
-244
-245
-246
-247
-248
-249
-250
-251
-252
-253
-254
-255
-256
-257
-258
-259
-260
-261
-262
-263
-264
-265
-266
-267
-268
-269
-270
-271
-272
-273
-274
-275
-276
-277
-278
-279
-280
-281
-282
-283
-284
-285
-286
-287
-288
-289
-290</pre>
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 202</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 13</span>
 
 class confdroid_ssh::params (
 
@@ -1323,63 +274,6 @@ class confdroid_ssh::params (
   String $ssh_fw_order                      = &#39;50&#39;,
   String $ssh_source_range                  = &#39;0.0.0.0/0&#39;,
 
-  # sshd configuration 
-  String  $ssh_custom_ensure                = &#39;absent&#39;,
-  Boolean $ssh_manage_config                = true,
-  String  $ssh_address_family               = &#39;any&#39;,
-  String  $ssh_listen_address               = &#39;0.0.0.0&#39;,
-  String  $ssh_login_grace_time             = &#39;2m&#39;,
-  String  $ssh_root_login                   = &#39;prohibit-password&#39;,
-  String  $ssh_strict_modes                 = &#39;yes&#39;,
-  String  $ssh_max_auth_tries               = &#39;6&#39;,
-  String  $ssh_max_sessions                 = &#39;10&#39;,
-  String  $ssh_pubkey_auth                  = &#39;yes&#39;,
-  String  $ssh_auth_key_files               = &#39;.ssh/authorized_keys&#39;,
-  String  $ssh_authorized_principals_file   = &#39;none&#39;,
-  String  $ssh_authorized_keys_command      = &#39;none&#39;,
-  String  $ssh_authorized_keys_command_user = &#39;nobody&#39;,
-  Boolean $ssh_use_specific_hostkey         = false,
-  String  $ssh_hostkey_type                 = &#39;rsa&#39;,
-  String  $ssh_rekeylimit                   = &#39;default none&#39;,
-  String  $ssh_syslog_facility              = &#39;AUTH&#39;,
-  String  $ssh_log_level                    = &#39;INFO&#39;,
-  String  $ssh_password_authentication      = &#39;yes&#39;,
-  String  $ssh_permit_empty_passwords       = &#39;no&#39;,
-  String  $ssh_kbd_interactive_auth         = &#39;yes&#39;,
-  Boolean $ssh_use_kerberos                 = false,
-  String  $ssh_kerberos_authentication      = &#39;yes&#39;,
-  String  $ssh_kerberos_or_local_passwd     = &#39;yes&#39;,
-  String  $ssh_kerberos_ticket_cleanup      = &#39;yes&#39;,
-  String  $ssh_kerberos_get_afstoken        = &#39;no&#39;,
-  String  $ssh_kerberos_use_kuserok         = &#39;yes&#39;,
-  Boolean $ssh_use_gssapi                   = false,
-  String  $ssh_gssapi_authentication        = &#39;yes&#39;,
-  String  $ssh_gssapi_cleanup_credentials   = &#39;yes&#39;,
-  String  $ssh_gssapi_key_exchange          = &#39;no&#39;,
-  String  $ssh_gssapi_enablek5users         = &#39;no&#39;,
-  String  $ssh_use_pam                      = &#39;no&#39;,
-  String  $ssh_allow_agent_forwarding       = &#39;yes&#39;,
-  String  $ssh_allow_tcp_forwarding         = &#39;yes&#39;,
-  String  $ssh_gateway_ports                = &#39;no&#39;,
-  String  $ssh_x11_forwarding               = &#39;no&#39;,
-  String  $ssh_x11_display_offset           = &#39;10&#39;,
-  String  $ssh_x11_use_localhost            = &#39;yes&#39;,
-  String  $ssh_permit_tty                   = &#39;yes&#39;,
-  String  $ssh_print_motd                   = &#39;yes&#39;,
-  String  $ssh_print_lastlog                = &#39;yes&#39;,
-  String  $ssh_tcp_keepalive                = &#39;yes&#39;,
-  String  $ssh_permit_user_environment      = &#39;no&#39;,
-  String  $ssh_compression                  = &#39;delayed&#39;,
-  String  $ssh_client_alive_interval        = &#39;0&#39;,
-  String  $ssh_client_alive_count_max       = &#39;3&#39;,
-  String  $ssh_use_dns                      = &#39;no&#39;,
-  String  $ssh_pid_file                     = &#39;/var/run/sshd.pid&#39;,
-  String  $ssh_max_startups                 = &#39;10:30:100&#39;,
-  String  $ssh_permit_tunnel                = &#39;no&#39;,
-  String  $ssh_chroot_directory             = &#39;none&#39;,
-  String  $ssh_version_addendum             = &#39;none&#39;,
-  String  $ssh_banner                       = &#39;none&#39;,
-
 ) {
 # default facts
   $fqdn                     = $facts[&#39;networking&#39;][&#39;fqdn&#39;]
@@ -1393,8 +287,6 @@ class confdroid_ssh::params (
   $sshd_service             = &#39;sshd&#39;
   $sshd_config_path         = &quot;${ssh_etc_path}/sshd_config&quot;
   $sshd_custom_path         = &quot;${ssh_etc_path}/sshd_config.d&quot;
-  $sshd_custom_conf         = &quot;${sshd_custom_path}/10-custom.conf&quot;
-  $sshd_custom_erb          = &#39;confdroid_ssh/sshd_custom_conf.erb&#39;
   $sshd_config_erb          = &#39;confdroid_ssh/sshd_config.erb&#39;
   $sshd_root_login_file     = &quot;${sshd_custom_path}/01-permitrootlogin.conf&quot;