diff --git a/README.md b/README.md
index 8f82905..7da0eb5 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@
 ## Features
 
 - install required binaries
-- manage configuration based on parameters
+- manage local custom configuration based on parameters, overriding the defaults
 - manage service
 - (optional) manage firewall
   
diff --git a/manifests/main/files.pp b/manifests/main/files.pp
index 43bca54..f464f53 100644
--- a/manifests/main/files.pp
+++ b/manifests/main/files.pp
@@ -10,8 +10,8 @@ class confdroid_ssh::main::files (
   file { $sshd_config_path:
     ensure   => file,
     path     => $sshd_config_path,
-    owner    => 'root',
-    group    => 'root',
+    owner    => $sshd_user,
+    group    => $sshd_user,
     mode     => '0640',
     selrange => s0,
     selrole  => object_r,
@@ -21,11 +21,17 @@ class confdroid_ssh::main::files (
   }
 
   if $ssh_manage_config {
-    file { "${ssh_etc_path}/sshd_config.d":
-      ensure => directory,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0755',
+    file { $sshd_custom_conf:
+      ensure   => file,
+      path     => $sshd_custom_conf,
+      owner    => $sshd_user,
+      group    => $sshd_user,
+      mode     => '0755',
+      selrange => s0,
+      selrole  => object_r,
+      seltype  => etc_t,
+      seluser  => system_u,
+      content  => template($sshd_custom_erb),
     }
   }
 }
diff --git a/manifests/params.pp b/manifests/params.pp
index 522f7b6..cf54a25 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -8,6 +8,7 @@
 # @param [String] ssh_fw_port port to use for SSHD and in fw
 # @param [String] ssh_fw_order order of firewall rule
 # @param [String] ssh_source_range source range for firewall rule
+# @param [Boolean] ssh_manage_config whether to manage the configuration
 ##############################################################################
 class confdroid_ssh::params (
 
@@ -36,6 +37,8 @@ class confdroid_ssh::params (
   $sshd_service       = 'sshd'
   $sshd_config_path   = "${ssh_etc_path}/sshd_config"
   $sshd_custom_path   = "${ssh_etc_path}/sshd_config.d"
+  $sshd_custom_conf   = "${sshd_custom_path}/10-custom.conf"
+  $sshd_custom_erb    = 'confdroid_ssh/ssh_custom_conf.erb'
   $sshd_config_erb    = 'confdroid_ssh/ssh_config.erb'
 
   # includes must be last