How to override sshd_config defaults with custom_override file inside /etc/ssh/sshd_config.d folder via puppet - ssh

Question

I have installed the below version of openssh rpms
openssh-clients-8.0p1-13.el8.x86_64
openssh-8.0p1-13.el8.x86_64
openssh-server-8.0p1-13.el8.x86_64
In the default sshd_config file, I do not see "Include" directive mentioned in it.
grep -nr "Include" /etc/ssh/sshd_config returns nothing. Also "/etc/ssh/sshd_config.d" is not created by rpm. So what I did is created /etc/ssh/sshd_config.d directory and added this "Include /etc/ssh/sshd_config.d/*.conf" in last line of /etc/ssh/sshd_config. I am using puppet to override the default sshd_config file by setting sshd_config_path parameter in puppet ssh module to "/etc/sshd_config.d/custom_sshd_config.conf". ssh module of puppet is just take a copy of sshd_config file and replacing the lines as per puppet configurations. With this I face issues like having conflicting & duplicate values for many sshd_config configurations. One such example:
sshd_config:
HostKey /etc/ssh/ssh_host_rsa_key # duplicate
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
Subsystem sftp /usr/libexec/openssh/sftp-server
sshd_config.d/custom_sshd_config.conf:
HostKey /etc/ssh/ssh_host_rsa_key # duplicate (gets added by default puppet ssh module itself)
Subsystem sftp /usr/libexec/openssh/sftp-server # When Subsystem in defined in both the places,
# sshd service is failed to start, So I am
# manually commenting this out in one file
sshd -T output has duplicates:
...
hostkey /etc/ssh/ssh_host_rsa_key
hostkey /etc/ssh/ssh_host_ecdsa_key
hostkey /etc/ssh/ssh_host_ed25519_key
hostkey /etc/ssh/ssh_host_rsa_key
...
Adding the Include directive in the top also doesn't solve my problem. I am aware of the sshd man page note
first obtained value for each parameter is used in sshd : Order matters only when conflicting parameters exist, as the first obtained value for each parameter is used
Also directly overriding sshd_config file itself by puppet will solve this duplication/conflict issue, but my need is to maintain a separate custom_sshd_config file without overriding directly the original sshd_config file.
What I expect is "Include directive file should behave like overrides of default sshd_config". Is there any way to automate this in puppet like whenever an sshd configuration is overridden in custom_sshd_config file that needs to be commented in default sshd_config so that it will be overridden in real. It would be really helpful if someone helps me out with this issue. Thanks in advance!!

Answer 1

In the default sshd_config file, I do not see "Include" directive mentioned in it. grep -nr "Include" /etc/ssh/sshd_config returns nothing. Also "/etc/ssh/sshd_config.d" is not created by rpm.
I don't find that particularly surprising. The logical contents of sshd_config are order- and context-sensitive, so although there is an Include directive available, using it to provide for generic drop-in sshd configuration files doesn't work very well. I could see a more targeted approach involving drop-in files, perhaps, but not what you're actually trying to do.
Nevertheless, ...
what I did is created /etc/ssh/sshd_config.d directory and added this "Include /etc/ssh/sshd_config.d/*.conf" in last line of /etc/ssh/sshd_config.
... sure, you can do that if you want. But this ...
I am using puppet to override the default sshd_config file by setting sshd_config_path parameter in puppet ssh module to "/etc/sshd_config.d/custom_sshd_config.conf".
... seems both to misrepresent fact and to be unwise. In the first place, no, you are not overriding the default config file. That suggests that sshd would use the config file you specify instead of /etc/sshd/sshd_config, but clearly that's not happening. What you are doing is simply telling Puppet to manage a different file instead.
In the second place, doing that in the way you are doing it is downright begging for exactly the kind of problem you observe: duplicate / inconsistent configuration. You're managing etc/sshd_config.d/custom_sshd_config.conf as if it were a complete sshd configuration file (because that's what the module does), yet the only way it gets used at all is by being included by the main config file.
It's not clear how you even expect to gain anything from this, when you could simply manage the regular config file directly. You say that you can't do that, but you already are doing it, in the sense that you are placing an Include directive in it that was not provided by the RPM.
What I expect is "Include directive file should behave like overrides of default sshd_config". Is there any way to automate this in puppet like whenever an sshd configuration is overridden in custom_sshd_config file that needs to be commented in default sshd_config so that it will be overridden in real.
The module you're using (see also below) does not do this, and I don't see why it would. If you're going to modify the main config file anyway, then why would you not put the configuration directives you want there? Or if indeed you must not modify that file, then why are you proposing an approach that involves modifying it (further)?
One way to move forward would be to indeed change which file sshd uses for its main config file. You could do that on EL8 by managing sshd's systemd unit file to add an appropriate -f option to the sshd command line it uses.
Or if you're ok with modifying /etc/ssh/sshd_config after all, but you still want drop-in files, then you could consider removing everything but the Include directive from the main config file, and otherwise proceeding as you already are doing.
But if you want exactly what you describe, then you'll need to write your own module to handle it.
Speaking of modules, though, the one you linked to is a less-maintained and little used fork of the massively popular, Puppet-approved one by ghoneycutt. At this point, the two are out of sync. Unless you need something that's not in ghoneycutt's version, I would strongly suggest switching.