The Linux SSHD Policy manages OpenSSH server configuration on enrolled Linux devices. Swif writes configuration snippets under:

Use the policy to configure SSH authentication, allowed groups, connection checks, listening ports, forwarding, and SFTP behavior. Each rule can contain global settings and conditional Match Blocks for particular users, groups, or connections.

The policy supports company-owned and BYOD Linux devices. It manages the SSH server (sshd), rather than the SSH client configuration used to connect to other computers.

Installing an SSH client alone does not provide the SSH server. Package names and service management differ between Linux distributions. Confirm compatibility on each distribution before broad deployment.

Test on a small device group first. Keep an existing administrative session open and retain console or another tested management route until a new SSH connection succeeds.

Before disabling password authentication, verify a working alternative login method. Before restricting groups, confirm that every required administrator and automation account belongs to an allowed group. Before changing ports, prepare the corresponding network and host access rules.

A rule named baseline with priority 10 may produce a filename such as 10-baseline.conf. Use distinct, descriptive names for your rules.

The main configuration must include the snippets, normally with a directive such as:

OpenSSH expands included filenames in lexical order and generally uses the first value obtained for a directive. Lower-numbered files are intended to load first; a higher priority number does not mean a stronger override. Some directives accumulate values, and Match processing has separate rules.

The location and scope of Include also matter. Validate the complete configuration, including existing files, instead of assessing one snippet in isolation. See Ubuntu’s OpenSSH configuration reference.

The policy definition specifies a default of 10 for Priority. It does not specify explicit defaults for the individual SSH directives.

Do not interpret a blank field as a security recommendation or as an explicit no. Review the generated configuration and effective values on the device. OpenSSH and distribution defaults can differ.

Permit Root Login options:

Disabling Password Authentication alone does not disable keyboard-interactive authentication. Preserve keyboard-interactive access if your approved MFA flow requires it. This policy does not expose PubkeyAuthentication or AuthenticationMethods, so configure and verify those separately where required.

Allow Groups is an access restriction, not a group-creation feature. Other SSH allow/deny rules and account controls can still prevent access.

Max Auth Tries limits one connection; it does not configure an operating-system account lockout threshold. Login Grace Time applies before authentication, not to the duration of an authenticated session. A value of 0 removes that authentication time limit.

Setting Client Alive Interval to 0 disables these probes. Setting Client Alive Count Max to 0 disables termination through this mechanism. These settings detect an unresponsive client; a responsive client can remain connected without user activity. They are not an idle-user logout timer.

Adding a port here does not configure firewall rules. Verify actual listeners as well as the parsed SSH configuration, especially on systems where a service or socket unit controls listening sockets.

For TCP forwarding, local and remote refer to the SSH client’s perspective. Disabling TTY allocation alone does not prevent non-interactive command execution.

Apply Force Command and Chroot Directory globally only when every affected account should receive those restrictions. For a dedicated file-transfer group, use a Match block instead.

A Match block applies settings only when its criteria are satisfied.

Provide at least one criterion. For ordinary positive entries, multiple values within a criterion are alternatives; different criteria must all match. For example, Group filetransfer plus Address 192.0.2.0/24 targets members of that group connecting from that subnet.

The policy form may expose the following fields under Match settings, but OpenSSH does not permit them there:

Configure these under Global Settings only. A visible field is not proof that OpenSSH accepts it in that scope.

Criteria > Local Port is valid: it selects connections arriving on a port. It does not configure a listening port.

Matching blocks can override global values for supported directives. If several matching blocks set the same directive, the first applicable instance wins. See OpenSSH sshd_config reference.

Use this example only after confirming key authentication and an alternative recovery route.

These are example choices, not Swif defaults. The client-alive values check connection responsiveness. They do not impose a three-minute user inactivity limit.

Leave ports and group restrictions unconfigured until their dependencies have been reviewed. This example disables two authentication methods; it does not itself install keys or enforce a complete key-only authentication configuration.

Set Global Settings > Allow Groups to an existing group, such as:

Before deployment, verify each required account on the target device:

Replace adminuser with a real account. Confirm the required group appears in its membership, then test a new SSH login after deployment.

Add a Match block:

Ensure SFTP is configured globally. Avoid adding another Subsystem sftp declaration without reviewing the existing declaration.

If filesystem confinement is also required, add Settings > Chroot Directory, for example /srv/sftp/%u. Prepare the directories separately: every component of the chroot path must be root-owned and not writable by other users or groups. Put user-writable content in a child directory, and ensure the user’s home path is usable inside the jail. See Ubuntu’s ChrootDirectory documentation.

The example does not configure every forwarding type. SSH-agent and Unix-socket forwarding controls are not exposed by this policy and require separate review for a fully restricted service account.

After checking the policy result in Swif, run:

Use the distribution’s actual sshd path if different. Resolve errors before manually reloading or restarting SSH.

To evaluate Match rules, supply a representative connection:

Replace the account, client hostname/address, server address, and port with actual test values. Repeat for restricted and unrestricted accounts.

-t checks configuration validity and host-key sanity. -T prints the effective configuration, and -C applies matching connection conditions. These commands validate configuration on disk; they do not prove that a running daemon has loaded it. See OpenSSH sshd command reference.

Confirm that the service has loaded the intended configuration using the distribution’s supported service procedure. From a separate terminal, test a new SSH login while keeping the original administrative session open.

For Match rules, test both matching and nonmatching accounts. For the SFTP example, verify file transfer and confirm that an interactive shell is unavailable for the restricted account.

For an installation or package-resolution error, send Swif Support the Linux distribution/version, agent version, and exact policy error. Do not assume that the policy’s general Linux support confirms every package-manager workflow.

Review the effective SSH configuration after changing a rule or removing its assignment. Do not assume that unassignment removes every snippet or restores the configuration that existed before deployment.

Use a tested access route to correct the relevant configuration, validate with sshd -t, and follow the distribution’s service procedure. Confirm a new connection before closing recovery access. Avoid deleting unrelated SSH configuration files.