From 6e6bf0dcebaa1bcb104bb9e09f4f69a92db7ec01 Mon Sep 17 00:00:00 2001
From: claude-hdb <dan@heavyduty.builders>
Date: Sun, 12 Jul 2026 15:29:09 +0000
Subject: [PATCH] fix(bootstrap): validate the merged sshd config before
 bouncing the daemon
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit restarted ssh and only checked `sshd -T` afterwards. On a
box whose only door is SSH, restarting against a config sshd refuses to parse
leaves no listener and no way back in — the same shape as the firewall-before-
bootstrap lockout this session already found in the migration runbook: commit
to the irreversible act, then verify.

Now `sshd -t` parses the MERGED config (our drop-in, cloud-init's, and any
third-party file) before the restart; on failure the drop-in is rolled back and
the daemon is left untouched. Verified: a bad neighbour drop-in exits 255 and
never reaches `systemctl restart`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 commands/bootstrap.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/commands/bootstrap.sh b/commands/bootstrap.sh
index af8373a..babe626 100755
--- a/commands/bootstrap.sh
+++ b/commands/bootstrap.sh
@@ -108,8 +108,23 @@ PermitRootLogin prohibit-password
 PasswordAuthentication no
 EOF
 if ! cmp -s "$TMP" "$DROPIN" 2>/dev/null || [ -e "$LEGACY_DROPIN" ]; then
+  BACKUP=""
+  [ -e "$DROPIN" ] && { BACKUP="$(mktemp)"; cp -a "$DROPIN" "$BACKUP"; }
   install -m 0644 "$TMP" "$DROPIN"
   rm -f "$LEGACY_DROPIN"   # sweep the losing file from already-bootstrapped boxes
+
+  # Validate the MERGED config BEFORE bouncing the daemon. On a box whose only
+  # door is SSH, `systemctl restart ssh` against a config sshd refuses to parse
+  # leaves no listener and no way back in. `sshd -t` parses everything sshd
+  # would parse — our drop-in, cloud-init's, and any third-party file — so a
+  # broken neighbour is caught here rather than after the door has shut.
+  if ! sshd -t 2>/dev/null; then
+    if [ -n "$BACKUP" ]; then cp -a "$BACKUP" "$DROPIN"; else rm -f "$DROPIN"; fi
+    rm -f "$TMP" "$BACKUP"
+    die "sshd rejects the merged config; drop-in rolled back, daemon untouched. Run 'sshd -t' to see which file is bad."
+  fi
+  rm -f "$BACKUP"
+
   systemctl restart ssh
   log "sshd hardening drop-in installed"
 else