17 lines
1.4 KiB
Markdown
17 lines
1.4 KiB
Markdown
# REPORT — D43 = A: BYO hosts keep their own SSH settings (R-1257), 2026-10-24 night (unattended; commit only)
|
|
|
|
Brief: the restore-holes run, Part 4. Starting the run was the operator's ruling **D43 = A**. Previous report (R-1250's
|
|
line hold, attended, same day): `git show f5c3d77:REPORT.md`.
|
|
|
|
- **`configs/felhom-os-apply` (commit `c8d3c17`):** the root-key-only sshd drop-in is an `appliance`-policy file —
|
|
written only when the root-owned install record says `appliance`; on `byo` nothing is written and a copy we wrote
|
|
(exact path, our header line) is removed (the previous copy kept for the undo, then `sshd -t` and a reload); a box
|
|
whose record proves nothing is left as it is. **X3:** the in-force check asks `sshd -T` for each of the host's own
|
|
global IPv4 addresses. **X4:** a failing `sshd -t` puts back only the SSH file (`sshd_step_undone` in the report);
|
|
the rest of the bundle stays.
|
|
- **Tests:** `configs/test_felhom_config_bundle.py` class `ByoKeepsItsSSH` (7), each rule seen failing with it taken out
|
|
(policy back to `replace`; the probe back to 192.0.2.1; `sshd -t` back to `must`). The fake box now carries an
|
|
appliance record by default; all 68 bundle tests and 146 os-apply tests pass; `agent_gates.py --fast` OK.
|
|
- **Not done here (Monday):** the agent release v0.165.0 and the operator's vouch; a signed bundle on a BYO test host.
|
|
- Docs: felhom.eu `03` (the D4 paragraph) and `11` §1 carry the ruling; register R-1257 → VERIFY.
|