Wed Oct 21 18:35:23 UTC 2026
## as the agent user (its own sudo grant), the same commands Status runs
rc_t=0
port 8822
rc_T=0
## without sudo (candidate 1)
Unable to load host key: /etc/felhom-sshd/ssh_host_ed25519_key
sshd: no hostkeys available -- exiting.
rc_nosudo=1
## listener
LISTEN 0      128          0.0.0.0:8822      0.0.0.0:*   
LISTEN 0      128             [::]:8822         [::]:*   
## sshd_config
# felhom OOB sshd — agent-managed (H1); DO NOT EDIT
Port 8822
ListenAddress 0.0.0.0
ListenAddress ::
HostKey /etc/felhom-sshd/ssh_host_ed25519_key
PidFile /run/felhom-sshd.pid
AuthorizedKeysFile /etc/felhom-sshd/authorized_keys/%u
PasswordAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
KbdInteractiveAuthentication no
UsePAM yes
AllowUsers root felhom-op
X11Forwarding no
Subsystem sftp internal-sftp
## sudoers lines for sshd
16:# dnsmasq drop-in, the WireGuard config and the OOB sshd config + key go through `felhom-priv-apply`, a root wrapper
244:# Dedicated OOB sshd (TASK H1). The agent manages felhom-sshd like wg-felhom/dnsmasq: it RENDERS the
245:# config (Port from its claim) + the operator's authorized_keys, validates with `sshd -t`, and reloads
246:# (never restart-on-change [SF-2]). Both files reach /etc/felhom-sshd only through felhom-priv-apply (R-861): the config
248:# a root login), the key file one plain public key without options. `sshd -t/-T` are the validate/discover reads. The
249:# systemctl verbs are SCOPED to felhom-sshd only. reset-failed precedes a deliberate restart [SF-5].
250:# NOTHING here can touch the stock sshd, :22, or /etc/ssh.
252:  /usr/local/sbin/felhom-priv-apply sshd-config, \
253:  /usr/local/sbin/felhom-priv-apply sshd-key, \
254:  /usr/sbin/sshd -t -f /var/lib/felhom-agent/felhom-sshd/sshd_config, \
255:  /usr/sbin/sshd -t -f /etc/felhom-sshd/sshd_config, \
256:  /usr/sbin/sshd -T -f /etc/felhom-sshd/sshd_config, \
257:  /usr/bin/systemctl enable --now felhom-sshd, \
258:  /usr/bin/systemctl reload felhom-sshd, \
259:  /usr/bin/systemctl restart felhom-sshd, \
260:  /usr/bin/systemctl reset-failed felhom-sshd, \
