Distribute the SSH Server configuration to multiple files in a config directory.
Ensure sshd configuration is split into drop-in files under /etc/ssh/sshd_config.d/, pulled in by an Include in sshd_config.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Hardened sshd settings should live in drop-in files under /etc/ssh/sshd_config.d/, with the main sshd_config reduced to an Include /etc/ssh/sshd_config.d/*.conf. All other SSH hardening rules assume drop-in directives are effective, so this distributed layout has to be in place for them to work. Splitting configuration by purpose also makes hardening changes easier to partition, review and merge when benchmarks are updated, instead of repeatedly editing one monolithic file.
What Pavois checks
Pavois reads the effective sshd -T output rather than the file layout. This matters precisely because the directory model relies on Include: only the live daemon shows whether the drop-ins are actually being parsed and merged, which is exactly what file-based scanners (OVAL/oscap) miss. Note the pinned check string is an artifact inherited from the source benchmark's remediation message and is OS-specific to RHEL 9 / AlmaLinux 9; the substantive goal is a working Include-based drop-in directory.
describe command('grep -iE "^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config\\.d/\\*\\.conf" /etc/ssh/sshd_config') do
its('stdout') { should match(/\S/) }
end
describe directory('/etc/ssh/sshd_config.d') do
it { should exist }
endHow to verify it is applied
Confirm the include and the directory are in place:
grep -i '^Include' /etc/ssh/sshd_configshould showInclude /etc/ssh/sshd_config.d/*.confls /etc/ssh/sshd_config.d/should list your hardening drop-inssshd -Tshould report all the expected hardened values, proving the drop-ins are effective
Inspect & investigate
Config parsing and reloads are logged in journalctl -u sshd (RHEL family); a syntax error in a drop-in surfaces there and in sshd -t output. Successful application is best confirmed by the resolved values in sshd -T.
Remediation
This rule has no automated harden plan in the reference, so it must be applied manually: ensure sshd_config contains Include /etc/ssh/sshd_config.d/*.conf (back up the original first), place hardening directives in .conf files under /etc/ssh/sshd_config.d/, validate with sshd -t, then systemctl reload sshd. In practice this is the foundation the other SSH harden plans write into.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | mkdir -p /etc/ssh/sshd_config.d; grep -qiE '^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config\.d/\*\.conf' /etc/ssh/sshd_config || sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' /etc/ssh/sshd_config; sshd -t |
|---|---|
| name | sshd-include-dropin-dir |
| not_if | grep -qiE '^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config\.d/\*\.conf' /etc/ssh/sshd_config |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Reorganizing sshd_config is delicate: if the Include is missing, misplaced (it should appear early so drop-ins can override defaults), or a drop-in has a syntax error, the daemon may ignore your hardening or fail to reload, risking lockout. Always back up the original config, validate with sshd -t before reloading, prefer reload over restart, and keep a second root session open until you have confirmed access still works.