Module sshd 

Editing of /etc/ssh/sshd_config for access-control directives.

This reuses the lossless ast::ConfigAst (which already handles Match blocks, Include, comments, and whitespace faithfully) to provide focused read/edit operations for the user-access directives Toride cares about: AllowUsers and DenyUsers.

Writes are privileged (the file is root-owned) and go through toride_ssh_core::run_privileged, which validates the result with sshd -t and keeps a .bak backup before installing — a malformed sshd_config would lock the user out of SSH, so an invalid config is never written.

All access here is restricted to global directives (those outside any Match block). Match-scoped directives are intentionally left untouched — editing them blindly is dangerous, and global scope is what we expose in the UI.

Functions

add_user_to_allow

Add user to the global AllowUsers directive.

add_user_to_deny

Add user to the global DenyUsers directive. Idempotent.

directive_has_patterns

Returns true if any global <key> directive contains pattern tokens.

edit

Load, mutate, and save /etc/ssh/sshd_config in one call.

get_allow_groups

The current global AllowGroups list (ignoring Match-scoped directives).

get_allow_users

The current global AllowUsers list (ignoring Match-scoped directives).

get_deny_groups

The current global DenyGroups list (ignoring Match-scoped directives).

get_deny_users

The current global DenyUsers list (ignoring Match-scoped directives).

has_pattern_tokens

Returns true if value contains any OpenSSH pattern tokens.

load

Load and parse /etc/ssh/sshd_config into a lossless AST.

remove_user_from_allow

Remove user from the global AllowUsers directive.

remove_user_from_deny

Remove user from the global DenyUsers directive, deleting the directive if it becomes empty.

save

Serialize the AST and install it as /etc/ssh/sshd_config via a privileged operation (validation + backup + atomic install).