OpenSSH policy and hardening
Replace a host group's typed SSH policy with canary evidence and signed reconciliation.
Each host group has a complete typed OpenSSH policy. Tenvyr accepts these controls only:
| Control | Default for a new host group | Meaning |
|---|---|---|
| Password authentication | On for onboarding | Allow password-based SSH |
| Agent forwarding | Off | Permit forwarding the user's SSH agent |
| Port forwarding | Off | Permit local, remote, or dynamic forwarding |
| X11 forwarding | Off | Permit X11 forwarding |
| User RC execution | Off | Permit user SSH RC processing |
The control plane does not accept arbitrary sshd_config directives or shell
commands.
Recommended rollout
- Enroll one canary while password authentication remains available.
- Confirm the agent has applied its current desired-state revision.
- Create a certificate-based access policy.
- Complete a direct Tenvyr SSH connection to the canary.
- Verify an independent out-of-band recovery path.
- Disable password authentication.
- Confirm both certificate SSH and the recovery path still work.
- Expand to the rest of the host group.
Change the policy
In Resources → Host groups, select Configure:
- choose the complete desired set of SSH behaviors;
- enter a change reason of at least ten characters;
- complete recent MFA; and
- publish the replacement policy.
The revision is replaced atomically, appended to audit evidence, signed into desired state, and reconciled by agents.
High-risk transitions
Tenvyr requires canary evidence when a change:
- disables password authentication; or
- enables agent, port, X11, or user-RC forwarding.
Provide:
- an online canary that applied the current revision within 15 minutes;
- validation completed within the previous hour;
- an evidence reference;
- confirmation that direct certificate SSH succeeded; and
- confirmation that an out-of-band break-glass path was tested.
The server validates the canary's current convergence state. A browser checkbox alone cannot satisfy the control.
Avoid conflicting ownership
Do not let Tenvyr and another configuration system manage the same OpenSSH settings independently. Either make Tenvyr authoritative for the typed policy or have the other system consume the same approved desired state.
If sshd validation fails, the agent must keep the last known-good
configuration and report the failure. Investigate the host before retrying or
advancing a deployment wave.