Docs: Explain transactional SSH hardening

2026-08-27 04:25:05 -04:00
parent ac25fd776c
commit 00e11e0b8d
3 changed files with 67 additions and 5 deletions
@@ -92,4 +92,17 @@ it against the real system.

 ## Root work

-Never bare `sudo` — load the `panama-sudo` skill. Migrations already follow the rule.
+Never bare `sudo`. Load the `panama-sudo` skill first. Migrations already follow the rule.
+
+`boot --server` is the one exception where a new Fedora VPS may begin as root.
+Before it offers SSH hardening, it copies a safe root key when possible or
+verifies the target key. The target user's `.ssh` must be owned by that user at
+`0700`, and `authorized_keys` must be owned by that user at `0600`. Without a
+verified target key, SSH hardening is unavailable and the bootstrap continues.
+
+Accepted hardening uses an atomic same-directory `sshd_config.d` drop-in,
+runs `sshd -t`, then reloads the detected SSH unit. Validation or reload
+failure restores the previous drop-in before it retries validation and reload;
+failed recovery stops the handoff with manual recovery instructions. The
+fixture contracts exercise those branches. `panama test --safe` never reloads
+a live daemon, so it is not live-host proof.