Dustin C. Hatch
8a7faac35b
In Fedora 41, it seems the SSH daemon no longer automatically uses the new certificate after its host certificates have been renewed. To get it to pick up the new ones, we have to explicitly tell it to reload. To handle that automatically, I've added a new systemd path unit that monitors the certificate files. When it detects that one of them has changed, it will send the signal to the SSH daemon to tell it to reload.
25 lines
532 B
Desktop File
25 lines
532 B
Desktop File
[Unit]
|
|
Description=Reload SSH daemon when certificate is renewed
|
|
After=sshd.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/systemctl reload sshd
|
|
CapabilityBoundingSet=
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateDevices=true
|
|
PrivateTmp=true
|
|
ProtectHostname=true
|
|
ProtectClock=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_UNIX
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|