From 71d7ac81ae96d628169247367e2778f23bd31a70 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Sun, 30 Aug 2026 15:03:06 -0400
Subject: [PATCH] Match sshd -T keywords case-insensitively when verifying
 hardening

OpenSSH 10.x prints configuration keywords in CamelCase in its sshd -T
dump, where 9.x printed them lowercase. The case-sensitive grep in
omarchy-setup-security-sshd therefore never matched on OpenSSH 10.x, so
the hardening drop-in was always judged ineffective and removed, leaving
password authentication enabled.
---
 bin/omarchy-setup-security-sshd          |  6 ++++--
 test/shell.d/setup-security-sshd-test.sh | 16 ++++++++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/bin/omarchy-setup-security-sshd b/bin/omarchy-setup-security-sshd
index 1f58cd3c..7b93936f 100755
--- a/bin/omarchy-setup-security-sshd
+++ b/bin/omarchy-setup-security-sshd
@@ -172,9 +172,11 @@ CONF
 
   # Syntax alone is insufficient because sshd uses the first value it reads for
   # these settings. An earlier administrator rule could leave passwords enabled.
+  # Match keywords case-insensitively: OpenSSH 9.x dumps them lowercase, 10.x
+  # in CamelCase.
   if ! effective_config=$(sudo sshd -T) ||
-    ! grep -qxF "passwordauthentication no" <<<"$effective_config" ||
-    ! grep -qxF "kbdinteractiveauthentication no" <<<"$effective_config"; then
+    ! grep -qixF "passwordauthentication no" <<<"$effective_config" ||
+    ! grep -qixF "kbdinteractiveauthentication no" <<<"$effective_config"; then
     echo -e "\e[31msshd did not apply the password-authentication restrictions; removing the ineffective config.\e[0m" >&2
     sudo rm -f "$config"
     return 1
diff --git a/test/shell.d/setup-security-sshd-test.sh b/test/shell.d/setup-security-sshd-test.sh
index f61d580a..b060c5ec 100755
--- a/test/shell.d/setup-security-sshd-test.sh
+++ b/test/shell.d/setup-security-sshd-test.sh
@@ -29,8 +29,14 @@ case $1 in
   [[ ${SSHD_SYNTAX_VALID:-1} == 1 ]]
   ;;
 -T)
-  printf 'passwordauthentication %s\n' "${SSHD_PASSWORD_AUTH:-no}"
-  printf 'kbdinteractiveauthentication %s\n' "${SSHD_KBD_AUTH:-no}"
+  # OpenSSH 10.x dumps keywords in CamelCase; 9.x dumped them lowercase.
+  if [[ ${SSHD_DUMP_LOWERCASE:-0} == 1 ]]; then
+    printf 'passwordauthentication %s\n' "${SSHD_PASSWORD_AUTH:-no}"
+    printf 'kbdinteractiveauthentication %s\n' "${SSHD_KBD_AUTH:-no}"
+  else
+    printf 'PasswordAuthentication %s\n' "${SSHD_PASSWORD_AUTH:-no}"
+    printf 'KbdInteractiveAuthentication %s\n' "${SSHD_KBD_AUTH:-no}"
+  fi
   ;;
 *)
   exit 2
@@ -82,6 +88,12 @@ grep -qxF "systemctl reload sshd.service" "$test_dir/success.calls" || fail "SSH
 grep -q "Password logins are off" <<<"$output" || fail "SSH setup reports hardening after it succeeds"
 pass "SSH setup authorizes a key and disables password logins"
 
+output=$(SSHD_DUMP_LOWERCASE=1 run_setup success-legacy)
+config="$test_dir/success-legacy/root/etc/ssh/sshd_config.d/10-omarchy-hardening.conf"
+[[ -e $config ]] || fail "SSH setup accepts the lowercase sshd -T dump of OpenSSH 9.x"
+grep -q "Password logins are off" <<<"$output" || fail "SSH setup reports hardening on OpenSSH 9.x"
+pass "SSH setup verifies settings across sshd -T keyword casings"
+
 if SSHD_PASSWORD_AUTH=yes run_setup ineffective >"$test_dir/ineffective.output" 2>&1; then
   fail "SSH setup must fail when password authentication remains effective"
 fi