From f68c75833831fb53341afaa37e9405d801f28fe6 Mon Sep 17 00:00:00 2001
From: Christian Manivong <christian.manivong@gmail.com>
Date: Sun, 11 Oct 2026 23:12:34 +0200
Subject: [PATCH] fix: opt out of the SSH hardening inherited from napalm-linux

OpenMediaVault generates sshd_config from its own database; a drop-in
netOrk wrote would be dropped by the next apply of the SSH settings
without a word. harden_ssh_server = None makes netOrk's capability probe
answer no.

Requires napalm-linux 0.5.0; bumps to 0.1.1. NetOrk/netork#1027
---
 napalm_openmediavault/openmediavault.py |  5 +++++
 pyproject.toml                          |  4 ++--
 tests/test_ssh_hardening_opt_out.py     | 16 ++++++++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_ssh_hardening_opt_out.py

diff --git a/napalm_openmediavault/openmediavault.py b/napalm_openmediavault/openmediavault.py
index 5f417a5..bff2d29 100644
--- a/napalm_openmediavault/openmediavault.py
+++ b/napalm_openmediavault/openmediavault.py
@@ -65,6 +65,11 @@ class OpenMediaVaultDriver(StorageDriver, LinuxDriver):
         FingerprintRule("openmediavault", weight=9.0, mandatory=True),
     ]
 
+    #: OMV generates sshd_config from its own database; a drop-in netOrk wrote
+    #: would be dropped on the next apply of the SSH settings. Inherited from
+    #: napalm-linux, so opted out here (NetOrk/netork#1027).
+    harden_ssh_server = None  # type: ignore[assignment]
+
     # ── Facts override ─────────────────────────────────────────────────────────
 
     def get_facts(self) -> dict[str, Any]:
diff --git a/pyproject.toml b/pyproject.toml
index b849a01..417bb11 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "napalm-openmediavault"
-version = "0.1.0"
+version = "0.1.1"
 description = "NAPALM driver for OpenMediaVault NAS (SSH)"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -25,7 +25,7 @@ classifiers = [
 dependencies = [
     "napalm>=4.0",
     "napalm-device-types>=0.3.0",
-    "napalm-linux>=0.1.0",
+    "napalm-linux>=0.5.0",
 ]
 
 [project.optional-dependencies]
diff --git a/tests/test_ssh_hardening_opt_out.py b/tests/test_ssh_hardening_opt_out.py
new file mode 100644
index 0000000..5618458
--- /dev/null
+++ b/tests/test_ssh_hardening_opt_out.py
@@ -0,0 +1,16 @@
+"""OpenMediaVault writes sshd_config itself, from its own database.
+
+The Linux driver offers to harden the SSH server by writing a drop-in under
+/etc/ssh/sshd_config.d (NetOrk/netork#1027). On OMV the next apply of the SSH
+settings (``omv-salt deploy run ssh``) would regenerate the configuration and
+take the change back without a word, so this driver opts out: netOrk's
+capability probe asks ``callable(harden_ssh_server)``.
+"""
+
+from __future__ import annotations
+
+from napalm_openmediavault.openmediavault import OpenMediaVaultDriver
+
+
+def test_does_not_offer_ssh_hardening():
+    assert not callable(getattr(OpenMediaVaultDriver, "harden_ssh_server", None))
-- 
2.54.0