ssh: Only restart sshd on reload when its config or host key changed (#1923)

ssh.go

@@ -60,6 +60,20 @@ type sshDeviceInfoFlags struct {
 func wireSSHReload(l *slog.Logger, ssh *sshd.SSHServer, c *config.C) {
 	c.RegisterReloadCallback(func(c *config.C) {
 		if c.GetBool("sshd.enabled", false) {
+			// Restarting the server drops every open session, the one that asked for this reload included. Only restart
+			// when it isn't running or its config changed. The host key file can change under the same config, new
+			// handshakes use the new key without a restart
+			if ssh.Running() && !c.HasChanged("sshd") {
+				key, err := loadSSHHostKey(c)
+				if err == nil {
+					err = ssh.SetHostKey(key)
+				}
+				if err != nil {
+					l.Error("Failed to reconfigure the sshd", "error", err)
+					ssh.Stop()
+				}
+				return
+			}
 			sshRun, err := configSSH(l, ssh, c)
 			if err != nil {
 				l.Error("Failed to reconfigure the sshd", "error", err)
@@ -74,6 +88,22 @@ func wireSSHReload(l *slog.Logger, ssh *sshd.SSHServer, c *config.C) {
 	})
 }
 
+// loadSSHHostKey returns sshd.host_key, read from its file when it names one.
+func loadSSHHostKey(c *config.C) ([]byte, error) {
+	hostKeyPathOrKey := c.GetString("sshd.host_key", "")
+	if hostKeyPathOrKey == "" {
+		return nil, fmt.Errorf("sshd.host_key must be provided")
+	}
+	if strings.Contains(hostKeyPathOrKey, "-----BEGIN") {
+		return []byte(hostKeyPathOrKey), nil
+	}
+	b, err := os.ReadFile(hostKeyPathOrKey)
+	if err != nil {
+		return nil, fmt.Errorf("error while loading sshd.host_key file: %s", err)
+	}
+	return b, nil
+}
+
 // configSSH reads the ssh info out of the passed-in Config and
 // updates the passed-in SSHServer. On success, it returns a function
 // that callers may invoke to run the configured ssh server. On
@@ -92,19 +122,9 @@ func configSSH(l *slog.Logger, ssh *sshd.SSHServer, c *config.C) (func(), error)
 		return nil, fmt.Errorf("sshd.listen can not use port 22")
 	}
 
-	hostKeyPathOrKey := c.GetString("sshd.host_key", "")
-	if hostKeyPathOrKey == "" {
-		return nil, fmt.Errorf("sshd.host_key must be provided")
-	}
-
-	var hostKeyBytes []byte
-	if strings.Contains(hostKeyPathOrKey, "-----BEGIN") {
-		hostKeyBytes = []byte(hostKeyPathOrKey)
-	} else {
-		hostKeyBytes, err = os.ReadFile(hostKeyPathOrKey)
-		if err != nil {
-			return nil, fmt.Errorf("error while loading sshd.host_key file: %s", err)
-		}
+	hostKeyBytes, err := loadSSHHostKey(c)
+	if err != nil {
+		return nil, err
 	}
 
 	err = ssh.SetHostKey(hostKeyBytes)