Enterprise Deployment & Policy

Administrators can set sshs3 options once per machine and lock them for users, using Group Policy (the Windows registry) or a root-owned policy.conf on Linux and macOS. A locked setting shows the policy value, cannot be changed in Settings, and is never written to the user's own settings, so removing the policy gives the user their own choice back.

1. How Policy Is Read

• Policy is read once at startup. Restart sshs3 after changing it.
• Per-user locations (HKCU, environment variables, files in the user's home) are deliberately ignored, because the user could change them.
• If a policy exists but cannot be trusted or read (for example a policy.conf that is writable by group), nothing from it is applied. Settings then shows a warning, and the log has the reason.
• A value that is invalid (wrong type or not an allowed choice) is ignored with a warning; the other values still apply.

2. Available Policies

The registry value name is the policy name with a capital first letter (autoCheckUpdates is AutoCheckUpdates); in policy.conf the names are not case-sensitive. Use REG_DWORD 1 / 0 for true / false and REG_SZ for text. Text values in the registry must be plain ASCII (a value with other characters is ignored with a warning); use policy.conf on Linux and macOS for anything else.

A setting that is not in the policy stays under the user's control.

3. Installing on Windows

Windows has two installers with different update paths:

Do not install both on the same machine: they are separate copies.

msiexec /i sshs3-<version>.msi /qn /l*v "%TEMP%\sshs3-install.log"
msiexec /x sshs3-<version>.msi /qn

An exit code of 0 (or 3010, restart needed) means success. Set the policy before the first start if you want it to apply from the beginning.

4. Group Policy and the Registry on Windows

Group Policy

Download sshs3-policy-templates-<version>.zip from the release (it also holds policy.conf.example), and copy sshs3.admx and en-US\sshs3.adml from it into C:\Windows\PolicyDefinitions (or your central store). The policies appear under Computer Configuration > Administrative Templates > sshs3. For yes/no policies, Enabled forces the option on and Disabled forces it off; Not configured leaves it to the user.

Without Group Policy

reg add HKLM\SOFTWARE\Policies\sshs3 /v AutoCheckUpdates /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Policies\sshs3 /v SmartcardAuthMode /t REG_SZ /d always-prompt /f

5. Linux and macOS

# Disable update checks on all machines
autoCheckUpdates = false
smartcardAuthMode = always-prompt
gitKeyFetch = false

sudo install -d -m 0755 -o root -g root /etc/sshs3
sudo install -m 0644 -o root -g root policy.conf /etc/sshs3/policy.conf

A commented example with every option is policy.conf.example in sshs3-policy-templates-<version>.zip on the release page (and packaging/policy.conf.example in the repository); copy it and remove the # in front of the lines you want to enforce.

6. What Users See

Technical Internals: One Table for Every Source

POLICY_DEFINITIONS (src/shared/types/policy.ts) lists each policy once; the parser, the registry reader, the settings UI and a test that checks the ADMX/ADML templates all use it. SettingsStore.getSettings() returns the settings with the policy applied, so every part of the app sees the enforced value, while profile sync reads the stored values only. This is what keeps a managed value from reaching settings.json or other machines.

7. Troubleshooting & Diagnostics