From 85eeb79971866ffc23e9f74e132fc041615b9f80 Mon Sep 17 00:00:00 2001
From: 57_Wolve <1+57_wolve@private.email>
Date: Fri, 12 Jun 2026 18:16:27 +0000
Subject: [PATCH] Update scripts/harden-ssh.sh

---
 scripts/harden-ssh.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/scripts/harden-ssh.sh b/scripts/harden-ssh.sh
index 9bdfe70..cebbf71 100644
--- a/scripts/harden-ssh.sh
+++ b/scripts/harden-ssh.sh
@@ -69,6 +69,14 @@ die()  { printf '\033[1;31m[x]\033[0m %s\n' "$*" >&2; exit 1; }
 # ----------------------------------------------------------------------------
 # 1. Pre-flight checks
 # ----------------------------------------------------------------------------
+# Ensure ssh client is installed before probing its version. On a fresh
+# Alpine box there's no `ssh` binary at all, and the version-detect
+# pipeline below would die silently under `set -euo pipefail`.
+if ! command -v ssh >/dev/null 2>&1; then
+    log "ssh not found; installing openssh + openssh-server..."
+    apk add -q openssh openssh-server
+fi
+
 log "Checking OpenSSH version supports PQ KEX..."
 SSH_VER=$(ssh -V 2>&1 | grep -oE 'OpenSSH_[0-9]+\.[0-9]+' | head -1 \
           | sed 's/OpenSSH_//')