ssh settings on a role

server/private/routers/billing/featureLifecycle.ts

@@ -286,6 +286,10 @@ async function disableFeature(
                 await disableAutoProvisioning(orgId);
                 break;
 
+            case TierFeature.SshPam:
+                await disableSshPam(orgId);
+                break;
+
             default:
                 logger.warn(
                     `Unknown feature ${feature} for org ${orgId}, skipping`
@@ -315,6 +319,20 @@ async function disableDeviceApprovals(orgId: string): Promise<void> {
     logger.info(`Disabled device approvals on all roles for org ${orgId}`);
 }
 
+async function disableSshPam(orgId: string): Promise<void> {
+    await db
+        .update(roles)
+        .set({
+            sshSudoMode: "none",
+            sshSudoCommands: "[]",
+            sshCreateHomeDir: false,
+            sshUnixGroups: "[]"
+        })
+        .where(eq(roles.orgId, orgId));
+
+    logger.info(`Disabled SSH PAM options on all roles for org ${orgId}`);
+}
+
 async function disableLoginPageBranding(orgId: string): Promise<void> {
     const [existingBranding] = await db
         .select()