sshd + tcp wrappers

sshd-tcpd.socket

# こいつは systemctl enable sshd-tcpd.socket する
[Unit]
Description=ssh
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
Conflicts=ssh.socket

[Socket]
ListenStream=22
Accept=yes

[Install]
WantedBy=sockets.target

sshd-tcpd@.service

# こいつはenableしなくていい
[Unit]
Description=sshd
Requires=sshd-tcpd.socket

[Service]
ExecStart=@/usr/sbin/tcpd sshd -i
Type=simple
RuntimeDirectory=sshd
RuntimeDirectoryMode=0755
StandardInput=socket
StandardError=journal

[Install]
WantedBy=multi-user.target