An alternative might be disabling sshd out of the box

I have never understood why every daemon does not have it's own "-on" RPM.  So, the RPM has all of the logic to do the right thing on how to enable it correctly.

So, to enable sshd the user would install 'openssh-server-on' and be done.  We would not be making a decision for the user.  We would be enabling the user to make the decision for themselves.

Also any service that required sshd to be on and running would simply require openssh-server-on in their RPM.

Mike

mrdvt92