From: Plom Heller <plom@plomlompom.com>
Date: Mon, 7 Sep 2026 10:49:46 +0000 (+0200)
Subject: Disallow server password login even for normal user.
X-Git-Url: https://plomlompom.com/repos/%7B%7Bdb.prefix%7D%7D/static/test?a=commitdiff_plain;h=cc266fdde00ec4149f7311ac2bc8c67e251b21e5;p=confplom

Disallow server password login even for normal user.
---

diff --git a/setup_scripts/start_root_server.sh b/setup_scripts/start_root_server.sh
index 8d82423..27d0a36 100755
--- a/setup_scripts/start_root_server.sh
+++ b/setup_scripts/start_root_server.sh
@@ -6,7 +6,7 @@ PATH_HOME_USER="/home/${USERNAME}"
 DIRNAME_SSH=.ssh
 PATH_ROOT_SSH="${HOME}/${DIRNAME_SSH}"
 PATH_USER_SSH="${PATH_HOME_USER}/${DIRNAME_SSH}"
-PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-no-root-login.conf
+PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-ssh-hardening.conf
 
 start_root server
 
@@ -14,12 +14,8 @@ msg 'Moving ssh access from root to user …'
 mv "${PATH_ROOT_SSH}" "${PATH_HOME_USER}"
 chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}"
 
-# Removing root's key isn't enough on its own to guarantee no direct root
-# SSH login: whether that suffices depends on the image's own
-# PermitRootLogin setting, which a root password (set below) could
-# otherwise still satisfy. Pin it explicitly instead of relying on that.
-msg 'Disabling direct root SSH login …'
-printf 'PermitRootLogin no\n' >| "${PATH_SSHD_DROPIN}"
+msg 'Hardening SSH login: no root login, no password auth …'
+printf 'PermitRootLogin no\nPasswordAuthentication no\n' >| "${PATH_SSHD_DROPIN}"
 systemctl reload ssh
 
 msg 'Setting up root password-login …'