Disallow server password login even for normal user.

diff --git a/setup_scripts/start_root_server.sh b/setup_scripts/start_root_server.sh
index 8d82423df9454ace4496de5a140ea7cd7161e87a..27d0a3612ecfbe2d55176976e8849631102adbab 100755 (executable)
--- a/setup_scripts/start_root_server.sh
+++ b/setup_scripts/start_root_server.sh
@@ -6,7 +6,7 @@ PATH_HOME_USER="/home/${USERNAME}"
 DIRNAME_SSH=.ssh
 PATH_ROOT_SSH="${HOME}/${DIRNAME_SSH}"
 PATH_USER_SSH="${PATH_HOME_USER}/${DIRNAME_SSH}"
-PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-no-root-login.conf
+PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-ssh-hardening.conf
 
 start_root server
 
@@ -14,12 +14,8 @@ msg 'Moving ssh access from root to user …'
 mv "${PATH_ROOT_SSH}" "${PATH_HOME_USER}"
 chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}"
 
-# Removing root's key isn't enough on its own to guarantee no direct root
-# SSH login: whether that suffices depends on the image's own
-# PermitRootLogin setting, which a root password (set below) could
-# otherwise still satisfy. Pin it explicitly instead of relying on that.
-msg 'Disabling direct root SSH login …'
-printf 'PermitRootLogin no\n' >| "${PATH_SSHD_DROPIN}"
+msg 'Hardening SSH login: no root login, no password auth …'
+printf 'PermitRootLogin no\nPasswordAuthentication no\n' >| "${PATH_SSHD_DROPIN}"
 systemctl reload ssh
 
 msg 'Setting up root password-login …'