From cc266fdde00ec4149f7311ac2bc8c67e251b21e5 Mon Sep 17 00:00:00 2001 From: Plom Heller Date: Mon, 7 Sep 2026 12:49:46 +0200 Subject: [PATCH] Disallow server password login even for normal user. --- setup_scripts/start_root_server.sh | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/setup_scripts/start_root_server.sh b/setup_scripts/start_root_server.sh index 8d82423..27d0a36 100755 --- a/setup_scripts/start_root_server.sh +++ b/setup_scripts/start_root_server.sh @@ -6,7 +6,7 @@ PATH_HOME_USER="/home/${USERNAME}" DIRNAME_SSH=.ssh PATH_ROOT_SSH="${HOME}/${DIRNAME_SSH}" PATH_USER_SSH="${PATH_HOME_USER}/${DIRNAME_SSH}" -PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-no-root-login.conf +PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-ssh-hardening.conf start_root server @@ -14,12 +14,8 @@ msg 'Moving ssh access from root to user …' mv "${PATH_ROOT_SSH}" "${PATH_HOME_USER}" chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}" -# Removing root's key isn't enough on its own to guarantee no direct root -# SSH login: whether that suffices depends on the image's own -# PermitRootLogin setting, which a root password (set below) could -# otherwise still satisfy. Pin it explicitly instead of relying on that. -msg 'Disabling direct root SSH login …' -printf 'PermitRootLogin no\n' >| "${PATH_SSHD_DROPIN}" +msg 'Hardening SSH login: no root login, no password auth …' +printf 'PermitRootLogin no\nPasswordAuthentication no\n' >| "${PATH_SSHD_DROPIN}" systemctl reload ssh msg 'Setting up root password-login …' -- 2.30.2