Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable SSH password logins by default #96

Merged
merged 1 commit into from
May 21, 2019
Merged

Disable SSH password logins by default #96

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions fedora-coreos-base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,14 @@ postprocess:
set -xeuo pipefail
sed -i 's/^AuthorizedKeysFile[[:blank:]]/#&/' /etc/ssh/sshd_config
echo -e '\n# Read authorized_keys fragments written by Ignition and Afterburn\nAuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/ignition .ssh/authorized_keys.d/afterburn' >> /etc/ssh/sshd_config
# Disable SSH password logins by default
# Move to overlay once sshd_config fragments are supported
Copy link
Contributor

@ajeddeloh ajeddeloh May 17, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this something that is coming to sshd?

Edit: I can't read backlog. https://bugzilla.mindrot.org/show_bug.cgi?id=2468#c8

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

coreos/fedora-coreos-tracker#138 (comment) is also an option.

# https://github.com/coreos/fedora-coreos-tracker/issues/138
- |
#!/usr/bin/env bash
set -xeuo pipefail
sed -Ei 's/^(PasswordAuthentication|PermitRootLogin)[[:blank:]]/#&/' /etc/ssh/sshd_config
echo -e '\n# Disable password logins by default\nPasswordAuthentication no\nPermitRootLogin prohibit-password' >> /etc/ssh/sshd_config
# This will be dropped once FCOS is out of preview.
# See also experimental.motd in overlay/.
# https://github.com/coreos/fedora-coreos-tracker/issues/164
Expand Down