Document SSH key and password authentication

[bgilbert]

Hold until Fedora 32 reaches FCOS stable.

Fixes coreos/fedora-coreos-tracker#138.

[dustymabe]

This looks great!

Any chance you could throw in an example of how to create a hashed password and an FCC that uses it? I know when I come to look at this documentation those two pieces of info (along with the SSH password auth enablement bit) are going to be exactly what I'm looking for to try to reproduce a problem and having them together is going to make my life way easier.

[dustymabe]

I wonder if since SSHD uses a "first one wins" strategy for config merging we should make the files we write easier to override by putting them at a higher number. i.e., 80-disable-passwords.conf

[bgilbert]

We can't. The Fedora package ships an 05-redhat.conf that includes PasswordAuthentication yes.

[dustymabe]

ahh - grr. I guess my same question would apply to the rpm maintainers. Started a discussion there: https://src.fedoraproject.org/rpms/openssh/pull-request/9

[bgilbert]

Updated!

[dustymabe]

This looks really great @bgilbert. Thanks for incorporating the suggestion to include an fcct snippet and also instructions on how to properly generate a hashed password. It makes this documentation so much better!

[dustymabe]

This is ready for merge, but I'm converting to draft so no one merges yet as recommended in #80 (comment)

[dustymabe]

Should we link to this new documentation from the "By default, FCOS does not allow password logins via SSH. We recommend configuring SSH keys instead." in https://docs.fedoraproject.org/en-US/fedora-coreos/migrate-cl/#_configuration_changes ?

[bgilbert]

Done!

[bgilbert]

Hold for sshd packaging changes.

[bgilbert]

Added a separate commit to renumber the sshd_config.d fragment more sensibly after coreos/fedora-coreos-config#480 lands, but that PR is blocked on coreos/fedora-coreos-tracker#540. Do we want to land the rest of this now, or wait until we can document a long-term stable filename?

[dustymabe]

Do we want to land the rest of this now, or wait until we can document a long-term stable filename?

IIUC if someone implements 02-enable-passwords.conf file now, things will still work even after the priority number of the other files are changed (in sshd and fcos configs). I think we can land the rest of it now.

[bgilbert]

OK, moved that part to #85.