Hi, On 6/18/19 9:33 PM, Ryan Harper wrote: > > > On Tue, Jun 18, 2019 at 8:24 PM Robert Schweikert <[email protected] > <mailto:[email protected]>> wrote: > > Hi, > > Had a comment on the behavior with disabling root/setting up ssh login. > > The configuration contains: > ssh_pwauth: False > lock-passwd: True > disable_root: True > > And the expectation is that > > ChallengeResponseAuthentication no > PermitRootLogin no > > would be set, which is currently not the case. The user is getting the > desired behavior with: > > runcmd: > # Disable root and password SSH login > - sed -i -e '/^PermitRootLogin/s/^.*$/PermitRootLogin no/' > /etc/ssh/sshd_config > - sed -i -e > '/^#ChallengeResponseAuthentication/s/^.*$/ChallengeResponseAuthentication > no/' /etc/ssh/sshd_config > - sed -i -e '/^#PasswordAuthentication/s/^.*$/PasswordAuthentication > no/' /etc/ssh/sshd_config > - systemctl restart sshd > > Is this a behior change we might want to make in cloud-init? > > > Those values are not current set so that ssh can respond with a helpful > method > which redirects the user to ssh in as a different user. > > $ ssh [email protected] <mailto:[email protected]> > Please login as the user "ubuntu" rather than the user "root". > > versus: > > % ssh [email protected] <mailto:[email protected]> > Permission denied (publickey). > > I think the current behavior is nicer. Is there a strong requirement to > not provide the hint?
No, I wouldn't call it a strong requirement, it was more of an expectation in behavior. Thanks for the explanation and the fast response. Robert -- Robert Schweikert MAY THE SOURCE BE WITH YOU Distinguished Architect LINUX Technical Team Lead Public Cloud [email protected] IRC: robjo -- Mailing list: https://launchpad.net/~cloud-init Post to : [email protected] Unsubscribe : https://launchpad.net/~cloud-init More help : https://help.launchpad.net/ListHelp
