diff options
| author | Craig Jennings <c@cjennings.net> | 2026-06-24 00:15:25 -0400 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-06-24 00:15:25 -0400 |
| commit | d6e83ea5e98c8fe890c7c51564652b6a40eabbf4 (patch) | |
| tree | 52d8a4267c0003c3da39162c9b7d2c0eb4f47a0b /scripts | |
| parent | 87d5bbcd4613deec2e9aed465726b64ade23e252 (diff) | |
| download | archsetup-d6e83ea5e98c8fe890c7c51564652b6a40eabbf4.tar.gz archsetup-d6e83ea5e98c8fe890c7c51564652b6a40eabbf4.zip | |
feat(archsetup): harden sshd with a prohibit-password drop-in
The installer now writes /etc/ssh/sshd_config.d/10-hardening.conf with PermitRootLogin prohibit-password and reloads sshd, right after it starts the service. Root can still log in by key, never by password. PasswordAuthentication is left at the default so a normal user can bootstrap a key with ssh-copy-id.
This makes the posture intentional instead of leaning on Arch's commented default. velox and ratio both carried an explicit PermitRootLogin yes from earlier provisioning, which I'd already fixed by hand.
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions