roles/common: default to disabling SSH passwords

2023-08-10 22:09:03 +02:00
parent 11614e3725
commit 6794eb0432
4 changed files with 19 additions and 4 deletions
--- a/roles/common/defaults/main.yml
+++ b/roles/common/defaults/main.yml
@ -10,4 +10,8 @@ fail2ban_findtime: 3600
 fail2ban_bantime: 1209600
 fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24

+# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
+# before re-configuring the SSH daemon to disable passwords.
+ssh_password_authentication: disabled
+
 # vim: set ts=2 sw=2: