roles/common: default to disabling SSH passwords

2023-08-10 22:09:03 +02:00
parent 11614e3725
commit 6794eb0432
4 changed files with 19 additions and 4 deletions
--- a/roles/common/templates/sshd_config_Debian-11.j2
+++ b/roles/common/templates/sshd_config_Debian-11.j2
@ -56,7 +56,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes

 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+{% if ssh_password_authentication == 'disabled' %}
+PasswordAuthentication no
+{% else %}
+PasswordAuthentication yes
+{% endif %}
 #PermitEmptyPasswords no

 # Change to yes to enable challenge-response passwords (beware issues with