roles/common: default to disabling SSH passwords

2023-08-10 22:09:03 +02:00
parent 11614e3725
commit 6794eb0432
4 changed files with 19 additions and 4 deletions
--- a/roles/common/templates/sshd_config_Debian-12.j2
+++ b/roles/common/templates/sshd_config_Debian-12.j2
@ -56,8 +56,12 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes

 # To disable tunneled clear text passwords, change to no here!
+{% if ssh_password_authentication == 'disabled' %}
+PasswordAuthentication no
+{% else %}
 PasswordAuthentication yes
-PermitEmptyPasswords no
+{% endif %}
+#PermitEmptyPasswords no

 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)