trim down install, tighten sshd

2026-10-31 07:23:08 -06:00
parent 69a01d8977
commit 27115f8245
18 changed files with 220 additions and 39 deletions
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# The SSH server now accepts keys only (system/sshd.sh). A machine someone has
+# logged in to over SSH with a password is left as it is, so nobody loses a
+# way in; it's told how to switch instead.
+SSHD_CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf
+
+[ -f "$SSHD_CONF" ] && exit 0
+
+if sudo journalctl -q --no-pager -u sshd.service \
+    | grep -qE 'Accepted (password|keyboard-interactive)'; then
+  echo "Someone has logged in to this machine over SSH with a password, so SSH still accepts passwords."
+  echo "To allow keys only, add your public key to ~/.ssh/authorized_keys, then run:"
+  echo "  bash ~/.local/share/coredesktop/system/sshd.sh"
+  exit 0
+fi
+
+bash "$HOME/.local/share/coredesktop/system/sshd.sh"