trim down install, tighten sshd

system/sshd.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+#
+# Purpose : Let the SSH server accept keys only, not passwords. sshd is on and
+#           port 22 is open on the LAN, so with passwords anyone on the same
+#           network (a café's Wi-Fi, say) could try to guess yours.
+#
+# To log in to this machine over SSH, add your public key to
+# ~/.ssh/authorized_keys on it, e.g. with ssh-copy-id from the other machine
+# before running this. To allow passwords again, delete the file this writes
+# and run: sudo systemctl reload sshd
+
+set -e
+
+CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf
+
+# Arch's sshd_config includes sshd_config.d first, and sshd keeps the first
+# value it reads, so this wins over the defaults further down
+echo "Allowing SSH logins with keys only..."
+sudo install -d -m 755 /etc/ssh/sshd_config.d
+sudo tee "$CONF" > /dev/null << 'EOF'
+# CoreDesktop: log in over SSH with a key, not a password.
+# Delete this file and run "sudo systemctl reload sshd" to allow passwords.
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin no
+EOF
+
+# Check the config before reloading, so a mistake can't stop sshd. Reloading
+# leaves SSH sessions that are already open as they are.
+sudo sshd -t
+if systemctl is-active -q sshd.service; then
+  sudo systemctl reload sshd.service
+fi