#!/bin/bash

# The SSH server now accepts keys only (system/sshd.sh). A machine someone has
# logged in to over SSH with a password is left as it is, so nobody loses a
# way in; it's told how to switch instead.
SSHD_CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf

[ -f "$SSHD_CONF" ] && exit 0

if sudo journalctl -q --no-pager -u sshd.service \
    | grep -qE 'Accepted (password|keyboard-interactive)'; then
  echo "Someone has logged in to this machine over SSH with a password, so SSH still accepts passwords."
  echo "To allow keys only, add your public key to ~/.ssh/authorized_keys, then run:"
  echo "  bash ~/.local/share/coredesktop/system/sshd.sh"
  exit 0
fi

bash "$HOME/.local/share/coredesktop/system/sshd.sh"