#!/bin/bash
#
# Purpose : Let the SSH server accept keys only, not passwords. sshd is on and
#           port 22 is open on the LAN, so with passwords anyone on the same
#           network (a café's Wi-Fi, say) could try to guess yours.
#
# To log in to this machine over SSH, add your public key to
# ~/.ssh/authorized_keys on it, e.g. with ssh-copy-id from the other machine
# before running this. To allow passwords again, delete the file this writes
# and run: sudo systemctl reload sshd

set -e

CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf

# Arch's sshd_config includes sshd_config.d first, and sshd keeps the first
# value it reads, so this wins over the defaults further down
echo "Allowing SSH logins with keys only..."
sudo install -d -m 755 /etc/ssh/sshd_config.d
sudo tee "$CONF" > /dev/null << 'EOF'
# CoreDesktop: log in over SSH with a key, not a password.
# Delete this file and run "sudo systemctl reload sshd" to allow passwords.
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
EOF

# Check the config before reloading, so a mistake can't stop sshd. Reloading
# leaves SSH sessions that are already open as they are.
sudo sshd -t
if systemctl is-active -q sshd.service; then
  sudo systemctl reload sshd.service
fi