34 lines
1.2 KiB
Bash
34 lines
1.2 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Purpose : Let the SSH server accept keys only, not passwords. sshd is on and
|
|
# port 22 is open on the LAN, so with passwords anyone on the same
|
|
# network (a café's Wi-Fi, say) could try to guess yours.
|
|
#
|
|
# To log in to this machine over SSH, add your public key to
|
|
# ~/.ssh/authorized_keys on it, e.g. with ssh-copy-id from the other machine
|
|
# before running this. To allow passwords again, delete the file this writes
|
|
# and run: sudo systemctl reload sshd
|
|
|
|
set -e
|
|
|
|
CONF=/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf
|
|
|
|
# Arch's sshd_config includes sshd_config.d first, and sshd keeps the first
|
|
# value it reads, so this wins over the defaults further down
|
|
echo "Allowing SSH logins with keys only..."
|
|
sudo install -d -m 755 /etc/ssh/sshd_config.d
|
|
sudo tee "$CONF" > /dev/null << 'EOF'
|
|
# CoreDesktop: log in over SSH with a key, not a password.
|
|
# Delete this file and run "sudo systemctl reload sshd" to allow passwords.
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PermitRootLogin no
|
|
EOF
|
|
|
|
# Check the config before reloading, so a mistake can't stop sshd. Reloading
|
|
# leaves SSH sessions that are already open as they are.
|
|
sudo sshd -t
|
|
if systemctl is-active -q sshd.service; then
|
|
sudo systemctl reload sshd.service
|
|
fi
|