docs: also update cloud-init sshd drop-in when disabling SSH password auth#34
Open
veto9292 wants to merge 1 commit into
Open
docs: also update cloud-init sshd drop-in when disabling SSH password auth#34veto9292 wants to merge 1 commit into
veto9292 wants to merge 1 commit into
Conversation
…rd auth Many cloud images (Ubuntu on Azure, AWS, Oracle Cloud, Hetzner, Vultr, etc.) ship /etc/ssh/sshd_config.d/50-cloud-init.conf containing `PasswordAuthentication yes`. Because sshd_config includes /etc/ssh/sshd_config.d/*.conf near its top and sshd uses the first value it finds for each option, that drop-in overrides the `PasswordAuthentication no` set in the main file. As a result, password login keeps working even after following the current guide. Add a step (English + Persian) instructing users to also check /etc/ssh/sshd_config.d/50-cloud-init.conf and set `PasswordAuthentication no` there when it exists. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The guide Disable SSH Password Authentication (
docs/manager/basic-concepts-and-troubleshooting/Disable-SSH-Password-Authentication) tells users to setPasswordAuthentication noin/etc/ssh/sshd_configand restart SSH.On most modern cloud images this is not enough. Ubuntu/Debian ship
/etc/ssh/sshd_configwith an include directive near the top:and many cloud providers (Azure, AWS, Oracle Cloud, Hetzner, Vultr, …) provision a drop-in file
/etc/ssh/sshd_config.d/50-cloud-init.confthat containsPasswordAuthentication yes. Becausesshduses the first value it finds for each option and the include sits at the top, that drop-in overrides the value set later in the main file.The result: after following the guide exactly and restarting SSH, password login still works. I reproduced this on a fresh server.
Fix
Add a step to Step 2 (in both the English and Persian versions) instructing users to also check
/etc/ssh/sshd_config.d/50-cloud-init.confand, if it exists, setPasswordAuthentication nothere as well.Files changed
docs/manager/basic-concepts-and-troubleshooting/Disable-SSH-Password-Authentication.md(English)docs/manager/basic-concepts-and-troubleshooting/Disable-SSH-Password-Authentication.fa.md(Persian)Documentation only — no other files touched.
🤖 Generated with Claude Code