Post #2672651
2026-05-12 14:29 UTC
Today I realized that to properly disable password auth on servers you need to modify both `/etc/ssh/sshd_config` AND `/etc/ssh/sshd_config.d/50-cloud-init.conf` otherwise it still stays enabled
#cybersecurity #linux
Replies (2)
-
@crmsnbleyd@hachyderm.io 2026-05-12 15:48
@alicegg@hachyderm.io you could do a recursive grep in the .d/ directory for "PasswordAuthentication" to find every file with a setting for this
-
@kln@mstdn.io 2026-05-13 06:32
@alicegg@hachyderm.io (please feel free to ignore me; have just spent way to much time obsessing over sshd) It should be enough to disable the password auth in the 50-cloud-init.conf file. Sshd uses "first mention" and ignores duplicates when reading config files. As the "include" statement in the sshd_config file is at the top, it starts by loading the config files from sshd_config.d in alphabetical order, so when cloud init says disable, it should disable it even if it is enabled in the sshd_config file.