Post #2850698
2026-05-13 06:32 UTC
@alicegg@hachyderm.io (please feel free to ignore me; have just spent way to much time obsessing over sshd)
It should be enough to disable the password auth in the 50-cloud-init.conf file.
Sshd uses "first mention" and ignores duplicates when reading config files. As the "include" statement in the sshd_config file is at the top, it starts by loading the config files from sshd_config.d in alphabetical order, so when cloud init says disable, it should disable it even if it is enabled in the sshd_config file.
Replies (1)
-
@kln@mstdn.io 2026-05-13 06:32
It is why many people have a drop-in hardened config for sshd (for example "20-custom.conf") that can be put in the config.d dir. It also ensures that any changes still apply even if an update were to mess around with the standard sshd config file (assuming the include statement is kept at the top of the standard config file). 🙂🤓