Post #3698204

Today I rented a server for the first time in my life. I ordered it on Monday, today I finally got access. Obviously, I've used #SSH many times before, since years. I know the `ssh-keygen -t ed25519` by heart. I wanted to have the server config reproducible, so I asked #claude #opus (you know, the "smart" one) to write an ansible playbook for me. (Because I've never really used ansible before.) Within two/three hours I had gotten myself *twice* into a situation where I needed to access the server through some fallback method (server console in the browser). :blob_grinning_sweat: The reason is that I wanted a somewhat hardened SSH setup. So Claude produced a config with `PermitRootLogin no`. Sensible. I saw it. I ran ansible, afterwards I couldn't log in anymore, because #Claude recommended to defer creating a non-root user account to the second step. I didn't think it through enough. That was issue 1. The fix was simple enough: I restored SSH access for `root`. I adapted the ansible playbool so that `PermitRootLogin` would only be set if there are other admin users. That fixed issue 1. So I continued. I set the config for adding the new user. It got added to the `sudo` group, but I didn't want to allow `sudo` without password. The user got it's own SSH key, the `.ssh` folder and the `.ssh/authorized_keys` had the right permissions. I ran ansible again. It worked, the new user was created. Now that there was another admin user in the config, ansible reestablished the `PermitRootLogin no`. I tried to log in as the new user, no problem. I tried running `sudo` and... it asked for the new user's password. But the user didn't have a password. That was issue 2. Fixing it was again simple: Log in as root (via the web console), set a password for the user. Still, I'm quite annoyed by myself screwing up two times in so short succession. Normally I pride myself in knowing what I'm doing (in most things I'm doing).