DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it

2026-11-09T17:06:23Z

cryptograss/maybelle-config#278, as GitHub has it

← Older revision		Revision as of 17:06, 9 November 2026
Line 16:		Line 16:
	\|deploy=		\|deploy=
	}}		}}
			<pre class="pr-body">## What's wrong now

			I probed each server's sshd with the `none` auth method from hunter at block 26,349,412. The list in brackets is what each server offers next:

			\| box \| offers \|
			\|---\|---\|
			\| hunter (:22) \| publickey \|
			\| maybelle \| publickey, password \|
			\| pickipedia (5.78.112.39) \| publickey, password \|
			\| delivery-kid (46.62.220.103) \| publickey, password \|
			\| NearlyFreeSpeech \| publickey, password, keyboard-interactive (their sshd, outside this repo) \|

			Only hunter has a role that turns passwords off (`hunter/ansible/roles/security`). The other three have nothing in deploy logic about sshd. My guess is that the Hetzner cloud image's `50-cloud-init.conf` sets `PasswordAuthentication yes`, but I haven't read those boxes' files to confirm it.

			## What this does

			It adds a shared role, `shared/ansible/roles/ssh-keys-only`, and includes it in all four playbooks, next to ssh-announce. The role:

			- writes `/etc/ssh/sshd_config.d/00-keys-only.conf` with `PasswordAuthentication no`, `KbdInteractiveAuthentication no`, `PermitEmptyPasswords no`, `PermitRootLogin prohibit-password` and `PubkeyAuthentication yes`
			- uses a drop-in rather than editing `sshd_config`, because sshd keeps the first value it reads for each setting and Ubuntu reads `sshd_config.d/*.conf` first, so `00-` beats cloud-init's `50-`
			- validates the file with `sshd -t` before writing it, and reloads ssh only if the file changed
			- asserts that `sshd -T` reports the effective settings, so the deploy fails loudly if anything still lets a password in

			Tested: in a throwaway ubuntu:24.04 container with a `50-cloud-init.conf` saying `PasswordAuthentication yes`:
			- before the drop-in, `sshd -T` gave `passwordauthentication yes`
			- after it, `sshd -T` gave `passwordauthentication no`
			- `sshd -t -f` passed on the drop-in alone

			Not tested: I couldn't run `ansible-playbook --syntax-check`, because ansible isn't in my container. All five YAML files parse.

			## If you deploy this

			- Anyone who logs into maybelle, pickipedia or delivery-kid with a password loses that way in. Key logins, including the deploy keys and maybelle's key to the others, are unchanged.
			- Root keeps key login. If root currently has `PermitRootLogin yes`, that becomes key-only.
			- If a box locks you out, the Hetzner console still works.

			Redeploy: hunter, maybelle, pickipedia, delivery-kid
			Worked on by: magent, at justin's question, in #security</pre>

DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it

2026-11-05T18:18:21Z

cryptograss/maybelle-config#278, as GitHub has it

← Older revision		Revision as of 18:18, 5 November 2026
Line 5:		Line 5:
	\|url=https://github.com/cryptograss/maybelle-config/pull/278		\|url=https://github.com/cryptograss/maybelle-config/pull/278
	\|author=magent-cryptograss		\|author=magent-cryptograss
	\|state=~~open~~		\|state=merged
	\|base=production		\|base=production
	\|branch=ssh-no-passwords		\|branch=ssh-no-passwords
	\|opened=2026-11-05 15:08:16		\|opened=2026-11-05 15:08:16
	\|pushed=2026-11-05 15:07:59		\|pushed=2026-11-05 15:07:59
	\|merged=		\|merged=2026-11-05 18:18:17
	\|closed=		\|closed=
	\|worked_on_by=magent, at justin's question		\|worked_on_by=magent, at justin's question

DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it

2026-11-05T15:08:21Z

cryptograss/maybelle-config#278, as GitHub has it

New page

{{PR
|repo=maybelle-config
|number=278
|title=SSH by key only on every box we run
|url=https://github.com/cryptograss/maybelle-config/pull/278
|author=magent-cryptograss
|state=open
|base=production
|branch=ssh-no-passwords
|opened=2026-11-05 15:08:16
|pushed=2026-11-05 15:07:59
|merged=
|closed=
|worked_on_by=magent, at justin's question
|moods=security
|deploy=
}}

VersionControl:PRs/maybelle-config/278 - Revision history

DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it

DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it

DrivingThatTrain: cryptograss/maybelle-config#278, as GitHub has it