VersionControl:PRs/maybelle-config/278

maybelle-config#278: SSH by key only on every box we run

State	🟣 merged 2026-11-05 18:18:17
Worked on by	magent, at justin's question
Moods	#security
Deploy	not said
Branch	ssh-no-passwords → production, by magent-cryptograss
Opened · last pushed	2026-11-05 15:08:16 · 2026-11-05 15:07:59

## What's wrong now

I probed each server's sshd with the `none` auth method from hunter at block 26,349,412. The list in brackets is what each server offers next:

| box | offers |
|---|---|
| hunter (:22) | publickey |
| maybelle | publickey, **password** |
| pickipedia (5.78.112.39) | publickey, **password** |
| delivery-kid (46.62.220.103) | publickey, **password** |
| NearlyFreeSpeech | publickey, **password, keyboard-interactive** (their sshd, outside this repo) |

Only hunter has a role that turns passwords off (`hunter/ansible/roles/security`). The other three have nothing in deploy logic about sshd. My guess is that the Hetzner cloud image's `50-cloud-init.conf` sets `PasswordAuthentication yes`, but I haven't read those boxes' files to confirm it.

## What this does

It adds a shared role, `shared/ansible/roles/ssh-keys-only`, and includes it in all four playbooks, next to ssh-announce. The role:

- writes `/etc/ssh/sshd_config.d/00-keys-only.conf` with `PasswordAuthentication no`, `KbdInteractiveAuthentication no`, `PermitEmptyPasswords no`, `PermitRootLogin prohibit-password` and `PubkeyAuthentication yes`
- uses a drop-in rather than editing `sshd_config`, because sshd keeps the first value it reads for each setting and Ubuntu reads `sshd_config.d/*.conf` first, so `00-` beats cloud-init's `50-`
- validates the file with `sshd -t` before writing it, and reloads ssh only if the file changed
- asserts that `sshd -T` reports the effective settings, so the deploy fails loudly if anything still lets a password in

**Tested:** in a throwaway ubuntu:24.04 container with a `50-cloud-init.conf` saying `PasswordAuthentication yes`:
- before the drop-in, `sshd -T` gave `passwordauthentication yes`
- after it, `sshd -T` gave `passwordauthentication no`
- `sshd -t -f` passed on the drop-in alone

**Not tested:** I couldn't run `ansible-playbook --syntax-check`, because ansible isn't in my container. All five YAML files parse.

## If you deploy this

- Anyone who logs into maybelle, pickipedia or delivery-kid with a password loses that way in. Key logins, including the deploy keys and maybelle's key to the others, are unchanged.
- Root keeps key login. If root currently has `PermitRootLogin yes`, that becomes key-only.
- If a box locks you out, the Hetzner console still works.

Redeploy: hunter, maybelle, pickipedia, delivery-kid
Worked on by: magent, at justin's question, in #security