fedora-cosmic: harden sshd for Kanidm key-only auth

Disable password/root/GSSAPI/Kerberos SSH auth now that public keys are served by Kanidm.
2026-09-27 22:11:55 +02:00
parent 0e4ea86f22
commit 6822bc3061
1 changed files with 9 additions and 0 deletions
@@ -5,3 +5,12 @@ PubkeyAuthentication yes
 UsePAM yes
 AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u
 AuthorizedKeysCommandUser nobody
+
+# Hardening: key-only auth through Kanidm. Make sure you have uploaded an SSH
+# public key to your account before relying on this, or you can lock yourself
+# out of SSH.
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+GSSAPIAuthentication no
+KerberosAuthentication no