diff --git a/images/fedora-cosmic/files/10-kanidm.conf b/images/fedora-cosmic/files/10-kanidm.conf
index dc7c9e4..77f85b1 100644
--- a/images/fedora-cosmic/files/10-kanidm.conf
+++ b/images/fedora-cosmic/files/10-kanidm.conf
@@ -5,3 +5,12 @@ PubkeyAuthentication yes
 UsePAM yes
 AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u
 AuthorizedKeysCommandUser nobody
+
+# Hardening: key-only auth through Kanidm. Make sure you have uploaded an SSH
+# public key to your account before relying on this, or you can lock yourself
+# out of SSH.
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+GSSAPIAuthentication no
+KerberosAuthentication no