Misthios/bootc-images
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

fedora-cosmic: harden sshd for Kanidm key-only auth
Build containers / fedora-cosmic (rawhide) (push) Failing after 54s
Details
Build containers / fedora-cosmic (44) (push) Successful in 12m1s
Details
Build containers / Prune old releases (push) Successful in 22s
Details

Browse Source 
Disable password/root/GSSAPI/Kerberos SSH auth now that public keys are
served by Kanidm.
This commit is contained in:
Misthios
2026-09-27 22:11:55 +02:00
parent 0e4ea86f22
commit 6822bc3061
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
images/fedora-cosmic/files/10-kanidm.conf
+9
View File
@@ -5,3 +5,12 @@ PubkeyAuthentication yes
UsePAM yes UsePAM yes
AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u
AuthorizedKeysCommandUser nobody AuthorizedKeysCommandUser nobody
# Hardening: key-only auth through Kanidm. Make sure you have uploaded an SSH
# public key to your account before relying on this, or you can lock yourself
# out of SSH.
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
GSSAPIAuthentication no
KerberosAuthentication no