Misthios
6d70a1bfb9
New image built from upstream base-atomic (no desktop), adding only gnome-shell + gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm. recommends=false to stay lean. Configures GNOME Remote Desktop headless remote login on first boot (TLS + credentials + enable). Firefox preinstalled as a per-user Flatpak. Add it to the CI matrix and prune both images.
17 lines
630 B
Plaintext
17 lines
630 B
Plaintext
# Fetch authorized SSH public keys from Kanidm (uploaded to the account).
|
|
# Name this 10-* so it is read before systemd-userdbd's AuthorizedKeysCommand
|
|
# drop-in, since sshd honours the first directive it sees.
|
|
PubkeyAuthentication yes
|
|
UsePAM yes
|
|
AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u
|
|
AuthorizedKeysCommandUser nobody
|
|
|
|
# Hardening: key-only auth through Kanidm. Make sure you have uploaded an SSH
|
|
# public key to your account before relying on this, or you can lock yourself
|
|
# out of SSH.
|
|
PermitRootLogin no
|
|
PasswordAuthentication no
|
|
PermitEmptyPasswords no
|
|
GSSAPIAuthentication no
|
|
KerberosAuthentication no
|