Re: [PATCH server-a001 v1 1/1] Apply default SSH config and add public keys

[Alviro Iskandar Setiawan <alviro.iskandar@gmail.com>]

On Sat, Apr 16, 2022 at 12:16 AM Ammar Faizi <ammarfaizi2@gnuweeb.org> wrote:
>
> 1) Set the default port to 48589, don't use port 22 since we will
>    inevitably get brute-force SSH attack from random botnets. Even if
>    it's not really a concern if we're using a private key for the auth,
>    let's not spam our auth log with many login failed lines.

The sshd_config in this patch doesn't disable the password auth, tho

This:

> +PermitRootLogin prohibit-password

only disables password auth for root, you're still asked to enter the
password, but it will never work for root even if the root password is
correct. However, if the login user is not root, the password auth is
still valid.

> +# To disable tunneled clear text passwords, change to no here!
> +#PasswordAuthentication yes

This should be set to "no" to really disable password auth.

-- Viro