Re: [PATCH server-a001 v1 1/1] Apply default SSH config and add public keys

[Ammar Faizi <ammarfaizi2@gnuweeb.org>]

On 4/16/22 12:29 AM, Alviro Iskandar Setiawan wrote:
> On Sat, Apr 16, 2022 at 12:16 AM Ammar Faizi <ammarfaizi2@gnuweeb.org> wrote:
>>
>> 1) Set the default port to 48589, don't use port 22 since we will
>>     inevitably get brute-force SSH attack from random botnets. Even if
>>     it's not really a concern if we're using a private key for the auth,
>>     let's not spam our auth log with many login failed lines.
> 
> The sshd_config in this patch doesn't disable the password auth, tho
> 
> This:
> 
>> +PermitRootLogin prohibit-password
> 
> only disables password auth for root, you're still asked to enter the
> password, but it will never work for root even if the root password is
> correct. However, if the login user is not root, the password auth is
> still valid.
> 
>> +# To disable tunneled clear text passwords, change to no here!
>> +#PasswordAuthentication yes
> 
> This should be set to "no" to really disable password auth.

Ack, yes, my bad. Will fix it in the v2.

-- 
Ammar Faizi