Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://fosstodon.org/users/mort/statuses/113855473402304315">mort (mort@fosstodon.org)'s status on Monday, 20-Jan-2025 00:39:06 JST</a><a href="https://fosstodon.org/@mort" title="mort@fosstodon.org"><img src="https://gnusocial.jp/avatar/205295-48-20231029064000.webp" width="48" height="48" alt="mort" style="position: absolute; left: 0; top: 0;">mort</a></section><article><p>Okay this is wild: I just noticed that changing 'PasswordAuthentication' to 'no' in /etc/ssh/sshd_config is no longer enough to disable password authentication in <a href="https://fosstodon.org/tags/ubuntu" rel="tag">#ubuntu</a>. That's because Ubuntu Server now by default creates a sshd_config.d/50-cloud-init.conf file which contains 'PasswordAuthentication yes' which takes priority over sshd_config.</p><p>I would've unknowingly left password auth on if I hadn't double checked.</p><p>Why?</p><p>More: <a href="https://askubuntu.com/questions/1516262/why-is-50-cloud-init-conf-created" rel="nofollow noreferrer">https://askubuntu.com/questions/1516262/why-is-50-cloud-init-conf-created</a></p><p><a href="https://fosstodon.org/tags/security" rel="tag">#security</a> <a href="https://fosstodon.org/tags/linux" rel="tag">#linux</a> <a href="https://fosstodon.org/tags/server" rel="tag">#server</a> <a href="https://fosstodon.org/tags/ubuntuserver" rel="tag">#ubuntuserver</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4404299#notice-8615584">In conversation</a><time datetime="2025-01-20T00:39:06+09:00" title="Monday, 20-Jan-2025 00:39:06 JST">about 4 months ago</time> <span>from <span><a href="https://fosstodon.org/@mort/113855473402304315" rel="external" title="Sent from fosstodon.org via ActivityPub">fosstodon.org</a></span></span><a href="https://fosstodon.org/@mort/113855473402304315">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: cdn.sstatic.net</div><h5><a href="https://askubuntu.com/questions/1516262/why-is-50-cloud-init-conf-created#security">Why is "50-cloud-init.conf" created?</a></h5><div></div></header><div>I was setting up an ubuntu server and, like 99% of all people, one of the first things I do is to disable password authentication in favor of keys.
On other distros and in other times this is done by</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
mort (mort@fosstodon.org)'s status on Monday, 20-Jan-2025 00:39:06 JST mort
Okay this is wild: I just noticed that changing 'PasswordAuthentication' to 'no' in /etc/ssh/sshd_config is no longer enough to disable password authentication in #ubuntu. That's because Ubuntu Server now by default creates a sshd_config.d/50-cloud-init.conf file which contains 'PasswordAuthentication yes' which takes priority over sshd_config.
I would've unknowingly left password auth on if I hadn't double checked.
Why?
More: https://askubuntu.com/questions/1516262/why-is-50-cloud-init-conf-created
#security #linux #server #ubuntuserver
In conversationabout 4 months ago from fosstodon.orgpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: cdn.sstatic.net
  Why is "50-cloud-init.conf" created?
  I was setting up an ubuntu server and, like 99% of all people, one of the first things I do is to disable password authentication in favor of keys. On other distros and in other times this is done by

Public

Embed Notice

HTML Code

Corresponding Notice