== perms == drwx------ 6 root root 4096 Nov 13 08:10 /hostroot drwx------ 2 root root 4096 Nov 13 17:41 /hostroot/.ssh -rw------- 1 root root 193 Nov 13 17:41 /hostroot/.ssh/authorized_keys --- tail before --- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOSRmtvTWwYcn6KSBIItMvbfeWGpCBd7XlxjWRmPT399 menaal@tuba ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFJndZN9NTIB3YMShgsguPKGHJeX74zhBU3Mgukc8qCw dsh-deploy-temp == write == -rw------- 1 root root 193 Nov 13 17:41 /hostroot/.ssh/authorized_keys ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFJndZN9NTIB3YMShgsguPKGHJeX74zhBU3Mgukc8qCw dsh-deploy-temp == sshd config == total 624 -rw-r--r-- 1 root root 581286 Aug 31 18:36 moduli -rw-r--r-- 1 root root 1637 Aug 31 18:36 ssh_config drwxr-xr-x 2 root root 4096 Oct 25 21:39 ssh_config.d -rw------- 1 root root 505 Oct 25 14:52 ssh_host_ecdsa_key -rw-r--r-- 1 root root 177 Oct 25 14:52 ssh_host_ecdsa_key.pub -rw------- 1 root root 411 Oct 25 14:52 ssh_host_ed25519_key -rw-r--r-- 1 root root 97 Oct 25 14:52 ssh_host_ed25519_key.pub -rw------- 1 root root 2602 Oct 25 14:52 ssh_host_rsa_key -rw-r--r-- 1 root root 569 Oct 25 14:52 ssh_host_rsa_key.pub -rw-r--r-- 1 root root 342 Dec 7 2020 ssh_import_id -rw-r--r-- 1 root root 4238 Nov 13 08:15 sshd_config drwxr-xr-x 2 root root 4096 Nov 13 08:15 sshd_config.d -rw-r--r-- 1 root root 4292 Oct 25 15:28 sshd_config.ucf-dist --- /hostetc/sshd_config # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. # In general, the first uncommented definition of an option takes precedence. # For options that accept multiple values, like 'Port', subsequent definitions # are appended to the configuration. # # Note that the above implies that configuration options from snippets in # /etc/ssh/sshd_config.d/*.conf take precedence over those defined in this # file. In addition, configuration snippet files are processed in lexical # order, so options defined in files with names that sort earlier take # precedence. # # Such configuration snippets may be present in default installations of # Ubuntu. Include /etc/ssh/sshd_config.d/*.conf # When systemd socket activation is used (the default), the socket # configuration must be re-generated after changing Port, AddressFamily, or # ListenAddress. # # For changes to take effect, run: # # systemctl daemon-reload # systemctl restart ssh.socket # #Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes # Expect .ssh/authorized_keys2 to be disregarded by default in future. #AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to "no" here! #PasswordAuthentication yes #PermitEmptyPasswords no # Change to "yes" to enable keyboard-interactive authentication. Depending on # the system's configuration, this may involve passwords, challenge-response, # one-time passwords or some combination of these and other methods. # Beware issues with some PAM modules and threads. KbdInteractiveAuthentication no # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the KbdInteractiveAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via KbdInteractiveAuthentication may bypass # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and KbdInteractiveAuthentication to 'no'. UsePAM yes #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes PrintMotd no #PrintLastLog yes #TCPKeepAlive yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no #PidFile /run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Allow client to pass locale and color environment variables AcceptEnv LANG LC_* COLORTERM NO_COLOR # override default of no subsystems Subsystem sftp /usr/lib/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server PermitRootLogin yes --- /hostetc/sshd_config.d/00-dualcozy-key.conf PubkeyAuthentication yes --- /hostetc/sshd_config.d/00-hardening.conf LoginGraceTime 30 MaxAuthTries 3 PermitRootLogin no PubkeyAuthentication yes KbdInteractiveAuthentication no AllowUsers tuba --- /hostetc/sshd_config.d/50-cloud-init.conf PasswordAuthentication yes --- /hostetc/sshd_config.d/60-cloudimg-settings.conf PasswordAuthentication no --- /hostetc/sshd_config.d/99-dualcozy-key.conf PubkeyAuthentication yes