#55 Fix OpenSSH PasswordAuthentication doc
Closed by vorburger. Opened by vorburger.
fedora-docs/ vorburger/system-administrators-guide fix-PasswordAuthentication-master  into  master

Download 55.patch

The doc re. PasswordAuthentication is wrong, changing it only in /etc/ssh/sshd_config is not sufficient, because /etc/ssh/sshd_config.d/50-redhat.conf also contains a PasswordAuthentication which needs to be changed as well (because it defaults to yes).

PS: Is this default really a good idea?! Has it already been considered, discussed and rejected to change this default in a future Fedora version? I stumbled upon this while fixing a box that kept getting automated root login accounts every 5 seconds...

FYI this is my very first PR to Fedora... thank you for your kind guidance if doing it like this here is wrong?

PS: I'm well familiar with Git and PRs in general, see https://github.com/vorburger.

Thanks for the contribution! A style comment and then a substance question.

Style comment: our standard practice is to write a sentence per line in order to make diffs more manageable. I know the previous version didn't follow it, but it would be good to fix that in future edits.

Substance question: Are you sure that's correct? Looking at an unmodified install, it looks like /etc/ssh/sshd_config does not explicitly set PasswordAuthentication (i.e. it's commented out), so changing it in /etc/ssh/sshd_config.d/50-readhat.conf should be sufficient.

As for whether or not that's the right default, I'd suggest discussing it with the openssh maintainers (by filing a bug against openssh in Bugzilla or emailing openssh-owner @ fedoraproject.org).

rebased onto d29ce82eabac045093168ea3eabb1f5338d3c4b3

@bcotton done! Ok? (Sorry it took a moment to get back to this.)

The current version looks good to me: https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/infrastructure-services/OpenSSH/#s2-ssh-configuration-keypairs. Can you check again?

OK, in that case, let me close this.

PS: I was surprised that "it is lexicographically before the 50-redhat.conf" (I would have thought it has to be after, to override?), but be that as it may.

Pull-Request has been closed by vorburger

Yes, it's not obvious, but from the man page:

For each keyword, the first obtained value will be used.
Metadata