Re: Fedora 31 System-Wide Change proposal: Disable Root Password Login in SSH

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 2019-05-17 at 11:54 -0700, Kevin Fenzi wrote:
> On 5/17/19 11:34 AM, Stephen John Smoogen wrote:
> > On Fri, 17 May 2019 at 14:02, Chris Adams <linux@xxxxxxxxxxx>
> > wrote:
> ...snip...
> > > > Make it a predefined kickstart thing they can do so all they
> > > > have to do
> > > is
> > > > add a line in it that says
> > > > 
> > > > ssh_remote --user=<account> --keyfile=<url> --
> > > > yesIwantrootandIknowitsbad
> > > 
> > > If this is the desired path, I'd go with a couple of additional
> > > arguments to existing directives:
> > > 
> > >   --enablerootssh (for rootpw or maybe auth?)
> > >   --sshkey (for both rootpw and user directives)
> > > 
> > > 
> > Yeah.. --sshkey is a better name than --keyfile
> > and --enablerootssh is better than --yesIwantrootandIknowitsbad
> 
> Some may notice this has already happened in Fedora 22:
> 
> https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html?highlight=ssh#sshkey
> 
> I think there were some arm install cases that still needed ssh root
> login post install, but those might be covered now (for example, a
> host
> that needs to join a ipa realm, so you need to login as root to set
> that
> up). CCing dgillmore here as I think he was the one who had the
> example
> last time this was brought up.

Thank you for all the comments and suggestions. I would like to cover
the important options in the change page so they can be used for a
reference for anyone trying to figure out a solution for their use
case. So far, I added the above link to the "Upgrade/compatibility
impact" section, but since I am only a developer here and I do not
maintain thousands of machines in the wild spawn by different
technologies, I would like to ask you to update the page with your
proposed solutions to your problems (it is still a wiki in the end).

For anaconda, I filled the following issue [1].

[1] https://github.com/rhinstaller/anaconda/issues/1974

Regards,
-- 
Jakub Jelen
Senior Software Engineer
Security Technologies
Red Hat, Inc.
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux