fix(std.yml): don't allow SSH logins as root using password authn

There's not point in allowing it, forbid it instead.

Sponsored-by: author

1 files changed, 6 insertions, 0 deletions

diff --git a/std.yml b/std.yml
index 9a46c1c..fdb56f8 100644
--- a/std.yml
+++ b/std.yml
@@ -41,6 +41,12 @@
           {{ user_ca_pubkey }}
         dest: /etc/ssh/user_ca_keys
 
+    - name: "restrict root logins over ssh to require a key"
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regex: "#* *PasswordAuthentication"
+        line: "PasswordAuthentication no"
+
     - name: "configure sshd to accept CA for users"
       when: user_ca_pubkey is defined
       copy: