OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      f95ca6bb5214
DATE      2025-05-09
SUBJECT   openssh: allow prohibit-password for installer role
FILES     1 CHANGED
HASH      f95ca6bb5214
DATE      2025-05-09
SUBJECT   openssh: allow prohibit-password for
          installer role
FILES     1 CHANGED
 

diff --git a/modules/nixos/base/openssh.nix b/modules/nixos/base/openssh.nix
index 428b11f..efaf69a 100644
--- a/modules/nixos/base/openssh.nix
+++ b/modules/nixos/base/openssh.nix
@@ -1,4 +1,4 @@
-let
+{config, ...}: let
   # restict key exchange, cipher, and MAC algorithms, as per <https://www.ssh-aud
it.com>
   KexAlgorithms = [
     "[email protected]"
@@ -21,6 +21,7 @@ let
     "[email protected]"
     "[email protected]"
   ];
+  inherit (config.ooknet.host) role;
 in {
   services = {
     openssh = {
@@ -31,7 +32,10 @@ in {
         inherit KexAlgorithms Ciphers Macs;
         UseDns = true;
         PubkeyAuthentication = "yes";
-        PermitRootLogin = "no";
+        PermitRootLogin =
+          if (role == "installer")
+          then "prohibit-password"
+          else "no";
         PermitEmptyPasswords = "no";
         PasswordAuthentication = false;
 


diff --git a/modules/nixos/base/openssh.nix 
b/modules/nixos/base/openssh.nix
index 428b11f..efaf69a 100644
--- a/modules/nixos/base/openssh.nix
+++ b/modules/nixos/base/openssh.nix
@@ -1,4 +1,4 @@
-let
+{config, ...}: let
   # restict key exchange, cipher, and MAC a
lgorithms, as per <https://www.ssh-audit.com
>
   KexAlgorithms = [
     "[email protected]"
@@ -21,6 +21,7 @@ let
     "[email protected]"
     "[email protected]"
   ];
+  inherit (config.ooknet.host) role;
 in {
   services = {
     openssh = {
@@ -31,7 +32,10 @@ in {
         inherit KexAlgorithms Ciphers Macs;
         UseDns = true;
         PubkeyAuthentication = "yes";
-        PermitRootLogin = "no";
+        PermitRootLogin =
+          if (role == "installer")
+          then "prohibit-password"
+          else "no";
         PermitEmptyPasswords = "no";
         PasswordAuthentication = false;
 

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET