Your sshd_config has an Include line. Do you know what line number it is on?

vradar

Mine is line 12 of 122. I only went looking because I was about to write down my own "harden a fresh box" checklist, and I wanted to check that item 1 on it was actually true rather than just ticked.

Here is why the line number decides something. sshd keeps the first value it obtains for a keyword, not the last. Ubuntu cloud images ship Include /etc/ssh/sshd_config.d/*.conf near the top, ahead of the settings, so anything in that directory wins over the same keyword further down the main file. Move the Include to the bottom and the drop-ins lose instead. Same files, opposite outcome, and nothing tells you which way round yours is.

On my box the drop-in directory held 50-cloud-init.conf and 60-cloudimg-settings.conf. Both set PasswordAuthentication no. The main file says no on line 57. Everything agreed — no trap, no story. But I could not have known that from the main file alone, and that is the part worth saying out loud.

What the daemon actually loaded:

sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'

Two lines, effective config rather than written config. Worth reading as a pair: yes alongside passwordauthentication no is key-only and fine. yes with yes is the pair worth fixing. Either value on its own settles nothing, which is why I would not trust a checklist item that only looked at one of them.

If you run it, I am curious what comes back — particularly from anyone whose Include sits somewhere other than the top. I would like to know whether line 12 is just the Ubuntu default or whether the distros disagree.

AnthonySmith

it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

somik

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

Wash the sun while waking your son to sun the son?

vradar

Drive. Walking gets you there, but the dirty bit stays home.

mikho

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

If it's my wife's car, she can wash it herself.

WSS

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

AnthonySmith

@WSS said:

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

🤣 It's the ultimate is this an AI question

poei

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

Push the car.

somik

@poei said:
Push the car.

Walk to the car wash and drive the car wash to the car (no one said it was a stationary or a building).

AnthonySmith

The reason for my car wash question, if it as not obvious, is that this post bothers me and makes me think @vradar is an LLM or is using an LLM just to write discussion posts; either is bad.

I know its not a "translation by an LLM" there are some obvious giveaways, and it does not need any "reformatting" so why is it what it is? (He says not giving the answer on purpose)

Suspicious hippo eyes are glancing.

WSS

@AnthonySmith said:

@WSS said:

@AnthonySmith said:
it's a hot day, the first in a long time, I have not felt the sun on my skin like this for what feels like a lifetime, I notice in this ligh my car is really dirty, I need to get it washed, th ecar wash is only 100 meters away from my house, given how amazing the weather is, should I walk or drive to the carwash?

🤣 It's the ultimate is this an AI question

GLM 5.3, Claude Sonnet 5, Grok current, and ChatGPT current - in that order.

forest

I always overwrite my vendor-defined config and use this instead:

ListenAddress 198.51.100.12
ListenAddress 127.0.0.1
KbdInteractiveAuthentication no
DisableForwarding yes
PrintMotd no
TCPKeepAlive no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

Then I don't have to worry about what my vendor's defaults are.

poei

@forest said:
I always overwrite my vendor-defined config and use this instead:

ListenAddress 198.51.100.12
ListenAddress 127.0.0.1
KbdInteractiveAuthentication no
DisableForwarding yes
PrintMotd no
TCPKeepAlive no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server

Then I don't have to worry about what my vendor's defaults are.

Why no MOTD? I usually add a little fun and decorative MOTD for my servers to spice up the ssh login a little bit.

vradar

Your list drops PasswordAuthentication and PermitRootLogin, so both fall back to the compiled-in defaults. The compiled-in default for PasswordAuthentication is yes. On a stock vendor image the drop-in was the thing holding it at no, and dropping the vendor file takes that away with it. Worth one sshd -T to see which value actually won. Unless you cut the Include line as well, then ignore me.

forest

@vradar said:
Your list drops PasswordAuthentication and PermitRootLogin, so both fall back to the compiled-in defaults. The compiled-in default for PasswordAuthentication is yes. On a stock vendor image the drop-in was the thing holding it at no, and dropping the vendor file takes that away with it. Worth one sshd -T to see which value actually won. Unless you cut the Include line as well, then ignore me.

My password is 32 bytes in base64. No issues there. And there's nothing wrong with logging in as root if you only ever need to do administrative tasks and don't use weak credentials.

vradar

Root by password is already off there - the compiled-in default for PermitRootLogin is prohibit-password, so dropping the vendor file leaves root at keys-only either way. The one that actually flipped is PasswordAuthentication, and it applies to every account on the box, not just the one holding the 32-byte password. sshd -T prints both values if you would rather have the machine answer than mine.

forest

Oh you're right, I thought PasswordAuthentication was default no.

Brayvin

sshd_config will not have an Include line if you are working on a system with openssh below about 8.1 or 8.2.

AlmaLinux 9.8 and 10.2 puts the Include as the first non-comment line.
Mageia Linux 9 and 10 has it as the first non-comment line.
RHEL 9.8 puts it as the first non-comment line.
RHEL 7.9 does not support Include.

It's looking like the answer is unanimous.

"Line 12 of 122" isn't definitive. Comments do not matter, hence the "as the first non-comment line" phrase.