particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

distro/rhel85: disable pw auth for EC2 images

Browse source 
Disable loging in via password authentication since this is an
official Amazon marketplace requirement

  Linux-based AMIs must not allow SSH password authentication.
  Disable password authentication via your sshd_config file by
  setting PasswordAuthentication to NO.

  Section "Security policies" from
  https://docs.aws.amazon.com/marketplace/latest/userguide/product-and-ami-policies.html
This commit is contained in:
Christian Kellner 2022-01-28 16:06:38 +00:00 • committed by Tomáš Hozza
parent 6f132181d9
commit 8aede24057
6 changed files with 46 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
internal/distro/rhel85/pipelines.go
View file

@ -371,6 +371,12 @@ func ec2BaseTreePipeline(repos []rpmmd.RepoConfig, packages []rpmmd.PackageSpec,
p.AddStage(osbuild.NewRHSMStage(rhsmStageOptions))
}
p.AddStage((osbuild.NewSshdConfigStage(&osbuild.SshdConfigStageOptions{
Config: osbuild.SshdConfigConfig{
PasswordAuthentication: common.BoolToPtr(false),
},
})))
return p, nil
}

8
test/data/manifests/rhel_85-aarch64-ami-boot.json
View file

@ -1060,6 +1060,14 @@
}
}
},
{
"type": "org.osbuild.sshd.config",
"options": {
"config": {
"PasswordAuthentication": false
}
}
},
{
"type": "org.osbuild.fstab",
"options": {

8
test/data/manifests/rhel_85-aarch64-ec2-boot.json
View file

@ -1074,6 +1074,14 @@
}
}
},
{
"type": "org.osbuild.sshd.config",
"options": {
"config": {
"PasswordAuthentication": false
}
}
},
{
"type": "org.osbuild.fstab",
"options": {

8
test/data/manifests/rhel_85-x86_64-ami-boot.json
View file

@ -1035,6 +1035,14 @@
}
}
},
{
"type": "org.osbuild.sshd.config",
"options": {
"config": {
"PasswordAuthentication": false
}
}
},
{
"type": "org.osbuild.dracut.conf",
"options": {

8
test/data/manifests/rhel_85-x86_64-ec2-boot.json
View file

@ -1050,6 +1050,14 @@
}
}
},
{
"type": "org.osbuild.sshd.config",
"options": {
"config": {
"PasswordAuthentication": false
}
}
},
{
"type": "org.osbuild.dracut.conf",
"options": {

8
test/data/manifests/rhel_85-x86_64-ec2_ha-boot.json
View file

@ -1234,6 +1234,14 @@
}
}
},
{
"type": "org.osbuild.sshd.config",
"options": {
"config": {
"PasswordAuthentication": false
}
}
},
{
"type": "org.osbuild.dracut.conf",
"options": {