Configuring a user should not configure root's authorized_keys

[Florian Apolloner]

When `ssh_authorized_keys` is configured in user-data keys are unconditionally copied into /root/.ssh/authorized_keys.

If `disable_root` is set to true it leaks the actual configured username: "Please login as the user XYZ rather than the user root." With `disable_root` set to false you can login.

It would be great if there were a way to actually disable root and not touch it at all. I fully understand that the info message is useful for new users, but it would be great to have a way to leave root alone.

[Andras Kovacs (andras0602)]

It would be great!

Now I do it like:
runcmd:
 - rm -f /root/.ssh/authorized_keys
But a proper option would be better.

[Dan Watkins (oddbloke)]

Hi Florian, Andras, thanks for the report and confirmation! Do you have any thoughts on what configuration for this might look like?

[Florian Apolloner (apollo13)]

Hi Dan,

thanks for taking this into consideration. My gut-feeling would be an option ala "root_login_help_msg: <true|false>" (Naming is hard). Preferably I'd have it set to false by default but I doubt that will fly :D

[James Falcon (falcojr)]

Tracked in Github Issues as https://github.com/canonical/cloud-init/issues/3648