If default_user="root" and "ssh_pwauth=true" then sshd PermitRootLogin should be "yes", not "without-password"

[Nux-m]

As per the $summary, if default_user is set to "root" and "ssh_pwauth=true", then sshd_config should be enforced with "PermitRootLogin yes" instead of leaving the defaults which nowadays in many distros is "without-password".

Thanks

[James Falcon (falcojr)]

Due to the security risk, we shouldn't automatically permit root login unless the user has explicitly asked for it. There are still use cases where you would set ssh_pwauth true while not wanting root login (i.e., creating new users later).

However, it doesn't look like there's any configuration at all to allow this currently and it makes sense for cloud-init to have that. I think the ability to "PermitRootLogin" and/or modify the sshd config more generally would be a good feature addition.

[Nux-m (nux-m)]

Agree with you, but in this case the user did ask for default_user to be "root".

Thanks!

[James Falcon (falcojr)]

Tracked in Github Issues as https://github.com/canonical/cloud-init/issues/4063