canonical / canonical/cloud-init
disable_root: true does not disable ssh login as root user
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
# Bug report
I created a packer image for Debian 12 with key-based ssh root access for provisioning tasks during the build process.
When creating an instance from this image with Terraform, I want to disable ssh login for the root user and lock the password.
The [documentation](https://cloudinit.readthedocs.io/en/23.4.1/reference/modules.html#ssh) states:
```
disable_root: (boolean) Disable root login. Default: true
```
Therefore I apply the below user_data config in Terraform.
I can see that cloudinit is run, the file /etc/ssh/sshd_config.d/50-cloud-init.conf is created and disables ssh password auth:
```
PasswordAuthentication no
```
But root login using the packer ssh key is still possible. 'PermitRootLogin no' is missing.
## Steps to reproduce the problem
```
#cloud-config
disable_root: true
ssh_pwauth: false
users:
- name: root
lock_passwd: true
- name: ansible
uid: 1000
...
```
## Environment details
- Cloud-init version: 22.4.2-1+deb12u2
- Operating System Distribution: Debian 12
- Cloud provider, platform or installer type: nocloud
## cloud-init logs
[cloud-init.tar.gz](https://github.com/user-attachments/files/18136977/cloud-init.tar.gz)
Contributor guide
Assessment
This issue has not been assessed yet.