openssh: disable password authentication by default (except dev)

[chef.git] / cookbooks / openssh / templates / default / sshd_config.conf.erb

diff --git a/cookbooks/openssh/templates/default/sshd_config.conf.erb b/cookbooks/openssh/templates/default/sshd_config.conf.erb
index 00a540a5e54e9d114d613d2a277220eb79027bd3..99e427cc450d2bfd3e886a3591f353a0a659348d 100644 (file)
--- a/cookbooks/openssh/templates/default/sshd_config.conf.erb
+++ b/cookbooks/openssh/templates/default/sshd_config.conf.erb
@@ -1,3 +1,9 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
 Port <%= node[:openssh][:port] %>
+
+<% if node[:openssh][:password_authentication] -%>
+PasswordAuthentication yes
+<% else -%>
+PasswordAuthentication no
+<% end -%>