Security58 mOctober 27, 2026, 15:38

Ansible disabled SSH passwords, but sshd read another file first

A penetration test flagged 23 Linux servers still accepting SSH password logins despite an Ansible playbook setting PasswordAuthentication no. A cloud-init drop-in, 50-cloud-init.conf, was read before the main sshd_config and overrode the setting.

DEV Community

Open source

Ansible disabled SSH passwords, but sshd read another file first

Pentest found 23 servers still accepting SSH password logins
cloud-init drop-in 50-cloud-init.conf overrode the sshd_config setting
sshd -T reported passwordauthentication yes despite no in the file
Fix: 00-hardening.conf drop-in plus sshd -T check after restart

#Ansible#Ubuntu#OpenSSH

Anthropic finds 94 cases of silently disabled security controls in open source

Security

SSH client silently deletes trusted host keys and exits 0 with empty stderr

Security

OpenSSH 10.6 released with post-quantum signatures, LZ77 disabled

Software

Ansible disabled SSH passwords, but sshd read another file first

Anthropic finds 94 cases of silently disabled security controls in open source

SSH client silently deletes trusted host keys and exits 0 with empty stderr

OpenSSH 10.6 released with post-quantum signatures, LZ77 disabled

Ubuntu 26.04 sudo-rs leaves sudo su processes alive after SSH drop