supabase-postgres.git / summary / log / commit / refs

commit    74aba22f77cd8e5e4d602322d60f80c80e1148de
Author:   Joel Low <joel.low@supabase.io>
Commit:   GitHub <noreply@github.com>
Date:     Fri May 22 01:49:36 2026 +0000

    security: disable password auth for root and ubuntu (#2161)
    
    * security: remove passwords for root and ubuntu
    
    This prevents the users from being logged into except by SSH public key
    authentication.
    
    * fix: ensure Password and Challenge Response auth for SSH is disabled


 ebssurrogate/scripts/qemu-bootstrap-nix.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/ebssurrogate/scripts/qemu-bootstrap-nix.sh b/ebssurrogate/scripts/qemu-bootstrap-nix.sh
index 43e1d98f..a76186bf 100755
--- a/ebssurrogate/scripts/qemu-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/qemu-bootstrap-nix.sh
@@ -156,6 +156,19 @@ function clean_system {
 	rm -rf /root/.vpython*
 	rm -rf /root/go
 	rm -rf /mnt/usr/share/doc
+
+	# remove passwords in user-data-cloudimg.img (required for Packer login)
+	usermod -p '*' ubuntu
+	usermod -p '*' root
+
+  # Ensure that PasswordAuthentication is off
+  # From chroot-boostrap-nix.sh
+  sed -i -E \
+    -e 's/^#?\s*PasswordAuthentication\s+(yes|no)\s*$/PasswordAuthentication no/g' \
+    -e 's/^#?\s*ChallengeResponseAuthentication\s+(yes|no)\s*$/ChallengeResponseAuthentication no/g' \
+    /etc/ssh/sshd_config
+  grep -qE "^PasswordAuthentication\s+no" /etc/ssh/sshd_config \
+    || { echo "ERROR: PasswordAuthentication is not disabled in sshd_config"; exit 1; }
 }
 
 install_nix