rt/wrolpi
1
0
Fork 0
mirror of https://github.com/lrnselfreliance/wrolpi.git synced 2026-10-25 18:40:06 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Live USB: allow password SSH (#845)

Browse source 
live-config's openssh-server component rewrites sshd_config to
"PasswordAuthentication no" on every live boot, so the live session only
accepted SSH keys.  An sshd_config.d drop-in sets it back to yes; sshd uses
the first value it reads and sshd_config includes the drop-ins first, so the
drop-in wins.  The login is user / live (live-config's default), now noted
in INSTALL.md.  check-iso.sh fails the build if the drop-in is missing.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
lrnselfreliance 2026-10-20 16:29:28 -06:00 • committed by Roland
parent 4becad7d36
commit 2f5d88ad4e
No known key found for this signature in database
GPG key ID: 1BA620CE6C9A4680
4 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
INSTALL.md
View file

@ -38,6 +38,7 @@ Steps:
minute or two; progress is shown on screen.
5. Once the desktop loads, browse to https://wrolpi.local or the IP address of
your WROLPi. Wi-Fi hotspot and all other features work as usual.
6. To use a terminal remotely: `ssh user@wrolpi.local`, password `live`.
Notes:

4
debian-live-config/README.md
View file

@ -65,7 +65,9 @@ Afterwards, future ISO upgrades preserve your library via the
- `wrolpi` is a system account (no password, no login sudo) that owns
`/media/wrolpi` and runs the WROLPi services, as on every other WROLPi.
- The live session logs in automatically as `user` (live-config).
- The live session logs in automatically as `user` (live-config), password
`live`. SSH accepts that password (`sshd_config.d/50-wrolpi-password.conf`
overrides live-config, which turns password SSH off).
- An installed system has the user the Debian installer asked for, with sudo,
and no automatic login.

8
debian-live-config/check-iso.sh
View file

@ -69,6 +69,14 @@ if awk -F: '$3 >= 1000 && $3 < 60000 {found=1} END {exit !found}' "${TMP}/passwd
FAILED=1
fi
# Password SSH must work in the live session. live-config turns it off at
# boot (1160-openssh-server); the sshd_config.d drop-in turns it back on.
if ! unsquashfs -o $((SQUASHFS_LBA * 2048)) -cat "${ISO}" etc/ssh/sshd_config.d/50-wrolpi-password.conf 2>/dev/null \
| grep -q '^PasswordAuthentication yes$'; then
echo "ERROR: the live session would refuse password SSH (live-config disables it)." >&2
FAILED=1
fi
# A Live USB must come back on its own after a reboot or power loss: the boot
# menus must boot their default entry after a timeout (0 waits forever).
if ! extract boot/grub/config.cfg || ! grep -qE '^set timeout=[1-9]' "${TMP}/config.cfg"; then

7
debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf Normal file
View file

@ -0,0 +1,7 @@
# Allow password SSH, as on every other WROLPi. On a Live USB, live-config
# (1160-openssh-server) rewrites sshd_config to "PasswordAuthentication no" at
# each boot; sshd uses the first value it reads, and sshd_config includes this
# directory before that line, so this wins. The live session's login is
# user / live (live-config's default password). On an installed system this
# matches Debian's default.
PasswordAuthentication yes