Live USB: allow password SSH

live-config's openssh-server component rewrites sshd_config to
"PasswordAuthentication no" on every live boot, so the live session only
accepted SSH keys.  An sshd_config.d drop-in sets it back to yes; sshd uses
the first value it reads and sshd_config includes the drop-ins first, so the
drop-in wins.  The login is user / live (live-config's default), now noted
in INSTALL.md.  check-iso.sh fails the build if the drop-in is missing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

INSTALL.md

@@ -38,6 +38,7 @@ Steps:
    minute or two; progress is shown on screen.
 5. Once the desktop loads, browse to https://wrolpi.local or the IP address of
    your WROLPi.  Wi-Fi hotspot and all other features work as usual.
+6. To use a terminal remotely: `ssh user@wrolpi.local`, password `live`.
 
 Notes:
 

debian-live-config/README.md

@@ -65,7 +65,9 @@ Afterwards, future ISO upgrades preserve your library via the
 
 - `wrolpi` is a system account (no password, no login sudo) that owns
   `/media/wrolpi` and runs the WROLPi services, as on every other WROLPi.
-- The live session logs in automatically as `user` (live-config).
+- The live session logs in automatically as `user` (live-config), password
+  `live`.  SSH accepts that password (`sshd_config.d/50-wrolpi-password.conf`
+  overrides live-config, which turns password SSH off).
 - An installed system has the user the Debian installer asked for, with sudo,
   and no automatic login.
 

debian-live-config/check-iso.sh

@@ -69,6 +69,14 @@ if awk -F: '$3 >= 1000 && $3 < 60000 {found=1} END {exit !found}' "${TMP}/passwd
   FAILED=1
 fi
 
+# Password SSH must work in the live session.  live-config turns it off at
+# boot (1160-openssh-server); the sshd_config.d drop-in turns it back on.
+if ! unsquashfs -o $((SQUASHFS_LBA * 2048)) -cat "${ISO}" etc/ssh/sshd_config.d/50-wrolpi-password.conf 2>/dev/null \
+    | grep -q '^PasswordAuthentication yes$'; then
+  echo "ERROR: the live session would refuse password SSH (live-config disables it)." >&2
+  FAILED=1
+fi
+
 # A Live USB must come back on its own after a reboot or power loss: the boot
 # menus must boot their default entry after a timeout (0 waits forever).
 if ! extract boot/grub/config.cfg || ! grep -qE '^set timeout=[1-9]' "${TMP}/config.cfg"; then

debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf

@@ -0,0 +1,7 @@
+# Allow password SSH, as on every other WROLPi.  On a Live USB, live-config
+# (1160-openssh-server) rewrites sshd_config to "PasswordAuthentication no" at
+# each boot; sshd uses the first value it reads, and sshd_config includes this
+# directory before that line, so this wins.  The live session's login is
+# user / live (live-config's default password).  On an installed system this
+# matches Debian's default.
+PasswordAuthentication yes