From c0fec6f563498bab506e9fd4f933980a18246adf Mon Sep 17 00:00:00 2001 From: Roland Date: Tue, 20 Oct 2026 15:03:32 -0600 Subject: [PATCH] Live USB: allow password SSH live-config's openssh-server component rewrites sshd_config to "PasswordAuthentication no" on every live boot, so the live session only accepted SSH keys. An sshd_config.d drop-in sets it back to yes; sshd uses the first value it reads and sshd_config includes the drop-ins first, so the drop-in wins. The login is user / live (live-config's default), now noted in INSTALL.md. check-iso.sh fails the build if the drop-in is missing. Co-Authored-By: Claude Opus 5.5 --- INSTALL.md | 1 + debian-live-config/README.md | 4 +++- debian-live-config/check-iso.sh | 8 ++++++++ .../etc/ssh/sshd_config.d/50-wrolpi-password.conf | 7 +++++++ 4 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf diff --git a/INSTALL.md b/INSTALL.md index f5f20c8f..cf93f460 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -38,6 +38,7 @@ Steps: minute or two; progress is shown on screen. 5. Once the desktop loads, browse to https://wrolpi.local or the IP address of your WROLPi. Wi-Fi hotspot and all other features work as usual. +6. To use a terminal remotely: `ssh user@wrolpi.local`, password `live`. Notes: diff --git a/debian-live-config/README.md b/debian-live-config/README.md index d728274b..fa13ab92 100644 --- a/debian-live-config/README.md +++ b/debian-live-config/README.md @@ -65,7 +65,9 @@ Afterwards, future ISO upgrades preserve your library via the - `wrolpi` is a system account (no password, no login sudo) that owns `/media/wrolpi` and runs the WROLPi services, as on every other WROLPi. -- The live session logs in automatically as `user` (live-config). +- The live session logs in automatically as `user` (live-config), password + `live`. SSH accepts that password (`sshd_config.d/50-wrolpi-password.conf` + overrides live-config, which turns password SSH off). - An installed system has the user the Debian installer asked for, with sudo, and no automatic login. diff --git a/debian-live-config/check-iso.sh b/debian-live-config/check-iso.sh index 9fda743c..1b08cf87 100755 --- a/debian-live-config/check-iso.sh +++ b/debian-live-config/check-iso.sh @@ -69,6 +69,14 @@ if awk -F: '$3 >= 1000 && $3 < 60000 {found=1} END {exit !found}' "${TMP}/passwd FAILED=1 fi +# Password SSH must work in the live session. live-config turns it off at +# boot (1160-openssh-server); the sshd_config.d drop-in turns it back on. +if ! unsquashfs -o $((SQUASHFS_LBA * 2048)) -cat "${ISO}" etc/ssh/sshd_config.d/50-wrolpi-password.conf 2>/dev/null \ + | grep -q '^PasswordAuthentication yes$'; then + echo "ERROR: the live session would refuse password SSH (live-config disables it)." >&2 + FAILED=1 +fi + # A Live USB must come back on its own after a reboot or power loss: the boot # menus must boot their default entry after a timeout (0 waits forever). if ! extract boot/grub/config.cfg || ! grep -qE '^set timeout=[1-9]' "${TMP}/config.cfg"; then diff --git a/debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf b/debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf new file mode 100644 index 00000000..8d467b69 --- /dev/null +++ b/debian-live-config/config/includes.chroot/etc/ssh/sshd_config.d/50-wrolpi-password.conf @@ -0,0 +1,7 @@ +# Allow password SSH, as on every other WROLPi. On a Live USB, live-config +# (1160-openssh-server) rewrites sshd_config to "PasswordAuthentication no" at +# each boot; sshd uses the first value it reads, and sshd_config includes this +# directory before that line, so this wins. The live session's login is +# user / live (live-config's default password). On an installed system this +# matches Debian's default. +PasswordAuthentication yes