From 84daa8eca4ba32d6a7b854f2902779efe756c911 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B8rn=20=C3=85ne=20de=20Jong?= <git@jornane.no>
Date: Thu, 2 Jun 2022 20:55:19 +0200
Subject: [PATCH] Set PermitRootLogin without-password

This replaces the PermitRootLogin yes + PasswordAuthentication no construction.
---
 .../freebsd-build-opennebula-image.sh            | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/opennebula-images/freebsd-build-opennebula-image.sh b/opennebula-images/freebsd-build-opennebula-image.sh
index 5ff345c..a63bba2 100755
--- a/opennebula-images/freebsd-build-opennebula-image.sh
+++ b/opennebula-images/freebsd-build-opennebula-image.sh
@@ -178,11 +178,19 @@ sysrc -f "$UFSTARGET/etc/rc.conf" \
 
 tzsetup -s -C "$UFSTARGET" UTC
 
-cat >>"$UFSTARGET/etc/ssh/sshd_config" <<EOF
-PermitRootLogin yes
-PasswordAuthentication no
-PermitEmptyPasswords no
+# Add PermitRootLogin without-password, unless PermitRootLogin yes was already set
+sed -i .orig -e '/^#PermitRootLogin[[:blank:]]/a\
+PermitRootLogin without-password
+' -e '/^PermitRootLogin[[:blank:]]*no/ s/\([[:blank:]]\).*$/\1without-password/' \
+	"$UFSTARGET/etc/ssh/sshd_config"
+if ! grep -Eq '^PermitRootLogin (without-password|yes)' "$UFSTARGET/etc/ssh/sshd_config"
+then
+	cat >>"$UFSTARGET/etc/ssh/sshd_config" <<EOF
+
+# Added by Ungleich
+PermitRootLogin without-password
 EOF
+fi
 
 # Set zstd-19 compression, copy all data to the pool, and then set compression to default again
 # This will make the base image smaller, at the cost of taking longer to generate, as zstd-19 is slow to write