Skip to content

Update Post Installation SSH Password Disable Steps #1074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alexfornuto wants to merge 4 commits into
base: main
Choose a base branch
from
+4 −5
Open

Update Post Installation SSH Password Disable Steps #1074

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1d03349
Update post-install.md
alexfornuto Jul 9, 2026
6c13f86
comment cleanup
alexfornuto Jul 9, 2026
46a8abc
Apply review suggestions.
alexfornuto Jul 17, 2026
172e199
squashme
alexfornuto Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions versioned_docs/version-v1.8/install/post-install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,23 +22,22 @@ By default during installation, SSH password authentication is enabled on the Ha
Once installation is completed, however, disabling SSH password authentication is recommended. You can run the following command, which uses `kubectl` to apply a [`CloudInit`](https://docs.harvesterhci.io/v1.6/advanced/cloudinitcrd/) configuration, to disable SSH password authentication on all Harvester nodes:

```sh
cat <<EOF | kubectl apply -f -
cat <<EOF | sudo env "PATH=$PATH" /var/lib/rancher/rke2/bin/kubectl --kubeconfig=/etc/rancher/rke2/rke2.yaml apply -f -

@votdev votdev Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not simply use sudo su to become root, then you can execute kubectl without issues.

Please keep the previous text.

Suggested change
cat <<EOF | sudo env "PATH=$PATH" /var/lib/rancher/rke2/bin/kubectl --kubeconfig=/etc/rancher/rke2/rke2.yaml apply -f -
cat <<EOF | kubectl apply -f -

@alexfornuto alexfornuto Jul 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my testing, kubectl wasn't in the root user's PATH.

apiVersion: node.harvesterhci.io/v1beta1
kind: CloudInit
metadata:
name: ssh-config
spec:
matchSelector:
matchSelector:
harvesterhci.io/managed: "true" # apply to all Harvester nodes
Comment thread
alexfornuto marked this conversation as resolved.
filename: 99-ssh-config
contents: |
stages:
network:
- name: "disable password login"
commands:
- sed -i -E 's/^#?PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
- sed -i -E 's/^#?ChallengeResponseAuthentication .*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
- sed -i -E 's/^#?UsePAM .*/UsePAM no/' /etc/ssh/sshd_config
- echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/99-disable-passwords.conf
- echo "KbdInteractiveAuthentication no" >> /etc/ssh/sshd_config.d/99-disable-passwords.conf
- systemctl restart sshd
paused: false
EOF
Expand Down