prime8dev

commit 89ebe089db333a60416a1c7280df1bfb49639857
parent 1dadbcbb105df5f7ae3024688feaf4025b2966be
Author: Damian Myrda <damian@prime8.dev>
Date:   Tue,  3 Mar 2026 18:55:44 -0600

feat: harden SSH config and enable all upgrade notifications

- Disable PAM in SSH for additional hardening
- Enable email notifications for all unattended upgrades (not just errors)

Diffstat:
M
generate_cloud_config.sh
 | 
3
++-

1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/generate_cloud_config.sh b/generate_cloud_config.sh
@@ -77,6 +77,7 @@ write_files:
       PasswordAuthentication no
       KbdInteractiveAuthentication no
       ChallengeResponseAuthentication no
+      UsePAM no
       MaxAuthTries 3
       AllowTcpForwarding no
       X11Forwarding no
@@ -95,7 +96,7 @@ write_files:
       Unattended-Upgrade::Mail "$EMAIL_ADDRESS";
       Unattended-Upgrade::Sender "server-updates <$EMAIL_ADDRESS>";
       Unattended-Upgrade::MailReport "on-change";
-      Unattended-Upgrade::MailOnlyOnError "true";
+      Unattended-Upgrade::MailOnlyOnError "false";
 
       Unattended-Upgrade::Automatic-Reboot "true";
       Unattended-Upgrade::Automatic-RebootTime "00:00";