In August an external penetration test listed twenty three of our Linux servers as accepting SSH password logins. Our hardening playbook had set PasswordAuthentication no on every one of them since the day they were built, and its compliance run, in check mode every night, reported nothing to change.

The playbook used lineinfile on /etc/ssh/sshd_config, with a regular expression that matched the commented default and replaced it with PasswordAuthentication no, then restarted sshd. I logged in to one of the reported hosts and the line was there, exactly as written. Then I ran sshd -T, which prints the configuration the daemon actually uses, and it said passwordauthentication yes.

Every reported server had been built from our hosting provider's newer Ubuntu image. Near the top of its sshd_config is the line Include /etc/ssh/sshd_config.d/*.conf, and in that directory cloud-init had written 50-cloud-init.conf, containing PasswordAuthentication yes, because the image offers a password at first boot.…