Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On AWS I have managed to create an AMI with a modified Ubuntu 12.04 LTS amd64. I've added lots of packages and much of our own code and files. The cloud init is still there, and I'm sure should stay. However, it is undermining my automations by re-disabling root at run time, after I enabled it in the original volume that was used to create the snapshot for the AMI.

File /usr/share/pyshared/cloudinit/CloudConfig/ appears to be connected to this. Since I am not experienced in Python coding, I have no idea what some of the functions it calls are, so I cannot really see what all this script is doing.

I could just add some init script of my own to run afterwards, somewhere, to just undo that and re-enable root. Is there a way, standardized or sanctioned by cloud init, to set a flag to indicate that disabling root login should not be done? Or should I just roll my own solution (later init to put back my own /root/.ssh/authorized_keys file).

I also see that this script is removing old host keys and regenerating new ones. That is something I'd like to keep (therefore I will not need to do this myself).

I also have the SSH listening port number changed to a number other than 22 (and security group set to allow access to that port only from my own IPs). That much did not get changed. This is good.

share|improve this question
up vote 6 down vote accepted

The code seems to check a disable_root boolean configuration value, so I'm guessing that you need to set this in /etc/cloud/cloud.cfg:

disable_root: 0
share|improve this answer
It worked! After my stuff was installed, I edited this file to change disable_root to 0, then on the EC2 instance panel, I selected Create Image for this instance and let it do its thing. After a few minutes I had an AMI, and the instance I launched from it worked just the same. My next step, building an AMI from scratch with this config change. – Skaperen Jul 29 '12 at 2:32
Or put the same line in the provided user-data file in a #cloud-config section. – mattdm Jun 13 '13 at 17:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.