On AWS I have managed to create an AMI with a modified Ubuntu 12.04 LTS amd64. I've added lots of packages and much of our own code and files. The cloud init is still there, and I'm sure should stay. However, it is undermining my automations by re-disabling root at run time, after I enabled it in the original volume that was used to create the snapshot for the AMI.

File /usr/share/pyshared/cloudinit/CloudConfig/cc_ssh.py appears to be connected to this. Since I am not experienced in Python coding, I have no idea what some of the functions it calls are, so I cannot really see what all this script is doing.

I could just add some init script of my own to run afterwards, somewhere, to just undo that and re-enable root. Is there a way, standardized or sanctioned by cloud init, to set a flag to indicate that disabling root login should not be done? Or should I just roll my own solution (later init to put back my own /root/.ssh/authorized_keys file).

I also see that this script is removing old host keys and regenerating new ones. That is something I'd like to keep (therefore I will not need to do this myself).

I also have the SSH listening port number changed to a number other than 22 (and security group set to allow access to that port only from my own IPs). That much did not get changed. This is good.


The code seems to check a disable_root boolean configuration value, so I'm guessing that you need to set this in /etc/cloud/cloud.cfg:

disable_root: 0
| improve this answer | |
  • It worked! After my stuff was installed, I edited this file to change disable_root to 0, then on the EC2 instance panel, I selected Create Image for this instance and let it do its thing. After a few minutes I had an AMI, and the instance I launched from it worked just the same. My next step, building an AMI from scratch with this config change. – Skaperen Jul 29 '12 at 2:32
  • Or put the same line in the provided user-data file in a #cloud-config section. – mattdm Jun 13 '13 at 17:59

There are 2 settings that relate to ssh in /etc/cloud/cloud.cfg. One blocks ssh in as root and the other blocks ssh in using a password. By default the cloud.cfg will block both all login direct as root and all ssh password based auth. These are the defaults:

disable_root: 1
ssh_pwauth:   0

1 for disable root turns on disabling root login and the 0 for ssh pwauth turns OFF being able to ssh in using a password. So if you WANT to be able to login as root AND do it with a password this is the required settings:

disable_root: 0
ssh_pwauth:   1

Keep in mind that setting ssh_pwauth to 1 allows password based auth globally NOT just for root.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.