ssh totp
- Thread starter Dragon19
- Start date
Proxmox VE assumes that it can freely connect between cluster nodes using SSH in a non-interactive session, so that would need to be still allowed, else things like VM/CT migration will fail.
As the nodes use public key authentication to login you could move your login also to that and then switch the "PermitRootLogin" setting of sshd to "prohibit-password" on all nodes. Old SSH cluster join of new nodes would need manual auth with that, but new API method should work fine.
You could try to set it up in a way so that the nodes are exempt from doing TOTP. I'm really not sure if it's possible easily, but one can to per host settings with the "Match" expression in sshd server config, so it could maybe work.
See https://stackpointer.io/unix/linux-allow-ssh-root-login-specific-ip/618/ from some intro.
As the nodes use public key authentication to login you could move your login also to that and then switch the "PermitRootLogin" setting of sshd to "prohibit-password" on all nodes. Old SSH cluster join of new nodes would need manual auth with that, but new API method should work fine.
You could try to set it up in a way so that the nodes are exempt from doing TOTP. I'm really not sure if it's possible easily, but one can to per host settings with the "Match" expression in sshd server config, so it could maybe work.
See https://stackpointer.io/unix/linux-allow-ssh-root-login-specific-ip/618/ from some intro.