From 341551d5bae7a051952559e835b420c82b28dc91 Mon Sep 17 00:00:00 2001
From: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
Date: Thu, 20 Nov 2025 15:21:14 +0100
Subject: [PATCH] Disable password login via SSH in apex

---
 m/apex/configuration.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/m/apex/configuration.nix b/m/apex/configuration.nix
index 2b4047a1..c2a3e73e 100644
--- a/m/apex/configuration.nix
+++ b/m/apex/configuration.nix
@@ -59,6 +59,9 @@
 
   services.fail2ban.enable = true;
 
+  # Disable SSH login with password, allow only keypair
+  services.openssh.settings.PasswordAuthentication = false;
+
   networking.firewall = {
     extraCommands = ''
       # Blackhole BSC vulnerability scanner (OpenVAS) as it is spamming our