From 484eda3c8303396ebaee310adeea5cd4da3df575 Mon Sep 17 00:00:00 2001
From: Adam Seishas <aseishas@stanford.edu>
Date: Tue, 23 Aug 2016 12:30:55 -0700
Subject: [PATCH] sshd_config.erb: If PasswordAuthentication is disabled, also
 remove this method from AuthenticationMethods

---
 templates/ssh/sshd_config.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/ssh/sshd_config.erb b/templates/ssh/sshd_config.erb
index c0bcaab..a2171ca 100644
--- a/templates/ssh/sshd_config.erb
+++ b/templates/ssh/sshd_config.erb
@@ -84,7 +84,7 @@ GSSAPIStoreCredentialsOnRekey yes
 <% if (@pam_duo) then -%>
 
 # Require both (GSS-API|PASSWORD) and PAM.
-AuthenticationMethods gssapi-with-mic,keyboard-interactive:pam password,keyboard-interactive:pam
+AuthenticationMethods gssapi-with-mic,keyboard-interactive:pam<% if password then %> password,keyboard-interactive:pam<% end %>
 KerberosAuthentication yes
 <% end -%>
 
-- 
GitLab