Setting PasswordAuthentication no is not always enough: with UsePAM yes and keyboard-interactive login left on, sshd still accepts passwords. On many cloud images, a 50-cloud-init.conf drop-in also turns passwords back on. This skill finds both, plus eight other risky SSH server settings, and tells you how to fix each one.

Your agent runs a scanner on sshd_config (and templates such as sshd_config.j2) and the sshd_config.d drop-ins it includes. It follows sshd's own rules: the first value wins, Include lines are expanded in place, and Match blocks are checked too. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach.

What it checks

BLOCK (fix before shipping)

• S01: PermitRootLogin yes

• S02: PermitEmptyPasswords yes

• S03: an SSH private key file (host key or id_rsa / id_ed25519) inside the project

REVIEW (check before release)

• S11: password logins on (explicitly, or by default)

• S12: passwords still accepted through PAM after PasswordAuthentication no

• S13: GatewayPorts yes or clientspecified

• S14: PermitUserEnvironment turned on

• S15: weak ciphers, MACs, key exchange, ssh-rsa or DSA keys

• S16: LogLevel QUIET, FATAL or ERROR

• S17: StrictModes no

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example configs, and the real report the scanner produces on the risky ones

Limits

It reads config text. It does not evaluate Match conditions or template logic, follow Include paths outside the scanned folder, or see the OpenSSH version, firewall or fail2ban. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 10 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (5 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.