Change "PermitRootLogin without-password" to the new preferred spelling of "PermitRootLogin prohibit-password" in sshd_config, and update documentation to reflect the new upstream default.

1 files changed, 6 insertions, 2 deletions

diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 9e8516ca7..72e993d0a 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -199,7 +199,7 @@ LogLevel INFO
 
 # Authentication:
 LoginGraceTime 120
-PermitRootLogin without-password
+PermitRootLogin prohibit-password
 StrictModes yes
 
 RSAAuthentication yes
@@ -312,7 +312,11 @@ if [ "$action" = configure ]; then
         if dpkg --compare-versions "$2" lt-nl 1:6.6p1-1 && \
            [ "$(get_config_option PermitRootLogin)" = yes ] &&
            db_get openssh-server/permit-root-login && [ "$RET" = true ]; then
-            set_config_option PermitRootLogin without-password
+            set_config_option PermitRootLogin prohibit-password
+        fi
+        if dpkg --compare-versions "$2" lt-nl 1:7.0p1-1 && \
+           [ "$(get_config_option PermitRootLogin)" = without-password ]; then
+            set_config_option PermitRootLogin prohibit-password
         fi
 fi