[Gerrrt]

What changed

build-the-playground.md §4 gains SSH on gandalf: keys only. The step writes /etc/ssh/sshd_config.d/10-keys-only.conf (PermitRootLogin prohibit-password, PasswordAuthentication no, KbdInteractiveAuthentication no), reloads sshd, and proves from Hicks that a password login is refused and a key login still works. §7's per-session read-back now checks it too. The changelog records it.

Why

A read-only audit of gandalf on 2026-11-13 found sshd taking root's password (permitrootlogin yes, passwordauthentication yes). That is the Proxmox installer's default, and the repository never said otherwise. The host firewall limits 22 to 10.0.50.0/24, but ADR-0017 gives gandalf no agent, so nothing would notice that firewall going off. If it did, the root password would be the only thing between VLAN 30, where the attack VM is, and a root shell on the range's isolation host.

Blast radius

gandalf's SSH only, and only once the step is run there. The risk is locking out root SSH. The step keeps a key session open across the change, and the console on KVM port 4 is the fallback. Root's password stays set, so the root@pam login on 8006 and the console are unchanged. phoenix drives gandalf through the API token on 8006, not SSH.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• make validate: all checks passed, 46 skipped for want of docker here, including markdownlint and editorconfig-checker. CI is their first run.

• On gandalf, read-only: /etc/ssh/sshd_config has Include /etc/ssh/sshd_config.d/*.conf on line 12, above PermitRootLogin yes on line 33, so the drop-in's value wins. Root's authorized_keys holds the operator's ed25519 key.

• Not yet applied on gandalf.

• make validate passes (with the skips above)

• Deployed to the lab and confirmed working

• Docs updated (docs/, service README, or docs/roadmap.md)

Not covered: Saruman's sshd, which I could not read from here. It likely has the same installer default.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The rollback instructions use an SSH command that exits immediately, leaving no retained session for recovery if new logins fail after the reload.

1 open issue

• SSH command exits instead of retaining a rollback session · New

What changed in this PR

This documentation-only PR adds a keys-only SSH procedure for gandalf, strengthening the playground isolation host’s defenses if its firewall is disabled. The change has not yet been applied to the host.

Changes:

• Documents the SSH configuration drop-in, reload, login checks, and rollback procedure.
• Adds SSH configuration checks to the per-session checklist.
• Records the audit and planned hardening in the changelog.

File	Description
docs/​runbooks/​build-the-playground.md	Adds keys-only SSH setup and per-session verification.
docs/​changelog.md	Records the audit, runbook changes, and pending deployment.

_{Review effort: Balanced}