ssh-cle-publique.sh
A board connected to the network must be locked before leaving the desk: this script checks your key is installed, disables password authentication and reloads sshd without cutting the current session.
Hardware
An Arduino Portenta X8 (ST STM32MP1 module: quad Cortex-A7 Linux + dual Cortex-M4 real-time core, 8 GB eMMC, 2 GB LPDDR4, on-board Wi-Fi/BT, optional LTE). None; an SSH keypair generated on the workstation.
Wiring
Nothing to wire. Do it over wired/USB SSH first, not remotely on a hostile network.
How it works
The script refuses to act with an empty authorized_keys, writes an sshd_config drop-in, validates with sshd -t then reloads — the running session is never cut.
Running it
Linux side: SSH access (routed USB-C or network) on the Portenta Linux image, bash/Python scripts. Real-time side: Arduino IDE with the « Arduino Mbed OS Portenta X8 Boards » core, application M7 core, flashing via mboot from Linux.
Variants
Add a non-root sudo user, a light fail2ban, or disable SSH when unused (systemd timer).
ssh-cle-publique.sh
#!/bin/bash
# Durcissement SSH de la carte : cle publique obligatoire.
# A lancer APRES avoir installe sa cle (ssh-copy-id).
set -e
echo "1) Cle publique installee ? (sinon : ssh-copy-id root@<carte>)"
grep -q . /root/.ssh/authorized_keys 2>/dev/null || {
echo "authorized_keys vide : installez d'abord votre cle !"; exit 1; }
echo "2) Desactivation des mots de passe..."
if ! grep -q '^PasswordAuthentication no' /etc/ssh/sshd_config.d/hardening.conf 2>/dev/null; then
printf 'PasswordAuthentication no\nPermitRootLogin prohibit-password\n' |
sudo tee /etc/ssh/sshd_config.d/hardening.conf
fi
sudo sshd -t && sudo systemctl reload ssh
echo "3) Verification : la session actuelle reste valide ;"
echo " ouvrez un AUTRE terminal pour tester la cle avant de fermer."
# En production, ajouter un utilisateur non-root + sudo,
# et couper le mot de passe sudo si la cle U2F est supportee.