When we provision new linux servers, we
- create a new user with sudo rights, and...
- block root from ssh access
And then we proceed to configure the system via the new user account. Of course we do it this way because our logs are full of hostile ssh root login attempts.
But now we're trying to use Chef (chef solo with knife-solo and librarian-chef) to build servers. Once we create a recipe that blocks ssh login from root, we can't run the recipes again.
I have seen this: How to run chef-client vagrant provisioner from custom non-root user? but it seems like "root" is hardcoded all over the place and the accepted solution would require branching all the basic cookbooks.
Any ideas on how to create a re-runnable Chef setup that includes disabling root ssh access ?