machineconfig 8.51__py3-none-any.whl → 8.61__py3-none-any.whl

machineconfig/scripts/python/helpers/helpers_devops/cli_ssh.py

@@ -128,13 +128,13 @@ def add_ssh_key(
     github: Annotated[Optional[str], typer.Option(..., "--github", "-g", help="Fetch public keys from a GitHub username")] = None,
 ) -> None:
     """🔑 Add SSH public key to this machine so its accessible by owner of corresponding private key."""
-    import machineconfig.scripts.python.helpers.helpers_network.ssh_add_ssh_key as helper
+    import machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_add_ssh_key as helper
     helper.main(pub_path=path, pub_choose=choose, pub_val=value, from_github=github)
 
 
 def add_ssh_identity() -> None:
     """🗝️ Add SSH identity (private key) to this machine"""
-    import machineconfig.scripts.python.helpers.helpers_network.ssh_add_identity as helper
+    import machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_add_identity as helper
     helper.main()
 
 
@@ -142,10 +142,10 @@ def debug_ssh() -> None:
     """🐛 Debug SSH connection"""
     from platform import system
     if system() == "Linux" or system() == "Darwin":
-        import machineconfig.scripts.python.helpers.helpers_network.ssh_debug_linux as helper
+        import machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_debug_linux as helper
         helper.ssh_debug_linux()
     elif system() == "Windows":
-        import machineconfig.scripts.python.helpers.helpers_network.ssh_debug_windows as helper
+        import machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_debug_windows as helper
         helper.ssh_debug_windows()
     else:
         print(f"❌ Error: Platform {system()} is not supported.")

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/commands.py

@@ -0,0 +1,25 @@
+import subprocess
+
+
+def run_command(command: list[str]) -> subprocess.CompletedProcess[str]:
+	result = subprocess.run(command, capture_output=True, text=True, check=False)
+	return result
+
+
+def run_command_sudo(command: list[str]) -> subprocess.CompletedProcess[str]:
+	result = subprocess.run(["sudo", *command], capture_output=True, text=True, check=False)
+	return result
+
+
+def run_powershell(command: str) -> subprocess.CompletedProcess[str]:
+	result = subprocess.run(["powershell", "-NoProfile", "-Command", command], capture_output=True, text=True, check=False)
+	return result
+
+
+def ensure_ok(result: subprocess.CompletedProcess[str], context: str) -> str:
+	if result.returncode != 0:
+		stderr_value = result.stderr.strip()
+		stdout_value = result.stdout.strip()
+		error_text = stderr_value if stderr_value != "" else stdout_value
+		raise RuntimeError(f"{context} failed: {error_text}")
+	return result.stdout

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/device_entry.py

@@ -0,0 +1,17 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class DeviceEntry:
+	platform_name: str
+	key: str
+	device_path: str
+	device_type: str | None
+	label: str | None
+	mount_point: str | None
+	fs_type: str | None
+	size: str | None
+	extra: str | None
+	disk_number: int | None
+	partition_number: int | None
+	drive_letter: str | None

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/devices.py

@@ -0,0 +1,17 @@
+import platform
+
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.linux import list_linux_devices
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.macos import list_macos_devices
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.windows import list_windows_devices
+
+
+def list_devices() -> list[DeviceEntry]:
+	platform_name = platform.system()
+	if platform_name == "Linux":
+		return list_linux_devices()
+	if platform_name == "Darwin":
+		return list_macos_devices()
+	if platform_name == "Windows":
+		return list_windows_devices()
+	return []

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/linux.py

@@ -0,0 +1,103 @@
+import json
+import os
+from pathlib import Path
+
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.commands import ensure_ok, run_command, run_command_sudo
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.selection import pick_device
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.utils import as_str
+
+
+def _flatten_lsblk_devices(devices: list[dict[str, object]]) -> list[dict[str, object]]:
+	result: list[dict[str, object]] = []
+	stack = list(devices)
+	while stack:
+		item = stack.pop(0)
+		result.append(item)
+		children = item.get("children")
+		if isinstance(children, list):
+			for child in children:
+				if isinstance(child, dict):
+					stack.append(child)
+	return result
+
+
+def list_linux_devices() -> list[DeviceEntry]:
+	result = run_command(["lsblk", "-J", "-o", "NAME,SIZE,TYPE,FSTYPE,LABEL,MOUNTPOINT,UUID,MODEL"])
+	text = ensure_ok(result, "lsblk")
+	data = json.loads(text)
+	raw_devices = data.get("blockdevices")
+	entries: list[DeviceEntry] = []
+	if isinstance(raw_devices, list):
+		for item in _flatten_lsblk_devices(raw_devices):
+			name_value = item.get("name")
+			if not isinstance(name_value, str):
+				continue
+			device_type = item.get("type")
+			if not isinstance(device_type, str):
+				continue
+			if device_type not in {"disk", "part"}:
+				continue
+			device_path = f"/dev/{name_value}"
+			label = as_str(item.get("label"))
+			mount_point = as_str(item.get("mountpoint"))
+			fs_type = as_str(item.get("fstype"))
+			size = as_str(item.get("size"))
+			model = as_str(item.get("model"))
+			entries.append(
+				DeviceEntry(
+					platform_name="Linux",
+					key=name_value,
+					device_path=device_path,
+					device_type=device_type,
+					label=label,
+					mount_point=mount_point,
+					fs_type=fs_type,
+					size=size,
+					extra=model,
+					disk_number=None,
+					partition_number=None,
+					drive_letter=None,
+				)
+			)
+	return entries
+
+
+def mount_linux(entry: DeviceEntry, mount_point: str) -> None:
+	mount_path = Path(mount_point)
+	try:
+		mount_path.mkdir(parents=True, exist_ok=True)
+	except PermissionError:
+		mkdir_result = run_command_sudo(["mkdir", "-p", str(mount_path)])
+		ensure_ok(mkdir_result, "mkdir")
+	if os.geteuid() == 0:
+		result = run_command(["mount", entry.device_path, str(mount_path)])
+	else:
+		result = run_command_sudo(["mount", entry.device_path, str(mount_path)])
+	ensure_ok(result, "mount")
+
+
+def _is_partition_of_disk(partition: DeviceEntry, disk: DeviceEntry) -> bool:
+	if partition.device_type != "part" or disk.device_type != "disk":
+		return False
+	if partition.key == disk.key:
+		return False
+	if not partition.key.startswith(disk.key):
+		return False
+	return True
+
+
+def select_linux_partition(entries: list[DeviceEntry], entry: DeviceEntry) -> DeviceEntry:
+	if entry.device_type != "disk":
+		return entry
+	candidates = [device for device in entries if _is_partition_of_disk(device, entry)]
+	with_fs = [device for device in candidates if device.fs_type is not None and device.fs_type != ""]
+	if len(with_fs) == 1:
+		return with_fs[0]
+	if len(with_fs) > 1:
+		return pick_device(with_fs, header="Select partition to mount")
+	if len(candidates) == 1:
+		return candidates[0]
+	if len(candidates) > 1:
+		return pick_device(candidates, header="Select partition to mount")
+	raise RuntimeError("No mountable partitions found for selected disk")

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/macos.py

@@ -0,0 +1,100 @@
+import plistlib
+from pathlib import Path
+
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.commands import ensure_ok, run_command
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.utils import as_str, format_size_bytes
+
+
+def _diskutil_info(identifier: str) -> dict[str, object]:
+	result = run_command(["diskutil", "info", "-plist", identifier])
+	text = ensure_ok(result, "diskutil info")
+	return plistlib.loads(text.encode("utf-8"))
+
+
+def list_macos_devices() -> list[DeviceEntry]:
+	result = run_command(["diskutil", "list", "-plist"])
+	text = ensure_ok(result, "diskutil list")
+	data = plistlib.loads(text.encode("utf-8"))
+	entries: list[DeviceEntry] = []
+	all_disks = data.get("AllDisksAndPartitions")
+	if isinstance(all_disks, list):
+		for disk in all_disks:
+			if not isinstance(disk, dict):
+				continue
+			partitions = disk.get("Partitions")
+			if isinstance(partitions, list) and partitions:
+				for partition in partitions:
+					if not isinstance(partition, dict):
+						continue
+					identifier = partition.get("DeviceIdentifier")
+					if not isinstance(identifier, str):
+						continue
+					info = _diskutil_info(identifier)
+					mount_point = as_str(info.get("MountPoint"))
+					label = as_str(info.get("VolumeName"))
+					fs_type = as_str(info.get("FilesystemType"))
+					if fs_type is None:
+						fs_type = as_str(info.get("FileSystemType"))
+					size_value = info.get("TotalSize")
+					size = format_size_bytes(size_value) if isinstance(size_value, int) else None
+					media_name = as_str(info.get("MediaName"))
+					device_path = f"/dev/{identifier}"
+					entries.append(
+						DeviceEntry(
+							platform_name="Darwin",
+							key=identifier,
+							device_path=device_path,
+							device_type="part",
+							label=label,
+							mount_point=mount_point,
+							fs_type=fs_type,
+							size=size,
+							extra=media_name,
+							disk_number=None,
+							partition_number=None,
+							drive_letter=None,
+						)
+					)
+			else:
+				identifier = disk.get("DeviceIdentifier")
+				if not isinstance(identifier, str):
+					continue
+				info = _diskutil_info(identifier)
+				mount_point = as_str(info.get("MountPoint"))
+				label = as_str(info.get("VolumeName"))
+				fs_type = as_str(info.get("FilesystemType"))
+				if fs_type is None:
+					fs_type = as_str(info.get("FileSystemType"))
+				size_value = info.get("TotalSize")
+				size = format_size_bytes(size_value) if isinstance(size_value, int) else None
+				media_name = as_str(info.get("MediaName"))
+				device_path = f"/dev/{identifier}"
+				entries.append(
+					DeviceEntry(
+						platform_name="Darwin",
+						key=identifier,
+						device_path=device_path,
+						device_type="disk",
+						label=label,
+						mount_point=mount_point,
+						fs_type=fs_type,
+						size=size,
+						extra=media_name,
+						disk_number=None,
+						partition_number=None,
+						drive_letter=None,
+					)
+				)
+	return entries
+
+
+def mount_macos(entry: DeviceEntry, mount_point: str) -> None:
+	if mount_point == "-":
+		result = run_command(["diskutil", "mount", entry.key])
+		ensure_ok(result, "diskutil mount")
+		return
+	mount_path = Path(mount_point)
+	mount_path.mkdir(parents=True, exist_ok=True)
+	result = run_command(["diskutil", "mount", "-mountPoint", str(mount_path), entry.key])
+	ensure_ok(result, "diskutil mount")

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/selection.py

@@ -0,0 +1,47 @@
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.utils import format_device
+
+
+def pick_device(entries: list[DeviceEntry], header: str) -> DeviceEntry:
+	from machineconfig.utils.options import choose_from_options
+
+	options: list[str] = []
+	map_option: dict[str, DeviceEntry] = {}
+	for idx, entry in enumerate(entries):
+		option = f"{idx:02d} {format_device(entry)}"
+		options.append(option)
+		map_option[option] = entry
+	choice = choose_from_options(options=options, msg="Select a device", multi=False, header=header, tv=True)
+	selected = map_option.get(choice)
+	if selected is None:
+		raise RuntimeError("Selection not found")
+	return selected
+
+
+def resolve_device(entries: list[DeviceEntry], query: str) -> DeviceEntry:
+	query_value = query.strip()
+	if query_value in {"?", ""}:
+		return pick_device(entries, header="Available devices")
+	exact_matches = [
+		entry
+		for entry in entries
+		if entry.device_path.lower() == query_value.lower()
+		or entry.key.lower() == query_value.lower()
+		or (entry.label is not None and entry.label.lower() == query_value.lower())
+	]
+	if len(exact_matches) == 1:
+		return exact_matches[0]
+	if len(exact_matches) > 1:
+		return pick_device(exact_matches, header="Multiple matches")
+	partial_matches = [
+		entry
+		for entry in entries
+		if query_value.lower() in entry.device_path.lower()
+		or query_value.lower() in entry.key.lower()
+		or (entry.label is not None and query_value.lower() in entry.label.lower())
+	]
+	if len(partial_matches) == 1:
+		return partial_matches[0]
+	if len(partial_matches) > 1:
+		return pick_device(partial_matches, header="Multiple matches")
+	return pick_device(entries, header="Available devices")

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/utils.py

@@ -0,0 +1,28 @@
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+
+
+def as_str(value: object) -> str | None:
+	if isinstance(value, str) and value != "":
+		return value
+	return None
+
+
+def format_size_bytes(size_bytes: int) -> str:
+	units = ["B", "KB", "MB", "GB", "TB", "PB"]
+	value = float(size_bytes)
+	unit_index = 0
+	while value >= 1024 and unit_index < len(units) - 1:
+		value = value / 1024
+		unit_index += 1
+	if unit_index == 0:
+		return f"{int(value)} {units[unit_index]}"
+	return f"{value:.1f} {units[unit_index]}"
+
+
+def format_device(entry: DeviceEntry) -> str:
+	label = entry.label if entry.label is not None and entry.label != "" else "-"
+	fs_type = entry.fs_type if entry.fs_type is not None and entry.fs_type != "" else "-"
+	size = entry.size if entry.size is not None and entry.size != "" else "-"
+	mount_point = entry.mount_point if entry.mount_point is not None and entry.mount_point != "" else "-"
+	extra = entry.extra if entry.extra is not None and entry.extra != "" else "-"
+	return f"{entry.key} | {entry.device_path} | {fs_type} | {size} | {mount_point} | {label} | {extra}"

machineconfig/scripts/python/helpers/helpers_devops/mount_helpers/windows.py

@@ -0,0 +1,91 @@
+import json
+import re
+
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.commands import ensure_ok, run_powershell
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.device_entry import DeviceEntry
+from machineconfig.scripts.python.helpers.helpers_devops.mount_helpers.utils import as_str, format_size_bytes
+
+
+def _normalize_ps_json(raw_text: str) -> list[dict[str, object]]:
+	if raw_text.strip() == "":
+		return []
+	data = json.loads(raw_text)
+	if isinstance(data, list):
+		return [x for x in data if isinstance(x, dict)]
+	if isinstance(data, dict):
+		return [data]
+	return []
+
+
+def list_windows_devices() -> list[DeviceEntry]:
+	partitions_result = run_powershell(
+		"Get-Partition | Select-Object DiskNumber,PartitionNumber,DriveLetter,Size,Type,Guid | ConvertTo-Json"
+	)
+	volumes_result = run_powershell(
+		"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,Size,SizeRemaining,DriveType,Path | ConvertTo-Json"
+	)
+	partitions_text = ensure_ok(partitions_result, "Get-Partition")
+	volumes_text = ensure_ok(volumes_result, "Get-Volume")
+	partitions = _normalize_ps_json(partitions_text)
+	volumes = _normalize_ps_json(volumes_text)
+	volume_map: dict[str, dict[str, object]] = {}
+	for volume in volumes:
+		drive_letter = as_str(volume.get("DriveLetter"))
+		if isinstance(drive_letter, str):
+			volume_map[drive_letter.upper()] = volume
+	entries: list[DeviceEntry] = []
+	for partition in partitions:
+		disk_number = partition.get("DiskNumber")
+		partition_number = partition.get("PartitionNumber")
+		drive_letter = as_str(partition.get("DriveLetter"))
+		volume = volume_map.get(drive_letter.upper()) if isinstance(drive_letter, str) else None
+		label = None
+		fs_type = None
+		mount_point = None
+		extra = as_str(partition.get("Type"))
+		if isinstance(volume, dict):
+			label = as_str(volume.get("FileSystemLabel"))
+			fs_type = as_str(volume.get("FileSystem"))
+			mount_point = as_str(volume.get("Path"))
+			if mount_point is None and isinstance(drive_letter, str) and drive_letter != "":
+				mount_point = f"{drive_letter}:\\"
+		size_value = partition.get("Size")
+		size = format_size_bytes(size_value) if isinstance(size_value, int) else None
+		key = f"Disk {disk_number} Part {partition_number}"
+		device_path = as_str(partition.get("Guid")) or key
+		entries.append(
+			DeviceEntry(
+				platform_name="Windows",
+				key=key,
+				device_path=device_path,
+				device_type="part",
+				label=label,
+				mount_point=mount_point,
+				fs_type=fs_type,
+				size=size,
+				extra=extra,
+				disk_number=disk_number if isinstance(disk_number, int) else None,
+				partition_number=partition_number if isinstance(partition_number, int) else None,
+				drive_letter=drive_letter.upper() if isinstance(drive_letter, str) and drive_letter != "" else None,
+			)
+		)
+	return entries
+
+
+def _normalize_drive_letter(value: str) -> str:
+	match = re.search(r"([A-Za-z])", value)
+	if match is None:
+		raise RuntimeError("Invalid drive letter")
+	return match.group(1).upper()
+
+
+def mount_windows(entry: DeviceEntry, mount_point: str) -> None:
+	if entry.disk_number is None or entry.partition_number is None:
+		raise RuntimeError("Partition details not available")
+	letter = _normalize_drive_letter(mount_point)
+	command = (
+		f"Get-Partition -DiskNumber {entry.disk_number} -PartitionNumber {entry.partition_number} | "
+		f"Set-Partition -NewDriveLetter {letter}"
+	)
+	result = run_powershell(command)
+	ensure_ok(result, "Set-Partition")

machineconfig/scripts/python/helpers/helpers_msearch/scripts_windows/fzfg.ps1

@@ -1,10 +1,5 @@
 #!/usr/bin/env pwsh
-[CmdletBinding()]
-param(
-    [Parameter(ValueFromRemainingArguments = $true)]
-    [string[]]$QueryTokens
-)
-
+$QueryTokens = $args
 if ($null -eq $QueryTokens) {
     $QueryTokens = @()
 }

machineconfig/scripts/python/helpers/helpers_network/ssh/ssh_add_key_windows.py

@@ -0,0 +1,23 @@
+from pathlib import Path
+import subprocess
+
+
+def add_ssh_key_windows(path_to_key: Path) -> None:
+    sshd_dir = Path("C:/ProgramData/ssh")
+    admin_auth_keys = sshd_dir / "administrators_authorized_keys"
+    sshd_config = sshd_dir / "sshd_config"
+    key_content = path_to_key.read_text(encoding="utf-8").strip()
+    if admin_auth_keys.exists():
+        existing = admin_auth_keys.read_text(encoding="utf-8")
+        if not existing.endswith("\n"):
+            existing += "\n"
+        admin_auth_keys.write_text(existing + key_content + "\n", encoding="utf-8")
+    else:
+        admin_auth_keys.write_text(key_content + "\n", encoding="utf-8")
+    icacls_cmd = f'icacls "{admin_auth_keys}" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"'
+    subprocess.run(icacls_cmd, shell=True, check=True)
+    if sshd_config.exists():
+        config_text = sshd_config.read_text(encoding="utf-8")
+        config_text = config_text.replace("#PubkeyAuthentication", "PubkeyAuthentication")
+        sshd_config.write_text(config_text, encoding="utf-8")
+    subprocess.run("Restart-Service sshd -Force", shell=True, check=True)

machineconfig/scripts/python/helpers/helpers_network/{ssh_add_ssh_key.py → ssh/ssh_add_ssh_key.py}

@@ -7,34 +7,12 @@ from rich.panel import Panel
 from rich import box
 from typing import Optional, Annotated
 import typer
-import subprocess
 
-
-console = Console()
+from machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_add_key_windows import add_ssh_key_windows
+from machineconfig.scripts.python.helpers.helpers_network.ssh.ssh_cloud_init import check_cloud_init_overrides, generate_cloud_init_fix_script
 
 
-def _add_ssh_key_windows(path_to_key: Path) -> None:
-    """Add SSH key on Windows using Python with proper UTF-8 encoding.
-    This replaces the PowerShell script that was writing UTF-16LE encoded files which openssh server cannot read.
-    """
-    sshd_dir = Path("C:/ProgramData/ssh")
-    admin_auth_keys = sshd_dir / "administrators_authorized_keys"
-    sshd_config = sshd_dir / "sshd_config"
-    key_content = path_to_key.read_text(encoding="utf-8").strip()
-    if admin_auth_keys.exists():
-        existing = admin_auth_keys.read_text(encoding="utf-8")
-        if not existing.endswith("\n"):
-            existing += "\n"
-        admin_auth_keys.write_text(existing + key_content + "\n", encoding="utf-8")
-    else:
-        admin_auth_keys.write_text(key_content + "\n", encoding="utf-8")
-    icacls_cmd = f'icacls "{admin_auth_keys}" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"'
-    subprocess.run(icacls_cmd, shell=True, check=True)
-    if sshd_config.exists():
-        config_text = sshd_config.read_text(encoding="utf-8")
-        config_text = config_text.replace("#PubkeyAuthentication", "PubkeyAuthentication")
-        sshd_config.write_text(config_text, encoding="utf-8")
-    subprocess.run("Restart-Service sshd -Force", shell=True, check=True)
+console = Console()
 
 
 def get_add_ssh_key_script(path_to_key: Path, verbose: bool = True) -> tuple[str, str]:
@@ -63,7 +41,7 @@ def get_add_ssh_key_script(path_to_key: Path, verbose: bool = True) -> tuple[str
             if os_name == "Linux" or os_name == "Darwin":
                 program = f"cat {path_to_key} >> ~/.ssh/authorized_keys"
             elif os_name == "Windows":
-                _add_ssh_key_windows(path_to_key)
+                add_ssh_key_windows(path_to_key)
             else:
                 raise NotImplementedError
     else:
@@ -71,9 +49,25 @@ def get_add_ssh_key_script(path_to_key: Path, verbose: bool = True) -> tuple[str
         if os_name == "Linux" or os_name == "Darwin":
             program = f"cat {path_to_key} > ~/.ssh/authorized_keys"
         else:
-            _add_ssh_key_windows(path_to_key)
+            add_ssh_key_windows(path_to_key)
 
     if os_name == "Linux" or os_name == "Darwin":
+        override_files, auth_overrides = check_cloud_init_overrides()
+        if override_files:
+            status_lines.append(f"\n⚠️  [yellow]Cloud-init override files detected:[/yellow]")
+            for of in override_files:
+                status_lines.append(f"   • {of.name}")
+        blocking_overrides: list[str] = []
+        for key, (file_path, value) in auth_overrides.items():
+            if key == "PubkeyAuthentication" and value == "no":
+                blocking_overrides.append(f"   ❌ {key}={value} in {file_path.name} - [red]blocks key auth![/red]")
+            elif key == "PasswordAuthentication" and value == "no":
+                blocking_overrides.append(f"   ⚠️  {key}={value} in {file_path.name}")
+        if blocking_overrides:
+            status_lines.extend(blocking_overrides)
+        cloud_init_fix = generate_cloud_init_fix_script(auth_overrides)
+        if cloud_init_fix:
+            program += f"\n# === Fix cloud-init SSH overrides ===\n{cloud_init_fix}\n"
         program += """
 sudo chmod 700 ~/.ssh
 sudo chmod 644 ~/.ssh/authorized_keys

machineconfig/scripts/python/helpers/helpers_network/ssh/ssh_cloud_init.py

@@ -0,0 +1,33 @@
+from pathlib import Path
+
+
+def check_cloud_init_overrides() -> tuple[list[Path], dict[str, tuple[Path, str]]]:
+    sshd_config_d = Path("/etc/ssh/sshd_config.d")
+    override_files: list[Path] = []
+    auth_overrides: dict[str, tuple[Path, str]] = {}
+    if not sshd_config_d.exists():
+        return override_files, auth_overrides
+    for conf_file in sorted(sshd_config_d.glob("*.conf")):
+        override_files.append(conf_file)
+        try:
+            conf_text = conf_file.read_text(encoding="utf-8")
+            for line in conf_text.split("\n"):
+                line_stripped = line.strip()
+                if line_stripped and not line_stripped.startswith("#"):
+                    parts = line_stripped.split(None, 1)
+                    if len(parts) >= 2:
+                        key, value = parts[0], parts[1]
+                        if key in ("PasswordAuthentication", "PubkeyAuthentication", "PermitRootLogin", "ChallengeResponseAuthentication", "KbdInteractiveAuthentication"):
+                            auth_overrides[key] = (conf_file, value.lower())
+        except Exception:
+            pass
+    return override_files, auth_overrides
+
+
+def generate_cloud_init_fix_script(auth_overrides: dict[str, tuple[Path, str]]) -> str:
+    fix_commands: list[str] = []
+    for key, (file_path, value) in auth_overrides.items():
+        if key in ("PasswordAuthentication", "PubkeyAuthentication") and value == "no":
+            fix_commands.append(f"# Fix {key} in {file_path.name}")
+            fix_commands.append(f"sudo sed -i 's/^{key}.*no/{key} yes/' {file_path}")
+    return "\n".join(fix_commands)