Disabling root SSH login over network in Yocto

One of the security measures we can take in our Yocto Image is to avoid root user login over SSH. The SSH server which gets installed on the image with core-image-sato is 'dropbear'

To avoid root login over SSH, you need to remove 'debug-tweaks'
EXTRA_IMAGE_FEATURES=""
With 'debug-tweaks' option enabled, Yocto runs with dropbear with -B option.
-B Allow blank password logins

To avoid root login over SSH, we need to pass the following options to dropbear

-w Disallow root logins

-g Disable password logins for root

dropbear recipe is present in 'poky/meta/recipes-core/dropbear/'. The 'init' file present in dropbear folder is the script which runs on boot. We need to add '-wg' option in DROPBEAR_EXTRA_ARGS

To achieve this:

1. Create recipes-core folder if it doesn't exist in your layer

2. Inside that create dropbear folder

3. In it create files folder

4. Copy the original init file and update DROPBEAR_EXTRA_ARGS="-w -g"

5. In the dropbear folder, create a dropbear_%.bbappend with the following content:

FILESEXTRAPATHS_prepend := "${THISDIR}/files:"

SRC_URI += "file://init"