Allow separate password login for sftp

[mib1185]

This will allow to enable password-based login for sftp, while it is still disabled for ssh connections.
To prevent a breaking change, this new option sftp_password_login inherits from ssh_server_password_login

[schurzi]

Your proposal seems reasonable, but we really want to avoid introducing more variables for our roles.

I have spent some time thinking about this and I think you can use existing variables to achieve the same result. We offer a way to add more custom group matches to sshd config via ssh_server_match_group. All these matches are placed after our main config and can be used to override previous config. so if you add these variables you should be able to get this working without changing the role.

Can you try adding these variables?

    ssh_server_match_group:
      - group: sftponly
        rules:
          - PasswordAuthentication yes

[mib1185]

Hi @schurzi
sorry for late reply. thanks for this suggestion, we will check if it fits for our needs. Since we're in progress of re-thinking of the concept, which is affected by this settings, i'm going to close this PR for now.