wip rke2

modules/nixos/services/openssh/default.nix

@@ -1,4 +1,4 @@
-{ config, format, lib, namespace, ... }:
+{ config, lib, namespace, ... }:
 let
   inherit (lib)
     types
@@ -40,7 +40,7 @@ in
         AuthenticationMethods = "publickey";
         ChallengeResponseAuthentication = "no";
         PasswordAuthentication = false;
-        PermitRootLogin = if format == "install-iso" then "yes" else "no";
+        PermitRootLogin = "prohibit-password";
         PubkeyAuthentication = "yes";
         StreamLocalBindUnlink = "yes";
         UseDns = false;