---
# List of prohibited usernames for use in production contexts.
# The Admin should set a unique username for the instance, to be
# used in all subsequent tasks.
securedrop_validate_disallowed_users:
  - amnesia
  - root
  - vagrant

---
# List of prohibited usernames for use in production contexts.
# The Admin should set a unique username for the instance, to be
# used in all subsequent tasks.
securedrop_validate_disallowed_users:
  - amnesia
  - root

Stop prohibiting "vagrant" as valid SSH username
Stop prohibiting "vagrant" as valid SSH username

The original intent with the 'validate' role was to ensure that
production SecureDrop instances do not use common values for required
variables, such as SSH username. The motiviation was to harden the
instance by forcing an attacker to steal secrets before they can
interact with the instance in a meaningful way, much how blacklisting
"root" as a valid SSH username is considered a best practice.

In practice, however, the non-standard SSH username (since Tails always
runs as the "amnesia" user, Admins cannot use their regular custom
username) causes problems, and requires that Admins pass in the SSH
username on every command-line invocation of the playbook. We can do
better than that, and pass in the site-specific username in the
playbook.
