add iptable rules, update ssh config

container/iptables.v4

+# iptable v4 rules for lustmolch container {{name}}
+*filter
+
+-A INPUT -p tcp -m tcp --dport {{ssh_port}} 10.150.0.0/17 -j ACCEPT
+-A INPUT -p tcp -m tcp --dport {{ssh_port}} 141.84.69.0/24 -j ACCEPT
+
+COMMIT
+

container/iptables.v6

+# iptable v6 rules for lustmolch container {{name}}
+
+*filter
+
+-A INPUT -p tcp -m tcp --dport {{ssh_port}} 2001:4ca0:200::/48 -j ACCEPT
+
+COMMIT

container/sshd_config

@@ -29,8 +29,8 @@ Port {{ssh_port}}
 # Authentication:
 
 #LoginGraceTime 2m
-PermitRootLogin prohibit-password
-#StrictModes yes
+PermitRootLogin without-password
+StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
 
@@ -53,7 +53,7 @@ PubkeyAuthentication yes
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+PasswordAuthentication no
 #PermitEmptyPasswords no
 
 # Change to yes to enable challenge-response passwords (beware issues with

lustmolch.py

@@ -13,7 +13,9 @@ cfg_template = namedtuple('cfg_template', ['source', 'path', 'filename'])
 
 template_files_host = [
     cfg_template('nginx', Path('/etc/nginx/sites-available'), '{name}'),
-    cfg_template('nspawn', Path('/etc/systemd/nspawn'), '{name}.nspawn')
+    cfg_template('nspawn', Path('/etc/systemd/nspawn'), '{name}.nspawn'),
+    cfg_template('iptables.v4', Path('/etc/iptables'), '{50-container-{name}.v4'),
+    cfg_template('iptables.v6', Path('/etc/iptables'), '{50-container-{name}.v6')
 ]
 template_files_container = [
     cfg_template('sshd_config', Path('/etc/ssh'), 'sshd_config')