this post was submitted on 09 Oct 2024
38 points (100.0% liked)

Linux

48663 readers
610 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
38
ssh won't ask for password unless i force PubkeyAuthentication=no (lemmy.ml)
submitted 2 months ago* (last edited 2 months ago) by [email protected] to c/[email protected]
15 comments fedilink hide all child comments
 

Lately I noticed that when I want to ssh to a server using a password I need to specify -o PubkeyAuthentication=no or I won't be asked for a password and the authentication will fail (well, for all I know, setting some other option may work too).

I use password authentication only once on freshly installed servers/vms, so it's not a huge deal, but... it still bothers me (mainly because I don't remember which option to set).

Do you guys have any idea what it may be?

client's ~/.ssh/config

Host 127.*.*.* 192.168.*.* 10.*.*.* 172.16.*.* 172.17.*.* 172.18.*.* 172.19.*.* 172.2?.*.* 172.30.*.* 172.31.*.*
  LogLevel quiet
  Stricthostkeychecking no
  Userknownhostsfile /dev/null

Host *
  ForwardAgent no
  AddKeysToAgent no
  Compression yes
  ServerAliveInterval 10
  ServerAliveCountMax 3
  HashKnownHosts no
  UserKnownHostsFile ~/.ssh/known_hosts
  ControlMaster no
  ControlPath ~/.ssh/master-%r@%n:%p
  ControlPersist no

server's /etc/ssh/sshd_config (it's from the nixos install iso)

AuthorizedPrincipalsFile none
Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
GatewayPorts no
KbdInteractiveAuthentication yes
KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group-exchange-sha256
LogLevel INFO
Macs [email protected],[email protected],[email protected]
PasswordAuthentication yes
PermitRootLogin yes
PrintMotd no
StrictModes yes
UseDns no
UsePAM yes
X11Forwarding no
Banner none
AddressFamily any
Port 22
Subsystem sftp /nix/store/78mv13w9mgh0s0rd7rnr6ff4d7a39bpd-openssh-9.7p1/libexec/sftp-server 
AuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

top 15 comments
sorted by: hot top controversial new old
[–] [email protected] 30 points 2 months ago (1 children)

Try putting -vvv when you connect and see what's happening. I can imagine this happening if you have multiple identities (private/public key pairs) on the client and you hit a max retry limit. Pub key is always tried first, and it should ask for password once all the local keys have been tried.

[–] [email protected] 5 points 2 months ago (2 children)

I did add a bunch of new keys to my ssh agent... this might really be it!

[–] [email protected] 5 points 2 months ago

Yep, this is the reason. I have many different identity key files in my ~/.ssh folder, and for some reason ssh always tries all of those first, then exhausts the login tries and doesn't ask for a password.

I have the same problem when I specify a specific private key file with -i ./path/to/priv.key. If that key is different than the ones in my .ssh folder, it will use all those first before the specified one, and often exhausts login attempts giving a very hard to diagnose login failure. In that case I need -o IdentitiesOnly yes option to tell ssh to only use the one I specified.

[–] [email protected] 4 points 2 months ago

Having 3 or more identities often causes authentication to fail before it gets around to trying password authentication (or even all the possible keys). Recommend configuring the client to turn off PubkeyAuthentication by default (so that hosts that you don't have a key for will prompt for a password) and specify which key to use on the appropriate hosts using IdentityFile (might need to specifically turn PubkeyAuthentication back on, I don't remember how openssh handles having a default host block with specific host blocks)

[–] [email protected] 12 points 2 months ago (2 children)

If you're trying to have password auth be a second layer on top of key auth (requiring a password after connecting with your ssh key), you can add the following to your server's sshd_conf:

AuthenticationMethods "publickey,password"

[–] [email protected] 4 points 2 months ago

Now that's a neat idea! (not sure I'll ever implement it though: having passwords on my ssh keys is already enough of a hassle, plus having provisioning and scripts ask for password is a PITA)

Anyway, I was just trying to authenticate with a password, like we used to back in the day :)
(it's only for install isos or freshly installed systems that I've not provisioned yet - everything else requires a key).

[–] [email protected] 2 points 2 months ago

This is the way.

[–] possiblylinux127 8 points 2 months ago* (last edited 2 months ago) (1 children)

That's the expected behavior as ssh password authentication is not considered secure.

You can force the ssh client to use passwords in the ssh_config file (either local or global)

[–] [email protected] 2 points 2 months ago (2 children)

How would that improve security when all a bad actor has to do is add -o PubkeyAuthentication=no on their side?

Also, I'm pretty sure it used to just ask for a password?

[–] possiblylinux127 1 points 2 months ago

You would want to disable password authentication on the host.

I'm not part of the OpenSSH team so I don't know the rational of the defaults

[–] [email protected] 1 points 2 months ago

-o PubkeyAuthentication=no should only work if the server is configured to allow password auth at all. I believe the advice these days is to disable password auth completely for security.

[–] [email protected] 7 points 2 months ago (1 children)

How many private keys do you happen to have in .ssh? MaxAuthTries defaults to 6, and keys are always tried before you are prompted for a password. Unless you set PubkeyAuthentication=no, or specify a single key, the ssh client will happily grind through each key until the server cuts you off.

[–] [email protected] 1 points 2 months ago

I ran into this today using ssh-copy-id on a new Debian box. Seems like that tool is biased toward copying a second key instead of a first. Either that or they assume most users use one key pair everywhere (and thus only have one loaded in their agent). I use one key pair per user per box. Excessive? 🤔

[–] [email protected] 1 points 2 months ago* (last edited 2 months ago)

I've slept since the last time I set up sshd on a new install. Do you need to be able to authenticate with a password when you ssh-copy-id on a user without a public key?

Edit: Silly me. Yes, password is required.

[–] [email protected] -1 points 2 months ago

Definitely not how it works for me and I've never used key Auth.