Disabling ssh password authentication does not work on my debian VPS
Solution 1
You only disabled ChallengeResponseAuthentication
. Lines starting with #
are comments and won't interpreted as configuration, they are for humans to read.
To disable all possibilities to login with a password you have to set
PasswordAuthentication no
AND
ChallengeResponseAuthentication no
There is a possible path over pam_unix
to login with a password. This will be disabled with the later.
Solution 2
You should double check if your /etc/ssh/sshd_config
file has any Include
directive. If so, follow the included files and check if PasswordAuthentication
is correctly set.
In my case: Fedora33, my sshd_config
file looked like this:
Include /etc/ssh/sshd_config.d/*.conf
...
PasswordAuthentication no
...
But the file: /etc/ssh/sshd_config.d/50-redhat.conf
overwrote the PasswordAuthentication
option. After changing PasswordAuthentication=no
in /etc/ssh/sshd_config.d/50-redhat.conf
everything worked as expected.
Related videos on Youtube
DebianVPS
Updated on September 18, 2022Comments
-
DebianVPS almost 2 years
I have a Debian 7 VPS setup. I just enabled SSH Key authentication and disabled password authentication but the disabling did not work.
When I attempt to SSH into my VPS, it prompts me for my SSH Key password which then works fine, BUT if I hit cancel, it will give me "Agent admitted faliure to sign" Error and then it prompts me for the current users account password, I enter it in and it logs me in with my account password, even though it's disabled... Does anyone have any idea why it allows me to login with password access? Thank you
I am connecting with a 4096 bit key.
Here is my sshd_config:
Port 22 # Use these options to restrict which interfaces/protocols sshd will bind to #ListenAddress :: #ListenAddress 0.0.0.0 Protocol 2 # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key #Privilege Separation is turned on for security UsePrivilegeSeparation yes # Lifetime and size of ephemeral version 1 server key KeyRegenerationInterval 3600 ServerKeyBits 768 # Logging SyslogFacility AUTH LogLevel INFO # Authentication: LoginGraceTime 120 PermitRootLogin no StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts yes # For this to work you will also need host keys in /etc/ssh_known_hosts RhostsRSAAuthentication no # similar for protocol version 2 HostbasedAuthentication no # Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication #IgnoreUserKnownHosts yes # To enable empty passwords, change to yes (NOT RECOMMENDED) PermitEmptyPasswords no # Change to yes to enable challenge-response passwords (beware issues with # some PAM modules and threads) ChallengeResponseAuthentication no # Change to no to disable tunnelled clear text passwords #PasswordAuthentication no # Kerberos options #KerberosAuthentication no #KerberosGetAFSToken no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #GSSAPIAuthentication no #GSSAPICleanupCredentials yes X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes #UseLogin no #MaxStartups 10:30:60 #Banner /etc/issue.net # Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. UsePAM yes
-
yaegashi almost 9 yearsHow did you disable the password authentication? Have you restarted sshd after you changed server's configuration? Could you show us your
/etc/ssh/sshd_config
? Please edit your post and add the additional info. -
DebianVPS almost 9 yearsI put the sshd_config info in the post and yes i restarted sshd afterwards. The formatting got all screwed up but all of the large text had # infront of it (the comment symbol) and theres no issues with the actual formatting in my file
-
Jodka Lemon almost 9 yearsYour
PasswordAuthentication no
is commented out...
-
-
DebianVPS almost 9 yearsI have both of these set already but the same thing as in the OP happens
-
Jodka Lemon almost 9 years
PasswordAuthentication no
is commented out. -
Serge almost 9 years@JodkaLemon with
PasswordAuthentication no
commented out, I still get a password prompt when trying to SSH without the correct key. Seems best to uncomment this line and set to no. -
Jodka Lemon almost 9 yearsyes, exactly, that's what i meant.
-
BhaveshDiwan almost 4 yearsFor suse linux, one might need to restart the SSH Daemon using
service sshd restart