Key based SSH login that requires both key AND password

Question

My problem is : I developed successfully RSA Key based ssh login on board from system. When a client logs in for the first time, ask about private key and passphrase also which works fine. In second time login, ssh doesn't ask private key or password, directly login on board.

Client side use Ubuntu 16.04 and on board customizes Ubuntu.

First time login with below command:

ssh -i ~/.ssh/id_rsa user@board_ip //works fine

Second time:

ssh user@board_ip //never ask password and public key - problem

First time:

ssh user@board_ip //not able to login without key - works fine

As per my understanding, I made a mistake in the sshd_config file on the board. I played with below settings but failed it all the time.

StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
#PasswordAuthentication yes                                            
PermitEmptyPasswords no

Project requirement is secure login, mainly on ssh. To achive more security SSH password based login, we shifted to key based login. As explain above after change all configuration. SSH login require private key and password also. After logout and after sometime login again, ssh doesn't require key or password, project requirement need key and password each and everytime.

Solution

There are two ways to configure ssh to require both a public key and a password or passphrase.

The difference between the password and the passphrase:

The password in this context is the password assigned to the user in the server computer (the board). If the board has only one user account, then it will have only one password. If the board has multiple user accounts, they should have their unique passwords.

The passphrase is linked to the private key in the client (local) computer, not to the remote server (board) computer. Thus, if you use two different client computers of devices to ssh from, then you will have to create a passphrases for the private keys stored in each local computer. Similarly, if two different users need to ssh to the server (board) from their own respective local computers, they will need their own private-public key pairs and own passphrase to unlock their respective private keys.

For example, say you and I need to ssh to the same server computer (the board) from our own laptops. You will have your own private key and a passphrase for that private key. I will have my own private key and its passphrase. The upshot of this arrangement is, I can change the passphrase of my private key any time without telling you, or changing anything to the server computer (the board). I can even remove the passphrase from my private key without telling you.

The other scenario is, if I have multiple servers to ssh to and if I use the same private key to authenticate myself to all the servers, I will need to use the same passphrase to access ssh in all the servers I work with, not just your board.

Method 1. Public Key with passphrase

Reference: https://help.ubuntu.com/community/SSH/OpenSSH/Keys

Step 1. Add a passphrase to the existing public-private keyfor each client and user combinations

For each user on each client computer or device use the following command to generate a passphrase for the exiting public-private key pair:

ssh-keygen -p

You wil be prompted for the the location where to keep the files. Hit enter to accept the default location.

If you already have a passphrase set, you will be asked to enter the existing passphrase. In that case you have already done this step. Press Ctrl+C to stop the process.

Next you will be prompted to enter a new passphrase. Do not hit Enter! Enter a long and difficult to guess passphrase that is easy to remember. You will be asked to re-enter the passphrase.

If you don't have an existing public-private key pair, use the following command to generate it. You will be prompted to add a passphrase if you need one:

ssh-keygen -t rsa

Every time you try to login to the ssh server, you will be asked to enter this passphrase. This can be different for the user password of the ssh server. Each user can have their own passphrase. If an user needs to login from different clients (laptop, phone, etc.) she will need to repeat this process for each client. She can choose different passphrase for different clients.

Step 2. Copy the public key to the server only if the key is new

In your client computer enter:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@board_ip

It will ask for the password of the user in the remote server. Remember, password based login must be enabled for this to work.

Repeat for all the users and all client devices.

Step 3. Test if it works

Try to login to the server by entering:

ssh user@board_ip 

If all goes well, you will be prompted to enter the passphrase you created in step 2. This is not the user password you were asked in step 3.

If you see the prompt to enter the user password, then something is not right. Do not proceed to the next step, until you get this working.

Step 4. Disable password based login

Once each user and their respective client devices have their own public-private key pairs and respective passphrases of their choice, you won't need the password based login. It is best to disable this method. Keeping it enabled will allow anyone without the public-private key pair to try to guess the password of the user@board-ip.

In the ssh server, the board, edit the file /etc/ssh/sshd_config and change:

#PasswordAuthentication yes

to read:

PasswordAuthentication no

Note, the # is not there in the second line and the yes is now no.

Restart the ssh service in the server by:

sudo service ssh restart

If this does not work, reboot the board.

It is done. The passphrase is cached in the client probably by Gnome-Keyring until the user logs out of the local computer. Thus, the phass-phrase is asked only once per session.

What comes next is another alternative. You need to do either 1 or 2.

Method 2. Public key and user password both required

Reference: https://security.stackexchange.com/questions/17931/possible-to-use-both-private-key-and-password-authentication-for-ssh-login

Step 1. Remove passphrase from Private key if present, for each client and user combinations

For each user on each client computer or device use the following command to remove the existing passphrase for each public-private key pair:

ssh-keygen -p

You will be prompted for the the location where to keep the files. Hit enter to accept the default location.

If you have an existing passphrase you will be asked to enter it. If you don't get prompted for existing passphrase, you are done. Press Ctrl+C to stop the process.

Otherwise enter the existing passphrase and continue.

Next you will be prompted to enter a passphrase. Hit Enter twice to remove the existing passphrase from the private key.

If you don't have an existing public-private key pair, use the following command to generate it. You will be prompted to add a passphrase if you need one:

ssh-keygen -t rsa

If an user needs to login from different clients (laptop, phone, etc.) she will need to repeat this process for each client.

Step 2. Copy the public key to the server only if the key is new

In your client computer enter:

ssh-copy-id -i ~/.ssh/id_rsa.pub user@board_ip

It will ask for the password of the user in the remote server. Remember, password based login must be enabled for this to work.

Repeat for all the users and all client devices.

Step 3. Test if public keys are being used

Try to login to the server by entering:

ssh user@board_ip 

If all goes well, you will not be prompted to enter any password or passphrase. This is normal. This shows that the public key is properly installed in the ssh server (the board) and it is working. We will change the setting so that it asks for the password again in the next step.

Step 4. Setup for both public key and password

Login to the ssh server (the board) and edit the /etc/ssh/sshd_config file. Add the following line in the file:

AuthenticationMethods "publickey,password"

Warning: Make sure the the PasswordAuthentication looks like:

#PasswordAuthentication yes

This is the default behavior. You may choose to keep or remove the # in the beginning. However, if this setting is set to no along with the line you just added, then nobody will be able to login to the server using ssh. If you get locked out, you will have to physically go to the remote server, hook it up to keyboard, monitor, etc. and login locally and edit this file to fix the problem.

End Warning

Restart the ssh service in the server by:

sudo service ssh restart

If this does not work, reboot the board.

Step 5. Test breaking in

Find a new computer or login to the client computer using a new username, say user2. This user should not have any public-private key pairs in his /home/$USER/.ssh/ folder. We will pretend that user2 is the hacker who has somehow found out the password of user@board_ip and try to ssh into that system.

Enter as user2, from the client computer:

ssh user@board_ip

If you can login with just the password, then it did not work. Anyone who has the password or can guess it, can login to the board. They do not need the key.

If you get a permission denied and login fails, then the double authentication of public key and password works.

Hope this helps

Comments

[steeldriver]

It sounds more like the credentials are being cached by your ssh agent than a mistake in the configuration

[Panther]

@steeldriver post that as an answer

[Tejas Virpariya]

@user68186 : As per requirement of project for more security, need key and password in every ssh attempt. first time for any reason user login and logout then some one use this system and try to login at that time for security password and key must require.

[Panther]

The "problem" you are having is that ssh-agent is storing the key and password. see askubuntu.com/questions/737251/… and similar. ssh and ssh-server are functioning normal this is not a configuration problem.

[raj]

Disable ssh-agent from running at startup on client system. Then probably you will have to retype the passphrase every time you attempt a ssh connection. The default in Ubuntu is to have the ssh-agent enabled and the function of ssh-agent is exactly to remember the passphrase typed on first ssh connection attempt, so you don't have to retype it every time.

[Tejas Virpariya]

I tried with both options, first I rename id_rsa and second rename and change location of id_rsa and also delete permanently id_rsa from ~/.ssh/ location, but same result. ssh allow access without key and password. I want security in every ssh login attempt.

[Arronical]

Did you remove id_rsa and id_rsa.pub? Otherwise it must be an ssh-agent caching issue.

[Tejas Virpariya]

I removed private key but didn't touch public key.

[Arronical]

I think you'd need to remove both.