ssh still accepts password authentication despite being configured for public-key only authentication (which works!)

Question

I have configured an Ubuntu 10.04LTS desktop install to only allow public key authentication.

RESULT: public key authentication works perfectly!

QUESTION: The problem is that despite being configured to only accept public key authentication the client still accepts password authentication - why?

Sure could use some suggestions as I have seen and followed the suggestions here: ssh: can still use password after setting the key

No success after following these suggestions:

• chmod 700 /home//.ssh
• chmod 600 /home//.ssh/authorized_keys
• added to /etc/ssh/ssh_config:
  • PasswordAuthentication no
  • ChallengeResponseAuthentication no
• restarted sshd (command: /usr/sbin/service ssh restart).

The client's /etc/ssh/ssh_config reads:

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
#   RhostsRSAAuthentication no
    RSAAuthentication yes
    PasswordAuthentication no
    PermitRootLogin no
    PubKeyAuthentication yes
    ChallengeResponseAuthentication no
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-c                                                    bc,3des-cbc
#   MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

Am I missing another option? Match perhaps (though that seems unlikely to help to me)?

Thanks.

Solution 1

/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.

Solution 2

This additional line works for me in /etc/ssh/sshd_config.

AuthenticationMethods publickey

Solution 3

I know this questions is really old, and has been answered, but since when I had this problem, this was the number one search result on google, I figured I'd put the information here.

For some reason after I changed

PasswordAuthentication yes

to

PasswordAuthentication no

in my sshd_config file, it was still asking for the password.

I had checked everything here, and I had also run

sudo /etc/init.d/ssh restart #or sshd

The changes to the config file just wouldn't make any difference, so I finally tried to just reboot the machine, and that worked. I guess the /etc/init.d/ssh restart wasn't working for some reason? Anyway, I hope this helps someone.

Comments

[aaaaaa]

For me I didn't change anything as the configuration was set like that from the beginning on digitalocean. however restarting sshd via sudo systemctl restart sshd worked. Seems like a bug in digitalocean's droplet initialization but whatever