10

I don't want to disable remote login with password altogether, but I want to make it so that my account is only accessible with key pair authentication (there are other users who wants to use passwords to log in). Is it possible to change this on a per-user basis, ideally without changing system settings?

And to make it clear, my account has sudo access, so I don't want to lock the password.

| improve this question | |
9

You can use the Match option in sshd_config

Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.[1]

So, at the end of that file you could specify:

Match User yourusername
PasswordAuthentication no

See man 5 sshd_config for all of the available options.

[1] http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5

| improve this answer | |
  • This is good already, but I want to see if I can do without editing sshd_config. – phunehehe May 27 '11 at 5:45
  • 2
    Given you are wanting to make a system change, ie., one that doesn't impact on other users, that seems to be unlikely... – jasonwryan May 27 '11 at 6:35
  • and what about ~/.ssh/config ? Have you tried including the settings there? – ttyS0 May 27 '11 at 15:15
  • 1
    AFAK ~/.ssh/config in for the client, not the server. – Adam Byrtek May 27 '11 at 18:12
1

The answer from jasonwryan is going to be the right way to make this change. The only addition I would make is that you could set the match to be group based so that any users in the wheel group would be required to use key authentication while others could use passwords.

I know you want to do this without changing the system config files, but there is a good reason why that will not be possible. In your head it makes sense that your user should be able to institute a more secure login policy, but just because in your mind it is a more secure option doesn't change the fact that it is still a change to the system login requirements for a remote user.

To understand why this is a problem, imagine the scenario the other way around. The system administrator (who can change the system config files) sets the system to key based login only. Then, some user comes along and with only access to their own user file and sets their account to allow password authentication, overriding the system policy. BEEEEEEP. Security problem!

Does that explain why the kind of change you want to make is only possible from the system config file?

| improve this answer | |
  • It's difficult to think that way around, since if I were a normal user who doesn't sudo, I can happily set up my keys then lock the password, thus making my account "key only authentication". – phunehehe May 27 '11 at 9:02
  • In another thought, I could lock my password every time I'm about to log out, which should disallow all password log in for my account. Then once I'm logged in with my keys, I could enable the password again to sudo. Obviously it's not a good solution, but it makes me think it's possible. – phunehehe May 27 '11 at 9:03
  • 1
    You can only do that because the system administrator allowed key authentication and you are only adding restrictions for yourself, not changing anything. Disabling your password just sets it to an invalid value, it doesn't change what authentication the system daemon allows. – Caleb May 27 '11 at 9:06
  • "adding restrictions for yourself, not changing anything", is exactly what I'm wanting to do. – phunehehe May 27 '11 at 10:24
  • @Caleb: There would be no security problem in allowing authorized_keys to put more restrictions, as phunehehe wants. For example authorized_keys can restrict certain keys to certain commands. – Gilles 'SO- stop being evil' May 27 '11 at 10:29
0

Adding restrictions for yourself, not changing anything

Why not at the client side, if it is sure that ssh would be the client to be used for login attempts? If yes, try making changes to ssh_config instead of sshd_config. Check for parameter 'PasswordAuthentication No' and PreferredAuthentications

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.