1

I want to know where I can increase the number of times I can enter the password when I try to login via ssh?

I am using CentOS 6.7 and I have just 3 times to enter the password before I got this message:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

I also changed the configuration in /etc/ssh/sshd_config to increase MaxAuthTries property to 6 but no luck.

Any suggestions?


UPDATE: after took a look at log file (/var/log/secure) i found the reason. Client is configured to have 3 times then disconnect by default.

Here is the log:

Oct 28 10:24:44 DG1 unix_chkpwd[4407]: password check failed for user (root)
Oct 28 10:24:44 DG1 sshd[4404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.100.8  user=root
Oct 28 10:24:46 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:47 DG1 unix_chkpwd[4409]: password check failed for user (root)
Oct 28 10:24:49 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:49 DG1 unix_chkpwd[4411]: password check failed for user (root)
Oct 28 10:24:51 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:51 DG1 sshd[4406]: Connection closed by 192.168.100.8

As you see the connection is closed by client. It means if we change config from client then we can have more times to input the password like @Jan said.

By combination between MaxAuthTries and NumberOfPasswordPrompts we can have a good view for my issue.

Thanks a lot for the helps, Guys.

3
  • 3
    If you ssh to this machine often have you considered using ssh keys instead? They would remove the need for a password entirely.
    – Centimane
    Commented Oct 27, 2015 at 12:24
  • 1
    Did you restart sshd after changing the config?
    – Jan
    Commented Oct 27, 2015 at 12:35
  • Yes i did but no luck :(
    – Chu
    Commented Oct 27, 2015 at 13:01

3 Answers 3

1

From

man 5 sshd_config

MaxAuthTries Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

So if you comment out MaxAuthTries and restart sshd you should have 6 attempts.

11
  • I did but no luck, that why i am concerned why i have just 3 times instead of 6 times to input the password :(
    – Chu
    Commented Oct 27, 2015 at 15:16
  • Can you post your sshd_config file? I think the error message would be "Too many authentication failures" and not "Permission denied"... maybe there is an error in the config
    – LilloX
    Commented Oct 27, 2015 at 15:23
  • Here is my config file: mediafire.com/download/hs43ktc83esi3ug/sshd_config Sorry for hosted but i cannot post entire the config file.
    – Chu
    Commented Oct 27, 2015 at 15:25
  • Ok i think i knew why the change didn't take effect. I tried to ssh to centOS 6.7 from Kali 2.0. That was why every time i got 3 times only for password inputting. I tried to use putty to log and got correct input times. But for now just a little concern that why Kali restricted 3 times for ssh. Hmm....
    – Chu
    Commented Oct 27, 2015 at 15:44
  • ok, I've reproduced your issue. I think you have to set ChallengeResponseAuthentication yes
    – LilloX
    Commented Oct 27, 2015 at 15:45
0

To use ONLY password authentication and nothing else, set the corresponding parameter on the command line: ssh -o PreferredAuthentications=password [email protected]

The number of retries isn't entirely configured on the server-side. From man 5 ssh_config:

 NumberOfPasswordPrompts
         Specifies the number of password prompts before giving up.  The
         argument to this keyword must be an integer.  The default is 3.

Either set this on your ssh_config, or set the option on the commandline:
ssh -o NumberOfPasswordPrompts=n user@hostname

1
  • Thanks but i just want to make sure the restriction is for client only, no additional config when ssh. :(
    – Chu
    Commented Oct 27, 2015 at 16:15
0

The MaxAuthTries parameter specifices the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. This should be set to 1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .