1

I want to know where I can increase the number of times I can enter the password when I try to login via ssh?

I am using CentOS 6.7 and I have just 3 times to enter the password before I got this message:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

I also changed the configuration in /etc/ssh/sshd_config to increase MaxAuthTries property to 6 but no luck.

Any suggestions?


UPDATE: after took a look at log file (/var/log/secure) i found the reason. Client is configured to have 3 times then disconnect by default.

Here is the log:

Oct 28 10:24:44 DG1 unix_chkpwd[4407]: password check failed for user (root)
Oct 28 10:24:44 DG1 sshd[4404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.100.8  user=root
Oct 28 10:24:46 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:47 DG1 unix_chkpwd[4409]: password check failed for user (root)
Oct 28 10:24:49 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:49 DG1 unix_chkpwd[4411]: password check failed for user (root)
Oct 28 10:24:51 DG1 sshd[4404]: Failed password for root from 192.168.100.8 port 45398 ssh2
Oct 28 10:24:51 DG1 sshd[4406]: Connection closed by 192.168.100.8

As you see the connection is closed by client. It means if we change config from client then we can have more times to input the password like @Jan said.

By combination between MaxAuthTries and NumberOfPasswordPrompts we can have a good view for my issue.

Thanks a lot for the helps, Guys.

  • 3
    If you ssh to this machine often have you considered using ssh keys instead? They would remove the need for a password entirely. – Centimane Oct 27 '15 at 12:24
  • 1
    Did you restart sshd after changing the config? – Jan Oct 27 '15 at 12:35
  • Yes i did but no luck :( – Chu Oct 27 '15 at 13:01
0

To use ONLY password authentication and nothing else, set the corresponding parameter on the command line: ssh -o PreferredAuthentications=password user@example.com

The number of retries isn't entirely configured on the server-side. From man 5 ssh_config:

 NumberOfPasswordPrompts
         Specifies the number of password prompts before giving up.  The
         argument to this keyword must be an integer.  The default is 3.

Either set this on your ssh_config, or set the option on the commandline:
ssh -o NumberOfPasswordPrompts=n user@hostname

  • Thanks but i just want to make sure the restriction is for client only, no additional config when ssh. :( – Chu Oct 27 '15 at 16:15
1

From

man 5 sshd_config

MaxAuthTries Specifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. The default is 6.

So if you comment out MaxAuthTries and restart sshd you should have 6 attempts.

  • I did but no luck, that why i am concerned why i have just 3 times instead of 6 times to input the password :( – Chu Oct 27 '15 at 15:16
  • Can you post your sshd_config file? I think the error message would be "Too many authentication failures" and not "Permission denied"... maybe there is an error in the config – LilloX Oct 27 '15 at 15:23
  • Here is my config file: mediafire.com/download/hs43ktc83esi3ug/sshd_config Sorry for hosted but i cannot post entire the config file. – Chu Oct 27 '15 at 15:25
  • Ok i think i knew why the change didn't take effect. I tried to ssh to centOS 6.7 from Kali 2.0. That was why every time i got 3 times only for password inputting. I tried to use putty to log and got correct input times. But for now just a little concern that why Kali restricted 3 times for ssh. Hmm.... – Chu Oct 27 '15 at 15:44
  • ok, I've reproduced your issue. I think you have to set ChallengeResponseAuthentication yes – LilloX Oct 27 '15 at 15:45
0

The MaxAuthTries parameter specifices the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged. This should be set to 1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.