4

I have already configured login to ssh with keys and it works fine. The problem is that when I'm connecting to the server with key and included password but I don't see any failed login attempts when I type a wrong password. There are no failed login attempts using key in:

/var/log/audit/audit.log

or

/var/log/secure

Other words i can type password to key til i die without any action. Do you have any ideas how to log to file failed login attemps to ssh using key with password ?

OS is : Red Hat Enterprise Linux Server release 7.3 (Maipo)

Thank you in advance.

This is log from the server when i have typed many times wrong password:

Connection from my_ip port 51115 on server_ip port 22
sshd[3639]: Found matching RSA key: 00:12:23 ...
sshd[3639]: Postponed publickey for some_user from ip_address port 51115 ssh2 [preauth]
5

It sounds like you've configured your client key to require a password to open the key before connecting to the server. It won't be logged by your server because that occurs on the client machine.

  • Thanks for answer but is there any other possibility to use keys while connecting to ssh serwer and log failed password on the server ? – admfotad Apr 20 '17 at 13:17
  • @admfotad You mean to log failed attempts at unlocking the key? – Alxs Apr 20 '17 at 13:20
  • Yes, when i get any login attempt using key with wrong password i can then block client ip with fail2ban on the server - but i need any logs on the server before. For example this i log from the server when i typed on client side wrong password many times: Connection from my_ip port 51115 on server_ip port 22 sshd[3639]: Found matching RSA key: 00:12:23 ... sshd[3639]: Postponed publickey for some_user from ip_address port 51115 ssh2 [preauth] – admfotad Apr 20 '17 at 13:25
  • By 'wrong password' do you by chance actually mean 'invalid key'? Because you can't use an ssh key with a wrong password. The password is to protect the key from unauthorized use. – Alxs Apr 20 '17 at 13:30
  • 1
    Key is valid but i wanted to track on the server when wrong password to client key is typed but as i can see from your answer it is only to protect access to client key not to verify this password on server side. If so i vane no more questions and thanks for explaining. Regards – admfotad Apr 20 '17 at 13:46
2

Basically, the passphrase protecting the SSH key is completely a client-side matter. Consider that even ssh-keygen allows you to change the passphrase without a connection to any server (ssh-keygen -p -f id_rsa). Of course that requires knowing the old passphrase, but you can (try to) guess it without hinting the server you're doing that.

That said, when connecting to a server, the SSH client offers the server any keys it has before asking for a passphrase to decrypt the key. You'll note that if you connect to a host that doesn't accept your key, the passphrase is never asked.

$ ssh -v -v somehost
...
debug1: Offering RSA public key: /...
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: pkalg ssh-rsa blen 407
debug2: input_userauth_pk_ok: fp blah
debug1: key_load_private_type: incorrect passphrase supplied to decrypt private key
Enter passphrase for key '/...':

Technically, you could modify the server to detect a client that offers a key, but doesn't follow through with authenticating with it. But that wouldn't help since any attacker could just try to decrypt the keys first before trying to authenticate. Again, this is possible even with the usual utilities: it's what you do when running ssh-agent.

If a key is not enough for you, current versions of OpenSSH allow the server to require both a key and a password. The documentation gives this as an example to require first a key, then a password (using either "password" or "keyboard-interactive" authentication):

AuthenticationMethods publickey,password publickey,keyboard-interactive
  • Thanks for hint. I tried connecting to server with wrong key and i will try now to block with fail2ban clients with bad keys. – admfotad Apr 21 '17 at 7:12
  • @admfotad, yeah, of course you can detect connections that didn't authenticate, regardless of if they had a key to try or just closed for some other reason. But like it said, it doesn't help with keys, if the passphrase on the key is weak, the attacker can just bruteforce it on the client-side before even trying to connect to your server. – ilkkachu Apr 21 '17 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.