3

In /etc/ssh/sshd_config I uncomment option PasswordAuthentication no and restart the service via service sshd reload. But password authentication is still available. Why?

  • Is password authentication still available, or is password-based keyboard-interactive authentication available? What is the setting in sshd_config of ChallengeResponseAuthentication ? – user4556274 Jun 25 '17 at 16:19
  • @user4556274 it's commented #ChallengeResponseAuthentication yes. – Hölderlin Jun 25 '17 at 16:27
  • 1
    Commented entries typically reflect the default setting, so this may be enabled unless you have edited it. Try setting ChallengeResponseAuthentication and UsePAM explicitly to No and test. Both of these settings (in addition to PasswordAuthentication) may affect password-based authentication. – user4556274 Jun 25 '17 at 16:30
  • @user4556274 now it worked, many thanks. – Hölderlin Jun 25 '17 at 16:42
2

The debug log (run ssh with -vvv arguments) would give you more clue about what is going on in the connection.

The password authentication is not the only one which can prompt you for some kind of password. There is always keyboard-interactive, which behaves very similarly and is usually used by PAM. It is controlled by the ChallengeResponseAuthentication option, which defaults to yes. If you want to disable it, you need to put this option with no into the configuration explicitly.

Also do not disable PAM (UsePAM). It is not used only for authentication, but also for setting up session of the user and other steps around authentication. It might work for you now, but it might break in future or for somebody else who will be using different system.

  • I'm a bit confused about default values, e.g. the default entry for option ChallengeResponseAuthentication is #ChallengeResponseAuthentication yes. IMO that means ChallengeResponseAuthentication is set to no by default. But in this case it is set to yes by default. For the PasswordAuthentication option the meaning is opposite, that's realy confusing. – Hölderlin Jun 25 '17 at 20:07
  • Nope. The default value is written (commented out) in the configuration file by default. But you can verify that from the manual page for sshd_config, where it is white on black. – Jakuje Jun 25 '17 at 20:08
  • But PasswordAuthentication option is by default #PasswordAuthentication no, so in your opinion I don't have to uncomment it? But man page says I have to set or uncomment this option if I want to have this property enabled. – Hölderlin Jun 25 '17 at 20:12
  • Yes, if it is so and if it corresponds with the manual page for you. – Jakuje Jun 25 '17 at 20:13
  • That make no sense. That is really inconsistent, like #OptionA yes and #OptionB no and the meaning is opposite in both ways, so that option A is by default no and option B is set to no as well. – Hölderlin Jun 25 '17 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.