SSH: disable password login for root but leaving the prompt

Question

I would like to disable password login for a user. But instead of the error message (Public key) I would not like the user notice that the password login is disabled and prompting him for password.

So far I know I can disable password login for all users except one with

PasswordAuthentication no
Match User toto
PasswordAuthentication yes

But attempting to login as 'not_toto' will result an error message from the server, which I do not wish.

Do I need to modify openssh sources to do that? Or is there a configuration option which can do the job?

Edit:

Having two ssh servers running is an option, so killing connections with iptables or via another method (outside ssh configuration) could do it.

Edit 2:

I want to do this as I need two ssh instances, one in the official door to get in and the other is a honeypot. So the bots will give their password but never letting them in. (nb: this is a personal project I am the only one using the server and not logging colleagues passwords nor other nasty things, I just want to make some stats on bots)

The 'honeypot' server will be listening to port 22 and the 'official' server to another one, for example 344.

The first ssh server (say official) is OpenSSH_7.4p1 Debian-10+deb9u1, OpenSSL 1.0.2l 25 May 2017, installed with Debian packages.

The 'honeypot' is a modified version of Openssh-7.4p1 that logs username and passwords from login attempts. Actually PAM should be enabled on this one but I will double check it. Maybe your option symcbean may be the right one.

Answer 1

Its not exactly clear what you are asking here. Do you mean that you still want to allow keypair login for this user? You said "say root" - but is it the root user? The root user is always a special case.

The other glaring question is why? If there is someone you don't want to allow in to your system then the last thing you should be doing is providing an API for them to attack.

Reading between the lines, you appear to be using Opensshd on Linux (it would have been helpful to explicitly state what versions of app and OS you are using).

Leaving that aside...

The username sent to the server by the client is sent after encryption has been negotiated. So you can't simply proxy and reroute the connection.

What you can do is tell sshd to use PAM and configure an appropriate policy to deny access regardless of the supplied password to specific users. While there are lots of ways of doing this, using pam_listfiles means you can move a lot of the config out of the pam stack itself (there's a good chance you could lock yourself out of the server, reducing the amount of tinkering with the pam config mitigates this).

Answer 2

Something you might try is disabling password login for the account entirely - that is, not just SSH, but this would also prevent anyone from logging in as that user account from the normal console, or with a graphical window manager, or so on. For a honeypot server which has no purpose other than to collect SSH login attempts, that should be fine.

On Linux you can disable an account's password with

# usermod --lock <username>

or

# passwd --lock <username>

You'll still be able to log in to that account with an SSH key, if you had pubkey authentication set up, and you can still use sudo to run commands under that account, if you have it configured appropriately.

Naturally, if you're going to do this to the root account, you should probably set up sudo first so you can reverse the process if needed. A locked password can be unlocked using either usermod --unlock or passwd --unlock (or in a pinch, by directly editing /etc/shadow). If you don't do this you could lose access to the root account entirely.