Configured Public/Private Key on CentOS6 - Still letting me connect without Private Key

Question

I have a VPS with CentOS 6. I've noticed a lot of login attempts via SSH, so I want to lock it down with key based authentication. Here is what I have done so far....

Ran the following on my client machine (OSX)

ssh-keygen -t rsa

Did this with default settings (no passphrase, default names, etc)

Set the following permissions on my client

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa

copied my public key to the root of my userfolder on my VPS using the following command (fake name/ip)

scp id_rsa.pub fakeuser@255.255.255.255:/home/fakeuser/id_rsa.pub

Here I noticed that I did NOT have an authorized_keys file within my .ssh. So I used touch to create it. Then I used CAT to copy the contents of the .pub into the authorized_keys file

cat id_rsa.pub >> ~/.ssh/authorized_keys

and set the appropriate permissions on .ssh and authorized_keys

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

In /etc/ssh/sshd_config I uncommented the following

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

I then restarted sshd

service sshd restart

From what I read, this is all I should have to do to enable public key authentication. However, when I attempt to SSH without supplying -i privatekey, I am allowed in from all devices.

Answer 1

If a client key is in the default location ~/.ssh/id_$alg it is used automatically unless you use -o IdentitiesOnly=yes (or the equivalent config file entry) to disable it. If you are able to connect from a client that does not have a copy of the privatekey and without specifying a password, then the authentication on your server is not set correctly. If you want to use only privatekey->publickey authentication, configure PasswordAuthentication no .

PS: anything >>file (and anything >file also) creates the file if it doesn't exist, you don't need to touch it. And the default remote dir for scp is your homedir, so you normally don't need to specify that.

Also:

RSAAuthentication is for SSHv1 which was broken decades ago and should never be used and is disabled by default in all OpenSSH versions for a long time and removed entirely from server side as of 7.4 although I expect CentOS 6 probably does not have that recent a version.

PubkeyAuthentication yes and AuthorizedKeysFile .ssh/authorized_keys (plus authorized_keys2 which is a relic and no longer used) are the defaults so you don't actually need to uncomment them.

Answer 2

You need to explicitly disable password authentication on the server if you only want to allow public/private keys. In your /etc/ssh/sshd_config change or add the setting:

PasswordAuthentication no

I also like to explicitly disable all other types of authentication that I don't use, like Kerberos and GSSAPI.