3

I would like to login to 127.0.0.1 via SSH without using a public key and password. sshd_config and log files are provided below, so here's just a quick outline:

  • The user accounts password is deleted with passwd --delete, i. e. login is possible without password
  • PasswordAuthentication and PermitEmptyPasswords is generally set to no, but is set to yes for logins from 127.0.0.0/8 via Match condition. Logs indicate the Match condition was parsed correctly and is met.
  • Logs suggest that it is PAM which is getting in the way.

I already did quite a bit of research, but PAM seems to be a very complex topic. I did not yet understand how SSH and PAM are interconnected.

I'm running Linux manuel-nas 4.9.0-6-amd64 #1 SMP Debian 4.9.82-1+deb9u3 (2018-03-02) x86_64 GNU/Linux

Logs and configuration files:

sshd_config:

#   $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here! PasswordAuthentication no
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads) ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'. UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed ClientAliveInterval 0 ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables AcceptEnv LANG LC_*

# override default of no subsystems Subsystem   sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server

Match Address 127.0.0.0/8
    PasswordAuthentication yes
    PermitEmptyPasswords yes

Match user diskuser
    ForceCommand internal-sftp
    ChrootDirectory /mnt/daten

Match user diskuser-privat
    ForceCommand internal-sftp
    ChrootDirectory /mnt/privat

sshd debug output:

$ /usr/sbin/sshd -p2222 -ddd
--- Beginning stripped for clarity ---
debug3: checking match for 'Address 127.0.0.0/8' user user host 127.0.0.1 addr 127.0.0.1 laddr 127.0.0.1 lport 2222
debug1: connection from 127.0.0.1 matched 'Address 127.0.0.0/8' at line 125
debug3: match found
debug3: reprocess config:126 setting PasswordAuthentication yes
debug3: reprocess config:127 setting PermitEmptyPasswords yes
debug3: checking match for 'user diskuser' user user host 127.0.0.1 addr 127.0.0.1 laddr 127.0.0.1 lport 2222
debug3: match not found
debug3: checking match for 'user diskuser-privat' user user host 127.0.0.1 addr 127.0.0.1 laddr 127.0.0.1 lport 2222
debug3: match not found
debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
debug3: mm_request_send entering: type 9
debug2: monitor_read: 8 used once, disabling now
debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
debug3: mm_request_receive_expect entering: type 9 [preauth]
debug3: mm_request_receive entering [preauth]
debug2: input_userauth_request: setting up authctxt for user [preauth]
debug3: mm_start_pam entering [preauth]
debug3: mm_request_send entering: type 100 [preauth]
debug3: mm_inform_authserv entering [preauth]
debug3: mm_request_send entering: type 4 [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 100
debug1: PAM: initializing for "user"
debug1: PAM: setting PAM_RHOST to "127.0.0.1"
debug1: PAM: setting PAM_TTY to "ssh"
debug2: monitor_read: 100 used once, disabling now
debug2: input_userauth_request: try method none [preauth]
debug3: mm_auth_password entering [preauth]
debug3: mm_request_send entering: type 12 [preauth]
debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD [preauth]
debug3: mm_request_receive_expect entering: type 13 [preauth]
debug3: mm_request_receive entering [preauth]
debug3: mm_request_receive entering
debug3: monitor_read: checking request 4
debug3: mm_answer_authserv: service=ssh-connection, style=, role=
debug2: monitor_read: 4 used once, disabling now
debug3: mm_request_receive entering
debug3: monitor_read: checking request 12
debug3: PAM: sshpam_passwd_conv called with 1 messages
debug1: PAM: password authentication failed for user: Authentication failure
debug3: mm_answer_authpassword: sending result 0
debug3: mm_request_send entering: type 13
Failed none for user from 127.0.0.1 port 36202 ssh2
debug3: mm_auth_password: user not authenticated [preauth]
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]
debug3: send packet: type 51 [preauth]

/var/log/auth.log output:

Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: recv_rexec_state: entering fd = 5
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: ssh_msg_recv entering
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: recv_rexec_state: done
Mar 23 11:09:52 manuel-nas sshd[23081]: debug2: parse_server_config: config rexec len 563
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:56 setting PasswordAuthentication no
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:61 setting ChallengeResponseAuthentication no
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:84 setting UsePAM yes
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:89 setting X11Forwarding yes
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:93 setting PrintMotd no
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:100 setting ClientAliveInterval 0
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:101 setting ClientAliveCountMax 3
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:113 setting AcceptEnv LANG LC_*
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: rexec:116 setting Subsystem sftp\t/usr/lib/openssh/sftp-server
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: checking syntax for 'Match Address 127.0.0.0/8'
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: checking syntax for 'Match user diskuser'
Mar 23 11:09:52 manuel-nas sshd[23081]: debug3: checking syntax for 'Match user diskuser-privat'
Mar 23 11:09:52 manuel-nas sshd[23081]: debug1: sshd version OpenSSH_7.4, OpenSSL 1.0.2l  25 May 2017
Mar 23 11:09:52 manuel-nas sshd[23081]: debug1: private host key #0: ssh-rsa SHA256:< removed for confidentiality >
Mar 23 11:09:52 manuel-nas sshd[23081]: debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:< removed for confidentiality >
Mar 23 11:09:52 manuel-nas sshd[23081]: debug1: private host key #2: ssh-ed25519 SHA256:< removed for confidentiality >
Mar 23 11:09:52 manuel-nas sshd[23081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1  user=user

ssh output: Note: In the logs I can see that my login attempt is already rejected when the password prompt appears

$ ssh 127.0.0.1 -p2222
user@127.0.0.1's password: 
  • @muru: It seems this happened during copying/pasting. I corrected it. Thanks for the info! – Multisync Mar 23 '18 at 11:32
  • 1
    When you say "user accounts password is deleted" do you mean the password is set to the empty string or that the the second field in getent shadow for that user is empty (by passwd -d or something similar)? – muru Mar 23 '18 at 11:41
  • @muru: Latter is correct, the password is deleted by passwd -d. – Multisync Mar 23 '18 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.