0

Setting up a CentOS 7 cloud server for a client, and have run into an issue with setting it to use a public RSA key instead of a password for one of a handful of SFTP users.

Found an online guide on setting up keys at:

https://debian-administration.org/article/530/SSH_with_authentication_key_instead_of_password

The client supplied a public key file, which I copied to the server using the "ssh-copy-id" command. All good according to the responses I got.

I then locked the account using the "passwd -l" command. Reset the server and checked, and the system confirms that the password is locked:

testuser1 LK 2018-09-17 0 99999 7 -1 (Password locked.)

However, I can still log in using a password using that account on computers that do not have the private key installed.

So, I did more research, and found another tutorial that says you can force the use of RSA keys by setting PasswordAuthentication to no in the etc/ssh/sshd_config file, which raises a concern as other users do not use RSA keys for their login.

Did I do something wrong, or is there something else I can do to disable passwords for this single account? Is there a way to allow some users to use passwords while allowing others to use a RSA key?

  • sudo passwd -l <username> should have worked. Check there are no typos and that sort of thing. – mikst Sep 17 '18 at 22:06
  • I agree - a locked password should, in fact, be locked. That's the behavior on my centos nodes. This statement, however, makes me wonder: However, I can still log in using a password using that account on computers that do not have the private key installed. Do you mean that you locked the password on all these other computers, or did you just lock it on one host and expect it to be locked everywhere? – guzzijason Sep 17 '18 at 22:12
  • @mikst Thanks for the advice. When I check the user, it shows that the password is locked, so it isn't a case of typos. – Charles Sep 17 '18 at 22:24
  • @guzzijason I'll try to clarify. A customer sent me a PUB key that they generated to use instead of a password. I installed the key on a cloud server, and then locked the password for that user account on the server. I then tested using a laptop that doesn't have the private key installed. When I attempt to login to SFTP with that user, I am prompted for a password since I don't have the key, which should not work as it is locked but does. I need to be able to lock password login ability for some users, but not all. Is that possible? If so, what do I need to do to make it work properly? – Charles Sep 17 '18 at 22:30
  • 1
    OK, so it prompts you for a password - that's normal, even if the account is locked. You should not be able to authenticate successfully using a password, however - it should always fail. – guzzijason Sep 17 '18 at 22:47
0

After spinning up a brand-new CentOS instance in AWS, I went through the process of:

  1. Adding a new user (and setting a password)
  2. Test password login
  3. Lock account
  4. Test password login
  5. Add ssh key to user's account
  6. Test ssh key login

  1. Add new user:

    [centos@ip-172-31-80-91 ~]$ sudo useradd -c "Demo User" -m demo_user
    [centos@ip-172-31-80-91 ~]$ sudo passwd demo_user
    Changing password for user demo_user.
    New password:
    Retype new password:
    passwd: all authentication tokens updated successfully.
    
  2. Test password login:

    [guzzijason@macbook ]$ ssh demo_user@54.147.127.91
    demo_user@54.147.127.91's password:
    [demo_user@ip-172-31-80-91 ~]$
    
  3. Lock account on server

    [centos@ip-172-31-80-91 ~]$ sudo passwd -l demo_user
    Locking password for user demo_user.
    passwd: Success
    
  4. Test password login (again; should fail this time)

    [guzzijason@macbook ]$ ssh demo_user@54.147.127.91
    demo_user@54.147.127.91's password:
    Permission denied, please try again.
    demo_user@54.147.127.91's password:
    Permission denied, please try again.
    demo_user@54.147.127.91's password:
    demo_user@54.147.127.91: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
    
  5. Add ssh key to user's account on server:

    [centos@ip-172-31-80-91 ~]$ sudo su -
    Last login: Mon Sep 17 22:07:43 UTC 2018 on pts/0
    [root@ip-172-31-80-91 ~]# umask 077
    [root@ip-172-31-80-91 ~]# mkdir /home/demo_user/.ssh
    [root@ip-172-31-80-91 ~]# echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDT+PautYetQxI+J8jshx2bZkMyuxd7dHBlCKjgIr9Y869RP+xzgvFFs1oCzAo/Q8Tn3Pz2htI4VN9h3LVsX+JuK3Omf+/vs6I21rIpDE2m/qhO5JH+2gflrsmhHRziHCbokoIr/LYIgkWAzgpiJ4tr2NWc8b32NggepIljfXBMm9TuuorYFNKqG8hpiHAsj5OugBiJUPyuBzPUlvFYdXuT0ireVlNgQcidi873psOWL9QQMrxTZYjd+Ucphk48otp/x7q3LD2luKXkfEsKyMgyVSApSfjdakh2ihJnfvhAfstAN+iuFPu1EYg5+4mUj0Z028TbxSn1hO5ijpgQDh8h guzzijason@macbook" >>/home/demo_user/.ssh/authorized_keys
    [root@ip-172-31-80-91 ~]# chown -R demo_user /home/demo_user/.ssh
    [root@ip-172-31-80-91 ~]# ls -ld $(find /home/demo_user/.ssh)
    drwx------. 2 demo_user root  29 Sep 18 02:25 /home/demo_user/.ssh
    -rw-------. 1 demo_user root 400 Sep 18 02:25 /home/demo_user/.ssh/authorized_keys
    [root@ip-172-31-80-91 ~]#
    
  6. Test ssh key login

    [guzzijason@macbook ]$ ssh -i .ssh/demo_user demo_user@54.147.127.91
    Last login: Tue Sep 18 02:28:18 2018 from xxx
    [demo_user@ip-172-31-80-91 ~]$
    

NOTE: a common mistake when setting up ssh keys for a user is not having the correct ownership or permissions on the .ssh directory and authorized_keys file. These are very important! If these permissions are not strictly set, ssh key authentication will fail.

ALSO: PasswordAuthentication yes was set in my sshd_config for all of this.

  • Thanks for the answer. I just read another tutorial on the subject, and it mentions that the tutorial works on CentOs 6, but not on CentOS 7. I'll try again using your suggestions. – Charles Sep 18 '18 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.