2

For all my servers PasswordAuthentication is set to no in the sshd_config file. This means that only key authentication is allowed.

In this situation, is there any risk if PasswordAuthentication is set to yes in the client's ssh_config?

  • Could you possibly explain what you mean by "risk" and whether your concern is regarding some risk on the server or on the client side of things? – Kusalananda Mar 30 at 21:51
  • 1
    Hi kusalananda. What I had in mind was a (theoretical or not) risk to the client. – NoExpert Mar 30 at 21:53
5

There's a risk, if the client connects to the wrong machine, and that machine allows password auth. Then the user may enter their password, thinking it might be a server side change... and now the password can be stolen.

Related: Is your SSH password revealed when you attempt to connect to the wrong server?

  • Thanks. A theoretical but real risk. This is the correct answer. – NoExpert Apr 1 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.