1

I currently use ssh keys to connect to my server (Ubuntu 18.04). I would like to allow (in a specific, limited scope) the ability to login with passwords.

Whenever I try, my passwords fail. below is a session where I set a password, then try to use it:

~ # id
uid=0(root) gid=0(root) groups=0(root)

~ # passwd
Enter new UNIX password: <helloworld>
Retype new UNIX password: <helloworld>
passwd: password updated successfully

~ # ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no [email protected]
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:AlFtwpK4EhhaMXP5aT6fuQM9u9RYPq/o/sLJXfz++jM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
[email protected]'s password: <helloworld>
Permission denied, please try again.

I apologize if this is something obvious, I have no clue why the server accepts a new password, then accepts a password-based login to finally reject the credentials.

EDIT: the sshd_config file I failed to add

~ # cat /etc/ssh/sshd_config | grep -v ^#  | grep -v ^$                                                                                                                  root@srv
Port 22
PasswordAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
UsePAM yes
PrintMotd no
UseDNS no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server
Match Address 192.168.10.0/24,192.168.20.0/24,127.0.0.0/8
    PasswordAuthentication yes
Improve this question
6
  • Can you show us your sshd_config file? Could be many things. Maybe PermitRootLogin no is configured as well
    – Arthedain
    Nov 26, 2019 at 16:00
  • PermitRootLogin defaults to prohibit-password, so password login is disabled for root. Use a different user or change the setting to yes and try again.
    – Freddy
    Nov 26, 2019 at 16:33
  • @Freddy: that was it, thank you. Would you mind copying that to an answer so that I can accept it?
    – WoJ
    Nov 26, 2019 at 16:39
  • running ssh -v may be helpful
    – rogerdpack
    Nov 26, 2019 at 16:44
  • @WoJ I really don't mind if you answer your question. You tested it and fixed it, not me ;)
    – Freddy
    Nov 26, 2019 at 16:46

1 Answer 1

Reset to default
2

The login failed, because there is no setting for PermitRootLogin in /etc/ssh/sshd_config which defaults to prohibit-password, which means password login is disabled for root.

Adding

PermitRootLogin yes

to the Match block would allow root to login with password or public key authentication.

Another option would be to use a different user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .