0

I'm a noob on Gnu/Linux and UNIX. I am playing a game to learn basics of this OS.

As part of the game I'm playing, I have to logon a remote server using ssh, having only the private key certificate and the username (no password).

  • If I log in using SSH from the remote machine (where I'm logged in with another username), I'm granted to access without any password.
  • If I try to log in from my local machine, SSH asks me a password instead.

Is this the consequence of an SSH configuration of the server I'm trying to access?
I mean, SSH can apply different login policy if I log from localhost (in this case, the server) and if I log from a remote machine (in this case, my PC)?

Thanks a lot.
Kind Regards.

4
  • The wording of your question compared to the title swaps local host with remote host. I assume the title is correct and the question is wrong, but please check and clarify.
    – Hermann
    Mar 18 '20 at 20:43
  • do you have the appropriate key files on both machines? Mar 18 '20 at 20:58
  • 1
    Also the ssh server may not ask for a password if the key is presented. Was the key available in both cases. It is good practice to configure ssh server to not except password authentication. It is hard to say any more without more information about your setup. Mar 18 '20 at 21:56
  • Thanks for helping. I noticed the grammar errors but I experienced network problems and I'm back only now. Sorry for the inconvenience. Actually I was doubtful about the different behavior while accessing to the same server, with the same username, from different points (one case from my laptop -remote-, and one case from the same server -local-). Actually fra-san comment answers the question. I can close this. Thanks a lot.
    – massi
    Mar 18 '20 at 22:16
1

Is this the consequence of an SSH configuration of the server I'm trying to access?

Based on the details you shared, we can not be sure. You may even be connecting to two distinct, independently configured SSH daemons running on on the same system.

I mean, SSH can apply different login policy if I log [in] from localhost (in this case, the server) and if I log [in] from a remote machine (in this case, my PC)?

Yes, SSH servers can apply different policies based on various properties of the incoming connections.

For instance, the Match keyword in OpenSSH sshd's configuration allows you to define conditional blocks that group directives which are only applied (and override those previously set) if a list of specified conditions are met (see, for details, man 5 sshd_config).

Adding this block to /etc/ssh/sshd_config (the exact location may vary, depending on your system):

PubkeyAuthentication yes

Match Address "!127.0.0.1,!::1,*"
    PubkeyAuthentication no

will instruct sshd to:

  • allow public key authentication by default;
  • disallow public key authentication for connections coming from other addresses than 127.0.0.1 and ::1.

(Headache-saving note: as stated in man 5 ssh_config, "PATTERNS",

[...] a negated match will never produce a positive result by itself. [...] The solution here is to include a term that will yield a positive match, such as a wildcard [...]

that is why "!127.0.0.1,!::1,*" includes a * at its end).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.