PasswordAuthentication no, but I can still login by password

Question

Why can I still ssh into my Ubuntu machine using a password? This is the /etc/ssh/sshd_config file of my Ubuntu 20.04 on ovh hosting (showing only non-commented lines for brevity):

Include /etc/ssh/sshd_config.d/*.conf
Port xxx
PermitRootLogin no
AllowUsers      user1 user2
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys .ssh/authorized_keys2
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server

The permissions of the relevant files seem to be OK:

$ stat -c %a /home/user1/.ssh/
700

$ stat -c %a /home/user1/.ssh/authorized_keys`
600

I have run sudo service ssh restart and sudo service sshd restart.

Why am I still able to log into my Ubuntu machine by password over ssh? I can login by user and password over ssh (PuTTY), it only asks for password. Both user1 and user2 have their key in .ssh home folder.  What is missing?

I checked the include file:

-rw------- 1 root root   27 Dec  1 12:52 50-cloud-init.conf
...:/etc/ssh/sshd_config.d$ sudo cat 50-cloud-init.conf
PasswordAuthentication yes

so I guess that is the cause?  However, wouldn’t my config overwrite this setting? since it is included above (line wise)?

Answer 1

Ubuntu/Debian distributions have the non-standard entry Include /etc/ssh/sshd_config.d/*.conf at the beginning of the distribution sshd_config. The purpose of this is to allow users to customize their sshd configuration without modifying the core sshd_config file, which can minimize conflicts or unexpected configuration changes on apt update of OpenSSH.

Because the first encountered configuration line is the one applied, any password commands in a custom configuration file in /etc/ssh/sshd_config.d/*.conf will pre-empt the PasswordAuthentication no line in the primary configuration. Ensure that all configuration is as you expect.

As noted by @dexter, you can output the effective configuration with sudo sshd -T, which may highlight when one configuration file overrides another.

Answer 2

Login by password could be performed not only with PasswordAuthentication. Actually, it is the "dedicated simple" method of authentication, and there is a generic method which, amongst others, can do password authentication - KbdInteractiveAuthentication, formerly known as ChallengeResponseAuhentication. It is a generic chat-like (that's what challenge response stands for) authentication, which can be made dual factor, use one-time passwords and so on, by asking additional or customized questions, while the former only allows exactly what it names — authentication by system password.

UsePAM controls somewhat how KbdInteractiveAuthentication (a.k.a. ChallengeResponseAuthentication) could replace/duplicate the PasswordAuthentication. PAM could provide challenge-response chat to sshd, and PAM usually is configured with pam_unix.so which performs traditional password authentication, so UsePAM + KbdInteractiveAuthentication effectively provides password authentication for SSH. (Thanks @TooTea for noticing this.)

See the most upvoted answer here (it's a shame it isn't the accepted answer, because it is clearly better), and also see man sshd_config, of course.

Answer 3

The include file had PasswordAuthentication yes which was used, thanks to man sshd_config: "For each keyword, the first obtained value will be used."

Now if I try to login via SSH, I "No supported authentication methods available (public key)".

Only SSH key works.

Answer 4

Keep in mind that the order matters when using match sections.

This one will work:

Match User user-special
    PasswordAuthentication yes

Match User user-ftp
    AuthorizedKeysFile /home/user-ftp/.ssh/authorized_keys
    ChrootDirectory /DATA/s2survey
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Match all
    PasswordAuthentication no
    KbdInteractiveAuthentication no
    ChallengeResponseAuthentication no

This order, however will not work as expected. Either the PasswordAuthentication is ignored (was not able to find out why) or it will not be changed in the more specific match sections.

PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no

Match User user-special
    PasswordAuthentication yes

Match User user-ftp
    AuthorizedKeysFile /home/user-ftp/.ssh/authorized_keys
    ChrootDirectory /DATA/s2survey
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Match all