25

Why can I still ssh into my Ubuntu machine using a password? This is the /etc/ssh/sshd_config file of my Ubuntu 20.04 on ovh hosting (showing only non-commented lines for brevity):

Include /etc/ssh/sshd_config.d/*.conf
Port xxx
PermitRootLogin no
AllowUsers      user1 user2
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys .ssh/authorized_keys2
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem       sftp    /usr/lib/openssh/sftp-server

The permissions of the relevant files seem to be OK:

$ stat -c %a /home/user1/.ssh/
700

$ stat -c %a /home/user1/.ssh/authorized_keys`
600

I have run sudo service ssh restart and sudo service sshd restart.

Why am I still able to log into my Ubuntu machine by password over ssh? I can login by user and password over ssh (PuTTY), it only asks for password. Both user1 and user2 have their key in .ssh home folder.  What is missing?

I checked the include file:

-rw------- 1 root root   27 Dec  1 12:52 50-cloud-init.conf
...:/etc/ssh/sshd_config.d$ sudo cat 50-cloud-init.conf
PasswordAuthentication yes

so I guess that is the cause?  However, wouldn’t my config overwrite this setting? since it is included above (line wise)?

14
  • 4
    Did you run sudo service sshd restart or did you only restart ssh? These are setting for the sshd service (the ssh server) not the ssh service (ssh client).
    – terdon
    Commented Dec 6, 2022 at 11:25
  • oh boy. i only run ssh not sshd. man! thanks
    – koko
    Commented Dec 6, 2022 at 11:28
  • Did that solve it?
    – terdon
    Commented Dec 6, 2022 at 11:30
  • 3
    @terdon is there really a separate ssh client service? AFAIK, the server service is really named ssh, and sshd is just an alias (/etc/systemd/system/sshd.service -> /lib/systemd/system/ssh.service) specified via the ssh.service file's [Install] section Commented Dec 6, 2022 at 12:29
  • 2
    @koko, from man sshd_config: "For eack keyword, the first obtained value will be used." Commented Dec 6, 2022 at 12:47

4 Answers 4

48

Ubuntu/Debian distributions have the non-standard entry Include /etc/ssh/sshd_config.d/*.conf at the beginning of the distribution sshd_config. The purpose of this is to allow users to customize their sshd configuration without modifying the core sshd_config file, which can minimize conflicts or unexpected configuration changes on apt update of OpenSSH.

Because the first encountered configuration line is the one applied, any password commands in a custom configuration file in /etc/ssh/sshd_config.d/*.conf will pre-empt the PasswordAuthentication no line in the primary configuration. Ensure that all configuration is as you expect.

As noted by @dexter, you can output the effective configuration with sudo sshd -T, which may highlight when one configuration file overrides another.

0
11

Login by password could be performed not only with PasswordAuthentication. Actually, it is the "dedicated simple" method of authentication, and there is a generic method which, amongst others, can do password authentication - KbdInteractiveAuthentication, formerly known as ChallengeResponseAuhentication. It is a generic chat-like (that's what challenge response stands for) authentication, which can be made dual factor, use one-time passwords and so on, by asking additional or customized questions, while the former only allows exactly what it names — authentication by system password.

UsePAM controls somewhat how KbdInteractiveAuthentication (a.k.a. ChallengeResponseAuthentication) could replace/duplicate the PasswordAuthentication. PAM could provide challenge-response chat to sshd, and PAM usually is configured with pam_unix.so which performs traditional password authentication, so UsePAM + KbdInteractiveAuthentication effectively provides password authentication for SSH. (Thanks @TooTea for noticing this.)

See the most upvoted answer here (it's a shame it isn't the accepted answer, because it is clearly better), and also see man sshd_config, of course.

3
  • I also wondered whether "UsePAM yes" could allow passwords. No PAM specialist...
    – U. Windl
    Commented Dec 7, 2022 at 7:08
  • 5
    @U.Windl Only in combination with ChallengeResponse/KbdInteractive. That's exactly what it does, provide a mechanism for PAM modules to interactively chat with the client, so it's typically PAM printing the exact same "Password:" prompt as on a local TTY, etc. If this mechanism is disabled, PAM modules have no way to interact with the user, so they can only use the password supplied to them by SSH (from the builtin PasswordAuthentication prompt, which runs before PAM is invoked).
    – TooTea
    Commented Dec 7, 2022 at 9:09
  • @TooTea thank you for noticing this, I put that into the answer. Commented Dec 7, 2022 at 11:23
4

The include file had PasswordAuthentication yes which was used, thanks to man sshd_config: "For each keyword, the first obtained value will be used."

Now if I try to login via SSH, I "No supported authentication methods available (public key)".

Only SSH key works.

0

Keep in mind that the order matters when using match sections.

This one will work:

Match User user-special
    PasswordAuthentication yes

Match User user-ftp
    AuthorizedKeysFile /home/user-ftp/.ssh/authorized_keys
    ChrootDirectory /DATA/s2survey
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Match all
    PasswordAuthentication no
    KbdInteractiveAuthentication no
    ChallengeResponseAuthentication no

This order, however will not work as expected. Either the PasswordAuthentication is ignored (was not able to find out why) or it will not be changed in the more specific match sections.

PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no

Match User user-special
    PasswordAuthentication yes

Match User user-ftp
    AuthorizedKeysFile /home/user-ftp/.ssh/authorized_keys
    ChrootDirectory /DATA/s2survey
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Match all

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .