0

Something is not clear to me with SSH authentication.

I have a Talend job which connects to sFTP (using SSH protocol) and on the property page of the component, I have the choice between: 1. Password authentication 2. PublicKey authentication

When I choose Password authentication the data to enter are username and password. but when I choose PublicKey authentication the data to enter are username, password, private key path and private key pass-phrase.

I though when a PublicKey authentication is set on a server there is no need for a password.

Is the SSH enables an authentication using a public key and a password in the same time as a security enforcement or it is just a fallback which means if the public key is not authorized, the standard username/password will be used (if the sshd server permits it)?

3
  • You could show verbose output log from such ssh session...
    – jirib
    Nov 7, 2013 at 14:02
  • I have only access to my own machine for testing purpose and I use a public key auth without password; but I do not have access to the real servers. The question was just to know if it is possible or not to have both authentication.
    – рüффп
    Nov 7, 2013 at 15:19
  • They can hack dual-password themself with ForceCommand and their own cooked scripts as well...
    – jirib
    Nov 8, 2013 at 8:06

2 Answers 2

1

OpenSSH 6.2 introduced multiple authentication methods.

For references, see sshd_config(5).

1
  • Then if they want both authentication, they must have (at least) this version of sshd on the server side, right?
    – рüффп
    Nov 7, 2013 at 15:21
0

Normally, if you use PublicKey and Password it is a fall back. PublicKey is tried first because it is safer and more secure, then Password is attempted.

I STRONGLY (and I can't make that bold enough). Suggest you allow only PublicKey based authentication for any SSH servers that you have running on the Internet.

When the SSH connection is established using Password authentication the password is sent to the server. Password authentication leave you wide open to the normal route of brute forcing a password. Which can and will happen, if there are enough users using that see server (one of them will pick a crappy password).

Key based authentication is much more secure, because it binds a user on a machine to a user on another machine. The key is typically generated per client machine/user pair. When I explain this to clients, I usually use the ID card example. You have one ID card but it can get you into many places.

That said, keys can be encrypted with passwords. So the key you generate on your local machine can have (and does by default) a password to decrypt it. Meaning that your local machine will ask you for a password, decrypt your key, send it to the server, and the server will try to authenticate. (In fairness it doesn't really decrypt your key, it's that the public key is "offset" by your password).

So, If you use PublicKey then you will need to provide a public key to the user/machine combo your trying to connect to.

If you use Password then you will need to provide a password (sent in the clear) to the server your trying to connect to.

If you use PublicKey and Password then you will need to provide Either a public key or a password.

4
  • You might want to double-check the "in the clear" statement. RFC 4253 (among others) state that the two systems involved in an ssh connection first exchange identification strings. Immediately afterwards they exchange keys and an encryption algorithm and key will be negotiated during the key exchange. When encryption is in effect, all packet payloads must be encrypted. All this happens before you ever see a login: prompt.
    – doneal24
    Nov 7, 2013 at 17:36
  • You are correct, updating answer.
    – coteyr
    Nov 7, 2013 at 17:57
  • "I STRONGLY (and I can't make that bold enough). Suggest you allow only PublicKey based authentication for any ssh servers that you have running on the internet." --> unfortunately it is not my responsibility to choose what method, it is external providers sFTP who choose what is the best for them and we have to fit their choices. Some providers also have firewall rules to enable only our (and others authorized companies) IP(s).
    – рüффп
    Nov 8, 2013 at 8:55
  • "So the key you generate on your local machine can have (and does by default) a password to decrepit it" --> I guess you are talking about the passphrase here. I made the distinction between password (to connect to the remote server) and the passphrase (to enable key extraction).
    – рüффп
    Nov 8, 2013 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .