[SOLVED] SSH Public Key Based Authentication

LinuxDunce · 08-30-2013, 04:10 PM

hello lq

I want to do SSH Public Key Based Authentication

There's no mention of modifying the /etc/ssh/sshd_config file in the article or don't no if it is necessary to do so.

If I want the ssh server to accept only key based authentication and no passwords, what lines in the sshd_config file should I comment out or in.

Thanks

acid_kewpie · 08-30-2013, 05:06 PM

Note this is really nothing to do with keys at all, just "not passwords". so you'd just set PasswordAuthentication to "no" as per the manpage for sshd_config

LinuxDunce · 08-30-2013, 05:28 PM

OK, acid_kewpie, I'll give it a go.

Janus_Hyperion · 08-30-2013, 05:38 PM

I think you should change passwords to no and this -

Code:

 PubKeyAuthentication yes

If this incorrect, someone please correct me!

LinuxDunce · 08-30-2013, 06:30 PM

I followed the suggestions from both of you and it worked.

user1 with the public key was granted access. ( no password was asked )

And user2, who doesn't have a public key was presented with this error

Permission denied (publickey,keyboard-interactive). And couldn't log on the system.

+1 to both of you

sundialsvcs · 08-30-2013, 07:10 PM

Check your settings one more time ... "keyboard-interactive" ought not be in that message.

As noted elsewhere, "ssh" has a very annoying "fee-chur" in that it will accept any authentication-method that it's been told to accept. "What? You don't have the super-duper security identity badge thingy? Cool! What's the magic word?"

Furthermore, it will happily tell the presumed-intruder what his choices are! It should be set to accept only one thing: public keys.

LinuxDunce · 08-30-2013, 08:51 PM

Hi sundialsvcs, thanks for informing me about the issue.

I did a google search on keyboard interactive

In the article it mentioned a challenged response. There was no challenge respond nor a prompt for user2. User2 does have a password of course. BTW, user1 and user2 are my test accounts to test public key authentication.

I'm no expert on ssh server authentication. I just follow what I read online. I don't want to modify the sshd_config file to much and mess things up. Right now it is doing what I want. Hopefully