Join Log in
Score:2
Jorg busch avatar Server

SSH authenticate with publickey,password or publickey,none

pn flag
Jorg busch

On my SFTP-Server I want to allow only login via public key AND password OR (if and ONLY IF user has no password) by only public key

I set the following in the the sshd_config:

AuthenticationMethods publickey,none publickey,password
PubkeyAuthentication yes
RSAAuthentication yes
PasswordAuthentication yes
PermitEmptyPasswords yes

But I'm always promptet for a password. When the user has no password it says "further authentication required", also when I just press Enter in the password dialog.

Login with password AND public key (in case user has a password set for his account) works fine.

Any recommendation?

EDIT: verbose output

user@DESKTOP-MS:~$ ssh -vvv -i administrator_priv_ssh -p 30627 [email protected]
OpenSSH_8.2p1 Ubuntu-4, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 10.0.20.20 is address
debug2: ssh_connect_direct
debug1: Connecting to 10.0.20.20 [10.0.20.20] port 30627.
debug1: Connection established.
debug1: identity file administrator_priv_ssh type -1
debug1: identity file administrator_priv_ssh-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4p1 Debian-5+deb11u1
debug1: match: OpenSSH_8.4p1 Debian-5+deb11u1 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 10.0.20.20:30627 as 'administrator'
debug3: put_host_port: [10.0.20.20]:30627
debug3: hostkeys_foreach: reading file "/home/user/.ssh/known_hosts"
debug3: record_hostkey: found key type ED25519 in file /home/user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from [10.0.20.20]:30627
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],ssh-ed25519
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c
debug2: host key algorithms: [email protected],ssh-ed25519,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected],zlib
debug2: compression stoc: none,[email protected],zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: ciphers stoc: [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
debug2: MACs ctos: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[email protected]
debug2: compression stoc: none,[email protected]
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ssh-ed25519 SHA256:iGPrTwK6NU0gPhVEKnHowNYUmvUKT0Iy7jMhKwWY0Ck
debug3: put_host_port: [10.0.20.20]:30627
debug3: put_host_port: [10.0.20.20]:30627
debug3: hostkeys_foreach: reading file "/home/user/.ssh/known_hosts"
debug3: record_hostkey: found key type ED25519 in file /home/user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from [10.0.20.20]:30627
debug3: hostkeys_foreach: reading file "/home/user/.ssh/known_hosts"
debug3: record_hostkey: found key type ED25519 in file /home/user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from [10.0.20.20]:30627
debug1: Host '[10.0.20.20]:30627' is known and matches the ED25519 host key.
debug1: Found key in /home/user/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: administrator_priv_ssh  explicit
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,[email protected],ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected]>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: administrator_priv_ssh
debug3: sign_and_send_pubkey: RSA SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
Authenticated with partial success.
debug1: Authentications that can continue: password
debug3: start over, passed a different list password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup password
debug3: remaining preferred: ,publickey,keyboard-interactive,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
[email protected]'s password:
debug3: send packet: type 50
debug2: we sent a password packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: password
Permission denied, please try again.
[email protected]'s password:
2947
3 + 0
ssh
Score:1
Serguei avatar Server
ng flag
Serguei

If you could provide a verbose output of ssh -vvv ... to see what may be the root cause. One possibility could the the permissions on the .ssh/ directory with the private keys are too loose, so it refuses to use the key. Could be something else, but we need to see the verbose output.

EDIT: Perhaps specifying PasswordAuthentication no for passwordless users explicitly is what you want while keeping the rest:

...
Match User alice
  PasswordAuthentication no
+ 5
Jorg busch avatar
pn flag
Jorg busch
seems that the "none" method it simply ignored by sshd when combined with others?
0
Reply
Marcel avatar
gb flag
Marcel
I think a better follow up question would be, do you have any user which CAN login with public key having a password that he never has to type? Then check the permissions of the $HOME/.ssh/* tree from this user and compare with the permissions of that tree from the user with password=none
0
Reply
Jorg busch avatar
pn flag
Jorg busch
@Marcel I hope I understood you correctly.. A user with a password and public key can only login with that two credentials combined (what works and is expected, user is not authenticated if he has a password and doesnt type it). What I want is that the user that has no password can login with only the public key. What I was thinking is the config doing with: `AuthenticationMethods publickey,none` `PasswordAuthentication yes` `PermitEmptyPasswords yes` That is not working as expected, ssh says password authentication is required (but the user a no password)
0
Reply
Serguei avatar
ng flag
Serguei
@Jorgbusch From your verbose output "Authenticated with partial success" means the server accepted your key and now asks for password to complete authentication. Which is your basic requirement that works, correct? Or the user in this case in your output does not have the password set and you only want them to use the key?
0
Reply
Serguei avatar
ng flag
Serguei
@Jorgbusch also if I understand correctly, for the passwordless users but with a key, you may need to update your `sshd_config` to explicitly list them: ```Match User alice PasswordAuthentication no ``` and keep the rest if your config as-is.
0
Reply
Score:1
Jorg busch avatar Server
pn flag
Jorg busch

This explicit setting in sshd_config for the user kind of solves the problem, but does not satisfy me. It is not what I wanted, because I have to set it for every user in the sshd_config manually and the AuthenticationMethod publickey,none doesn't seem to work at all

AuthenticationMethods publickey,none publickey,password none
PubkeyAuthentication yes
RSAAuthentication yes
PasswordAuthentication yes
PermitEmptyPasswords yes

Match User administrator
    AuthenticationMethods publickey
    PubkeyAuthentication yes
    PasswordAuthentication no
+ 2
Serguei avatar
ng flag
Serguei
Yes this is what I meant. I understand it can be daunting with a lot of users. Another option is to Match Group instead of Match User if you have such users in a well defined group -- this would better scale. I can't think of any other solution at the moment.
0
Reply
Colt avatar
br flag
Colt
@jorg busch you should make your clarifications as edits/addendum to your original question, rather than putting them in an "answer" that is not
0
Reply
Score:0
Jorg busch avatar Server
pn flag
Jorg busch

@Serguei

Match User alice
   PasswordAuthentication no

makes it even worse. It recognized no next authentication method, starts over, tries every method until we are again at the password prompt...

debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: administrator_priv_ssh
debug3: sign_and_send_pubkey: RSA SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
Authenticated with partial success.
debug1: Authentications that can continue:
debug3: start over, passed a different list gssapi-with-mic,publickey,keyboard-interactive,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)


debug1: Unspecified GSS failure.  Minor code may provide more information
No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_1000)


debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: administrator_priv_ssh
debug3: sign_and_send_pubkey: RSA SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:qvtj3y/xdk1IIwdYjXgyzMEtpZNfgxKMGKojrGMic74
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue:
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue:
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred:
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
[email protected]'s password:
debug3: send packet: type 50
debug2: we sent a password packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue:
Permission denied, please try again.
[email protected]'s password:```
+ 2
Serguei avatar
ng flag
Serguei
I of course meant that you keep other settings on as required for publickey etc as you did in your other answer.
0
Reply
Colt avatar
br flag
Colt
@jorg bush you should make your clarifications as edits/addendum to your original question, rather than putting them in an "answer" that is not
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.