Score:1

Server

SSH will not use password authentication, still tries disabled methods

tmoore82

11/16/23, 2:58 AM

I'm running Fedora 36 Workstation with OpenSSH server 8.8p1. I want to log on a single remote user and authenticate with their password, but OpenSSH seems determined not to let me. I've tried every solution I can find online. Most of them seem to come down to "edit the password authentication line in /etc/ssh/sshd_config so that it reads as follows:

PasswordAuthentication yes

Done. I've also set the following:

PubkeyAuthentication no

KerberosAuthentication no

GSSAPIAuthentication no

I've tried connecting from Putty on Windows and through the terminal on another Fedora 36 Workstation. No luck. Same errors. I tried setting up keys, and I couldn't ssh-copy-id to the server because I haven't been able to authenticate a user yet.

At this point, my login attempt looks like this:

ssh -vv [email protected]

and always spits back

[email protected]: Permission denied (gssapi-keyex,gssapi-with-mic).

In the debug log, I also see

Authentications that can continue: gssapi-keyex,gssapi-with-mic

I'm sure I've restarted sshd. I'm sure that I'm editing the correct config file on the server. I've also tried to ssh with options set on the client side:

ssh -o [relevant options, etc.]

Why, if password authentication is set to yes, is it not showing up as an authentication method that can continue? Why, if GSSAPI is set to no, are those options showing as available? I've also tried removing openssh-server from the server and cleared out all ssh config files, then reinstalled and reset the options.

What else can I try?

I've seen references to UsePAM and ChallengeResponseAuthentication, but I've tried every combination of values for those, as well, and I keep ending up in the same place. The fact that I'm getting the same errors on both clients says that it's something on the server. Is there something that could be overriding my config file?

871

1 + 6

remote-access

ssh

password

gssapi

jabbson

11/16/23, 3:41 AM

You say you tried setting up keys but couldn't, since you haven't been able to authenticate a user yet. How did you change the sshd config?

asktyagi

11/16/23, 4:13 AM

are you doing changes in client side or server side? it seems you are doing client side only can you confirm?

diya

11/17/23, 1:09 PM

If Fedora is like RHEL it may be setting options/features in the sshd start-up command line that override settings form /etc/ssh/sshd_config ; check those commandline arguments with for example `systemctl status sshd` and/or the contents `EnvironmentFile` referenced in the systemd sshd.service unit file

tmoore82

11/17/23, 3:35 PM

@asktyagi I am making the changes on the server.

tmoore82

11/17/23, 3:36 PM

@jabbson I edited /etc/ssh/sshd_config with `sudo vi /etc/ssh/sshd_config`

tmoore82

11/17/23, 3:51 PM

@diya thank you! I found the problem. you pointed me in the right direction.

Score:0

Server

tmoore82

11/17/23, 4:02 PM

Turns out there was a local config file I had missed. Thanks to @diya's comment above, I went looking for another conf file.

/etc/ssh/sshd_config.d/01-local.conf

It contained one line

PasswordAuthentication no

Changed this to yes, restarted sshd, had immediate success logging in from the client.

I'm glad it's working, but I would still be interested to know if anyone has any insight into why this extra config file was tucked away, overriding my sshd_config. I didn't see any reference to this in any of the troubleshooting materials I found on ssh login issues.

+ 1

Tomek

11/17/23, 7:35 PM

It is probably included from `/etc/ssh/sshd_config` by `Include /etc/ssh/sshd_config.d/*.conf` (or something similar), likely close to the top of the file.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: SSH will not use password authentication, still tries disabled methods

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.