Can openssh daemon count key failures separately from password failures?

elyograg

5/24/24, 11:38 PM

Recently the max number of auth for ssh was reduced on some servers at my work from 6 to 3 to comply with new security restrictions. Most of us in IT are seeing "too many failures" and no password prompt at all when we try to connect because ssh is counting all of our ssh keys as authentication attempts, and we have at least 3 keys each.

While this is technically correct, as a key auth is an auth attempt, what I am wondering is if sshd can track key-based authentications separately from password authentications. So we can have the key-based limit at 6 and set the password-based to 3 to comply with the new restrictions. I don't want to just have it not count key-based attempts, as it could be abused.

Either that, or make it so that it takes 2 or 3 key failures to count as one failed auth for the purposes of the limit. But I like the notion of tracking them separately more than this.

1 + 0

ssh

centos

Score:1

Server

Lacek

5/25/24, 10:27 AM

No, any authentication attempt is counted by sshd as "an attempt" regardless of the authentication method used. You cannot track different authentication methods differently.

What you can do is restrict the keys used for a particular host with the IdentitiesOnly config parameter. If it is set to yes, then only the specified identities will be used (or the default ones is none specified). So to force using only one specific key regardless of how many identities your agent stores, you need a config like this:

Host *.mycompany.localnet
  IdentitiesOnly yes
  IdentityFile /home/youruser/.ssh/my_company_ssh_key

+ 2

elyograg

5/26/24, 11:48 PM

That would be a LOT of entries in ~/.ssh/config.

Lacek

5/27/24, 4:56 PM

You can use wildcards as in the example, or you can have your most-used key file defined in a default block. But yes, if you have dozens of keys, and no host grouping can be done, you are to write a long config.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Can openssh daemon count key failures separately from password failures?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.