Score:0

No Password Prompt - SSH

vn flag

I have new ubuntu server setup in Linode. I am trying to disable password logins and was successfull doing so for root users but unable to do so for a new user(lrehan) created by me.

root cannot login via password/ssh key lrehan can login without password or by not providing the ssh key (as there is no password prompt)

root login

  1. ssh root@ip - FAILED - EXPECTED RESULTS
  2. ssh -i ~./ssh/linode root@ip - FAILED - EXPECTED RESULTS

lrehan login

  1. ssh lrehan@ip - LOGS IN (NO PASSWORD PROMT) - NOT EXPECTED
  2. ssh -i ~./ssh/linode lrehan@ip - LOGS IN - EXPECTED RESULTS

Here is my sshd_config file

#       $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
#HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM no

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

Can someone direct me or help me on what is going wrong with this? Thanks!
vn flag
The thing is, even though lrehan user has password, when I try to ssh into the system via lrehan, there is no password prompt. This is why you have the confusion i guess.
vn flag
Is it expected even without providing the ssh key?
vn flag
Totally understand. But the command #3 doesn't have any ssh key passed to it when you compare with #2 and #4 in which u have provided.
user535733 avatar
cn flag
Since your question does not tell us what you did, nor provide a link to any instructions you followed, nor provide diagnostic output from ssh, you are asking us to speculate. Please edit your question to provide any of that additional information. Comments are not intended for conversation. Comments are intended to help you refine and improve your unanswerable question to become answerable.
ar flag
Do you have any other keys in the `~/.ssh` folder? Have you uploaded any other public key to the remote computer? Run `ssh -vvv lrehan@ip` and copy and paste all the output in your question. This will tell us which key it is using.
vn flag
I have multiple keys in the folder. But have uploaded only one to the server.
ar flag
What do you get when you run `ssh` with the verbose `-vvv` option?
karel avatar
sa flag
Does this answer your question? [Unable to disable password authentication over SSH](https://askubuntu.com/questions/1440290/unable-to-disable-password-authentication-over-ssh)
Score:0
tg flag

I solved using this answer https://askubuntu.com/a/1440509/1713168

Inside the directory /etc/ssh/sshd_config.d/ there is only one .conf file (50-cloud-init.conf), but inside it contains the line: PasswordAuthentication yes

I changed the line to #PasswordAuthentication no

and i restarted the ssh. Now is working. I can only access with the ssh key.

Luuk avatar
cn flag
You disabled the `PasswordAuthentication yes`, and this succeeded in "I am trying to disable password logins" ?? BTW: The default value for that setting is `yes`, see: https://man.openbsd.org/sshd_config#PasswordAuthentication
Jonatas Artur avatar
tg flag
Sorry, im changed the line to `#PasswordAuthentication no`
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.