9mo ago

ssh won't ask for password unless i force `PubkeyAuthentication=no`

Lately I noticed that when I want to ssh to a server using a password I need to specify -o PubkeyAuthentication=no or I won't be asked for a password and the authentication will fail (well, for all I know, setting some other option may work too).

I use password authentication only once on freshly installed servers/vms, so it's not a huge deal, but... it still bothers me (mainly because I don't remember which option to set).

Do you guys have any idea what it may be?

17 comments

Try putting -vvv when you connect and see what's happening. I can imagine this happening if you have multiple identities (private/public key pairs) on the client and you hit a max retry limit. Pub key is always tried first, and it should ask for password once all the local keys have been tried.
- I did add a bunch of new keys to my ssh agent... this might really be it!
  
  dood. you have too many identities. who are you even
  
  Yep, this is the reason. I have many different identity key files in my ~/.ssh folder, and for some reason ssh always tries all of those first, then exhausts the login tries and doesn't ask for a password.
  I have the same problem when I specify a specific private key file with -i ./path/to/priv.key. If that key is different than the ones in my .ssh folder, it will use all those first before the specified one, and often exhausts login attempts giving a very hard to diagnose login failure. In that case I need -o IdentitiesOnly yes option to tell ssh to only use the one I specified.
  
  Having 3 or more identities often causes authentication to fail before it gets around to trying password authentication (or even all the possible keys). Recommend configuring the client to turn off PubkeyAuthentication by default (so that hosts that you don't have a key for will prompt for a password) and specify which key to use on the appropriate hosts using IdentityFile (might need to specifically turn PubkeyAuthentication back on, I don't remember how openssh handles having a default host block with specific host blocks)
If you're trying to have password auth be a second layer on top of key auth (requiring a password after connecting with your ssh key), you can add the following to your server's sshd_conf:
AuthenticationMethods "publickey,password"
- Now that's a neat idea! (not sure I'll ever implement it though: having passwords on my ssh keys is already enough of a hassle, plus having provisioning and scripts ask for password is a PITA)
  Anyway, I was just trying to authenticate with a password, like we used to back in the day :)
  (it's only for install isos or freshly installed systems that I've not provisioned yet - everything else requires a key).
- This is the way.
That's the expected behavior as ssh password authentication is not considered secure.
You can force the ssh client to use passwords in the ssh_config file (either local or global)
- How would that improve security when all a bad actor has to do is add -o PubkeyAuthentication=no on their side?
  Also, I'm pretty sure it used to just ask for a password?
  
  -o PubkeyAuthentication=no should only work if the server is configured to allow password auth at all. I believe the advice these days is to disable password auth completely for security.
How many private keys do you happen to have in .ssh? MaxAuthTries defaults to 6, and keys are always tried before you are prompted for a password. Unless you set PubkeyAuthentication=no, or specify a single key, the ssh client will happily grind through each key until the server cuts you off.
- I ran into this today using ssh-copy-id on a new Debian box. Seems like that tool is biased toward copying a second key instead of a first. Either that or they assume most users use one key pair everywhere (and thus only have one loaded in their agent). I use one key pair per user per box. Excessive? 🤔
I read the title of your post quickly in my feed and thought you were shushing me
I've slept since the last time I set up sshd on a new install. Do you need to be able to authenticate with a password when you ssh-copy-id on a user without a public key?
Edit: Silly me. Yes, password is required.
Definitely not how it works for me and I've never used key Auth.

17 comments