0

Good Morning, I need to force my SSH server to deny any connection which doesn't have my private SSH key... and not to ask a password

My /etc/ssh/sshd_config:

Include /etc/ssh/sshd_config.d/*.conf

Port 22 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key

Ciphers and keying

#RekeyLimit default none

Logging

#SyslogFacility AUTH #LogLevel INFO

Authentication:

#LoginGraceTime 2m #PermitRootLogin prohibit-password #StrictModes yes #MaxAuthTries 7 #MaxSessions 3

PubkeyAuthentication no

Expect .ssh/authorized_keys2 to be disregarded by default in future.

AuthorizedKeysFile ~/.ssh/authorized_keys ~/.ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody

For this to work you will also need host keys in /etc/ssh/ssh_known_hosts

#HostbasedAuthentication no

Change to yes if you don't trust ~/.ssh/known_hosts for

HostbasedAuthentication

#IgnoreUserKnownHosts no

Don't read the user's ~/.rhosts and ~/.shosts files

#IgnoreRhosts yes

To disable tunneled clear text passwords, change to no here!

PasswordAuthentication no PermitEmptyPasswords no

Change to yes to enable challenge-response passwords (beware issues with

some PAM modules and threads)

ChallengeResponseAuthentication no

Kerberos options

#KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no

GSSAPI options

#GSSAPIAuthentication no #GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no

Set this to 'yes' to enable PAM authentication, account processing,

and session processing. If this is enabled, PAM authentication will

be allowed through the ChallengeResponseAuthentication and

PasswordAuthentication. Depending on your PAM configuration,

PAM authentication via ChallengeResponseAuthentication may bypass

the setting of "PermitRootLogin without-password".

If you just want the PAM account and session checks to run without

PAM authentication, then enable this but set PasswordAuthentication

and ChallengeResponseAuthentication to 'no'.

UsePAM yes

#AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes PrintMotd no #PrintLastLog yes #TCPKeepAlive yes #PermitUserEnvironment no #Compression delayed #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no #PidFile /var/run/sshd.pid #MaxStartups 10:30:100 #PermitTunnel no #ChrootDirectory none #VersionAddendum none

no default banner path

#Banner none

Allow client to pass locale environment variables

AcceptEnv LANG LC_*

override default of no subsystems

Subsystem sftp /usr/lib/openssh/sftp-server

Example of overriding settings on a per-user basis

#Match User anoncvs

X11Forwarding no

AllowTcpForwarding no

PermitTTY no

ForceCommand cvs server

Match Address 127.0.0.* PubkeyAuthentication yes

Match Address 192.168.1.* PubkeyAuthentication yes

when i try ssh -i "/path/to/ssh-key-private.txt" john@localhost it results in

john@localhost's password: 
Permission denied, please try again.
john@localhost's password: 
Permission denied, please try again.
john@localhost's password: 
Received disconnect from ::1 port 22:2: Too many authentication failures
Disconnected from ::1 port 22

and when i change PubkeyAuthentication to yes

john@localhost: Permission denied (publickey)

please note that i had already tried the following https://askubuntu.com/a/974566/1067284 https://askubuntu.com/a/1335082/1067284 and nothing worked...

Zorono
  • 41

0 Answers0