21

Trying to SSH using a user account; root account works but I am specifying a private key. User account simply gives "Permission denied (publickey,gssapi-with-mic) without prompting me for my password at all.

How can I fix this so I can log in with a password, and NOT a key? I don't want to use a private key for this right now, but a regular account.

1
  • 4
    Key-based authentication still logs you into a "regular" account...
    – womble
    Dec 31, 2009 at 0:15

9 Answers 9

41

The server has setting

 PasswordAuthentication no 

Change it to yes and after a restart you'll be able to use password authentication.

1
  • 10
    In case anyone doesn't know, the PasswordAuthentication setting is in /etc/ssh/sshd_config. Oct 26, 2018 at 22:34
8

You will also need to edit /etc/ssh/sshd_config to have the setting:

ChallengeResponseAuthentication yes

as well as...

PasswordAuthentication yes

And remember to run /user/sbin/service ssh restart afterwards to pick up the new settings.

2
  • The literal /etc/ssh/sshd_config needs to have its underscore escaped with a backslash for the whole path to be displayed in italics . (Edits were too minor to submit them myself) Nov 18, 2014 at 22:45
  • its the better answer Oct 27, 2015 at 17:21
7

Check your login sequence with ssh -vv. This will tell you what authentication methods are tried and which fail. You can then enable what you want and disable what you don't want. Enable first, of course.

2

its in your sshd file (not ssh, which you'll also probably find in /etc/ssh)

I believe you want to make sure PasswordAuthentication yes is set and uncommented.

5
  • 2
    af beat me to it by moments. -annoyingly I can't comment on his yet. You should be able to run /etc/init.d/sshd restart rather than having to reboot, after editing the conf. Dec 30, 2009 at 17:40
  • and I typo'd when telling you what directive. sorry :( Dec 30, 2009 at 19:53
  • MidnighToker: you should have an "edit" link at the bottom of your answer that you can use to fix the name of the directive (from PubkeyAuthentication to PasswordAuthentication) Dec 30, 2009 at 20:19
  • thanks. It'll make me more careful in future -lost rep for that. Dec 30, 2009 at 20:29
  • 1
    That'd be /etc/init.d/sshd reload on any half-sane distro.
    – womble
    Dec 31, 2009 at 6:37
1

And in case anyone else runs into this problem, I've received this problem whenever the private key of the user has too open of permissions. In order to get it to work I had to chmod the private key to 400 (which is the permissions level by default when the key is created, I believe. Don't know why this one was different).

I don't know if this is always the case, though. This happened on a Mac.

1

There are three things that can cause it, and the two discussed by everyone else here don't cover a common scenario that's arising with AWS-deployed AMIs.

PasswordAuthentication no - don't allow password authentication

or

ChallengeResponseAuthentication no - don't challenge the user for authentication (could be password or other keyboard-interactive)

or

AuthenticationMethods publickey - only allow someone to login after they've authed via publickey

Change these to:

PasswordAuthentication yes - allow password authentication

and

ChallengeResponseAuthentication yes - allow the user to be challenged

and

AuthenticationMethods any - allow any valid form of authentication to succeed

I think you may find ChallengeResponseAuthentication yes to be optional, I'm just including it here for thoroughness.

0

This can also be caused by ssh-agent running. ps aux|grep ssh-agent

It can safely be killed.

2
  • 4
    No, it can't, and no, it can't.
    – womble
    Jul 23, 2016 at 1:11
  • Killing ssh-agent caused the client to once again prompt me for my password. Feb 2, 2022 at 18:44
0

For me, it turned out that during a freak troubleshooting session, the LOCAL ssh_config file was modified. None of these methods worked for me, but changing PasswordAuthentication yes in /etc/ssh/ssh_config of the local machine worked.

Just in case it helps someone out.

0

I had the same problem in Ubuntu 22.04. I could not find the line :

ChallengeResponseAuthentication no

in the /etc/ssh/sshd_config file. I read the whole configuration file and found the following:

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
KbdInteractiveAuthentication no

I simply changed it to yes :

KbdInteractiveAuthentication yes

Then, I restarted the SSH service:

service ssh restart

Voilà!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .