Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given the recent attack on SSH port I'm trying my best to keep my servers at bay. Of course changing the default port would be the number 1 rule to go but that is not feasible.

We've got denyhosts will set up some iptables rules, maybe fail2ban. Appart from than and considering that the least possible ways you have to get in the saffer you are, my SSHD has set up:

ssh -v
debug1: Authentications that can continue: publickey,password,keyboard-interactive

I started wondering, what sould I keep? keyboard-interactive (KI) or password?

Public key is needed. Both KI and password seam to do the same thing but KI, according to the docs, would do it better. Can anyone shed some lights here, please?

Thank you in advance.

share|improve this question
up vote 2 down vote accepted

If it is not a public/multiuser system, severely limit access via the firewall. Default to DROP and only allow specific IPs or subnets access to the system. If you must stay public, fail2ban is the right idea.

msanford is spot on when it comes to the authentication recommendation. For the best security, you want the least access possible for meeting the requirements. If the access is not justified it should not be allowed.

share|improve this answer

If everyone who needs ssh access to your server can use a public key, then yes, you can safely and arguably should disable password/keyboard-interactive logins.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.