On several systems I have this sshd_config
Port 22 Protocol 2 PermitRootLogin no StrictModes yes PasswordAuthentication no ChallengeResponseAuthentication no MaxStartups 2 AllowUsers john joe
Can anyone explain the difference between keyboard-interactive and password authentication? How can I test my sshd server for these?
These systems are accessible using SSH via the internet (port-forwarding at firewall). Despite turning off password authentication I am still seeing syslog records for invalid users and invalid passwords being rejected by sshd - obviously some bot-net(s) are attempting brute-force password guessing.
If I try to ssh in, without setting up a public key, my session is closed with a message "Permission denied (publickey)" before I have an opportunity to enter a username. So I don't see how these password attempts are ocurring.
Here's an example from syslog (all lines prefixed 'Oct 12 08:40:49 host sshd:')
Could not reverse map address 203.0.113.1. User root not allowed because not listed in AllowUsers input_userauth_request: illegal user root Failed password for illegal user root from 203.0.113.1 port 35902 ssh2 Received disconnect from 203.0.113.1: 11: Bye Bye
How are these invalid passwords getting through? Is the server still therefore vulnerable to brute-force password guessing?