Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have configured an Ubuntu 10.04LTS desktop install to only allow public key authentication.

RESULT: public key authentication works perfectly!

QUESTION: The problem is that despite being configured to only accept public key authentication the client still accepts password authentication - why?

Sure could use some suggestions as I have seen and followed the suggestions here: ssh: can still use password after setting the key

No success after following these suggestions:

  • chmod 700 /home//.ssh
  • chmod 600 /home//.ssh/authorized_keys
  • added to /etc/ssh/ssh_config:
    • PasswordAuthentication no
    • ChallengeResponseAuthentication no
  • restarted sshd (command: /usr/sbin/service ssh restart).

The client's /etc/ssh/ssh_config reads:

# This is the ssh client system-wide configuration file.  See
# ssh_config(5) for more information.  This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.

# Configuration data is parsed as follows:
#  1. command line options
#  2. user-specific file
#  3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.

# Site-wide defaults for some commonly used options.  For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.

Host *
#   ForwardAgent no
#   ForwardX11 no
#   ForwardX11Trusted yes
#   RhostsRSAAuthentication no
    RSAAuthentication yes
    PasswordAuthentication no
    PermitRootLogin no
    PubKeyAuthentication yes
    ChallengeResponseAuthentication no
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   GSSAPIKeyExchange no
#   GSSAPITrustDNS no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   Port 22
#   Protocol 2,1
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-c                                                    bc,3des-cbc
#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no

Am I missing another option? Match perhaps (though that seems unlikely to help to me)?

Thanks.

share|improve this question
    
Have you restarted ssh? –  gravyface May 3 '11 at 15:51
    
yes - good idea though. First thing I tried. –  rfreytag May 3 '11 at 15:57
add comment

2 Answers

up vote 8 down vote accepted

/etc/ssh/ssh_config is for the client. You want to set those options on the server config file, which is /etc/ssh/sshd_config.

share|improve this answer
    
Ah, good catch. –  gravyface May 3 '11 at 16:00
    
I've been staring at this for too long to admit here. Just figured it out after I posted the Q. I figured someone else deserved the credit. Thank you! Lots more errors like this to come no doubt - stay tuned. (sigh) –  rfreytag May 3 '11 at 16:09
    
You're welcome! –  EEAA May 3 '11 at 16:28
    
Just been wondering why the hell my changes weren't making any difference and come across this... then went doh! –  Andy Davies Aug 10 '12 at 14:11
add comment

Try setting PreferredAuthentications to just publickey.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.