Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have disabled PermitRootLogin and I cannot login to server by root, but password is asked from user:

enter image description here

Is this correct? Or there is something here that I'm missing? Why password is asked when it is not permitted?!

share|improve this question
up vote 19 down vote accepted

Why password is asked when it is not permitted?!

The one of the rules of security is not to tell attacker if something is enabled/disabled. This is just one example. The other is logging in as non-existing user. It will also ask for password.

Telling attacker "root is disabled" or "the user does not exists" gives him some information, which you would not want to give away. These are side channels that would allow to eliminate one place of attack surface and focus on some others.

If you don't want to ask for password, you would need to disable password authentication completely.

share|improve this answer
2  
Or, in other words, just let the attacker waste time trying to brute force that password... – jcaron Feb 21 at 15:06
    
@jcaron It is not the main point. You also waste your cycles (if you don't have any fail2ban service). You don't want to give attacker the information about users on that host (then he would be able to attack them using different services or use the information for other malicious purpose). – Jakuje Feb 21 at 15:11
    
Curious. On some of my systems I get this behavior; but others just yield no you can't when requesting keyboard-interactive authentication (that is, prompt for password). – joshudson Feb 21 at 16:32
    
@joshudson This is the case, when you set PasswordAuthentication no and ChallengeResponseAuthentication no in your sshd_config. In that case, it will not even offer this authentication method (and you usually don't brute-force using public key). It might be more complicated when mixing all of that with Match blocks. – Jakuje Feb 21 at 16:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.