3

I'm currently disabling password authentication on all my ssh servers (good idea of the day!). Some of my servers are shared with other people and I want to force them to use a ssh key with a passphrase. Is it possible to disallow ssh login for ssh keys without passphrase?

Improve this question
0

3 Answers 3

Reset to default
7

As mentioned in the other answers you cannot enforce a passphrase on a key. However, to enforce two-factor authentication (something you have, the key, and something you know, the password) you can use another option.

In newer versions of OpenSSH you can set the RequiredAuthentications2 pubkey,password parameter in /etc/ssh/sshd_config. This will force the user to use both public key AND password authentication, effectively giving you two-factor authentication.

Improve this answer
3
  • 1
    Something like duo would be even better
    – user9517
    Apr 17, 2014 at 10:17
  • 1
    Just to add a small thing to add, it is not the most effective 2fa because usually people do not have very good management and security of their private SSH keys (like the question says, they use it without a password or things like this). That's why nobody really uses 2fa like this in practice but you get codes on your phone or hardware tokens, things that you need to have in physical possession, rather than the keys which, if they don't have a password, could easily be stolen from an infected computer.
    – Florin Asăvoaie
    Apr 17, 2014 at 12:42
  • 1
    You definitely have a point. I am in favour of hardware tokens. Smartphones I'm not so giddy about, because they are vulnerable to lots of security holes as well (perhaps even more than desktops nowadays). However, the result is the same, you require a password(know) and a key(have). This is not different from encrypting a key with a passphrase. Actually, one could argue it's better, because if you steal a keyfile, you can try infinite times to unlock the key, but you can only try to log on to a server finite times (if properly set up).
    – mtak
    Apr 17, 2014 at 12:56
6

Unfortunately you can't do this as it is all managed on the client side. Perhaps this would be a good time to introduce people to ssh-agent or pageant if you use putty/kitty or something similar. The passphrase only needs to be supplied once when the key is added to the agent using this method.

Improve this answer
5

No, this is not possible as it is handled 100% on client side of SSH.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .