I'm running Mac OS X Server.app on Yosemite and I have SSH enabled for users with the default settings in
/etc/sshd_config (publickey and password auth enabled by default). However, I need to restrict the
git local user to have publickey access ONLY via SSH.
Full disclosure, the Server.app enables some additional Kerberos and GSSAPI options (although I'm not 100% sure how these effect my questions below):
# Kerberos options KerberosAuthentication yes KerberosOrLocalPasswd yes KerberosTicketCleanup yes # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials yes GSSAPIStrictAcceptorCheck yes GSSAPIKeyExchange no
/etc/sshd_config says the following:
# To disable tunneled clear text passwords both PasswordAuthentication and # ChallengeResponseAuthentication must be set to "no".
ChallengeResponseAuthentication is not allowed in match statements, so I tried just disabling password authentication only:
Match User git PasswordAuthentication no
This does not work--I was still able to log in with username/password to email@example.com :(
KbdInteractiveAuthentication no seemed to work correctly:
Match User git PasswordAuthentication no KbdInteractiveAuthentication no
Now I get
Permission denied (publickey,gssapi-keyex,gssapi-with-mic) when trying to log in without a public key. This seems to indicate that there are still methods besides publickey which will allow login from the
git user (i.e.
It seems like a better approach is to simply restrict the authentication method to
Match User git AuthenticationMethods publickey
This gives the response `Permission denied (publickey).
- What's the difference between
KbdInteractiveAuthentication? Why is
KbdInteractiveAuthenticationallowed in match statements but not
- Is there any downside/security concern with the
- (Bonus if you can help me understand
gssapi-with-micand how they relate to the GSSAPI/Kerberos options that were enabled)