9

Here's a question that I have found absolutely no answers for: how can you configure sshd so that anybody can freely SSH into the box without password or key authentication? The objective is to allow anybody to run "ssh user@host" and get into the box without having to provide a password or have any keys configured. Is this even possible?

Before anyone asks, I am very aware that this is a bad idea in practice, however, this is purely for a sandbox server that I am using for learning purposes.

Improve this question
3
  • @krisFR not trying to break it but I was really just curious if this was even possible.
    – trinth
    May 16, 2015 at 0:01
  • 2
    For future readers, there is actually a valid use case for this. Instead of running a shell on login, configure the server to launch a specific program. This is sometimes done with Telnet (try running telnet towel.blinkenlights.nl for an example), but if you wanted an encrypted connection for some reason this would work as a replacement.
    – Skylar Ittner
    Apr 20, 2019 at 21:27
  • 1
    Same here, I have a bunch of devices at customer sites that hav a Linux-based firmware. Whenever they boot, they ssh into my server (the sshd forces them to execute "sleep 7200") and open a reverse tunnel so I can ssh into them. One day, one of the boxes tried to ssh into my server but failed; temporarily enabling authenticationless ssh (and taking neccesary precautions) allowed me to fix the box from remote and saved me a 5 hour trip to the customer and back.
    – Guntram Blohm
    Jul 1, 2019 at 13:58

1 Answer 1

Reset to default
15

Disclaimer: I would never recommend doing this.

I assume this is for a LAN system, I hope not an internet system, but you can create a user without a password and enable the following option in the OpenSSHd config:

PermitEmptyPasswords yes

To remove a password from a user, you can use -d with passwd.

passwd -d username

The correct way using SSH keys

You generate an SSH key pair for yourself, how you generate this depends on your client. For linux, it is ssh-keygen. You can use an empty password when generating the key so you won't have to enter one upon logging in.

In your server, you can store the public key (id_rsa.pub) on a line in the authorized_keys file usually found in the user's .ssh directory. This file may need to be created. (For a single key, copying id_rsa.pub to the server as ~/.ssh/authorized_keys should be enough).

The private key file should never be released publicly but can be released to anyone who you wish to have access to this user@machine.

Improve this answer
4
  • Thanks Devon, that's a very simple and straightforward solution! Yes, I am actually testing this on a LAN system. I also knew about the correct way, however, this question was really out of curiosity because it seemed so simple, yet there was seemingly nothing on Google that pointed out how this could be done.
    – trinth
    May 16, 2015 at 0:00
  • @trinth, I figured. I mostly wrote that in there in case of future users who comes across this wondering how they can access a server without having to enter a password.
    – Devon
    May 16, 2015 at 14:53
  • 1
    Note that by default, PAM will also deny empty passwords. So you either need to pass nullok to pam_unix.so for the auth section (in /etc/pam.d/ssh or a file it includes, usually common-auth), or you need to disable PAM in sshd using UsePAM no (making sshd read /etc/passwd and /etc/shadow itself).
    – Matthijs Kooijman
    Mar 2, 2018 at 8:51
  • I just used this technique but combined it with IP whitelisting in the SSH config. An automated system was having issues authing back. so I white listed the IP and followed the methods here ONLY for that IP so it could connect back irregardless of the id_rsa pair. this meant that all other connections were safe and required the same level of authentication but the specific user / IP could simply connect. hence a real life use case for such a thing (hello from the future 2015)
    – TheHidden
    Jan 18, 2022 at 15:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.