Security implications when only allowing logins via key and UsePAM setting is 'yes'?

Question

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this:

I change 'PermitRootLogin' to 'no' and uncomment 'PasswordAuthentification' and set this to 'no' as well. While this works very well and I've checked and found no way to login only via password, I was wondering why some guides recommend to set 'UsePAM' to 'no' while other guides don't mention it at all (and thereby keep it as 'yes'). There seems to be no clear opinion on whether the UsePAM setting should be changed when switching to key only auth.

What are the security implications of leaving UsePAM as it is ('yes'), if there are any at all?

Answer 1

You keep UsePAM as yes because when PasswordAuthentication is set to no PAM does not call the 'auth' section of the PAM service:

UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types.

Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.

If UsePAM is enabled, you will not be able to run sshd(8) as a non-root user. The default is “no”.

This way PAM runs through account and session types properly which is actually very important if you want to restrict access to servies based off of IP, time or other factors of the account. Additionally if you want to make sure users inherit certain environment variables on login or disallow access to the server when SELinux is disabled.

Its a common fallacy to think it runs through all the auth modules when PAM is enabled but password authentication is disabled.