I have disabled PermitRootLogin and I cannot login to server by root, but password is asked from user:
Is this correct? Or there is something here that I'm missing? Why password is asked when it is not permitted?!
Why password is asked when it is not permitted?!
The one of the rules of security is not to tell attacker if something is enabled/disabled. This is just one example. The other is logging in as non-existing user. It will also ask for password.
Telling attacker "root is disabled" or "the user does not exists" gives him some information, which you would not want to give away. These are side channels that would allow to eliminate one place of attack surface and focus on some others.
If you don't want to ask for password, you would need to disable password authentication completely.
-
2Or, in other words, just let the attacker waste time trying to brute force that password... – jcaron Feb 21 '16 at 15:06
-
@jcaron It is not the main point. You also waste your cycles (if you don't have any fail2ban service). You don't want to give attacker the information about users on that host (then he would be able to attack them using different services or use the information for other malicious purpose). – Jakuje Feb 21 '16 at 15:11
-
Curious. On some of my systems I get this behavior; but others just yield no you can't when requesting keyboard-interactive authentication (that is, prompt for password). – joshudson Feb 21 '16 at 16:32
-
@joshudson This is the case, when you set
PasswordAuthentication noandChallengeResponseAuthentication noin yoursshd_config. In that case, it will not even offer this authentication method (and you usually don't brute-force using public key). It might be more complicated when mixing all of that withMatchblocks. – Jakuje Feb 21 '16 at 16:38
