I've read various articles about how to setup authentication without password, only by certificate and I haven't a common solution: some suggest this, other that. How to do this properly?

This config works, yes, but maybe there's something I should I remove? Or something I should add anything else?

# /etc/ssh/sshd_config:

ChallengeResponseAuthentication no
UsePAM no
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
RSAAuthentication yes
PubkeyAuthentication yes

My question is about this config in particular and I don't need any more links to read.

  • The above denies password use and requires key-based authentication. Is there some additional goal you are looking to accomplish? – Jason Martin May 16 '17 at 3:45
  • You don't need RSAAuthentication. It is deprecated in current OpenSSH.
  • PermitEmptyPasswords is not needed once you disable the password authentication.
  • UsePAM should stay on in most of todays systems since it does not do only authentication, but also setting up your session.
  • UsePAM -- by on you mean "yes" or merely its presence with no as it is now? – Jodimoro May 16 '17 at 11:01
  • "should stay on" ~~ "yes" (default is no on OpenBSD, but all Linuxes are using PAM if I am right). – Jakuje May 16 '17 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.