32

I have an Ubuntu Linux server allowing password authentication for SSH, and I want to switch it to SSH keys only and disable password login.

Before I disable password login, how can I find out which users are still using passwords, and which have switched to key authentication?

  • Btw., while many people don't know that, you can also ask for key and serverside password. A bit more bothersome, but of course more secure too, if you do that... – deviantfan Sep 28 '17 at 20:49
  • 34
    Disable password login without notice and see how many people scream. – Mark Sep 28 '17 at 23:44
  • 19
  • @deviantfan It would be more secure to simply require a longer keyfile, but that would require a bit of scripting. – jpaugh Sep 29 '17 at 3:39
  • 1
    @deviantfan I take your point. But, you're assuming the password for the private key is different than the one for the server; (whereas, I'm assuming the private key file has a password, I know.) – jpaugh Sep 29 '17 at 14:38
49

You can't do that 100% reliably, but there are two strong indications:

  • First, the presence of a .ssh/authorized_keys file is a hint the user is at least prepared to use key based login
  • Second, in the authentication log file (/var/log/secure on CentOS, /var/log/auth.log on Debian/Ubuntu), the auth method will be logged:

    Sep 28 13:44:28 hostname sshd[12084]: Accepted publickey for sven
    

    vs

    Sep 28 13:47:36 hostname sshd[12698]: Accepted password for sven
    

    Scan the log for entries with password mentioned to learn who is still using passwords. This will not work with users seldom logging in of course unless you have very long log retention.

  • by 'Scan' the log file, I presume you mean sensible options such as using grep? grep 'password' /var/log/ssh/sshd.log – djsmiley2k Sep 28 '17 at 14:44
  • 8
    @djsmiley2k: Yes, exactly. Or whatever other method you prefer for that task. – Sven Sep 28 '17 at 15:36
  • Isn't the first method thwarted by proper security practices, such as 700 permissions on the user's .ssh directory, and root squash on mounted home directories? – Ogre Psalm33 Sep 29 '17 at 20:21
  • 1
    @OgrePsalm33: You can do this search on the NFS server ... – Sven Sep 29 '17 at 21:20
  • 1
    @R..: You can get NFS reasonably secure with NFSv4 and Kerberos (in which case key based login gets complicated ). Other than that: Yes, key based login works without any issues when ~/.ssh is set to 700 and in root squashed NFS home directories, so it clearly has to switch user ids at least for key based auth to read authorized_keys. – Sven Sep 30 '17 at 16:50
19

Fastest way is to disable it and see who knocks on your office door ;p

  • 6
    This is not the fastest way, because not every user might login every day, while the logs can clearly show when someone logged in, so they give an instant result – Ferrybig Sep 29 '17 at 7:47
  • 3
    This is the slowest way. People only login to the server if their application is down. It could take years for that to happen. – Navin Sep 29 '17 at 21:10
  • @pete you are the top :) – c4f4t0r Oct 3 '17 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.