SSH - identify which users still login using passwords

Question

I have an Ubuntu Linux server allowing password authentication for SSH, and I want to switch it to SSH keys only and disable password login.

Before I disable password login, how can I find out which users are still using passwords, and which have switched to key authentication?

Btw., while many people don't know that, you can also ask for key and serverside password. A bit more bothersome, but of course more secure too, if you do that... — deviantfan, Sep 28, 2017 at 20:49
Disable password login without notice and see how many people scream. — Mark, Sep 28, 2017 at 23:44
@Mark: If a user screams in frustration, but they're logging in remotely so you don't hear it, will you still get an angry email? — tonysdg, Sep 29, 2017 at 1:50
@deviantfan It would be more secure to simply require a longer keyfile, but that would require a bit of scripting. — jpaugh, Sep 29, 2017 at 3:39
@deviantfan I take your point. But, you're assuming the password for the private key is different than the one for the server; (whereas, I'm assuming the private key file has a password, I know.) — jpaugh, Sep 29, 2017 at 14:38

Sven · Accepted Answer · 2017-09-28 13:58:18Z

48

You can't do that 100% reliably, but there are two strong indications:

First, the presence of a .ssh/authorized_keys file is a hint the user is at least prepared to use key based login
Second, in the authentication log file (/var/log/secure on CentOS, /var/log/auth.log on Debian/Ubuntu), the auth method will be logged:
```
Sep 28 13:44:28 hostname sshd[12084]: Accepted publickey for sven
```
vs
```
Sep 28 13:47:36 hostname sshd[12698]: Accepted password for sven
```
Scan the log for entries with password mentioned to learn who is still using passwords. This will not work with users seldom logging in of course unless you have very long log retention.

answered Sep 28, 2017 at 11:50

Sven

99.1k15 gold badges180 silver badges226 bronze badges

by 'Scan' the log file, I presume you mean sensible options such as using grep? grep 'password' /var/log/ssh/sshd.log
– djsmiley2kStaysInside
Sep 28, 2017 at 14:44
8

@djsmiley2k: Yes, exactly. Or whatever other method you prefer for that task.
– Sven
Sep 28, 2017 at 15:36
Isn't the first method thwarted by proper security practices, such as 700 permissions on the user's .ssh directory, and root squash on mounted home directories?
– Ogre Psalm33
Sep 29, 2017 at 20:21
1

@OgrePsalm33: You can do this search on the NFS server ...
– Sven
Sep 29, 2017 at 21:20
1

@R..: You can get NFS reasonably secure with NFSv4 and Kerberos (in which case key based login gets complicated ). Other than that: Yes, key based login works without any issues when ~/.ssh is set to 700 and in root squashed NFS home directories, so it clearly has to switch user ids at least for key based auth to read authorized_keys.
– Sven
Sep 30, 2017 at 16:50

| Show 3 more comments

pete · Accepted Answer · 2017-09-28 22:58:57Z

19

Fastest way is to disable it and see who knocks on your office door ;p

answered Sep 28, 2017 at 22:58

pete

2071 silver badge2 bronze badges

6

This is not the fastest way, because not every user might login every day, while the logs can clearly show when someone logged in, so they give an instant result
– Ferrybig
Sep 29, 2017 at 7:47
3

This is the slowest way. People only login to the server if their application is down. It could take years for that to happen.
– Navin
Sep 29, 2017 at 21:10
@pete you are the top :)
– c4f4t0r
Oct 3, 2017 at 19:55

Add a comment |

2 Answers 2