2

I'd like to disable password authentication for SSH (for all the users) in Linux. I'm setting the PasswordAuthentication to no is the sshd_config file but then I'm no longer to log in using my private key.

p.s. I'm specifying my private key file when trying to log in.

  • 1
    Please edit your sshd_config file in your question. – Gerald Schneider Apr 28 '18 at 17:45
3

Before you disable password authentication you need to configure public key authentication and ensure that you are using it. If you haven't already done so, you can generate a key pair using ssh-keygen.

The key pair consists of a private key and a public key with .pub at the end of the file name. The public key consists of a single line with a type, the public key, and a comment. I find it useful to edit the comment to include the date on which the key pair was generated, as that is not included in the default comment.

You need to put that one line in .ssh/authorized_keys on the account you log in on.

When you connect to the server using ssh in the future you will not be asked for a password to log in. You may be asked for a passphrase for the key if you entered one when creating it. If you don't want to be asked for the passphrase each time you log in use ssh-agent.

On the server you can edit /etc/ssh/sshd_config find the PasswordAuthentication line and make it:

PasswordAuthentication no

If there is no PasswordAuthentication line in the file you need to add one. There may be a comment telling you what the default value is. You can either remove the # on that line to make it no longer be a comment or add a PasswordAuthentication line after the comment.

To make the change take effect run

service ssh reload

as root on the server. This command is on Ubuntu it may differ slightly between distributions. I recommend running the command in a screen session such that the reload will complete even if you lose connectivity to the server when running it.

Once you have made the change open a new window to start another ssh connection to verify that connectivity works as intended. This step is important as the shell you left open gives you a last chance to fix the problem if you accidentally locked yourself out from reaching a root shell on the server.

  • I have created the public key (using PuTTyGen) and put it in the .ssh/authorized_keys but it doesn't let me login using private key – H.Z. Apr 28 '18 at 17:20
  • @H.Z. Then you should ask a separate question on how to configure public keys in PuTTY. That's not a question I can answer as I never use PuTTY. – kasperd Apr 28 '18 at 17:25
  • 1
    Check the permissions on the authorized_keys file and the home dir as that can cause this issue. You disabling password with simply removes the fall back auth mode meaning you have no option to log in. A quick google should tell you what the perms should be and try adding -v to your ssh command to see what it’s attempting or enable the equivalent option for verbose in putty – Timothy Frew Apr 28 '18 at 23:32
0

On the server disable SSH password authentication, also disable being able to login as root.

Note Make sure you have a user on the server with a password before doing this or you will be locked out from the server.

$ vim /etc/ssh/sshd_config

Edit / add the following lines

  • PermitRootLogin no
  • PasswordAuthentication no
  • UsePAM no
  • UseLogin no

Execute the command

$ service ssh restart

Create a new SSH key on client (example)

cd ~/.ssh    
ssh-keygen -t rsa -b 4096 -C server1 -f server1

Copy the SSH key to the server

ssh-copy-id -i server1.pub username@server-ip

Use the new key to connect to the server

vim ~/.ssh/config

Add the following lines

Host ip-of-server
  User yourUsername
  IdentifyFile /home/yourUsername/.ssh/server1

Connect to the server

ssh server-ip
0

Check the file and folder permission on the server where you want to login to. If the permission is too loose it doesn't work.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.