5

I want to test whether or not an ssh server allows passwords and immediately close the connection without actually attempting a login.

Something like this:

allows_password=$(ssh --some-option example.com)
if [ -z "$allows_password" ]; then
  echo "Insecure Server Options"
else
  echo "Insecure Password Access is not Allowed, Great!"
fi

I've actually done this once before, but I couldn't find old script or docs. Sad day. :-/

  • 2
    Are you sure? The ssh server can be configured to allow passwords for some users but not others. So you at least have to send a username to the server. At that point it will attempt to authenticate you... – Michael Hampton Nov 1 '18 at 3:28
  • 1
    ssh -v will output debug1: Authentications that can continue: publickey,password, however @MichaelHampton is right, its dependent on user. Some form of ansible/puppet to enforce practices would suite you better. – danblack Nov 1 '18 at 3:52
  • I'm developing telebit.cloud, which enables remote access via ssh, among other things. People typically have very poor passwords on their personal computers, so I want to make sure I have a way to test for bad defaults and display a warning, in addition to checking /etc/ssh/sshd_config. – CoolAJ86 Nov 1 '18 at 4:01
8

I found my old script:

ssh -v -n \
  -o Batchmode=yes \
  -o StrictHostKeyChecking=no \
  -o UserKnownHostsFile=/dev/null \
  DOES_NOT_EXIST@localhost 2>&1 | grep password
  • The -o Batchmode=yes option causes a non-interactive mode where a fallback to password results in failure.

  • The -v causes the authentication methods to be displayed (among other things).

  • The -n causes ssh to not open a shell (often used with tunneling), which in this case will cause it to immediately exit (just in case you're connecting to a honeypot or a service like serveo.net that allows clients without authentication)

  • -o StrictHostKeyChecking=no and -o UserKnownHostsFile=/dev/null automatically accepts the host without writing it to the known-hosts file.

  • 2>&1 forwards debug messages (stderr) to the logging system (stdout) so that grep can do its magic

If password authentication is enabled for some users, it will shows as enabled for all users (but fail after the prompt), as far as I can tell. I suspect this is so that you can't positively id that a user exists on the system.

And so that I don't lose it again: https://coolaj86.com/articles/testing-if-ssh-allows-passwords/

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.