Comment on Update all your stuff, NOW - again.

danielquinn@lemmy.ca ⁨4⁩ ⁨days⁩ ago

• needanke@feddit.org ⁨4⁩ ⁨days⁩ ago

  The way I read it, it is fine if you do not allow password authentication in general?

  source
• ScoffingLizard@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago

  I’m not following. Are you saying you login with ssh keys and not the password, but leave ``` UsePam = no

  source

  • danielquinn@lemmy.ca ⁨1⁩ ⁨day⁩ ago

    It’s been years since I was experimenting, trying to set things up properly, but at the time I could swear that I’d have the following set:

    PubkeyAuthentication yes
    PasswordAuthentication no
    UsePam yes
    

    and attempts to SSH into the system would still result in a password prompt, even though PasswordAuthentication was set to no. After some experimentation, I found that if I set UsePam to no, you wouldn’t get a password prompt, so that’s what I’ve been doing on every SSH server I’ve had since like, 2000.

    Tinkering with it now though, I see there’s also another directive, KbdInteractiveAuthentication, which when set to no, will ensure I don’t see a password prompt even when UsePam is set to yes. I can only assume that 26ish years ago there was no KbdInteractiveAuthentication, or I just didn’t know about / notice it!

    Well no harm done in my case anyway, as I don’t generally expose SSH servers to the outside world anyway. But it’s good to know that I don’t have to turn off PAM to disable password logins anymore.

    source