DescriptionPatrick Johnston
2020-07-08 23:41:52 UTC
Description of problem:
So as per the F32 Docs in order to disable Password Authentication, you edit sshd_config and set PasswordAuthentication no
Then you restart sshd
However, after restart if you issue ssh username@host -o PubkeyAuthentication=no
from client to verify that password authentication is disabled, you still are prompted to enter password.
Version-Release number of selected component (if applicable):
openssh-server.x86_64 8.3p1-3.fc32
How reproducible:
Can reproduce on fresh installs on both bare metal and VMs
Steps to Reproduce:
1. vim sshd_config and set PasswordAuthentication no
2. systemctl restart sshd
3. (from client) ssh username@host -o PubkeyAuthentication=no
Actual results:
Prompts for password authentication
Expected results:
Should get on client this prompt
username@host: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
Additional info:
I did find a workaround. If you edit sshd_config with following
Match User username
PasswordAuthentication no
Then you obtain expected results, but that means on multi-user system would have to edit sshd_config everytime you add users
That sounds like a documentation issue. Please, update the bug with the appropriate documentation where you found this note.
The sshd_config now uses drop-in directory and /etc/ssh/sshd_config.d/50-redhat.conf, which is loaded before anything you modify in sshd_config directly.
Suggested solution is not to modify shipped configuration file, but create your own file /etc/ssh/sshd_config.d/30-local.conf (for example), which will get loaded before the distribution defaults.
Description of problem: So as per the F32 Docs in order to disable Password Authentication, you edit sshd_config and set PasswordAuthentication no Then you restart sshd However, after restart if you issue ssh username@host -o PubkeyAuthentication=no from client to verify that password authentication is disabled, you still are prompted to enter password. Version-Release number of selected component (if applicable): openssh-server.x86_64 8.3p1-3.fc32 How reproducible: Can reproduce on fresh installs on both bare metal and VMs Steps to Reproduce: 1. vim sshd_config and set PasswordAuthentication no 2. systemctl restart sshd 3. (from client) ssh username@host -o PubkeyAuthentication=no Actual results: Prompts for password authentication Expected results: Should get on client this prompt username@host: Permission denied (publickey,gssapi-keyex,gssapi-with-mic). Additional info: I did find a workaround. If you edit sshd_config with following Match User username PasswordAuthentication no Then you obtain expected results, but that means on multi-user system would have to edit sshd_config everytime you add users