Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have ubuntu server at home, and I use SSH keys to log in via terminal from my laptop. Rarely, but mostly from work, I need to access this server, but I dont want to copy keys on my work laptop - Id rather just use plain password for that.

So if I enable password log in from ssh config file, it will ask me password on my laptop too even though it contains keys, right?

Is there a way to stop this behavior?

Thanks.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

It is possible to force your laptop to use the keyfile even if both the password and keybased approach are available. If you're currently connecting with ssh user@your.host.tld -p 22, edit ~/.ssh/config and add:

Host your.host.tld
    PreferredAuthentications publickey

This configuration file can be used to make you type even less:

Host home
    Hostname your.host.tld
    User user
    PreferredAuthentications publickey
    Port 22

With that configuration, you just need ssh home.

It's possible to restrict password-based logins to a certain IP address. In /etc/ssh/sshd_config, you'd have a line that disabled password-based auth: PasswordAuthentication no. To enable it for logins from a certain IP, you could use:

Match Address 12.34.56.78
    PasswordAuthentication yes

I suggest you to use keybased auth even if on work. It's much safer than password-based auth as it cannot be bruteforced that easily. You can have multiple keys for the same account, that should not be an issue.

For more fancy configuration directives, see the manual page of ssh_config(5). (for the server side, see sshd_config(5))

share|improve this answer
    
thats an awesome trick! I have seen people do this at my work, and was ashamed to ask :=) thanks. Till now I had .ssh scripts that just had line of command inside them. –  Sandro Dzneladze Apr 14 '12 at 19:52
    
Another advantage of using the ssh config file over scripts with ssh options in it is that commands like sftp and scp also work with it. Consider the case where you need to copy a file quickly. Then it suffices to run scp home:.vimrc ~ to copy .vimrc from your remote home directory in the local home dir. –  Lekensteyn Apr 14 '12 at 19:55
add comment

No, at least with the configuration I have if you enable password authentication it will only prompt for the password if you do not have a key.

That being said -- I would never enable password authentication on a server exposed to the Internet.

share|improve this answer
    
hey, thanks for response. Is it such a big security risk? –  Sandro Dzneladze Apr 14 '12 at 19:40
    
Yeah it is. It allows people to brute-force attack the username and password fields. Even if they don't get in, it can cause a whole slew of issues. Fore example, I need to move mine to ssh-based authentication because my hosts.deny file is getting too large, due to using fail2ban to limit the amount of abuse ssh username login gets. –  cptmashek Apr 14 '12 at 19:46
    
Just create a different key pair for your PC @work. That way you can block the key@work separately from your key@home. –  jippie Apr 14 '12 at 19:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.