Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I connect to a server I don't control via SSH.

I use public key access and don't need to be able to connect with a keyboard-interactive password.

I would like to disable keyboard-interactive access to my user so that there is no way for others to hack in this way.

Since I don't control the server, is there a way to set up my user's config file to prevent keyboard-interactive access?

share|improve this question

2 Answers 2

If you have absolutely no control over the server, I don't see a way of doing this, as you don't control server settings, which is where this would have to be.

What you'd need to do is add this to the /etc/ssh/sshd_config file:

PasswordAuthentication no

Now, this would effectively disable password authentication for all users, which may be undesirable. What you could do then, is put this configuration directive in a Match block, so it only applies to your user, in the same config file:

Match user yourusername
PasswordAuthentication no

If you could get the server's admin to do this for you, it might be the way to go.

One other way is to set a really long, random and complicated password for your user, that way you're reasonably protected from random brute-force break-in attempts. Most attackers would likely be using some dictionary-based technique so as long as your password is long and random enough, it should be quite safe.

See "man sshd_config" for more details. Also, the solution I propose was suggested here.

share|improve this answer
1  
This is helpful, but I do not believe that this would "have" to be done in the server settings, as you say. It is clear that when I use public-key authentication, the SSH daemon is checking the public key against a file in my user directory. There is no reason to believe that the server could not, in principle, check a user config file for appropriate actions to take regarding keyboard-interactive logins. Whether or not SSHD implements this, I do not know. –  Richard Oct 27 '11 at 19:39
    
Indeed, the "KbdInteractiveAuthentication" and possibly the "ChallengeResponseAuthentication" settings in the "~/.ssh/config" file seem relevant, though I have not yet succeeded in getting them to work. –  Richard Oct 27 '11 at 20:14
1  
@Richard ~/.ssh/config is only read by the client, not by the server. Sure, the server could, in principle, check a file in your home directory to check whether you want to allow password authentication. But it doesn't. In fact, sshd allows password logins even if your home directory doesn't exist; this can be a lifesaver in some circumstances, such as a hosed /home filesystem. The simple way to prevent others from logging in with your password is not to use a weak or reused password. –  Gilles Oct 27 '11 at 21:10
    
+1 for strong random password. I assume your current setup is such that you don't need to ever enter the account password? I usually use pwgen 20 or similar to generate a strong random string. Be sure to write down the password somewhere for backup. –  noleti Jul 15 at 3:45

[I assume you're using BASH as your login shell. If not, adjust appropriately...]

In ~/.ssh/authorized_keys, prepend a command specification to each line like this:

command="ssh_key=XXX /bin/bash -l" ssh-dss AAAA...K3E= me@mymachine

In ~/.bash-profile, put the following trap at the top:

if [ "${ssh_key}" != "XXX" ]; then
  echo "${SSH_CLIENT}" | mailx -s "password login attempt!" me@mailservice
  exit
fi

Now you'll just get mail when someone uses a password to enter your account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.