2

I have a fresh Ubuntu 16.04.1 LTS system and have noticed that key-based SSH authentication asks for the account's password the first time I login to the machine and subsequent SSH attempts work without prompting for a password.

So far, the behavior can be reproduced by rebooting the machine. There may be a timeout as well, but I'm in the process of setting up the machine and haven't encountered it yet.

In general this is pretty neat as it mitigates a compromised SSH key, though it has a drawback for automated processes; in my case config management with Ansible.

Where is the SSH server behavior configured? Specifically, to ask for password authentication even if a key-based auth succeeds, but only the first time the key is used to open a session.

I'd like to keep this "two-factor"ish behavior for interactive sessions, but disable it (i.e. do not prompt for password) for certain accounts (e.g. a dedicated ansible user).

Thanks!

3
  • Do you have an idea why the password is only requested once? I don't know of any mechanism that caches remote account passwords for SSH. Are you sure the password challenge stems from the SSH server and not from a local key chain manager or something like that? Dec 29, 2016 at 15:23
  • 1
    I think this is what you're looking for: sysconfig.org.uk/two-factor-authentication-with-ssh.html
    – Terrance
    Dec 29, 2016 at 15:26
  • Thanks for the tip, @Terrance. This is a good lead for setting up 2FA the right way. After some digging, I found the answer to my question here. See below in a bit for my answer.
    – berto
    Dec 29, 2016 at 15:28

2 Answers 2

3

I found the answer on another stack exchange. The reason for this behavior is that the home directory is encrypted!

Why am I still getting a password prompt with ssh with public key authentication?

Is your home dir encrypted? If so, for your first ssh session you will have to provide a password. The second ssh session to the same server is working with auth key. If this is the case, you could move your authorized_keys to an unencrypted dir and change the path in ~/.ssh/config.

I tracked this by looking through /var/log/auth.log, and specifically, the line:

pam_ecryptfs: Passphrase file wrapped

Searching for that led me to the other stack exchange answer.

0

If you remove the password from the private key the SSH agent will not ask for one. Assuming that the machine-only account is called ansible like in the question you can achieve it with this command:

sudo -u ansible ssh-keygen -f ~ansible/.ssh/id_<TYPE> -N ''

or

sudo ssh-keygen -f ~ansible/.ssh/id_<TYPE> -N ''

depending on your access rights management configuration (replace <TYPE> with the key type in question, e. g. rsa, ecdsa, ed25519 etc.).


Password-less machine keys are common practice and safe enough as long as one

  • uses a unique dedicated key for the service using the key (not the same as the key used by the service developer(s)!) and

  • replaces the key and removes it from all authorized_keys files at the first sign of a potential compromise (which is facilitated by the measure described at the previous bullet point).

Of course the key file should have the access mode 0500 to restrict access to the machine account only. That's the default access mode for keys created with ssh-keygen.

1
  • Thanks, though the key password is not the one I'm being prompted for. It's the account password on the remote machine.
    – berto
    Dec 29, 2016 at 15:11

Not the answer you're looking for? Browse other questions tagged .