Disable Local Password Authentication for SSH

[henry-lemi]

We want to disallow Local Password Authentication for SSH.

I think Local Password Authentication is still helpful when physically accessing the machine offline or when doing sudo, but allowing it for SSH login is not secure and we would like to disable it before we can use Authd for our company.

[3v1n0]

We are actually already working on this for some time, but it needs still some efforts.

However, for the time being, you just don't have to enable KbdInteractiveAuthentication in sshd config file, or just leave it in a way that can be safer (depending on the environment)

Like:

KbdInteractiveAuthentication no

Match Address 127.0.0.1
    KbdInteractiveAuthentication yes

Match Address 192.168.*.*
    KbdInteractiveAuthentication yes

# And repeat the same for the local IPs match address:
Match Address 10.*.*.*
Match Address 127.0.0.1
Match Address 172.16.*.*
Match Address 172.17.*.*
Match Address 172.18.*.*
Match Address 172.19.*.*
Match Address 172.20.*.*
Match Address 172.21.*.*
Match Address 172.22.*.*
Match Address 172.23.*.*
Match Address 172.24.*.*
Match Address 172.25.*.*
Match Address 172.26.*.*
Match Address 172.27.*.*
Match Address 172.28.*.*
Match Address 172.29.*.*
Match Address 172.30.*.*
Match Address 172.31.*.*

Eventually we'll just enable it only for a 2nd factor authentication is used in authd itself though.

[henry-lemi]

I am still able to SSH with local password when KbdInteractiveAuthentication is set to no, only the prompt is different.

[3v1n0]

Well that's likely because PasswordAuthentication is enabled? You can also set that to no, but that one should not allow using authd password anyways, or you can also disable UsePAM completely.

[henry-lemi]

Thank you! Is there an ETA? Is there related PRs?