Wednesday, September 23, 2009

Mandating key-based logins with sshd

This page provides a pretty good summary of creating a public/private key pair on the client and adding the public key to the server's authorized_keys file.

On the server side, edit /etc/ssh/sshd_config and add the directive PasswordAuthentication no and then restart sshd with sudo /etc/init.d/ssh restart Anyone that tries to log in to your server without a public key in the server's authorized_keys file will now not even be given the chance to enter a password.

sshd_config manpage

3 comments:

Anonymous said...

On some distributions you must also set "UsePAM no" to avoid accepting passwords.

Anonymous said...

On some distributions you must also set "UsePAM no" to avoid accepting passwords.

Anonymous said...

On some distributions you must also set "UsePAM no" to avoid accepting passwords.