Disable SSH Password Authentication

Prevent Password-based Brute Force Logon Attempts

Whenever you use SSH for remote access to a server on the public internet, you may think “How secure this is?“. If you are ever looking over access logs you may see a large amount of attempts to login that fail from unknown sources for generic or common usernames.

Service providers like Shodan, FortiGate & CheckPoint have maps that can show you the landscape of live attempts to cause DDoS attacks, gain unauthorized access or exploit known CVEs 🚨

The unfortunate reality is that if you have a public IPv4 or IPv6 address then routing towards this address is available to anyone.
This can be alarming but is required for online services.
It doesn’t mean that you need to just accept bad traffic.

While there are several ways to harden inbound access to a server such as preventing root logon, using fail2ban or having a dedicated Firewall between the internet and your sever – there are also things you can do to secure the server itself to supplement your existing security infrastructure.

Today I’ll be focusing on disabling SSH password authentication. This will prevent attempts to login using a basic password when you already have a better authentication method, such as key-based authentication. Remember to be sure that you can access your server either locally, by console connection or by with an alternative authentication mechanism before disabling the use of password authentication.

Expectations

You have a server running OpenSSH’s SSH Server daemon.
You have access to this server, with root level permissions.
You have alternative local, console or remote access to your server.
You have configured & tested alternative access to your server.

Given Example

In our example we have a GNU/Linux Server called “SSHS” which is running OpenSSH’s SSH Server daemon.
We have root user access & a user called “keyadmin” that is setup with sudo access to carry out actions at a root permission level.
We have configured key-based authentication for “keyadmin” which has been tested ahead of time, which I have a guide on.
We have alternative access to SSHS by means of local login.

Disable Password Authentication

On an OpenSSH server daemon the system wide SSH service configuration file /etc/ssh/sshd_config can be altered to disable password authentication.

Backup the default sshd_config

The default sshd_config actually highlights a lot of useful parameters that it supports. Whenever you’re making a change to a config file like this I suggest you clone the original file to easily revert any changes you make if this breaks any functionality.

We’ll do this quickly by copying the config with a different name that won’t be used by the daemon.

keyadmin@SSHS:~# sudo cp /etc/ssh/sshd_config /etc/ssh/.backup_sshd_config

Edit sshd_config

Using your favorite editor or whatever editor is available to you on your server, edit the /etc/ssh/sshd_config file. In our example we have nano installed and use this to alter the SSH Server daemon configuration.

keyadmin@SSHS:~# sudo nano /etc/ssh/sshd_config

Within this file, we ensure the following statement is in place ;-

PasswordAuthentication no

It may also be worth verifying if there is a statement on which authentication methods are permitted, see the man page for the file or this online version of the man page on the sshd_config file.
Here we’ll also ensure that our only valid authentication methods are key-based as this is what is desired in our example ;-

AuthenticationMethods publickey

Restarting the SSH Server daemon

After modifying configuration files for a daemon, it is recommended to restart the service itself to ensure that the configuration change is picked up and the new behavior is performed. In our example we’re using systemd and the unit for the OpenSSH Server daemon is sshd.

keyadmin@SSHS:~# sudo systemctl restart sshd

Testing password authentication is disabled

You should now be able to attempt to login to your server without specifying alternative methods to password authentication & be prevented from logging in.

In our example we’ve prevented password authentication and ensured that interactive-keyboard and password authentication types are not supported, replaced exclusively with key-based authentication. Our SSH Server daemon also confirms to our SSH Client PuTTY the reasons for disconnecting the logon attempt, highlighting that keyboard-interactive login isn’t supported ;-

PuTTY told no password auth allowed.

Rolling Back

If there are any issues with the changes made to sshd_config or you wish to undo them you can revert back easily.

Restoring from our backup sshd_config file

As we initially backed up the sshd_config file, we can simply revert changes made to it from our example guide by copying it back over & restarting the SSH Server daemon ;-

keyadmin@SSHS:~# sudo cp /etc/ssh/.backup_sshd_config /etc/ssh/sshd_config
keyadmin@SSHS:~# sudo systemctl restart sshd

Restoring to the default sshd_config file

While I don’t recommend this if you have heavily modified your configuration file, simply renaming or even deleting the file itself and restarting the SSH Server daemon will force the daemon to re-create the file with the default configuration applied. This will remove any custom parameters. Here we rename the sshd_config file ;-

keyadmin@SSHS:~# sudo mv /etc/ssh/sshd_config /etc/ssh/sshd_config.old
keyadmin@SSHS:~# ls /etc/ssh/sshd_config
keyadmin@SSHS:~# sudo systemctl restart sshd
keyadmin@SSHS:~# ls /etc/ssh/sshd_config

Using apt package manager to restore the configuration file

Another, more advanced option would be to use your package manager to reinstall OpenSSH and pull down the package maintainer configuration file to replace your sshd_config file.
This depends entirely on your package manager, in our example we’re using apt & specifically we can use apt-get with some options specified and selecting to use the maintainer’s version of the sshd_config file when prompted ;-

keyadmin@SSHS:~# sudo apt-get -o Dpkg::Options::="--force-confask" install --reinstall openssh-server

Restoring the default sshd_config parameters we changed

In our example, we only modified two parameters. The main parameter that prevents password authentication has been changed from default ‘yes’ to ‘no’ and can be changed back ;-

PasswordAuthentication yes

We also specify the valid authentication types in our example to only be ‘publickey’ to meet our desired logon expectations. You could remove this parameter to restore the default behavior or specify the default use of ‘any’ within your configuration file if desired ;-

AuthenticationMethods any

Diagnostic Help

If you are having issues with our example guide, it would be best to use documentation on the sshd_config file.
Here are some documents I suggest reviewing ;-

• Details on the OpenSSH Service Daemon Config File
• The official OpenSSH Manual Pages
• Helpful details on the sshd_config file itself