Re: keyboard-interactive only authentication


I am posting my ideas in reverse order:

if you know a better solution for these attacks please
let me know.

What port is your server listening on? It's usually not a bad idea to chose some other
than the default 22. Especially the script kiddies often target their attacks on the
default port.

i want this especially because i see alot of password
brute force attacks on my server. i`ve studied the
script kiddies tools and the most widely used use only
the password authentication schema so this will be a
quick workaround.

Have you thought of using publiy key authentication instead? If that's an option in your
environment that could help.

how can i configure my openssh to accept only
keyboard-interactive logins?
if i specify PasswordAuthentication no then my ssh
client says No supported authentication methods left
to try!

keyboard-interactive is basically a client-side abstraction layer. What authentication
mechanism you use is up to you. That could be PAM with all its possibilities or s/key for
If you opt for PAM with authentication based on /etc/shadow that does not solve your
problem with brute force attacks.

As far as keyboard-interactive with OpenSSH is concerned: it is tied to
ChallengeResponseAuthentication. In order to setup you have to:

ChallengeResponseAuthentication yes
# for the PAM solution, which is very flexible
UsePAM yes
# Protocol must contain 2, since SSHv2 does ChallengeResponseAuthentication
# with keyboard-interactive
Protocol 2
# Deactivate any authentication methods not needed

ChallengeResponseAuthentication yes
PreferredAuthentications keyboard-interactive
# KbdInteractiveDevices is set inernally to "pam", you can assign skey as well
Protocol 2
# Deactivate any authentication methods not needed

Also check if your OpenSSH package was compiled with the --with-pam flag, otherwise the
UsePAM yes will have no effect. If you want to use skey directly (without pam) you have to
set KbdInteractiveDevices as outlined and check the compile time support (has the package
been compiled with --with-skey?).


Best regards
Tobias Lütticke

Relevant Pages

  • Re: OpenSSH and pam_krb5
    ... > with GSSAPI and PAM authentication. ... this data is present in a separate process (the "authentication ... application (ie sshd). ...
  • Re: PHKs MD5 might not be slow enough anymore
    ... It does not disable password authentication. ... It disables the SSH ... most people *do* need PAM. ... And, just to be safe, also turn off the challenge-response ...
  • Re: Solaris 9 authentication and access control into Active Directory
    ... implement a user within your Active Directory for the machine, ... As others have mentioned there's PAM samba SMB integration. ... Recently I've been using LDAP authentication. ...
  • Re: Understanding LDAP or MS Active Directory authenticationand Informix
    ... Hopefully we can upgrade to IDS 10 once Orrible certs PeopleSoft Tools ... Understanding LDAP or MS Active ... I know the LDAP support is through PAM. ... when you make the authentication call to the OS, ...
  • Re: alternatives to NIS and NFS
    ... >> I have been having some hassles with NIS and would like to upgrade to ... > For authentication, ... > OSX should be able to authenticate against LDAP. ... Authentication in Linux is done via the PAM library, ...