Re: can't turn off ssh password access on my new solaris box




"Richard E. Silverman" <res@xxxxxxxx> wrote in message
news:m2fyk4vt5q.fsf@xxxxxxxxxxxxxxxxxxxxx
"DT" == Darren Tucker <dtucker@xxxxxxxxxxxxxxxx> writes:
>> Try this in sshd_config:
>>
>> KbdInteractiveAuthentication no

DT> That will turn off keyboard-interactive in Protocol 2 but you
DT> probably want to also set "ChallengeResponseAuthentication no"
DT> turn off the equivalent authentication (PAM via TIS
DT> challenge-response) for Protocol 1.

Good point. I try to forget that SSH-1 exists. :)

Richard, are we anywhere near the point where SSH 1 should be disabled by
default in sshd_config? I'm under the impression that it's really fallen out
of favor: I haven't used it in years except by accident.


.



Relevant Pages

  • Re: keyboard-interactive and challenge-response
    ... > AFAIK OpenSSH has always had ChallengeResponseAuthentication and the ... > current version still has KbdInteractiveAuthentication (although it does ... keyboard-interactive in protocol 2. ...
    (comp.security.ssh)
  • Re: cant turn off ssh password access on my new solaris box
    ... >> KbdInteractiveAuthentication no ... DT> probably want to also set "ChallengeResponseAuthentication no" ... DT> turn off the equivalent authentication (PAM via TIS ... DT> challenge-response) for Protocol 1. ...
    (comp.security.ssh)
  • Re: keyboard-interactive and challenge-response
    ... AFAIK OpenSSH has always had ChallengeResponseAuthentication and the ... current version still has KbdInteractiveAuthentication (although it does ... > Keyboard Interactive or Challenge Response? ...
    (comp.security.ssh)
  • Re: Match user not working
    ... The server sees and recognises the ... you're logged in by keyboard-interactive (via PAM). ... either PasswordAuthentication or ChallengeResponseAuthentication. ... KbdInteractiveAuthentication, which is the Protocol 2 method. ...
    (comp.security.ssh)