8

I want to share my answer for question in title, which I can't find quickly.

There many topics how to disable password auth at all:

UsePam yes # it will not be used
ChallengeResponseAuthentication no
PasswordAuthentication no
kbdInteractiveAutentication no

but no topics how to enable for paticular user:

Match User myuser
    PasswordAuthentication yes
    KbdInteractiveAutentication yes

Also useful command to test sshd config is:

sshd -T -C user=myuser,host=127.1,addr=127.1

Please, note that "127.1" will not work on every system, so you may need paste 127.0.0.1 here.

1 Answer 1

2

If it is not about password authentication specifically, you could force usage of pam_access.so and have your /etc/security/access.conf look like so:

+ : myuser : <ip/net here or ALL>
- : ALL : ALL
3
  • It is anti-hacking security policy for my server. Many attacks and scans use password auth method to check weak passwords. So when potential attacker will want to hack me, he goes away with nothing.
    – Eir Nym
    Nov 22, 2010 at 0:21
  • Then you might consider using pam_access.so globally as that would affect not only SSH's password authentication but also every other service configured to use PAM.
    – dennycrane
    Nov 22, 2010 at 0:25
  • Allmost all other services are behind pf(4)
    – Eir Nym
    Nov 22, 2010 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.