SSH password auth keeps being set to "no" automatically

DrData · October 24, 2023, 6:50pm

I’m attempting to use the AlmaLinux 9 cloud img and i’m finding that my config in the sshd_config file keeps being reset. “passwordauthentication” is set to no when I had set it to yes. It results in the following message when trying to connect by SSH.

No supported authentication methods available (server sent: publickey,gssapi-keyex,gssapi-with-mic)

Any advice would be appreciated.

jlehtone · October 25, 2023, 7:32am

Do not edit that file. The first non-comment in it should be:

Include /etc/ssh/sshd_config.d/*.conf

Do look what /etc/ssh/sshd_config.d/*.conf files you do have.

You want to add a *.conffile that is lexicographically before any of those
and has the settings that you want. SSH does use first occurrences.

Plan A:
Its a cloud image, so it probably has cloud_init and the hypervisor that spawns the instance may offer a way to supply cloud_init customization script. (OpenStack does.)

If could_init sets the sshd config, then you might be able to change that bit of could_init config and never have to touch sshd config directly.

DrData · October 25, 2023, 8:02am

I do think it might be caused by the default cloud_init conf based on the info i’m finding online, as you mentioned too. I’m about to start testing today to see if that is the issue. Appreciate the insight.

sej7278 · October 25, 2023, 3:35pm

aren’t you supposed to disable the cloud-init service after first boot or it’ll keep running on subsequent reboots…?

i’d think sudo systemctl disable cloud-init or mask even should work although there’s some horrible alternatives in the official docs

looks like its set in /etc/ssh/sshd_config not an include file:

github.com

AlmaLinux/cloud-images/blob/master/ansible/roles/aws_ami_aarch64/tasks/aws_guest.yml#L165


      
            community.general.ini_file:
              path: /rootfs/etc/NetworkManager/conf.d/dhcp.conf
              section: connection
              option: ipv4.dhcp-timeout
              value: 300
              owner: root
              group: root
              mode: 0644
              seuser: system_u
          
          - name: Disable SSH password authentication
            lineinfile:
              path: /rootfs/etc/ssh/sshd_config
              regexp: "{{ item.regexp }}"
              line: "{{ item.line }}"
              state: present
              validate: 'sshd -T -f %s'
            loop:
              - { regexp: '^PasswordAuthentication', line: 'PasswordAuthentication no' }
              - { regexp: '^ChallengeResponseAuthentication', line: 'ChallengeResponseAuthentication no' }

DrData · October 25, 2023, 3:49pm

I was able to fix this by editing the cloud init file at /etc/cloud/cloud.cfg. The first two options needed to be set to my needs and was the culprit overwriting my changes to the ssh config file.

I do use this in cloud environment so cloud init is needed to configure the user/network.

Ty for the assists

Topic		Replies	Views
SSH configuration is not being honored Security	3	873	October 2, 2023
Openssh-server-8.0p1-16.el8 update and HostKey	9	969	March 17, 2023
Ssh root login disabled Support	1	5133	August 18, 2022
Raspberry Pi SSH Support	4	368	August 2, 2023
"Allow root SSH login with password" does not work Support	14	213	April 5, 2024

SSH password auth keeps being set to "no" automatically

Related Topics