I am trying to understand the mechanism by which I am successfully performing password-less SSH authentication. Though public key authentication is enabled, this is not how it is happening. I have my public key commented out in my authorized_keys file. Furthermore, I'm not even sure if my personal user's authorized_keys file comes into play since we're using FreeIPA's LDAP implementation for authentication.
The client-side SSH configuration makes it look as if host-based authentication is being used. However, the server-side SSH configuration has host-based authentication disabled.
Below, I provide what I believe to be all of the relevant configuration information.
From what's provided below, would anybody be able to explain to me how password-less authentication is occurring? If not, what additional information can I provide to help?
Thank you in advance!
Software versions
CentOS: 7.3.1611
ipa-client.x86_64 4.4.0-14.el7.centos.7
ipa-client-common.noarch 4.4.0-14.el7.centos.7
ipa-common.noarch 4.4.0-14.el7.centos.7
sssd-ipa.x86_64 1.14.0-43.el7_3.18
openssh.x86_64 6.6.1p1-35.el7_3
sssd.x86_64 1.14.0-43.el7_3.18
sssd-ad.x86_64 1.14.0-43.el7_3.18
sssd-client.x86_64 1.14.0-43.el7_3.18
sssd-common.x86_64 1.14.0-43.el7_3.18
sssd-common-pac.x86_64 1.14.0-43.el7_3.18
sssd-ipa.x86_64 1.14.0-43.el7_3.18
sssd-krb5.x86_64 1.14.0-43.el7_3.18
sssd-krb5-common.x86_64 1.14.0-43.el7_3.18
sssd-ldap.x86_64 1.14.0-43.el7_3.18
sssd-proxy.x86_64 1.14.0-43.el7_3.18
SSH Client Configuration
PubkeyAuthentication yes
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
Host *
GSSAPIAuthentication yes
SSH Server Configuration
Below, I provide the sshd configuration options I believe to be relevant. Please let me know if the value of other options is needed. These were obtained by executing sshd -T rather than just by copying and pasting from /etc/ssh/sshd_config. So, they should be what's really in effect.
allowtcpforwarding yes
authenticationmethods any
authorizedkeyscommand /usr/bin/sss_ssh_authorizedkeys
authorizedkeysfile .ssh/authorized_keys
challengeresponseauthentication yes
gatewayports no
gssapiauthentication yes
gssapicleanupcredentials yes
gssapienablek5users no
gssapikexalgorithms gss-gex-sha1-,gss-group1-sha1-,gss-group14-sha1-
gssapikeyexchange no
gssapistorecredentialsonrekey no
gssapistrictacceptorcheck yes
hostbasedauthentication no
hostbasedusesnamefrompacketonly no
ignoreuserknownhosts no
kbdinteractiveauthentication yes
kerberosauthentication no
kerberosorlocalpasswd yes
kerberosticketcleanup yes
kerberosusekuserok yes
passwordauthentication yes
permitopen any
permittunnel no
permituserenvironment no
pubkeyauthentication yes
strictmodes yes
usedns no
uselogin no
usepam yes
ssh -v {host}
and you will have a complete list of the authentication protocols that are checked (the last one being the one used). – xenoid Jul 2 '18 at 20:20