Determining Mechanism of SSH Password-Less Authentication

Question

I am trying to understand the mechanism by which I am successfully performing password-less SSH authentication. Though public key authentication is enabled, this is not how it is happening. I have my public key commented out in my authorized_keys file. Furthermore, I'm not even sure if my personal user's authorized_keys file comes into play since we're using FreeIPA's LDAP implementation for authentication.

The client-side SSH configuration makes it look as if host-based authentication is being used. However, the server-side SSH configuration has host-based authentication disabled.

Below, I provide what I believe to be all of the relevant configuration information.

From what's provided below, would anybody be able to explain to me how password-less authentication is occurring? If not, what additional information can I provide to help?

Thank you in advance!

Software versions

CentOS: 7.3.1611

ipa-client.x86_64 4.4.0-14.el7.centos.7
ipa-client-common.noarch 4.4.0-14.el7.centos.7
ipa-common.noarch 4.4.0-14.el7.centos.7
sssd-ipa.x86_64 1.14.0-43.el7_3.18

openssh.x86_64 6.6.1p1-35.el7_3

sssd.x86_64 1.14.0-43.el7_3.18
sssd-ad.x86_64 1.14.0-43.el7_3.18
sssd-client.x86_64 1.14.0-43.el7_3.18
sssd-common.x86_64 1.14.0-43.el7_3.18
sssd-common-pac.x86_64 1.14.0-43.el7_3.18
sssd-ipa.x86_64 1.14.0-43.el7_3.18
sssd-krb5.x86_64 1.14.0-43.el7_3.18
sssd-krb5-common.x86_64 1.14.0-43.el7_3.18
sssd-ldap.x86_64 1.14.0-43.el7_3.18
sssd-proxy.x86_64 1.14.0-43.el7_3.18

SSH Client Configuration

PubkeyAuthentication yes
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

Host *
GSSAPIAuthentication yes

SSH Server Configuration

Below, I provide the sshd configuration options I believe to be relevant. Please let me know if the value of other options is needed. These were obtained by executing sshd -T rather than just by copying and pasting from /etc/ssh/sshd_config. So, they should be what's really in effect.

allowtcpforwarding yes
authenticationmethods any
authorizedkeyscommand /usr/bin/sss_ssh_authorizedkeys
authorizedkeysfile .ssh/authorized_keys
challengeresponseauthentication yes
gatewayports no
gssapiauthentication yes
gssapicleanupcredentials yes
gssapienablek5users no
gssapikexalgorithms gss-gex-sha1-,gss-group1-sha1-,gss-group14-sha1-
gssapikeyexchange no
gssapistorecredentialsonrekey no
gssapistrictacceptorcheck yes
hostbasedauthentication no
hostbasedusesnamefrompacketonly no
ignoreuserknownhosts no
kbdinteractiveauthentication yes
kerberosauthentication no
kerberosorlocalpasswd yes
kerberosticketcleanup yes
kerberosusekuserok yes
passwordauthentication yes
permitopen any
permittunnel no
permituserenvironment no
pubkeyauthentication yes
strictmodes yes
usedns no
uselogin no
usepam yes

Answer 1

Posting Xenoid's comment as an answer:

Do ssh -v {host} and you will have a complete list of the authentication protocols that are checked (the last one being the one used). – xenoid Jul 2 at 20:20

NOTE: Credit due to Xenoid

Answer 2

From your package list:

sssd-ipa.x86_64 1.14.0-43.el7_3.18

sssd-krb5.x86_64 1.14.0-43.el7_3.18

From your SSH server config:

gssapiauthentication yes

From your SSH client config:

GSSAPIAuthentication yes

Based on your information I assume that you've enrolled your host as IPA client with FreeIPA and you're probably using Kerberos based single-signon through GSSAPI.

Mainly you would have done kinit user@REALM.EXAMPLE.COM before SSH login to obtain a Kerberos ticket granting ticket (TGT) which you can list with command klist together with service tickets obtained.

To know for sure it would be helpful to look at output of ssh -vas others already wrote and if you add which docs / how-to you have followed when setting up all this.