1

I have these settings on my remote machine under /etc/ssh/sshd_config

PermitRootLogin no
PermitRootLogin prohibit-password
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

The reason I did that is because I previously only wanted to be able to remotely connect via ssh with my public key installed.

But then I was curious about trying cockpit, installed it, and logged in successfully. But why did it work?

This stack answer directed me here stating that cockpit runs as a PAM module. But if I disabled PAM, why does it let me still log in via the web interface?

Improve this question
2
  • 1
    You have changed the SSH server configuration. It is entirely unrelated to anything that does not use SSH.
    – Daniel B
    Jan 10, 2023 at 15:32
  • Ok, so that means if I have cockpit enabled and running, it just ignores my ssh settings. If that is correct, the using cockpit web UI defeats the purpose of me connecting via ssh with only public key as a security measure. It seems like using cockpit is a security downgrade. Am I correct? I don't think there is a way to force it to use ssh keys as a login method.
    – orr
    Jan 10, 2023 at 15:36

1 Answer 1

Reset to default
1

You have to disable password authentication in PAM, not SSH.

For my distribution, Fedora, the solution was to comment add line in /etc/pam.d/cockpit to disable PAM authentication for Cockpit alltogether:

auth       required     pam_deny.so
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .