2

I have an SSH key based authentication setup for some deployment script. But there is a chance that the authentication files are not setup properly at some point. I don't want my shell scripts to ask for passwords, I want them to fail immediately.

Using

ssh -o KbdInteractiveAuthentication=no -o PasswordAuthentication=no -o PubkeyAuthentication=yes test@host

or some thing along those lines does not work. I do not want to change configuration files since the script can be executed from any where.

Improve this question
4

I just had this problem and found the answer here:

http://www.gossamer-threads.com/lists/openssh/dev/47179

Basically, openssh used keyboard-interactive to implement challenge-repsonse. So if either of these options are set to "yes", then keyboard-interactive gets set to "yes" in the code. You have to set both to "no" in order to get the behavior you want.

I had to do:

ssh -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -o ChallengeResponseAuthentication=no

Of course, the BatchMode=yes setting would take care of all of these for you and future proof you against any new user interactive authentication methods in the future.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.