Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
I have an SSH key based authentication setup for some deployment script. But there is a chance that the authentication files are not setup properly at some point. I don't want my shell scripts to ask for passwords, I want them to fail immediately.
Using
ssh -o KbdInteractiveAuthentication=no -o PasswordAuthentication=no -o PubkeyAuthentication=yes test@host
or some thing along those lines does not work. I do not want to change configuration files since the script can be executed from any where.
I just had this problem and found the answer here:
http://www.gossamer-threads.com/lists/openssh/dev/47179
Basically, openssh used keyboard-interactive to implement challenge-repsonse. So if either of these options are set to "yes", then keyboard-interactive gets set to "yes" in the code. You have to set both to "no" in order to get the behavior you want.
I had to do:
ssh -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -o ChallengeResponseAuthentication=no
Of course, the BatchMode=yes setting would take care of all of these for you and future proof you against any new user interactive authentication methods in the future.
