10

I have a question regarding this option:

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

If set to yes, users can login using the local password.

What exactly does the "clear text" mean in this case?

Is the connection during authentication not encrypted? Is the password issued not hashed?

My main interest is, wether someone can see the password when using ngrep or tcpdump in my WLAN for example.

Improve this question

1 Answer 1

Reset to default
10

Password Authentication in SSH is a cleartext password communication protected by the SSH tunnel, no more, no less.

Why isn't the password hashed? For technical reasons, the password is already hashed in /etc/shadow file. So it cannot be hashed again by the protocol. (Well, you could make a hash of the hash, but that doesn't offer additional security imho).

In normal circumstances this is secure. This assumes that you connect to a trusted server and you verify server signature.

The only case this could be insecure is when you connect to a malicious server (eg: MITM attack) and you don't verify the server signature. In this case the attacker could easily sniff the password.

What is the alternative to password authentication? Public Key authentication, because in this mode the key itself is never sent.

Improve this answer
4
  • So the target host receives the password clear text, hashes it, and then compares it to its own hashed password? Why doesn't the connecting host hash it, connect, and the target compares just the both hashes? The server's signature could be spoofed, too, not? Is someone in my WLAN able to see the password?
    – Daniel W.
    Jun 24, 2014 at 13:00
  • Why not hash before send? With a salted hash it would prevent from recovering original password, and from reusing the hash to login again, that's true. The problem would be portability as not all system cipher their passwords the same way. Server signatures are supposed to be unspoofable, server private key is never sent, only used.
    – LatinSuD
    Jun 24, 2014 at 13:08
  • 2
    No, some one on your wlan can not see your password because of the ssh tunnel (encrypted)... password are in clear text in sshd context not outside... this mean that the encryption happen for the whole communication done with ssh, authentication included... the only risk with ssh is MITM attack... someone on your wlan can not see your password but he could use MITM attack for instance by spoofing the DNS and replacing the remote ssh server and thus get the password after all... but this is not easily doable many other component have to be vulnerable like DNS, Lan, Wlan etc...
    – intika
    Jan 12, 2020 at 12:22
  • So the ssh tunnel is encrypted like an ssl/tls connection right? This means using password authentication with ssh is as secure as using password authentication when I log into my bank website over https right? (of course hopefully your bank uses 2fa also now)
    – Sámal Rasmussen
    Feb 21 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .