3

I’ve asked some web hosting providers (Bluehost and Dreamhost) and they both said that on shared hosting accounts they have no way to disable login via SSH with a password. What this means is that even if we set up SSH keys, logging in without them and via the hosting’s password will always be enabled, pretty much negating most of the advantage for the keys.

From what I can find online, editing /etc/ssh/sshd_config is the way to go do disable login via a password, but since it’s shared hosting, that’s not a possibility.

All that said, they never claimed it can’t be done (though I haven’t found a way), just that they don’t support it. Is there a way to do it on a per-user basis, so that I can set it up myself? And if not, why not, what is the (technical/design) limitation in the way SSH works that prevents it?

  • While security is important in any environment, if it's critical to your mission then get your own dedicated server or VPS where you have control over disabling passworded login's. I have one of the hosts you mentioned, while not 100% the same as disabling passworded logins I created long 50+ character random passwords with garbage keyboard banging on notepad. After I pasted the passwords twice to set and confirm the notepad files were never saved. True it could be cracked eventually, but it can't ever be "found" or guessed. I imagine other shared hosting aspects are less secure than my pass. – Tyson Dec 31 '14 at 15:17
  • I have 60+ character passwords protected in a password manager. That’s not the point. I’d like to know if it’s possible to do, and if not, why not. – user137369 Dec 31 '14 at 15:19
  • It could be done if they configured it, there is no way YOU can configure without su priveldges. Will they do it? No, not for that pricing model, move up to the next level if you need it. – Tyson Dec 31 '14 at 15:28
  • Yes, I know that, I say as much in the question. My question is why? Why doesn’t SSH allow that? Is it by design; is it a limitation that can be overcome but they’re not interested in; is it a limitation of the underlying system? What prevents this from being a possibility? – user137369 Dec 31 '14 at 15:43
  • It's a limitation that can be overcome but they’re not interested in doing so. Also the number of users wanting/needing/demanding it is going to be rather low at that price model. Users that fall into the category of wanting/needing/demanding it will have other reasons for needing su privileges which come at the very next level of hosting. Once you have su/root you can make it work yourself. The hosts control panel robot is a su on your shared host, they could program the steps to make it happen based on a checkbox if they wanted to. – Tyson Dec 31 '14 at 16:05
3

[Is there a way to] disable SSH login via password on a per-user basis?

No. Generally.

what is the (technical/design) limitation in the way SSH works that prevents it?

There is noting in the SSH protocol design or specification that prevents this.

It is an implementation-specific restriction in the SSH daemon (or service)

The usual sshd program on Linux (etc) platforms was written to read a single configuration file that applies to all users of that instance of the program.

I believe it would be possible to write an SSH daemon that looks for a supplementary configuration file in a user's home directory (for example). However this has not been done (insufficient demand probably)


Is there anything approximately equivalent?

What you can do is set the user's login password to some extremely long and completely random string.

It might be possible to use the shell to set a password that contains characters that cannot be entered using SSH clients of the sort believed to be used by attackers. Or at least to set a password that is much longer than any they are likely to attempt using the usual dictionary-based approaches.

  • 1
    One thing you can do is manually edit /etc/shadow and set the encrypted password to x. Since nothing encrypts to that string, there is no valid password. Now, if only there was a way to make the standard tools do this for us... – Throw Away Account Sep 13 '17 at 18:51
-1

SSH DOES support this function, and its quite trivial to implement - as others have said, it needs the co-operation of your provider. You would do it by setting up a user account without a valid password (On my distro you can do this by failing to enter a password a few times on adduser, but you can always edit /etc/shadow and change the encrypted password to "*" or "!" - as many accounts will already be set up.

The second step is to install your public key in authorised_hosts - this negates the need for ssh to check your password to give you access.

  • Yes, like I’ve commented many times and mention in the original question, I do understand it’s possible to do with the host’s intervention. My question is why isn’t it possible to do without the host’s intervention, on a per-user basis. – user137369 Jan 2 '15 at 3:07
-1

With the OpenSSH server, to disable password authentication on a per-user basis, you would add these lines to the sshd_config file:

Match user someuser
PasswordAuthentication no

Refer to the sshd_config manual for details. After editing sshd_config, be sure to restart sshd.

  • 2
    Like I say in the original question and many comments, I do not have access to /etc/ssh/sshd_config. – user137369 Jan 2 '15 at 5:12
  • And it wouldn't matter if you did. This is not "per user". This is system-wide. – HörmannHH Sep 18 '18 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.