0

I am the admin of a Ubuntu 20.04 server and I want to enable ssh login for a user through password, rather than using key pairs.

The /etc/ssh/ssh_config file on the host looks like this (<username> is replaced by its actual username):

Host*
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes

Match User <username>
    PubkeyAuthentication no
    PreferredAuthentications password
    PasswordAuthentication yes

Still, when he tries to login as:

ssh \<username>@\<host>

he receive an error:

Permission denied (publickey)

What am I doing wrong?

Pilot6
  • 90,100
  • 91
  • 213
  • 324
A.Manfreda
  • 11
  • 2
    AFAIK the ssh_config file is for configuring the host's ssh clients - it's the sshd_config file that controls the server's permitted authentication methods. – steeldriver Jan 19 '23 at 20:55
  • 1
    Wow, I am so dumb. It is working now. Cannot believe the amount of time I lost by editing the wrong file... Thank you very much! – A.Manfreda Jan 23 '23 at 09:56
  • @steeldriver, you should post that as an answer. – pbhj Feb 09 '23 at 14:48

1 Answers1

1

Note: You have to edit the ssh daemon config, not the ssh.config in the remote computer.

I assume the ssh-server is configured to user key based authentication only and password based authentication is turned off in the file /etc/ssh/sshd_config.

Create an additional config file:

Newer versions of openssh-server allows creation of /etc/ssh/sshd_config.d/*.conf files rather than editing the ``/etc/ssh/sshd_config` file.

Create a new file /etc/ssh/sshd_config.d/10-password-login-for-special-user.conf:

sudo nano /etc/ssh/sshd_config.d/10-password-login-for-special-user.conf

Add the following lines:

Match User <username>
    PasswordAuthentication yes

Replace <username> with the username of the special user.

Save the file using Ctrl+O followed by Enter. Then exit the editor by Ctrl+X.

Restart the ssh service by the following command:

sudo systemctl restart ssh.service

Now the special user will be able to login remotely using password, while all other users will continue to use key based authentication.

Referrences:

Hope this helps

user68186
  • 33,360
  • Please note, that newer versions of sshd will be sensitive about the order of commands. If you want to place a PasswordAuthentication no in the configuration as well, make sure to put it below the yes, i.e. Match User <username> ↲ PasswordAuthentication yes ↲ Match All ↲ PasswordAuthentication no. – BurninLeo Mar 05 '24 at 19:41