140
PSA: Test Your Server SSH Access (lemmy.ml)
submitted 1 month ago* (last edited 1 month ago) by brownmustardminion@lemmy.ml to c/selfhost@lemmy.ml
12 comments fedilink hide all child comments

I accidentally attempted to SSH into one of my servers from a device that did not contain my ssh key. I configure all of my servers to only allow authentication via cryptographic keys. Root ssh as well as password auth are disabled.

To my surprise, I was able to log in to my server with a password despite this. Baffled, I first tried some other servers. 2 of the 5 other servers I tried were accessabke via password.

After some swift investigation the culprit was found, a cloud-init ssh config in sshd_config.d/ with one line: password_authentication Yes.

So TLDR PSA....if you run a server in any type of virtualized environment, including a VPS, check your /etc/ssh/sshd_config.d/ folder. And more broadly, actually thoroughly test your ssh access to confirm everything is working as you intend it to.

you are viewing a single comment's thread
view the rest of the comments
[-] arrakark@10291998.xyz 1 points 8 hours ago

Yeah that sounds pretty bad. Is there a quick way to disable ssh keys to test?

this post was submitted on 30 Sep 2024
140 points (100.0% liked)

Self Hosted - Self-hosting your services.

11378 readers
47 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules

Important

Beginning of January 1st 2024 this rule WILL be enforced. Posts that are not tagged will be warned and if not fixed within 24h then removed!

Cross-posting

If you see a rule-breaker please DM the mods!

founded 3 years ago
MODERATORS
dogmuffins@lemmy.ml
Zoe8338@lemmy.ml
testman@lemmy.ml