topic Setup for password-less SSH sessions in Operating System - HP-UX

Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 13:43:26 GMT

I have installed SSH on Redhat and had no problems with the default behaviour NOT asking for login/password. On RH, if a authorized key file is not present, the session is immediately closed after entering the login ID. How can I duplicate this behaviour on HP-UX. Running 11.11 and HP-UX Secure Shell A.04.30.002. I do not want SSH allowing logins if keys are not found.

Re: Setup for password-less SSH sessions

Christian Tremblay — Fri, 02 Jun 2006 14:06:55 GMT

Check the global ssh daemon configuration file:/opt/ssh/etc/sshd_config and set
PasswordAuthentication=no

(The default is yes)

Re: Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 14:14:01 GMT

Nice try, but my config file already has PasswordAuthentication=no

I am hoping there is something else I have missed.

... Jerry

Re: Setup for password-less SSH sessions

Christian Tremblay — Fri, 02 Jun 2006 14:39:56 GMT

Did you kill/restart the daemon after you made the change ?

Re: Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 14:42:48 GMT

Yes. I did a kill on the PID. Verified it had died and then issued the command /usr/sbin/sshd to restart the daemon.

Re: Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 14:45:21 GMT

Christian - attached is the config file from /opt/ssh/etc/sshd_config

... Jerry

Re: Setup for password-less SSH sessions

Christian Tremblay — Fri, 02 Jun 2006 15:00:10 GMT

I don't have a machine to test on right now,
but you could try setting:

usePAM=no

Re: Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 15:24:11 GMT

That worked. Thanks.
Points assigned.

Re: Setup for password-less SSH sessions

Christian Tremblay — Fri, 02 Jun 2006 15:25:25 GMT

Sorry, do not change usePAM but uncomment the "UseLogin no" line in your config file.

This should do it.But the down side to this is that a user with a key will still be able to login even if the account is disabled.

Re: Setup for password-less SSH sessions

Jerry Sommerville_2 — Fri, 02 Jun 2006 15:34:13 GMT

You had it right the first time Christian. When I change UsePAM back to yes and uncommented UseLogin=no it still prompted for a login ID and password and I was able to get in. The UsePAM=no did work however so I am going to continue testing with that option. Thanks,

... Jerry

Re: Setup for password-less SSH sessions

Logu_2 — Sat, 03 Jun 2006 02:12:53 GMT

There are actually two password authentication.

1. normal password.
2. Challenge-response via PAM and keyboard interactive.

So set both of them to "no" instead of doing a usepam=no

PasswordAuthentication yes
ChallengeResponseAuthentication yes

-logu