UNIX for Advanced & Expert Users

Hi,

I am trying to force a server to only accept ssh connections which are:

a. the ssh key connecting to the server has 2048 bits
b. The ssh key they use has a password set on the private key

I have seen in /etc/ssh/sshd_config there are two such parameters:

1. ServerKeyBits
2. PermitEmptyPasswords no

But when these are set to the appropriate values ie (1) 2048 (2) no, it still fails in that users can login with no private key password, and also users with eg 1024 bit keys can login.

I am running Redhat 6.6, but I have tried this on RHEL 3.X as well with the same results.

Thanks in advance
Mantis

Hello mantis10,

I do not believe that you can force the private key to require a password. The PermitEmptyPasswords no is for the challenge & response access (i.e. user and password keyed in)

I think (but am happy to be corrected) that the ServerKeyBits is for how the server side will generate/use keys (for the client to server traffic rather than authentication and/or server to client traffic), rather than being able to restrict the client access.


Sorry about that, but like I say, I think this is working properly. I would be delighted to be corrected though.



Robin

ok thanks Robin, so there is no way to do either thing I am trying to achieve? ie set private key password & Server key bits?

Mantis

I am not aware of any, but others may have a way - and I would be delighted to learn of it. I've had similar arguments about key generation here



Robin

Isn't the password defined on key creation? Not sure if you can enforce it there.