5 ms·

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host:

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

rjh29 4y ago
This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all. ^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway. edit: as several people have pointed out, this config option does not completely prevent pubkey auth being used (i.e. if configured or overriden on the command line). But if you only use that config by itself, it will disable pubkey authentication for every host.
- addingnumbers 4y ago
  That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead." Nothing about that config snippet precludes using private keys for known servers.
  - rjh29 4y ago
    Well that is how I read it :P I think it would be good to point out that you can add other Host sections to override it.
    - alexeldeib 4y ago
      It’s about preventing identity leakage, not using password. I can’t tell if the post was edited, but it already includes how to override per host. I value this and I universally disable password auth…on the server :) E: as listed by others, IdentitiesOnly=yes seems like a better approach?
- nerdbert 4y ago
  I have that line in my .ssh/config and I never use password auth. I explicitly list every server that I want to connect to in the config file, so I know exactly what is going to happen.
- cryptonector 4y ago
  You can disable password authentication as well.
akerl_ 4y ago
This doesn't really turn off the behavior. I think you're looking for IdentitiesOnly and IdentityFile, which lets you tell your client to send only the right key per host, rather than sending all of them until it gets a hit.
Sparkyte 4y ago
Excellent way to also do ssh-agent less key site binding for those who are ssh adding a new key. I would always rather manage a key per host than manage it inside of the ever forgetful agent.

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

rjh29 4y ago

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all. ^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway. edit: as several people have pointed out, this config option does not completely prevent pubkey auth being used (i.e. if configured or overriden on the command line). But if you only use that config by itself, it will disable pubkey authentication for every host.

addingnumbers 4y ago
That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead." Nothing about that config snippet precludes using private keys for known servers.
- rjh29 4y ago
  Well that is how I read it :P I think it would be good to point out that you can add other Host sections to override it.
  - alexeldeib 4y ago
    It’s about preventing identity leakage, not using password. I can’t tell if the post was edited, but it already includes how to override per host. I value this and I universally disable password auth…on the server :) E: as listed by others, IdentitiesOnly=yes seems like a better approach?
nerdbert 4y ago
I have that line in my .ssh/config and I never use password auth. I explicitly list every server that I want to connect to in the config file, so I know exactly what is going to happen.
cryptonector 4y ago
You can disable password authentication as well.

akerl_ 4y ago

This doesn't really turn off the behavior. I think you're looking for IdentitiesOnly and IdentityFile, which lets you tell your client to send only the right key per host, rather than sending all of them until it gets a hit.

Sparkyte 4y ago

Excellent way to also do ssh-agent less key site binding for those who are ssh adding a new key. I would always rather manage a key per host than manage it inside of the ever forgetful agent.