Disabling password access for the SSH protocol

Continuing along the path taken in the previous articles on securing a VPS running Linux (the basic guide and access with SSH keys), we will now change the SSH service so that it no longer accepts login requests made by entering a password. Access will then be possible exclusively with SSH keys, intrinsically raising the security level of your VPS.

Should you lose your private key, you will still be able to access your VPS with a username and password through the VPS GREEN web console, reachable from the dashboard. Once logged in via the console, you can reconfigure SSH with a new private key or restore access with a username and password.

Prerequisites

1. A VPS running a Linux operating system
2. A user with adequate privileges, i.e. sudo, or root directly
3. A text editor; in our example we will use nano
4. SSH already set up to use encrypted keys

Edit the SSH service configuration

Before starting with the changes, open two SSH sessions: in one you will carry out all the operations described, while the other stays open in case of emergency (it can be useful to avoid being locked out if the changes made to the configuration file turn out to be wrong). The SSH service configuration file is located at /etc/ssh/sshd_config; only the root user can edit it.

1. Let’s move to the directory containing the sshd_config file:

   $ cd /etc/ssh

2. Let’s make a copy of the sshd_config file, so that all the modified settings can be restored quickly:

   $ sudo cp sshd_config sshd_config.orig

3. At this point we can start editing the configuration:

   $ sudo nano sshd_config

Inside the file, anything beginning with # (hash) is a comment and is ignored when the service starts; at the same time, though, it tells us the default value for that particular option. For example:

#Port 22   <- questa è la porta di default del servizio, ignorata
Port 4422  <- questa è la nuova porta, scelta da noi, utilizzata

To prevent password access we need to find the PasswordAuthentication option, remove the # symbol and change its default value to no — or, if you prefer, write a new line while keeping the previous value intact. The nano editor gives us a handy search feature: just press CTRL+W to bring up, at the bottom of the window, a field where you can enter the text to search for; press ENTER to start searching the file.

Once you have found the PasswordAuthentication parameter, you can change it:

# PasswordAuthentication yes
PasswordAuthentication no

Save the changes by pressing CTRL+X, then Y and finally ENTER to accept the suggested file name.

1. Now the changes you have just made need to take effect: you therefore have to restart the SSH service by running the command

   $ sudo systemctl restart sshd

2. Since you will not receive any particular output confirming the restart, check that the service has started correctly (if the sshd_config file contains errors, the service will not restart):

   $ sudo systemctl status sshd

No more passwords

If the procedure has been carried out properly, under ‘Active:’ you will see that the service is up and running, with a reassuring active (running). Now you can try connecting, perhaps without the private key, to see for yourself that the SSH service on your VPS will firmly deny access, without even asking for a username or password:

utente_vps@ip_vps: Permission denied (publickey)

Guide originally published on the blog of VPS GREEN, the VPS service on our green private cloud.

• VPS
• SSH
• sshd_config
• hardening
• SSH keys
• security