It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for user's password. It makes me think - what stops the attacker from trying to brute force this password instead (and upload self-generated public key to gain permanent access)? Is it a security hole, or am I missing something important?

P.S. let's assume there is no fail2ban or similar software running


ssh-copy-id is a script that simply logs onto a target machine and copies your public key there, so that further login attempts on that machine can be done with your SSH private key. This assumes that you can log on that machine right now, while your public key is not there. If you get asked for a password, then this means that password-based login is still enabled on that server (or at least that the client is trying to authenticate with a password, which may or may not work depending on server configuration).

  • Thanks! I've been misled with ssh-copy-id asking me for password - I've never checked if entering the correct one will allow me to upload another key. However, I'm afraid I can't agree with everything you've said - while it's true I can't upload a new key that way, the If you get asked for a password, then this means that password-based login is still enabled on that server. sentence doesn't seem to be true - I am asked for password even if I run ssh a@x but the password is being rejected (and yes, I am sure it's the correct one). I'll be happy to accept your answer if you fix that part :) – Hipolith Oct 6 '15 at 16:27
  • OK, I added a provision for that. Maybe entering the password would not have worked. Anyway, the important point is that ssh-copy-id is just an automation script that uses the normal SSH protocol and configuration; it is not an additional mechanism. The server is not even aware of the existence of ssh-copy-id. – Tom Leek Oct 6 '15 at 17:21

You are prompted to type a password each time you use it because it is the default behavior of that tool as you can read through its documentation:

presumably using a login password, so password authentication should be enabled, unless you've done some clever use of multiple identities

As for preventing bruteforce attacks, may be you can refer to the good practices listed via this answer in case you can not use fail2ban.

  • So it is the tool that's asking for the password and not the SSH server? – Neil Smithline Oct 6 '15 at 21:07
  • @NeilSmithline from what I understand, it's SSH server asking - even if the password authentication is disabled you can try to log in using password. However, even the correct password will be rejected in that case – Hipolith Oct 7 '15 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.