I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
ssh -vvv host, at some point, you will see something like:
debug1: Authentications that can continue: publickey,password debug3: start over, passed a different list publickey,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
The first two lines describe what methods are offered by the server and the last one is what is offered by your client (
PreferredAuthentications option from
ssh_config). From this log (to my Raspberry Pi), you can see that server is able to accept
publickey,password authentication methods. This list might also differ for different users or for different source addresses (
AuthenticationMethods options in
Match block in server
sshd_config), but it does not say that the authentication can succeed (eg. the user have a password or public key, nor whether the
root login is allowed is you try
Most of the servers will give you this "fingerprint". Some of them will give you just
publickey, which says they do not accept passwords. Having server accepting passwords and not accepting pubkey is very rare.
In short, you are able to gain some information as described above, but it is not much useful in most of the cases.