I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
1 Answer
Running ssh -vvv host
, at some point, you will see something like:
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
The first two lines describe what methods are offered by the server and the last one is what is offered by your client (PreferredAuthentications
option from ssh_config
). From this log (to my Raspberry Pi), you can see that server is able to accept publickey,password
authentication methods. This list might also differ for different users or for different source addresses (AuthenticationMethods
options in Match
block in server sshd_config
), but it does not say that the authentication can succeed (eg. the user have a password or public key, nor whether the root
login is allowed is you try root
login).
Most of the servers will give you this "fingerprint". Some of them will give you just publickey
, which says they do not accept passwords. Having server accepting passwords and not accepting pubkey is very rare.
In short, you are able to gain some information as described above, but it is not much useful in most of the cases.
-
Thank Jakuje! I was wondering whether only having password can be count as a insecurity for a sever?– UserYmYJun 17, 2016 at 8:09
-
1It depends on which password. But generally yes. If you don't have any detection of brute-force attacks.– JakujeJun 17, 2016 at 8:17
-
Thanks @Jakuje. Do you have an idea how can I run it via a python script? I tried subprocesses but it always requires password whereas with shell it does not– UserYmYJun 22, 2016 at 6:52
ssh user@localhost -vv