Is there a way to know if a server is using ssh public key or password?

Question

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?

Answer 1

Running ssh -vvv host, at some point, you will see something like:

debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password

The first two lines describe what methods are offered by the server and the last one is what is offered by your client (PreferredAuthentications option from ssh_config). From this log (to my Raspberry Pi), you can see that server is able to accept publickey,password authentication methods. This list might also differ for different users or for different source addresses (AuthenticationMethods options in Match block in server sshd_config), but it does not say that the authentication can succeed (eg. the user have a password or public key, nor whether the root login is allowed is you try root login).

Most of the servers will give you this "fingerprint". Some of them will give you just publickey, which says they do not accept passwords. Having server accepting passwords and not accepting pubkey is very rare.

In short, you are able to gain some information as described above, but it is not much useful in most of the cases.