1

I'm wanting to use hashbackup to backup one server (A) to another server (B).

Hashbackup can send the backup to server B, if server A has server B's key (public?) for passwordless ssh.

I haven't used keys prior. I prefer ssh'ing with password and 2FA. I guess that I generate the private/public key pair on server A. Then I copy server A's public key to server B.

That may be all that hashbackup needs to do the backup on server B, but it seems (in my mind anyways) that I need to configure server B to accept passwordless ssh.

Is it possible to setup ssh authentication for either/or password/key authentication in server B? If so, how and what would the sshd_config be?

Also, if I issue the "ssh-keygen -t rsa" command on server A, is it correct that if I don't change the existing server A sshd_config, then the prior authentication method (password with 2FA) for server A will remain active?

https://www.hashbackup.com/hashbackup/destinations/rsync.html

1
  • Technically, Yes, as @mti2935 pionts out, but allowing Passwords at all negates much of the security advantages of having keys.
    – tjd
    Apr 14, 2022 at 16:58

2 Answers 2

2

TL;DR

Depending on the specific SSH implementation, you can certainly specify multiple authentication mechanisms, and even control their order of precedence. With OpenSSH, the default is to try SSH keys before trying passwords, but the allowed authentication mechanisms and precedence can be modified in configuration files.

There are different settings related to both the client and the server. You may need to modify and reload/restart both for the any changes that implement your preferred set of options to properly take effect.

OpenSSH Configuration Options

Client Configuration

This is usually stored in ~/.ssh/config on *nix systems, and controls what authentication settings your SSH client will attempt. Some of the relevant settings include:

PreferredAuthentications

Specifies the order in which the client should try authentication methods. This allows a client to prefer one method (e.g. keyboard-interactive) over another method (e.g. password). The default is:

gssapi-with-mic, hostbased, publickey, keyboard-interactive, password

PasswordAuthentication

Specifies whether to use password authentication. The argument to this keyword must be yes (the default) or no.

Others may apply as well. See man 5 ssh_config for a complete list.

Server Configuration

This is generally stored in /etc/ssh/sshd_config, but the actual location may be distribution or OS specific. This file controls what authentication settings the server will allow. Some of the essential configuration items include the following.

AuthenticationMethods

Specifies the authentication methods that must be successfully completed for a user to be granted access. This option must be followed by one or more lists of comma-separated authentication method names, or by the single string any to indicate the default behaviour of accepting any single authentication method. If the default is overridden, then successful authentication requires completion of every method in at least one of these lists.

For example, "publickey,password publickey,keyboard-interactive" would require the user to complete public key authentication, followed by either password or keyboard interactive authentication. Only methods that are next in one or more lists are offered at each stage, so for this example it would not be possible to attempt password or keyboard-interactive authentication before public key.

For keyboard interactive authentication it is also possible to restrict authentication to a specific device by appending a colon followed by the device identifier bsdauth, pam, or skey, depending on the server configuration. For example, "keyboard-interactive:bsdauth" would restrict keyboard interactive authentication to the bsdauth device.

If the publickey method is listed more than once, sshd(8) verifies that keys that have been used successfully are not reused for subsequent authentications. For example, "publickey,publickey" requires successful authentication using two different public keys.

Note that each authentication method listed should also be explicitly enabled in the configuration.

The available authentication methods are: "gssapi-with-mic", "hostbased", "keyboard-interactive", "none" (used for access to password-less accounts when PermitEmptyPasswords is enabled), "password" and "publickey".

PubkeyAuthentication

Specifies whether to try public key authentication. The argument to this keyword must be yes (the default), no, unbound or host-bound. The final two options enable public key authentication while respectively disabling or enabling the OpenSSH host-bound authentication protocol extension required for restricted ssh-agent(1) forwarding.

PasswordAuthentication

Specifies whether password authentication is allowed. The default is yes.

Other settings interact with or apply to these settings as well. See man 5 sshd_config for the complete list.

Restarting Services After Configuration Changes

You will likely need to reload your SSH daemon or restart any muxed client connections in order for changes to configuration files to take effect. How you do this will vary from system to system, so please check your server OS and SSH client documentation for details.

0

Is it possible to setup ssh authentication for either/or password/key authentication in server B? If so, how and what would the sshd_config be?

Yes, you can enable both methods of authentication. In your sshd_config file, set the following:

PubkeyAuthentication yes
PasswordAuthentication yes

Then, restart sshd.

Also, if I issue the "ssh-keygen -t rsa" command on server A, is it correct that if I don't change the existing server A sshd_config, then the prior authentication method (password with 2FA) for server A will remain active?

That's correct. Running ssh-keygen on server A will not change anything with your sshd configuration on server A.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .