Question 29

Explanation

Answer:

1. Edit the SSH Server Configuration File

   • Command: # vim /etc/ssh/sshd_config

   • Explanation: The sshd_config file controls SSH server settings. Opening it in vim allows you to make persistent configuration changes that will impact all SSH connections to ServerB. Disabling password-less connections helps secure the server against unauthorized access.

2. Update Configuration Settings

   • In vim, uncomment and adjust the following lines:

     PermitEmptyPasswords no
     PubkeyAuthentication no

   • Explanation of Each Setting:

     • PermitEmptyPasswords no: This setting ensures that no user can log in without a password, which prevents accounts with empty passwords from accessing the server.

     • PubkeyAuthentication no: Disabling public key authentication (no) restricts users from logging in without a password, even if they have a valid SSH key. This is useful if you need all users to authenticate with a password.

   • Important Note:

     • PubkeyAuthentication no disables all SSH key-based logins. If the goal is only to require passwords for some users, adjust this setting cautiously based on security needs.

3. Save and Quit vim

   • Command: Press Esc, then type :wq and press Enter.

   • Explanation: This saves the changes to sshd_config and exits vim. Make sure the settings are correct before saving, as mistakes in sshd_config could lead to login issues.

4. Restart the SSH Service to Apply Changes

   • Command: # systemctl restart sshd

   • Explanation: Restarting the SSH daemon (sshd) is essential for applying changes to the configuration file. Without restarting, the updated settings won’t take effect.

Additional Notes and Tips:

• Verification:

  • To confirm that password-less login is disabled, attempt to log in from another terminal or device without specifying a password. If the configuration is correct, SSH will deny access without a password.

  • You can also check active SSH configuration by running:

    # sshd -T | grep -E "permitemptypasswords|pubkeyauthentication"

    This command outputs the effective values of the relevant settings, allowing you to verify changes without testing logins.

• Security Implications:
  Disabling password-less logins helps protect against unauthorized access and brute force attacks. It’s an important step in hardening SSH, especially in multi-user environments or public-facing servers.

• Troubleshooting Tips:

  • Access Issues: If you’re unable to log in after making changes, verify that sshd is running with # systemctl status sshd and confirm settings in sshd_config.

  • Restoring Defaults: If troubleshooting is needed, revert changes in sshd_config to allow SSH key-based login temporarily or to allow users with existing keys to access the system.