SSH password login
critical on-server
What it inspects
The effective SSH daemon configuration from `sshd -T`, plus a grep of /etc/ssh/sshd_config and /etc/ssh/sshd_config.d/ for PasswordAuthentication and Match lines. The check fails when PasswordAuthentication is `yes`, and warns when it is `no` globally but a Match block turns it back on. Severity is reduced when SSH is not reachable from the public internet.
Why it matters
Password logins let anyone on the internet try credentials against your server, and automated scanners do so constantly. SSH keys cannot be guessed that way. sshd keeps the first value it reads for a keyword, and cloud images often ship a drop-in such as 50-cloud-init.conf that sets PasswordAuthentication yes, so a later `no` in the main file is silently ignored.
How to verify
sudo sshd -T | grep -iE '^(passwordauthentication|kbdinteractiveauthentication)'
sudo grep -rniE '^[[:space:]]*(Match[[:space:]]|PasswordAuthentication)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/How to fix
Write a 00- drop-in with PasswordAuthentication no so it wins over cloud-init's 50- file, validate, reload, then check for Match blocks that re-enable passwords.
Turn off password logins with a drop-in and reload sshd
Debian / Ubuntu
# First confirm a key-based login for a sudo-capable non-root user works in a SECOND session.
if grep -q '^Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
install -m 0644 /dev/stdin /etc/ssh/sshd_config.d/00-umbermark-ssh_password_authentication.conf <<'EOF'
PasswordAuthentication no
EOF
sshd -t && systemctl reload ssh
if ! sshd -t >/dev/null 2>&1; then rm -f /etc/ssh/sshd_config.d/00-umbermark-ssh_password_authentication.conf; echo 'sshd -t failed: drop-in removed, nothing changed'; fi
else
echo 'sshd_config has no Include for sshd_config.d (older distro). Put these directives at the TOP of /etc/ssh/sshd_config instead, then run: sshd -t'
fi
RHEL / Rocky / Alma / Fedora
# First confirm a key-based login for a sudo-capable non-root user works in a SECOND session.
if grep -q '^Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
install -m 0644 /dev/stdin /etc/ssh/sshd_config.d/00-umbermark-ssh_password_authentication.conf <<'EOF'
PasswordAuthentication no
EOF
sshd -t && systemctl reload sshd
if ! sshd -t >/dev/null 2>&1; then rm -f /etc/ssh/sshd_config.d/00-umbermark-ssh_password_authentication.conf; echo 'sshd -t failed: drop-in removed, nothing changed'; fi
else
echo 'sshd_config has no Include for sshd_config.d (older distro). Put these directives at the TOP of /etc/ssh/sshd_config instead, then run: sshd -t'
fi
- Review Match blocks that re-enable passwords
1 more step in the Fix Pack. See pricing