What the server actually allows

The server settings live in sshd_config, but what the file says is not always what applies. The server itself prints the values it ends up with.

Line	What it decides
`PasswordAuthentication`	password login
`KbdInteractiveAuthentication`	login with questions from the server — usually about a password too
`PubkeyAuthentication`	key login
`PermitRootLogin`	whether root may log in
`AuthenticationMethods publickey`	of all methods only one is left — the key

sudo sshd -t -f file checks the file for errors, sudo sshd -T -f file prints every value the server will use.

Exercise · look

Which value applies

Password login seems to be turned off in the practice server's /opt/ssh-lab/sshd_config. Find the password lines in the file, then ask sshd itself which values it applies.

First, predict

The file has two lines: PasswordAuthentication yes higher up and PasswordAuthentication no further down. Which value applies?

Now start the exercise, run the command and compare your prediction with the output.

If a line is repeated, sshd takes the first one. So you edit the line that is already there: a new line at the end of the file changes nothing.

The server reads its settings file when it starts — unlike authorized_keys, which it reads at every login. The order for a change: edit the file, check it with sshd -t, restart the server and log in with a fresh connection.

bash

sudo vim /opt/ssh-lab/sshd_config

bash

sudo sshd -t -f /opt/ssh-lab/sshd_config
sudo systemctl restart lab-sshd
sudo sshd -T -f /opt/ssh-lab/sshd_config | grep passwordauth
ssh training id -un

A fresh login is needed after the change too: a session that is already open passed its check earlier and says nothing about the new settings.

Check yourself 1 question

You turned passwords off in sshd_config and restarted the server. An earlier session as deploy still works. What does that prove?

sudo sshd -t -f file looks for errors in the file. An open session does not read it.
sudo sshd -T -f file prints the value in force: the passwordauthentication line.
That session passed its check before the change. A fresh login shows how the server lets people in now: ssh training id -un.

An open session passed the login checks earlier, and the change does not touch it. Three commands confirm the change: sshd -t, sshd -T and a fresh login.

SSH — trusting the server and logging in with a key

Which value applies

Signing in is needed to start the machine