Enforce Key‑Only SSH Access on OpenSSH Server
Guide to configure OpenSSH to accept only public‑key authentication for a non‑root account, disabling password and root login, with verification and rollback steps.
Loading…
ReadMeFeed / Community knowledge
#openssh
Real questions. Useful conversations. Find the people who know your stack.
sshDiagnosing SSH Public‑Key Authentication Failures on OpenSSH Servers
A step‑by‑step diagnostic guide for SSH public‑key authentication failures, covering permissions, sshd_config, SELinux/AppArmor, agent loading, and key type issues with rollback notes.
SSH authorized_keys command restriction and shell escape prevention
The command="..." option in the authorized_keys file allows a server administrator to restrict a public key to a single predefined binary. This is intended to limit the scope of access for automated scripts or third-party integrations. While this configuration forces the execution of a specific command, the security boundary depends on the behavior of the bi
SSH Public Key Authentication: Transitioning from ssh-rsa to SHA-2 signatures in OpenSSH 8.8+
Signature Algorithm Deprecation OpenSSH 8.8 and later versions have disabled the ssh-rsa signature algorithm by default. This change targets the use of SHA-1 for signatures during the authentication handshake, though the underlying RSA key pair remains valid if a more secure signature scheme is employed. Compatibility Constraints Systems maintaining legacy c
Switching TortoiseGit from TortoiseGitPlink to Git's ssh.exe: what key and host-key configuration must move with it
Goal Our team standardizes developer machines on TortoiseGit over Windows. Repositories authenticate to our Git server over SSH, and the setup works on every interactive desktop where Pageant holds a PuTTY-format .ppk key. The same repositories fail authentication when cloned from a Windows service account on a build machine, and we are considering changing
putty
tortoisegitStrictModes constraints on authorized_keys file permissions
OpenSSH utilizes the StrictModes configuration to ensure that authentication keys are stored in a secure environment. When enabled, the SSH daemon validates that the authorized_keys file and its parent directory are not writable by group or others. A design uncertainty arises when balancing security requirements with automated deployment tools that may inadv
PermitRootLogin default prohibit-password in OpenSSH 7.0 breaks legacy root SSH automation
OpenSSH 7.0 changed the default for PermitRootLogin from yes to prohibit-password, allowing root login only via key-based authentication when the directive is not explicitly set. A small application with legacy automation that relies on root SSH access is being considered for migration to a host running OpenSSH 7.0 or later. The change creates a compatibilit
SSH ControlMaster: Retrying slave channels during master connection timeouts
Multiplexing and Connection Persistence OpenSSH utilizes ControlMaster and ControlPersist to allow multiple sessions to share a single TCP connection, bypassing repeated authentication handshakes for subsequent slave channels. Data Integrity During Reconnection A technical uncertainty exists when a master connection experiences a network timeout while a slav