Home / server / Questions / 807074
Accepted
Dr NYU
Asked: 2016-10-05 12:04:21 +0800 CST

Enable password login for SFTP while keeping authentication by SSH keys

  • 772

How do I keep a password login enabled for SFTP transactions (made by Drupal, if this is important) while keeping it disabled for all other SSH key based authentications? Currently all the existing users of the CentOS server use keys to log in and /etc/ssh/sshd_config has PasswordAuthentication no)?

authentication ssh sftp drupal7

3 Answers

  1. Best Answer

    From what I gather you want to permit passwords from some users, but not others?
    You could setup a Match block. So your config might look something like below.

    ...
PasswordAuthentication no
...
Match user drupalsftp
    PasswordAuthentication yes

    Since you mentioned these password-based transactions are happening from drupal, perhaps you could whitelist based on the host address? Match address 127.0.0.1/32

    You should even be able to combine the criteria, and say only a specific account from a specific address can do password authentication.

    PasswordAuthentication no
...
Match user drupalsftp address 10.1.2.3/32
    PasswordAuthentication yes
    # also since we want only sftp
    ForceCommand internal-sftp

    Links

    • 14

  2. The SFTP is just a specific case of SSH session. Password login is enabled by default, if you have PasswordAuthentication yes or ChallengeResponseAuthentication yes in your /etc/ssh/sshd_config. Allowing password authentication does not block the key based authentication.

    • 0

  3. Head over to the file /etc/ssh/sshd_config, and change the following line :

    PasswordAuthentication yes

    Then restart sshd :

    sudo service ssh restart

    • 0