8

I am building a progressive cyber challenge for my club members (the challenges work), but what I was trying to do to make the progressive part is have each challenge reveal the password for the next account (kind of like the bandit challenge on overthewire.org).

So I am creating 18 accounts on the boxes, each with a different password and the password for user7 is hidden in the home directory of user6 and you have to pass the challenge to get it.

Anyway, everything works locally, but I can't seem to enable password-only ssh for these non-root accounts. There are tons of quides about getting publickey ssh working, but everything seems to treat password ssh like it just works automatically, but it keeps telling me that my password is invalid even though it isn't. Anyone know of a good guide for this?

Ubuntu 18.04

/etc/ssh/sshd_config

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation yes

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no
AJ Henley
  • 93
  • 1
  • 1
  • 4
  • Your configuration is valid but how do you SSH in? Also once you through the first user, how do you access the next? (Please post the command(ssh/bash)). – Prav Jul 07 '18 at 21:53

2 Answers2

9

You need to add 

PasswordAuthentication yes

to your config file in 

/etc/ssh/sshd_config

Once you have that added, you'll need to reload your SSH daemon, using sudo systemctl restart ssh or similar as appropriate for your platform.

Moshe Katz
  • 3,112
  • 5
  • 28
  • 43
frontsidebus
  • 536
  • 2
  • 7
  • 1
    But `man sshd_config` says the default is ''yes''. – kubanczyk Jul 06 '18 at 21:03
  • @kubanczyk That may be true of sshd itself, but this may be overridden by the distro. For instance, Ubuntu 18.04 on Amazon EC2, sets it to "no" by default. (I'm unsure if this is Ubuntu's doing, or a customisation for Amazon EC2.) – Max Barraclough Dec 28 '19 at 17:03
1

You might be missing AuthenticationMethods setting.

Furthermore I'd also recommend to limit those settings to specific user accounts with the Match directive.

This configuration snippet enables password authentication for a specific user foobar while the rest of the config mandates using publickey authentication:

Match User foobar
    PasswordAuthentication yes
    AuthenticationMethods password
Michael Ströder
  • 974
  • 5
  • 9