Can't login to a newly installed freeBSD host by ssh (secure shell)

F

freeink

login_from_linux_to_freebsd_host.png


Can't login from a debian terminal (192.168.1.31) to a freeBSD host( 192.168.23 ) , in a same Local Area Network.
sshd_enable="YES" have been set in freeBSD /etc/rc.conf
 
You should definitely type "yes" and then confirm this with enter key press.
This message appears on first ssh login to host, which is not added yet to your "list of known hosts"
(~/.ssh/known_hosts file).
 
Blank_password_freebsd_host_failed.png

sam@192.168.1.31 uncle sam is angry; input empty password ,hit enter key three times,got above result.
mas@192.168.1.23 mas host is anxious (user "mas" password is confirmed tested on freeBSD host, really is blank no mistake )
I did not change anything of ssh config setting. default setting do not allow blank password?
Should I change config file ?
vi /etc/ssh/sshd_config
:set number
:79
line 62 have an option #PermitEmptyPasswords no

62_empty_password.png
 
The default for 'PermitEmptyPasswords' is no; you must set it to 'Yes' if that's what you really want to do (but why?)
 
ILUXA said:
You should definitely type "yes" and then confirm this with enter key press.
This message appears on first ssh login to host, which is not added yet to your "list of known hosts"
(~/.ssh/known_hosts file).
Click to expand...
$ sudo service sshd restart
 
ljboiler said:
The default for 'PermitEmptyPasswords' is no; you must set it to 'Yes' if that's what you really want to do (but why?)
Click to expand...

I've never been sure what constitutes an empty password in FreeBSD...

On a new installation of FreeBSD I always set

PermitRootLogin yes

in /etc/ssh/sshd_config but am not allowed to login initially because no password has been using passwd(). However I am able to enter a blank password by jest pressing ENTER twice and then I can login.

So does that constitute an empty password? I guess not.
 
PermitEmptyPasswords yes, config altered ,sshd restarted , user mas with empty passwords still can't login.
Any user with passwords include root can login.
 
balanga said:
I've never been sure what constitutes an empty password in FreeBSD...

On a new installation of FreeBSD I always set

PermitRootLogin yes

in /etc/ssh/sshd_config but am not allowed to login initially because no password has been using passwd(). However I am able to enter a blank password by jest pressing ENTER twice and then I can login.

So does that constitute an empty password? I guess not.
Click to expand...
balanga said:
I've never been sure what constitutes an empty password in FreeBSD...

On a new installation of FreeBSD I always set

PermitRootLogin yes

in /etc/ssh/sshd_config but am not allowed to login initially because no password has been using passwd(). However I am able to enter a blank password by jest pressing ENTER twice and then I can login.

So does that constitute an empty password? I guess not.
Click to expand...
empty password=auto login after input username ? system even don't bother asking you for a password
 
balanga said:
I've never been sure what constitutes an empty password in FreeBSD...

On a new installation of FreeBSD I always set

PermitRootLogin yes

in /etc/ssh/sshd_config but am not allowed to login initially because no password has been using passwd(). However I am able to enter a blank password by jest pressing ENTER twice and then I can login.

So does that constitute an empty password? I guess not.
Click to expand...

Please don't do that. Instead create a user, add it to wheel group, and configure sshd to allow key-based authentication (set AuthenticationMethods to publickey in sshd_config)

The handbook: https://www.freebsd.org/doc/handbook/openssh.html and the man pages for sshd_config()
 
freeink said:
PermitEmptyPasswords yes, config altered ,sshd restarted , user mas with empty passwords still can't login.
Any user with passwords include root can login.
Click to expand...

Last paragraph of AuthenticationMethods in sshd_config() man page:

The available authentication methods are: "gssapi-with-mic",
"hostbased", "keyboard-interactive", "none" (used for access to
password-less accounts when PermitEmptyPasswords is enabled),
"password" and "publickey".

But as above, please don't do that! Follow a guide like the one Phishfry posted or at least leave it at defaults(any method and no root allowed).
 
What about public key passphrase? Does everyone use passphrase protected keys?
I use them because it feels secure but you are really adding another step by having to send a passphrase.
I understand it is more secure but it it really worth it?
 
In newer versions of OpenSSH, certainly the one in the port, but I'm not sure about the version in the base, the default is PermitRootLogin prohibit-password. This allows you to authenticate directly as root using a key but will refuse a password.

This is a reasonable compromise as long as you still understand the consequences. Although as I said, might need to use the port/pkg version rather than the base.

Code: 
% /usr/local/bin/ssh -V
OpenSSH_8.2p1, OpenSSL 1.1.1e  17 Mar 2020
% /usr/bin/ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.1d-freebsd  10 Sep 2019

Although, now I read the man page. It looks like without-password might work on older versions?

If this option is set to prohibit-password (or its deprecated alias, without-password), password and keyboard-interactive authentication are disabled for root.
 
Phishfry said:
What about public key passphrase? Does everyone use passphrase protected keys?
I use them because it feels secure but you are really adding another step by having to send a passphrase.
I understand it is more secure but it it really worth it?
Click to expand...

Depending on your use case, a PK with a passphrase used with ssh-agent(1) and ssh-add(1) can give you the best of both worlds: encrypted (password phrase) on disk, but passwordless connections (after you’ve entered the password during the add) for your session.
 
xtaz said:
In newer versions of OpenSSH, certainly the one in the port, but I'm not sure about the version in the base, the default is PermitRootLogin prohibit-password. This allows you to authenticate directly as root using a key but will refuse a password.

This is a reasonable compromise as long as you still understand the consequences. Although as I said, might need to use the port/pkg version rather than the base.

Code: 
% /usr/local/bin/ssh -V
OpenSSH_8.2p1, OpenSSL 1.1.1e  17 Mar 2020
% /usr/bin/ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.1d-freebsd  10 Sep 2019

Although, now I read the man page. It looks like without-password might work on older versions?

If this option is set to prohibit-password (or its deprecated alias, without-password), password and keyboard-interactive authentication are disabled for root.
Click to expand...

I would also recommend creating a pair of SSH keys, adding the public key to the target host and setting PermitRootLogin prohibit-password in the sshd config. Many cloud providers default to root as the only user after all. Creating users with empty passwords is, in my experience, useful mostly for local-only purposes.
 
You must log in or register to reply here.
Back
Top