Disable Password Auth

[kenneth_vkd]

Hi
We are looking into hardening our PVE setup. Currently access to the web UI is fairly locked down with restrictive inbound firewall rules and 2FA for all users, including root@pam.
We do however plan to update the SSH server configuration to disable password-based authentication entirely, so that you can only access SSH using key-based authentication. This way it becomes more difficult for a potential attacker to access servers if they were to infiltrate a "trusted" network and somehow gain the password for th root user.
Currently running 5 nodes on PVE 7.3, and expanding regularly as needed.

Are there any special considerations for doing this on existing nodes and will there be a change in the process of joingin a new node to the cluster?

 

[sterzy]

Hi,

from the top of my head, removing password-based authentication from SSH should be fine for an existing cluster. Upon join the nodes should install the SSH keys on all other respective nodes. However, if you carry out a join through the GUI the root password will be used to do that out. I haven't tested it, but if you manually enter the new node's key beforehand on the other nodes, the join may still succeed. I'll see if I can get around to testing this soon, if you want.

 

[sterzy]

As a colleague pointed out to me, you don't even need to exchange the ssh keys manually. We do that via the API these days. So yes, you can just disable password authentication. That should work just fine.

 

[nMax]

So in other words, setting

PasswordAuthentication no

in sshd config is a good idea, and nothing breaks with it?

Regarding sshd options:
I read on the internet that disabling root login is a bad idea, is that still the case? Are there other options in the sshd config that should not be changed/set?

 

[LnxBil]

If you don't have other local user accounts, why don't you just use the normally nowadays default of

PermitRootLogin prohibit-password

So that root cannot login via password, just via key/certificate.

in sshd config is a good idea, and nothing breaks with it?

In recent Debian version, I'd just go with a file like /etc/ssh/sshd_config.d/disable_password_authentication.conf instead of changing the stock configuration file. This is perfect for scripting and also packaging of the file, yet YMMV.

 

[nMax]

Is there any benefit in using "prohibit-password" over "PasswordAuthentication no"?

Separate file in sshd_config.d/ is a smart idea, I'll do that!