Change sshd_config option via cli

    • Official Post

    Ok, so that explains what the error is. But, hey. If I see a slider button that says "Disable SSH Password" that means to me "Disable password on SSH" meaning I can SSH into the box without a password.

    Nowhere does it say I have to provide a public key, nor how to do it.

    Maybe it should be renamed to "Disable SSH" to eliminate confusion.

    • Official Post

    The on-screen context help clearly states "Set to ON if you have copied private SSH keys to your HTPC and would like to improve security by disabling SSH username and password authentication" so I think we have the bases covered. It would be inappropriate to change the label text as you suggest because disabling password-auth does not disable the SSH service (that's the line immediately above).

    Quote from Tim_Taylor


    You have to edit /etc/ssh/sshd_config:

    Code
    PasswordAuthentication no

    That does not work since its mounted ro and remount rw does not work either due to squashfs, thats why i was asking here.
    [hr]

    Quote from lrusak

    That won't work. Please don't suggest things unless you have actually tried it.

    Code
    echo 'SSHD_DISABLE_PW_AUTH="true"' > /storage/.cache/services/sshd.conf
systemctl restart sshd

    Thanks but it seems it has no effect here.
    [code=php]
    # cat sshd.conf
    SSHD_DISABLE_PW_AUTH="true"

    # systemctl restart sshd
    Connection to 192.168.1.201 closed by remote host.
    Connection to 192.168.1.201 closed.
    battlecat:~ root# ssh [email protected]
    [email protected]'s password:


    [/php]
    I can still login with the default password without mypubkey. I'll try rebooting later when the rpi is not in use and will report back.

    Edited once, last by Hagamuga (February 21, 2017 at 8:47 PM).

    I have similar issue, if OP thinks I need to create a new thread, I will :)

    I'm using OE version 8.0.1.
    The following have been done:
    1) Followed this instruction to create public key: Config connect ssh wo password - OpenELEC
    The following is the permission of the files:

    Code
    -rw-------    1 root     root          1675 May 21 03:21 id_rsa
-rw-r--r--    1 root     root           391 May 21 03:21 id_rsa.pub
-rw-r--r--    1 root     root           166 Mar 31 23:12 known_hosts

    2) Transferred the public key and add the public key to the remote device "~/.ssh/authorized_keys" file
    The following is the permission of the file:

    Code
    -rw-r--r--   1 televisi  staff   392 21 May 03:22 authorized_key

    3) Went to OE GUI and TICK the "Disable SSH password" option
    4) Run the following command:

    Code
    echo 'SSHD_DISABLE_PW_AUTH="true"' > /storage/.cache/services/sshd.conf
systemctl restart sshd

    The following is the content of my /storage/.cache/services/sshd.conf:

    Code
    SSHD_DISABLE_PW_AUTH="true"
SSH_ARGS="-o 'PasswordAuthentication no'"

    Error received: Permission denied (publickey,keyboard-interactive).

    Does it mean my remote machine (OSX) does not recognise the public key?

    PS: If I UNTICK the "Disable SSH password" option; I can relogin SSH, but requires password .

    Edited once, last by televisi (May 20, 2017 at 7:00 PM).

    Quote from chewitt

    It means you are attempting to authenticate with a password, which is not a valid authentication method. If you allowed passwords the methods available would be "publickey,password,keyboard-interactive".

    Err... does it mean the suggestion to add the following lines are incorrect, then?

    Code
    SSHD_DISABLE_PW_AUTH="true"
SSH_ARGS="-o 'PasswordAuthentication no'"

    Okay, I found the resolution and managed to find the problem.

    The instruction on Config connect ssh wo password - OpenELEC is to copy the public key of OE to the authorized_keys file on remote machine (in my case Mac); it should be the other way around, the public key of the one who connecting from is the one to be stored on OE authorized_keys file.

    The following works for me:
    On MAC (not on OE server):
    1) Generate RSA key

    2) Get the contents of the public key (~/.ssh/id_rsa.pub)

    Code
    Mac:televisi$ vi ~/.ssh/id_rsa.pub
ssh-rsa:blablablapublic_keyForMac [email protected]

    On OE:
    3) SSH to OE
    4) Copy the contents of public key retrieved before (from OSX, step 2) to OE ~/.ssh/authorized_keys file

    Code
    echo 'ssh-rsa:blablablapublic_keyForMac [email protected]' >> ~/.ssh/authorized_keys

    5) Make sure the ~/.ssh/authorized_keys has the following permission

    Code
    -rw-------    1 root     root           395 May 22 04:24 authorized_keys


    if not, just run "chmod 600 authorized_keys"

    On OE GUI:
    6) Go to OE GUI > Settings > OpenElec > Services > SSH
    7) Disable SSH Password = TICK

    On OSX:
    8) use ssh root@OE without password now :)

    Edited once, last by televisi (May 21, 2017 at 7:51 PM).