☰

了解sshd配置中的PasswordAuthentication

tag-icon • tag-icon password authentication sshd
了解sshd配置中的PasswordAuthentication

我有一个仅支持密码身份验证的 OpenSSH 服务器：

[martin@ ~]$ ssh -v 10.10.1.183 -l root
OpenSSH_5.2p1 FreeBSD-20090522, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 10.10.1.183 [10.10.1.183] port 22.
debug1: Connection established.
debug1: identity file /home/martin/.ssh/identity type 0
debug1: identity file /home/martin/.ssh/id_rsa type -1
debug1: identity file /home/martin/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5
debug1: match: OpenSSH_6.7p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2p1 FreeBSD-20090522
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.10.1.183' is known and matches the RSA host key.
debug1: Found key in /home/martin/.ssh/known_hosts:3
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: password
debug1: Next authentication method: password
[email protected]'s password:

换句话说，只有PasswordAuthentication服务器内的sshd_config文件被设置为yes.

根据RFC 4252第 8 节It is up to the server how to interpret the password and validate it against the password database.我是否正确地认为，在 Linux 中这意味着如果在配置中被禁用，则sshd直接检查/etc/passwd和文件？/etc/shadowUsePAMsshd

答案1

快速查看源代码表明 auth-passwd.c 包含 <pwd.h> & auth-shadow.c 包含 <shadow.h>。无需深入研究，sshd 似乎确实使用系统调用来检查密码。还有一些代码允许 sshd 要求并对过期密码进行密码更改。

答案2

我是否正确，在 Linux 中这意味着如果 sshd 配置中的 UsePAM 被禁用，sshd 会直接检查 /etc/passwd 和 /etc/shadow 文件？

是的。但目前大多数发行版都使用 pam 处理登录，因为当今系统中的会话变得越来越复杂。 OpenSSH 可以使用<shadow.h>头文件和其中定义的函数与影子通信。

有关更多信息，请参阅源代码文件auth.c和auth-shadow.c

相关内容