Note:<\/strong> \nNote on the Allow SSH Root Login<\/strong> setting: sshd_config PermitRootLogin<\/code> typically has four permissible values: yes, prohibit-password, forced-commands-only, or no. JumpCloud will only support yes or no values, and it is our policy to convert any non-yes value to no. If you want to enforce one of the other permissible values, it’s recommended to use the conditional Match block<\/a> to override the enforced value. See the man page<\/a> for your particular distribution to confirm permissible values and the default setting.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n- SSH Password Login<\/a><\/li>\n\n\n\n
- Public Key Authentication<\/a><\/li>\n\n\n\n
- SSH Password Login + Public Key Authentication<\/a><\/li>\n\n\n\n
- SSH Password Login + MFA<\/a><\/li>\n\n\n\n
- Public Key Authentication + MFA<\/a><\/li>\n<\/ul>\n\n\n\n
SSH Password Login<\/h2>\n\n\n\nExpected Behavior:<\/strong> Users will authenticate with password only.<\/p>\n\n\n\n
To enable SSH Password Login<\/strong>:<\/p>\n\n\n\n
\n- Go to DEVICE MANAGEMENT > Devices<\/strong>.<\/li>\n\n\n\n
- Select a device. <\/li>\n\n\n\n
- Under the device Details<\/strong> tab, scroll to SSH Settings<\/strong>.<\/li>\n\n\n\n
- Select the Allow SSH Password Login<\/strong> option.<\/li>\n\n\n\n
- Save Device<\/strong>.<\/li>\n<\/ol>\n\n\n\n
\/etc\/ssh\/sshd_config<\/strong>:<\/p>\n\n\n\n
\nChallengeResponseAuthentication no<\/code>
UsePAM yes<\/code>
PubkeyAuthentication no<\/code>
PermitRootLogin no<\/code>
PasswordAuthentication yes<\/code>
AuthorizedKeysFile .ssh\/authorized_keys<\/code><\/p>\n<\/div><\/div>\n\n\n\n
Public Key Authentication<\/h2>\n\n\n\nExpected Behavior:<\/strong> Users will authenticate with public key only.<\/p>\n\n\n\n
To enable Public Key authentication<\/strong>:<\/p>\n\n\n\n
\n- Go to DEVICE MANAGEMENT > Devices<\/strong>.<\/li>\n\n\n\n
- Select a device. <\/li>\n\n\n\n
- Under the device Details<\/strong> tab, scroll to SSH Settings<\/strong>.<\/li>\n\n\n\n
- Select the Enable Public Key Authentication<\/strong> option.<\/li>\n\n\n\n
- Save Device<\/strong>.<\/strong><\/li>\n<\/ol>\n\n\n\n
\/etc\/ssh\/sshd_config<\/strong>:<\/p>\n\n\n\n
\n\u200b\u200bChallengeResponseAuthentication no<\/code>
UsePAM yes<\/code>
AuthorizedKeysFile .ssh\/authorized_keys<\/code>
PubkeyAuthentication yes<\/code>
PermitRootLogin no<\/code>
PasswordAuthentication no\u200b<\/code><\/p>\n<\/div><\/div>\n\n\n\n
SSH Password Login + Public Key Authentication<\/h2>\n\n\n\nExpected Behavior: <\/strong>When Public Key Authentication<\/strong> is selected in conjunction with Allow SSH Password Login<\/strong>, users will be able to authenticate using either of the selected options.<\/p>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>
Note:<\/strong> Allow SSH Password Login and Enable Public Key Authentication cannot both be enabled if MFA is also enforced.<\/p><\/div><\/div><\/div>\n\n\n\n
\/etc\/ssh\/sshd_config<\/strong>:<\/p>\n\n\n\n
\n\u200b\u200bChallengeResponseAuthentication no<\/code>
UsePAM yes<\/code>
AuthorizedKeysFile .ssh\/authorized_keys<\/code>
PubkeyAuthentication yes<\/code>
PermitRootLogin no<\/code>
PasswordAuthentication yes\u200b<\/code><\/p>\n<\/div><\/div>\n\n\n\n
SSH Password Login + MFA<\/h2>\n\n\n\nExpected Behavior:<\/strong> Users will authenticate with password and TOTP token (when the TOTP Key is activated). See Enabling TOTP MFA for Linux<\/a>.<\/p>\n\n\n\n
\/etc\/ssh\/sshd_config<\/strong>:<\/p>\n\n\n\n
\nChallengeResponseAuthentication yes<\/code>
UsePAM yesPubkeyAuthentication no<\/code>
PermitRootLogin no<\/code>
PasswordAuthentication yes<\/code>
AuthorizedKeysFile .ssh\/authorized_keys<\/code><\/p>\n<\/div><\/div>\n\n\n\n
Public Key Authentication + MFA<\/h2>\n\n\n\nExpected Behavior:<\/strong> Users will authenticate with public key and TOTP token (when the TOTP Key is activated). See Enabling TOTP MFA for Linux<\/a>.<\/p>\n\n\n\n
\/etc\/ssh\/sshd_config<\/strong>:<\/p>\n\n\n\n
\n\u200b\u200bChallengeResponseAuthentication yes<\/code>
UsePAM yes<\/code>
AuthorizedKeysFile .ssh\/authorized_keys<\/code>
PubkeyAuthentication yes<\/code>
PermitRootLogin no<\/code>
PasswordAuthentication no<\/code>
AuthenticationMethods publickey,keyboard-interactive<\/code><\/p>\n<\/div><\/div>\n\n\n\n
Using the Match Block in sshd_config<\/h2>\n\n\n\nMatch is an optional, conditional block in the sshd_config, and may be used to satisfy use cases that the agent does not. The agent will not overwrite a Match block. For detailed information, see the man page for your particular distro. Append a Match block to the end of the file. <\/p>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>
Important:<\/strong> \nBe sure to restart sshd after making any config changes so that they take effect.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
In this example, require all users to use both a password AND a public key:<\/p>\n\n\n\n
\nBeginGlobalExceptions
Match All
PasswordAuthentication yes
PubkeyAuthentication yes
AuthenticationMethods password,publickey
GlobalExceptionsEnd<\/p>\n<\/div><\/div>\n\n\n\n
Automate change distribution to many devices<\/h3>\n\n\n\n
In order to apply this to many devices at once, the Commands function can be leveraged in the JumpCloud Admin Portal.<\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
\n- Before running this across many systems, test the process on a small number of systems to manually verify desired behavior has been achieved.<\/li>\n\n\n\n
- This will not work with very old versions of sshd. In testing, we found the parameters needed for the exception were not honored with OpenSSH 5.x.<\/li>\n\n\n\n
- The script expects your sshd service to be called sshd. If it is not, modify lines 27 and 29 with the appropriate name of the service.<\/li>\n\n\n\n
- Appending the Match block to the end of the config is one way, and does not check to see if there are conflicting Match blocks. This method should work for most implementations, but testing before mass deployment is recommended.<\/li>\n\n\n\n
- The Match block in this script contains the above conditions. If there are other conditions required for your environment, change them as needed.<\/li>\n<\/ul>\n\n\n\n
To apply to multiple devices in Commands<\/strong>:<\/p>\n\n\n\n
\n- Copy the contents of the script<\/a> to a local file.<\/li>\n\n\n\n
- In the JumpCloud Admin Portal, create a new command. See Get Started: Commands<\/a>.<\/li>\n\n\n\n
- Upload the file created in step 1.<\/li>\n\n\n\n
- Enter the path to the file in the command for execution. This is \/tmp\/FILENAME<\/strong> by default<\/li>\n\n\n\n
- Select the desired device or device groups to apply the command to and save<\/strong>.<\/li>\n\n\n\n
- When ready, select the new command and select run now<\/strong>.<\/li>\n\n\n\n
- This command should return exit 0<\/strong>. Depending on the Linux flavor, there may also be some stdout in the logs section.<\/li>\n<\/ol>\n\n\n\n
Configuring SSH Settings at Scale<\/h2>\n\n\n\nIn order to make changes to existing systems’ ssh settings at scale, below are examples of two tools that allow for finding any system based on filter parameters, and then setting the desired parameters. In both examples, we’re filtering on the following settings:<\/p>\n\n\n\n
\n- allowSshPasswordAuthentication<\/li>\n\n\n\n
- allowPublicKeyAuthentication<\/li>\n\n\n\n
- allowMultiFactorAuthentication<\/li>\n<\/ul>\n\n\n\n
Depending on the current settings of the system, one or more parameters may need to be set to false. In both examples, any system found will be set to only require public key authentication unless the parameter values are changed. <\/p>\n\n\n\n
Using the PowerShell Module<\/h3>\n\n\n\n
See the Support Wiki<\/a> for PowerShell Module basics.<\/p>\n\n\n\n
\nGet-JCSystem -allowSshPasswordAuthentication $true -allowMultiFactorAuthentication $true -allowPublicKeyAuthentication $true | Set-JCSystem -allowSshPasswordAuthentication $false -allowMultiFactorAuthentication $false -allowPublicKeyAuthentication $true<\/p>\n<\/div><\/div>\n\n\n\n
To change the filter parameters, set one or more boolean values to false on the Get-JCSystem<\/strong> side of the operation. To change the settings being applied, set one or more of the boolean values on the Set-JCSystem<\/strong> side of the operation. Results are printed to screen.<\/p>\n\n\n\n
Using Bash<\/h3>\n\n\n\n