CME-804

SSH Key-Only Authentication

Harden Identity Unquantified evidence Preventive

Description

Disable all password-based SSH authentication methods (PasswordAuthentication, KbdInteractiveAuthentication) in sshd, requiring public key authentication exclusively. This eliminates the entire password attack surface for SSH — brute force, credential stuffing, and dictionary attacks become impossible regardless of password strength or lockout policy. Supported key types include Ed25519 (recommended), ECDSA, and RSA (4096-bit minimum). Both PasswordAuthentication and KbdInteractiveAuthentication must be set to 'no' — disabling only PasswordAuthentication leaves keyboard-interactive password prompts active on many configurations. On RHEL 9+, the AuthenticationMethods directive can further restrict to publickey-only. Key management (rotation, passphrase protection, authorized_keys auditing) becomes the primary credential risk surface. Does not protect against pre-authentication SSH daemon vulnerabilities or key compromise via stolen private keys.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	With password authentication enabled, attackers use standard brute-force tools (Hydra, Medusa) against SSH with publicly available credential dumps — attack complexity is Low. With key-only authentication, the attacker must obtain the target's private key through a separate compromise: stealing from a developer workstation, extracting from CI/CD secrets, compromising a jump host with agent forwarding, or insider access. Each path requires a multi-step attack chain with preconditions that raise complexity from trivial credential guessing to targeted key theft

CWE Relationships

CWE-287 CWE-307 CWE-521

Verification

Verify all password-based SSH authentication methods are disabled and only public key authentication is accepted

$ sshd -T | grep passwordauthentication
# Expected: passwordauthentication no

Platform: linux

$ sshd -T | grep kbdinteractiveauthentication
# Expected: kbdinteractiveauthentication no

Platform: linux

$ sshd -T | grep pubkeyauthentication
# Expected: pubkeyauthentication yes

Platform: linux

$ Get-Content $env:ProgramData\ssh\sshd_config | Select-String 'PasswordAuthentication'
# Expected: PasswordAuthentication no

Platform: windows

Remediation

linux sshd key-only authentication via drop-in config


printf 'PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
' > /etc/ssh/sshd_config.d/99-cme-804-key-only.conf
sshd -t
systemctl restart sshd

windows Windows OpenSSH key-only authentication


(Get-Content $env:ProgramData\ssh\sshd_config) -replace '^#?PasswordAuthentication\s+.*', 'PasswordAuthentication no' | Set-Content $env:ProgramData\ssh\sshd_config
if (-not (Select-String -Path $env:ProgramData\ssh\sshd_config -Pattern '^PubkeyAuthentication yes')) { Add-Content $env:ProgramData\ssh\sshd_config 'PubkeyAuthentication yes' }
Restart-Service sshd

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
redhat	enterprise_linux	`cpe:2.3:o:redhat:enterprise_linux:8:::::::` `cpe:2.3:o:redhat:enterprise_linux:9:::::::` `cpe:2.3:o:redhat:enterprise_linux:10:::::::*`	All	applicable