Authentication

SSH authenticates by password or public key, and both are attack surfaces: default and weak passwords yield to brute force and spraying, exposed or reused private keys authenticate with no password, and keys from broken generators are predictable. The authentication method the server offers per user also shapes which attack applies.

1 min di letturaaggiornato il 7 ott 2026

1 contributore

OpenSSH can authenticate clients through public keys or certificates, passwords, keyboard-interactive mechanisms, host-based authentication, GSSAPI, and hardware-backed security keys. AuthenticationMethods can also require a sequence such as public key followed by keyboard-interactive. The effective methods may vary with Match rules, username, source address, groups, and other connection attributes. Review the complete authentication chain before assessing password guessing, exposed private keys, weak key generation, certificate trust, or multifactor controls.

bash

# non-interactive diagnostic; inspect the server-reported continuation methods
ssh -vvv -o BatchMode=yes -o PreferredAuthentications=password \
  -o PubkeyAuthentication=no user@<target> true 2>&1 \
  | sed -n 's/^debug1: Authentications that can continue: //p'

Subtopics#

Default credentials: vendor and factory SSH logins.
Password brute force: online password attacks and spraying.
Public key exposure: finding and reusing private keys.
Weak key generation: predictable keys from broken generators.

Authentication

Subtopics#

References#