OpenSSH can authenticate clients through public keys or certificates, passwords, keyboard-interactive mechanisms, host-based authentication, GSSAPI, and hardware-backed security keys. AuthenticationMethods can also require a sequence such as public key followed by keyboard-interactive. The effective methods may vary with Match rules, username, source address, groups, and other connection attributes. Review the complete authentication chain before assessing password guessing, exposed private keys, weak key generation, certificate trust, or multifactor controls.
# non-interactive diagnostic; inspect the server-reported continuation methods
ssh -vvv -o BatchMode=yes -o PreferredAuthentications=password \
-o PubkeyAuthentication=no user@<target> true 2>&1 \
| sed -n 's/^debug1: Authentications that can continue: //p'
Subtopics#
- Default credentials: vendor and factory SSH logins.
- Password brute force: online password attacks and spraying.
- Public key exposure: finding and reusing private keys.
- Weak key generation: predictable keys from broken generators.