Hi, I am posting my ideas in reverse order:
> if you know a better solution for these attacks please > let me know. What port is your server listening on? It's usually not a bad idea to chose some other than the default 22. Especially the script kiddies often target their attacks on the default port. > i want this especially because i see alot of password > brute force attacks on my server. i`ve studied the > script kiddies tools and the most widely used use only > the password authentication schema so this will be a > quick workaround. Have you thought of using publiy key authentication instead? If that's an option in your environment that could help. > how can i configure my openssh to accept only > keyboard-interactive logins? > if i specify PasswordAuthentication no then my ssh > client says No supported authentication methods left > to try! keyboard-interactive is basically a client-side abstraction layer. What authentication mechanism you use is up to you. That could be PAM with all its possibilities or s/key for instance. If you opt for PAM with authentication based on /etc/shadow that does not solve your problem with brute force attacks. As far as keyboard-interactive with OpenSSH is concerned: it is tied to ChallengeResponseAuthentication. In order to setup you have to: sshd_config: ChallengeResponseAuthentication yes # for the PAM solution, which is very flexible UsePAM yes # Protocol must contain 2, since SSHv2 does ChallengeResponseAuthentication # with keyboard-interactive Protocol 2 # Deactivate any authentication methods not needed ssh_config: ChallengeResponseAuthentication yes PreferredAuthentications keyboard-interactive # KbdInteractiveDevices is set inernally to "pam", you can assign skey as well Protocol 2 # Deactivate any authentication methods not needed Also check if your OpenSSH package was compiled with the --with-pam flag, otherwise the UsePAM yes will have no effect. If you want to use skey directly (without pam) you have to set KbdInteractiveDevices as outlined and check the compile time support (has the package been compiled with --with-skey?). HTH. Best regards Tobias Lütticke
