Hi,
I am posting my ideas in reverse order:
if you know a better solution for these attacks please
let me know.
What port is your server listening on? It's usually not a bad idea to chose
some other
than the default 22. Especially the script kiddies often target their attacks
on the
default port.
i want this especially because i see alot of password
brute force attacks on my server. i`ve studied the
script kiddies tools and the most widely used use only
the password authentication schema so this will be a
quick workaround.
Have you thought of using publiy key authentication instead? If that's an
option in your
environment that could help.
how can i configure my openssh to accept only
keyboard-interactive logins?
if i specify PasswordAuthentication no then my ssh
client says No supported authentication methods left
to try!
keyboard-interactive is basically a client-side abstraction layer. What
authentication
mechanism you use is up to you. That could be PAM with all its possibilities or
s/key for
instance.
If you opt for PAM with authentication based on /etc/shadow that does not solve
your
problem with brute force attacks.
As far as keyboard-interactive with OpenSSH is concerned: it is tied to
ChallengeResponseAuthentication. In order to setup you have to:
sshd_config:
ChallengeResponseAuthentication yes
# for the PAM solution, which is very flexible
UsePAM yes
# Protocol must contain 2, since SSHv2 does ChallengeResponseAuthentication
# with keyboard-interactive
Protocol 2
# Deactivate any authentication methods not needed
ssh_config:
ChallengeResponseAuthentication yes
PreferredAuthentications keyboard-interactive
# KbdInteractiveDevices is set inernally to "pam", you can assign skey as well
Protocol 2
# Deactivate any authentication methods not needed
Also check if your OpenSSH package was compiled with the --with-pam flag,
otherwise the
UsePAM yes will have no effect. If you want to use skey directly (without pam)
you have to
set KbdInteractiveDevices as outlined and check the compile time support (has
the package
been compiled with --with-skey?).
HTH.
Best regards
Tobias Lütticke
