Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-11.txt

[Martin Bjorklund <[e-mail]>]

Juergen Schoenwaelder <[e-mail]> wrote:
> On Thu, Feb 06, 2014 at 12:59:14PM +0100, Martin Bjorklund wrote:
> > Juergen Schoenwaelder <[e-mail]> wrote:
> > > On Wed, Feb 05, 2014 at 07:05:30PM +0000, Yi Yang (yiya) wrote:
> > > > I have a quick question on authentication method.
> > > > 
> > > > If the system supports SSH public key authentication only, but not local
> > > > user password, how user-authentication-order should be set?
> > >  
> > > I think this is fair question to ask. Martin and Andy, are we missing
> > > an identity for this case?
> > 
> > The local-users feature handles SSH keys as well, see 3.5.1.  As
> > explained in 3.5.1, ssh public key authentication is requested by the
> > client, so the authentication-order on the server doesn't really
> > apply.
> > 
> 
> Martin,
> 
> we are talking about the case where you disable password and
> key-interactive authentication on the server side. This is actually
> how I run the machines I am reponsible for (so I can sleep well
> despite all the SSH login scanners out there).

Ok, but it doesn't make much sense to control this with
user-authentication-order.  The reason for this is that it is unclear
what this means:

  user-authentication-order: radius, ssh-key

First radius, then ssh-key?  It doesn't make much sense.

Actually, this can be achieved today if you set
user-authentication-order to the empty list.


/martin