If PasswordAuthentication is disabled, then offer to disable

ChallengeResponseAuthentication too. The current PAM code will attempt
password-style authentication if ChallengeResponseAuthentication is enabled
(closes: #250369).

1 files changed, 16 insertions, 0 deletions

diff --git a/debian/templates.master b/debian/templates.master
index 07f62b178..55727c933 100644
--- a/debian/templates.master
+++ b/debian/templates.master
@@ -123,3 +123,19 @@ _Description: Environment options on keys have been deprecated
  To re-enable this option, set "PermitUserEnvironment yes" in
  /etc/ssh/sshd_config after the upgrade is complete, taking note of the
  warning in the sshd_config(5) manual page.
+
+Template: ssh/disable_cr_auth
+Type: boolean
+Default: true
+_Description: Disable challenge-response authentication?
+ Password authentication appears to be disabled in your current OpenSSH
+ server configuration. In order to prevent users from logging in using
+ passwords (perhaps using only public key authentication instead) with
+ recent versions of OpenSSH, you must disable challenge-response
+ authentication, or else ensure that your PAM configuration does not allow
+ Unix password file authentication.
+ .
+ If you disable challenge-response authentication (the default answer), then
+ users will not be able to log in using passwords. If you leave it enabled,
+ then the 'PasswordAuthentication no' option will have no useful effect
+ unless you also adjust your PAM configuration in /etc/pam.d/ssh.