LX0-104 · Question #395
An administrator can prevent dictionary based attacks against an OpenSSH server by forcing keybased authentication with which TWO parameters in sshd_config?
The correct answer is A. PasswordAuthentication D. PubkeyAuthentication. To prevent dictionary attacks against an OpenSSH server, an administrator should disable password-based authentication and enable public key-based authentication in sshd_config.
Question
Options
- APasswordAuthentication
- BHostKey
- CPrivatekeyAuthentication
- DPubkeyAuthentication
- EServerKey
How the community answered
(24 responses)- A75% (18)
- B4% (1)
- C4% (1)
- E17% (4)
Why each option
To prevent dictionary attacks against an OpenSSH server, an administrator should disable password-based authentication and enable public key-based authentication in `sshd_config`.
Setting `PasswordAuthentication no` explicitly disables the use of passwords for authentication, thereby eliminating the attack vector for dictionary or brute-force password attempts.
`HostKey` specifies the path to the server's private host key, which is used to identify the server to clients, not to control user authentication methods.
`PrivatekeyAuthentication` is not a standard `sshd_config` parameter for controlling user authentication; `PubkeyAuthentication` is the correct directive for enabling key-based logins.
Setting `PubkeyAuthentication yes` (which is often the default or desired state) ensures that users must authenticate using SSH keys, which are much more resilient to dictionary attacks due to their complexity and cryptographic nature.
`ServerKey` is not a standard `sshd_config` parameter; `HostKey` is used for server key configuration.
Concept tested: OpenSSH sshd_config key-based authentication enforcement
Source: https://man7.org/linux/man-pages/man5/sshd_config.5.html
Topics
Community Discussion
No community discussion yet for this question.