According to this, a user should no longer be able to log in with password if a ssh key has been imported for the user.
https://help.mikrotik.com/docs/display/ROS/User
I’m running 6.49.2 MIPSBE and I am able to log in to a user account with both password and ssh key.
Is the documentation incorrect or is this a bug? I did a quick search of the forum but didn’t see anything.
Personally, I would prefer to have control over whether or not a password was allowed even when a key has been specified.
Under /ip/ssh there’s setting always-allow-password-login … default setting is no and in this case, if user has some foreign public keys installed, it won’t be possible to log-in using password. If it’s set to yes, then it will be possible to log in either by using SSH key or password.
For some reason, /ip/ssh/set always-allow-password-login=no is not mentioned in the new (confluence-based) documentation, although this setting has not been removed at least until ROS 7.1.3. Also, no, which means that password authentication is disabled for any user whose key has been installed, is the default setting, so if you find this to be set to yes, it is likely that you have changed it in the past. If it is set to no and you can nevertheless log in when a key is installed, it is a bug.
In 7.2rc4 this setting is still available. And default setting is still no. I had to set it to yes to get behaviour I desire. (I’m not going to discuss merrits of either setting though).
Poked a little more. v6.49.2
The default is the following and system was at default when I started the process:
forwarding-enabled: no
always-allow-password-login: no
strong-crypto: no
allow-none-crypto: no
host-key-size: 2048
I was able to log in to an account with a key provisioned using the account password. I changed always-allow-password-login to yes, verified that I could still log in with the account password and the key.
I then changed always-allow-password-login back to no and I was unable to log into the account using the account password with a key provisioned, only the key would work.
I did the same procedure on another unit with 6.48.6 with default SSH settings and it denied login with password after I imported the key as expected. However, it also denied the user login via the web interface.
After that test, I removed the key from the user and was able to log in as the user with NO password on both the web interface and via ssh.
The login without password was persistent through reboot. Changing the user’s password restored password requirement. Unfortunately, I have not been able to repeat this behavior.
I don’t see anything of interest in the system log.
I have been unable to duplicate the issues I experienced thus far. I will report back if I experience the issue again.