Enable Public Key Authentication
Ensures SSH accepts key-based logins by setting PubkeyAuthentication yes in sshd.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Public-key authentication is the foundation of strong, phishing-resistant SSH access and a prerequisite for hardware-token or multi-factor setups (smart cards, FIDO/U2F security keys backed by certificates). Keeping PubkeyAuthentication yes lets you move away from reusable passwords toward cryptographic credentials that cannot be brute-forced or replayed. Disabling it would force a fallback to weaker password authentication, greatly increasing the ease of unauthorized access to privileged functions.
What Pavois checks
Pavois reads the effective pubkeyauthentication value from sshd -T, the daemon's resolved configuration. A file scan of /etc/ssh/sshd_config could miss the value if it is set in an Included drop-in or a Match block, sshd -T shows exactly what the running daemon enforces.
describe command('sshd -T') do
its('stdout') { should match(/^pubkeyauthentication\s+yes$/i) }
endHow to verify it is applied
Run sudo sshd -T | grep -i pubkeyauthentication. The expected output is pubkeyauthentication yes.
Inspect & investigate
Successful and failed key authentications are logged by sshd in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family); follow with journalctl -u ssh -f (or -u sshd). Look for Accepted publickey for ... and the offered key fingerprint.
Remediation
pavois harden apply sets the sshd_setting directive pubkeyauthentication to yes in a managed drop-in, validates it with sshd -t -f %{path}, then notifies a reload of the ssh service so key-based logins are accepted without dropping live sessions.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | pubkeyauthentication |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | yes |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If key authentication is disabled, the system falls back to passwords, weakening access security and breaking any automation or admin that relies on keys. Enabling it is safe and additive, it does not disable other methods. Precaution: before you later disable password authentication (a complementary hardening step), make sure at least one working authorized key is in place for an account with access, and keep a console or second session open, otherwise you risk locking yourself out. The reload preserves your current SSH session.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-612020, UBTU-24-400030 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.