Configuring SSH server to require RSA key

Question

I'm trying to configure my SSH server to require users to have an RSA key. To do this I have the settings in sshd_config set to

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile %h/.ssh/authorized_keys 

and

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

and

UsePAM no

Then I do sudo /etc/init.d/ssh restart to restart the server.

This seems to work to some degree, because I included my macs rsa_key and it lets me log in without asking for a password. However when I try to ssh in through a computer that I haven't included the key of, it just prompts me for my password, and then when entered, lets me in.

What am I doing wrong?

Answer 1

I'd say you're not reloading your ssh config correctly. Which Linux distribution/version are you using (assuming you're even using Linux)?

In Ubuntu I usually do:

sudo restart ssh
OR
sudo service ssh restart

Additionally, though not germane to this question - ideally root should not have a password - you should use be using sudo.

Answer 2

I think you also need

ChallengeResponseAuthentication no
UsePAM no 
PermitRootLogin without-password

otherwise even if sshd does not ask itself for a password, it will trust PAM and login which will authenticate the user with its password.

While testing, make sure to have another way in in case a problem occurs with SSH... And make sure you restart your server with /etc/init.d/sshd restart.