SSH Learning

Password Authentication

SSH Topic

Level: Beginner → Intermediate → Security Foundation

Before learning SSH keys, certificates, and advanced authentication, you must understand how traditional SSH password authentication works.

Even though modern environments prefer SSH keys, password authentication is still widely used in:

  • Labs
  • Internal networks
  • Legacy systems
  • Initial server setup
  • Enterprise environments using centralized authentication

Table of Contents

  1. What is Password Authentication?
  2. Password Authentication Overview
  3. Password Login Process
  4. PAM (Pluggable Authentication Modules)
  5. Authentication Flow
  6. Password Storage
  7. Understanding /etc/shadow
  8. Authentication Logs
  9. Password Policies
  10. Password Security
  11. Brute Force Attacks
  12. Lockout Mechanisms
  13. Internal Architecture
  14. Authentication Diagrams
  15. Commands
  16. Code Examples
  17. Real-World Examples
  18. Production Examples
  19. Common Mistakes
  20. Troubleshooting
  21. Security Notes
  22. Interview Questions
  23. Hands-On Labs
  24. Exercises
  25. Quiz

1. What is Password Authentication?

Password Authentication is the process where a user proves their identity by providing a secret password.

Example

ssh john@server

Prompt:

john@server's password:

User enters:

MySecurePassword123

If correct:

john@server:~$

appears.

Goal

Answer the question:

Who are you?

Authentication Factors

Password authentication uses:

Something You Know

Specifically:

A Secret Password

2. Password Authentication Overview

High-level flow:

User
  |
Password Entered
  |
SSH Client
  |
Encrypted Tunnel
  |
SSH Server
  |
Password Verification
  |
Login Success

Important

Passwords are NOT sent in plaintext.

SSH encrypts the communication first.

Actual Sequence

TCP Connection
      |
Key Exchange
      |
Encryption Enabled
      |
Password Sent Securely
      |
Password Verified
      |
Session Created

Common Misconception

Wrong:

SSH sends passwords in plaintext.

Correct:

SSH encrypts traffic before
authentication occurs.

3. Password Login Process

Let's examine the complete process.

Step 1

User runs:

ssh john@server

Step 2

SSH connection established.

Step 3

Encrypted tunnel created.

Step 4

Server requests authentication.

Step 5

User enters password.

Step 6

Password sent through encrypted channel.

Step 7

Server validates password.

Step 8

If valid:

john@server:~$

appears.

Login Flow Diagram

Client
   |
ssh john@server
   |
Encrypted Tunnel
   |
Password Prompt
   |
Password Entered
   |
Password Verification
   |
Login Success

Example

ssh [email protected]

Prompt:

[email protected]'s password:

4. PAM (Pluggable Authentication Modules)

One of the most important Linux authentication concepts.

What is PAM?

PAM stands for:

Pluggable Authentication Modules

Purpose

Provides a centralized authentication framework.

Instead of SSH Handling Everything

SSH asks PAM:

Is this user allowed to log in?

PAM performs the checks.

Diagram

SSHD
  |
  |
 PAM
  |
  +-- Password Check
  |
  +-- Account Check
  |
  +-- Policy Check
  |
  +-- Expiration Check

PAM Benefits

Centralized Authentication

Password Policies

Account Restrictions

MFA Integration

LDAP Integration

PAM Configuration

Location:

/etc/pam.d/

SSH PAM Configuration

/etc/pam.d/sshd

Example

auth required pam_unix.so

Verify PAM Usage

SSH configuration:

grep UsePAM /etc/ssh/sshd_config

Example:

UsePAM yes

5. Authentication Flow

Let's follow a real login.

User

ssh john@server

Server

Requests password.

User

Enters:

MyPassword123

SSHD

Passes authentication request to PAM.

PAM

Checks:

User Exists?

Account Locked?

Password Valid?

Password Expired?

If All Pass

Authentication Success

Flow Diagram

User
  |
Password
  |
SSHD
  |
PAM
  |
Password Verification
  |
Success

Authentication Failure

Permission denied

6. Password Storage

Important:

Linux does NOT store passwords directly.

Wrong

john:MyPassword123

Correct

Linux stores:

Password Hashes

Why?

If attackers steal the database:

They cannot immediately see passwords.

Example Hash

$6$randomsalt$xxxxxxxxxxxxxxxxxxxx

Password Storage Concept

Password
   |
Hash Function
   |
Hash Stored

Login Verification

User Password
     |
Hash Generated
     |
Compare Stored Hash

Match?

Yes → Login

No → Denied

7. Understanding /etc/shadow

Linux stores password hashes in:

/etc/shadow

Security

Only root can read.

Example

john:$6$xyz$abc123...

View File

sudo cat /etc/shadow

Fields

Example:

john:$6$hash:20000:0:99999:7:::

Breakdown

Username

Password Hash

Last Password Change

Minimum Age

Maximum Age

Warning Period

Hash Types

Common:

SHA-512

Identifier:

$6$

Example Hash Prefixes

$1$  MD5

$5$  SHA256

$6$  SHA512

8. Authentication Logs

Authentication events are logged.

Ubuntu/Debian

/var/log/auth.log

RHEL/CentOS

/var/log/secure

Watch Logs Live

Ubuntu:

sudo tail -f /var/log/auth.log

Example Success

Accepted password for john

Example Failure

Failed password for john

Useful For

Auditing

Troubleshooting

Security Monitoring

9. Password Policies

Strong password policies improve security.

Common Rules

Minimum Length

Uppercase Letters

Lowercase Letters

Numbers

Special Characters

Weak Password

password123

Strong Password

S3cure!Admin#2025

Password Aging

Users may be forced to change passwords.

Check Policy

sudo chage -l username

Example Output

Password expires: Dec 31

Set Expiration

sudo chage -M 90 username

Meaning

Password expires every 90 days.

10. Password Security

Password authentication is only as strong as the password itself.

Strong Password Characteristics

Long

Random

Unique

Hard to Guess

Recommended

14+ Characters

Example

Bad:

admin123

Good:

Tr@vel!2026#Cloud$Server

Never Use

Company Name

Username

Birthdate

Simple Words

Password Managers

Recommended:

Bitwarden

KeePassXC

1Password

11. Brute Force Attacks

A brute force attack tries many passwords.

Example

Attacker attempts:

admin

admin123

password

welcome123

root123

Attack Flow

Attacker
    |
Thousands of Passwords
    |
SSH Server

Signs

Authentication logs show:

Failed password
Failed password
Failed password
Failed password

repeatedly.

Example Log

Failed password for root

Why Dangerous?

Weak passwords can be guessed.

Common Targets

root

admin

ubuntu

test

12. Lockout Mechanisms

Lockout prevents unlimited attempts.

Purpose

Reduce brute-force success.

Example Policy

5 Failed Attempts
     |
Account Locked

PAM Lockout

Module:

pam_faillock

Example Flow

Wrong Password
Wrong Password
Wrong Password
Wrong Password
Wrong Password
      |
Account Locked

Check Failed Attempts

sudo faillock

Reset Lock

sudo faillock --user john --reset

Benefits

Protects Accounts

Stops Automated Attacks

13. Internal Architecture

User
 |
SSH Client
 |
Encrypted Tunnel
 |
SSHD
 |
PAM
 |
/etc/shadow
 |
Authentication Decision
 |
Session Creation

14. Authentication Diagram

User
 |
Password
 |
SSH Client
 |
Encrypted SSH Tunnel
 |
SSHD
 |
PAM
 |
/etc/shadow
 |
Password Hash Comparison
 |
Success / Failure

15. Commands

Connect:

ssh user@server

Check PAM:

grep UsePAM /etc/ssh/sshd_config

View Shadow File:

sudo cat /etc/shadow

Check Password Aging:

sudo chage -l username

Watch Authentication Logs:

sudo tail -f /var/log/auth.log

View Failed Logins:

sudo faillock

16. Code Examples

Password Login:

ssh john@server

Check User:

whoami

Check Password Policy:

sudo chage -l john

Monitor Logs:

sudo tail -f /var/log/auth.log

17. Real-World Examples

University Server:

Students login using usernames
and passwords.

Internal Company Servers:

Employees authenticate
through centralized accounts.

18. Production Examples

Legacy Systems:

SSH Password Authentication Enabled

Enterprise Authentication:

SSHD
 |
PAM
 |
LDAP
 |
Active Directory

Cloud Servers

Initial login may use:

Temporary password

before switching to SSH keys.

19. Common Mistakes

Mistake 1

Weak passwords.

Mistake 2

Sharing passwords.

Mistake 3

Allowing root password login.

Mistake 4

Ignoring failed login logs.

Mistake 5

No account lockout policy.

20. Troubleshooting

Permission Denied

Check:

Username

Password

Account Status

Account Locked

Check:

sudo faillock

Password Expired

Check:

sudo chage -l username

PAM Failure

Inspect:

/etc/pam.d/sshd

Authentication Logs

Ubuntu:

tail -f /var/log/auth.log

21. Security Notes

Prefer:

SSH Keys

over passwords.

Disable root password login.

Enforce strong password policies.

Use account lockouts.

Monitor authentication logs.

Consider MFA.

22. Interview Questions

Q1

What is PAM?

Answer:

Pluggable Authentication Modules

Q2

Where are password hashes stored?

Answer:

/etc/shadow

Q3

Does SSH send passwords in plaintext?

Answer:

No.
Passwords are sent through an encrypted tunnel.

Q4

How do you view authentication logs?

Answer:

tail -f /var/log/auth.log

Q5

What is a brute force attack?

Answer:

Repeated password guessing attempts.

23. Hands-On Labs

Lab 1

Perform Password Login

ssh user@localhost

Lab 2

Inspect PAM Configuration

cat /etc/pam.d/sshd

Lab 3

Inspect Shadow File

sudo cat /etc/shadow

Lab 4

Check Password Aging

sudo chage -l username

Lab 5

Watch Login Logs

sudo tail -f /var/log/auth.log

Then attempt login.

Lab 6

View Lockout Status

sudo faillock

24. Exercises

Exercise 1

Explain how password authentication works.

Exercise 2

Describe PAM's role in SSH authentication.

Exercise 3

Explain why Linux stores hashes instead of passwords.

Exercise 4

List common brute force attack indicators.

Exercise 5

Explain account lockout mechanisms.

25. Quiz

Question 1

Where are password hashes stored?

A. /etc/passwd
B. /etc/hosts
C. /etc/shadow
D. /etc/group

Answer:

C

Question 2

What does PAM stand for?

A. Password Access Manager
B. Pluggable Authentication Modules
C. Protected Access Mechanism
D. Password Authentication Module

Answer:

B

Question 3

Are SSH passwords transmitted in plaintext?

A. Yes
B. No

Answer:

B

Question 4

Which file contains SSH authentication logs on Ubuntu?

A. /var/log/syslog
B. /var/log/messages
C. /var/log/auth.log
D. /var/log/kernel.log

Answer:

C

Question 5

Purpose of account lockout?

A. Increase performance
B. Stop brute force attacks
C. Improve DNS
D. Reduce encryption

Answer:

B

Summary

You should now understand:

✓ Password Authentication

✓ Password Login Process

✓ PAM

✓ Authentication Flow

✓ Password Storage

✓ /etc/shadow

✓ Authentication Logs

✓ Password Policies

✓ Password Security

✓ Brute Force Attacks

✓ Lockout Mechanisms

✓ Password Authentication Architecture

Next Topic:

Topic #7 — Public Key Authentication

Private Keys
Public Keys
Key Pairs
Challenge-Response Authentication
authorized_keys
SSH Key Verification
Key-Based Login Flow
Security Advantages
Key Management
Key Authentication Debugging

Filters

No filters available for this view.

Reset All