Find SSH Password Auth Exceptions

You need to see whether sshd_config has password authentication exceptions under Match rules.

Command

awk '/^Match /{ctx=$0} /^PasswordAuthentication|^AuthenticationMethods|^[[:space:]]+PasswordAuthentication|^[[:space:]]+AuthenticationMethods/ {print (ctx ? ctx : "global") ": " $0}' etc/ssh/sshd_config

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not reload SSH based only on this excerpt; validate the full effective sshd configuration on a real host.

Expected output

Authentication directives labeled as global or attached to the active Match block.

System impact

Read-only, sensitive output. Nothing changes. The command reads sshd_config and prints authentication directives with their current Match context.

Recovery / rollback: no state is changed.

When to use it

Use when a host appears key-only but some users or source ranges can still use password authentication.

When not to use it

Do not reload SSH based only on this excerpt; validate the full effective sshd configuration on a real host.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ sed -n '1,12p' etc/ssh/sshd_config

Port 22
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
AuthenticationMethods publickey
AllowUsers alice deploy
Include etc/ssh/sshd_config.d/*.conf
Match Address 198.51.100.0/24
    PasswordAuthentication yes
    AuthenticationMethods publickey,password

$ awk '/^Match /{ctx=$0} /^PasswordAuthentication|^AuthenticationMethods|^[[:space:]]+PasswordAuthentication|^[[:space:]]+AuthenticationMethods/ {print (ctx ? ctx : "global") ": " $0}' etc/ssh/sshd_config

global: PasswordAuthentication no
global: AuthenticationMethods publickey
Match Address 198.51.100.0/24:     PasswordAuthentication yes
Match Address 198.51.100.0/24:     AuthenticationMethods publickey,password

View commands shown

These are the commands shown in the sanitized transcript.