Skip to content
HackIndex logo

HackIndex

SSH Authentication Method Enumeration

2 min read Jan 4, 2026

Identify which authentication methods the server will accept so you do not waste time on dead paths.

What you are validating

This is not about trying passwords. It is about confirming what the server is willing to do for a user context.

Common pivots:

  • publickey-only means you switch to key hunting and config mistakes

  • keyboard-interactive often means PAM controls, MFA, or policy gates

  • GSSAPI hints at domain integration and different attack angles

  • password enabled means credential attacks are at least technically possible, subject to rules of engagement

Auth methods can vary by user depending on server config. Testing root vs a normal username can produce different results.

Nmap auth method enumeration

This gives you a clean list of methods for a specific username.

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ssh-auth-methods --script-args "ssh.user=$USERNAME" $TARGET_IP 
22/tcp open  ssh     syn-ack
22/tcp open  ssh     syn-ack
| ssh-auth-methods:
|   Supported authentication methods:
|     publickey
|     password
|   Banner: This is a private system. Use of this system constitutes
|_consent to monitoring.

Expect this to be logged on the server. It is still enumeration, but it is not silent.

Confirm server offers via verbose SSH without prompting

This keeps the session non-interactive while still showing the “authentications that can continue” line.

┌──(kali㉿kali)-[~]
└─$ ssh -vvv -p $PORT -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USERNAME@$TARGET_IP exit 
debug1: Authentications that can continue: publickey,password,keyboard-interactive

If you want the server to advertise methods without your client trying anything meaningful, forcing “none” is a useful trick:

┌──(kali㉿kali)-[~]
└─$ ssh -vvv -p $PORT -o PreferredAuthentications=none -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USERNAME@$TARGET_IP exit

That usually fails immediately, but it often prints the list you care about in the debug lines.

References