Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to be able to have one set of users authenticating using public key auth and other users to use password authentication.

Is this possible in OpenSSH on Linux? If so how do I go about it?

After looking through /etc/ssh/sshd_config, it seems like I am limited to either enabling key authentication or using PAM.

share|improve this question

The Match directive (described in man sshd_config) allows to specify different authentication methods for different users in one instance of sshd server. As a bonus to enumerating individual users and groups, it also allows selecting them via wildcards.

Match Group wheel                # for users from group wheel:
Match Group !wheel,*             # for other users:
# caution: don't add directives here - they will be caught by "Match" block
# (end of file /etc/ssh/sshd_config)
share|improve this answer

It is possible to run two different instances of OpenSSH. One would be configured for PasswordAuthentication and the other for PubkeyAuthentication (each bound to a different address). Then the AllowGroups configuration directive would be used to control which groups can use which server.

But I may be misunderstanding the question because you say "it's either PAM or PublicKey authentication." Both can be enabled at the same time. They are not mutually exclusive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.