Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to be able to have one set of users authenticating using public key auth and other users to use password authentication.

Is this possible in OpenSSH on Linux? If so how do I go about it?

After looking through /etc/ssh/sshd_config, it seems like I am limited to either enabling key authentication or using PAM.

share|improve this question

2 Answers 2

The Match directive (described in man sshd_config) allows to specify different authentication methods for different users in one instance of sshd server. As a bonus to enumerating individual users and groups, it also allows selecting them via wildcards.

Match Group wheel                # for users from group wheel:
PubkeyAuthentication
Match Group !wheel,*             # for other users:
PasswordAuthentication
# caution: don't add directives here - they will be caught by "Match" block
# (end of file /etc/ssh/sshd_config)
share|improve this answer

It is possible to run two different instances of OpenSSH. One would be configured for PasswordAuthentication and the other for PubkeyAuthentication (each bound to a different address). Then the AllowGroups configuration directive would be used to control which groups can use which server.

But I may be misunderstanding the question because you say "it's either PAM or PublicKey authentication." Both can be enabled at the same time. They are not mutually exclusive.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.