How can I enable both password and public key authentication with OpenSSH

Question

I would like for sshd to verify the users' public key and then prompt for their password, rather than just one or the other. Is this possible?

Answer 1

Not presently. But there are some patches floating around that are supposed to add this.

See https://bugzilla.mindrot.org/show_bug.cgi?id=983

Answer 2

It is possible but in a kludgish and limited sort of way. First you only allow public key authentication. Then in /etc/ssh/sshd_config add a ForceCommand that executes a script that will check the password.

The script will break SFTP unless you check that the command is sftp and allow it through without a password.

I've never tried this so somebody may be able to see more issues.