Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I login via ssh with -v I see that ssh is authenticating the following way

debug1: Authentications that can continue: publickey,gssapi-with-mic,password,hostbased

I would like to change the order ...any idea how?

My bigger problem is that user with locked accounts, can still login via public-keys. I have found that I could add the user to a group "ssh-locked" add deny that group from sshing, but I am still wondering if there is a way to tell ssh'd: Please check password before keys...

share|improve this question
I think you're approaching this the wrong way - keys are (usually) more secure than passwords. If the account is locked, you need to tell the sshd daemon to not let the user login regardless of the authentication method. – EightBitTony Jun 24 '11 at 7:58
Like I said, I found a solution, via DenyGroups. I am asking it for the sake of interest. – Oz123 Jun 24 '11 at 7:59
up vote 18 down vote accepted

The ssh server decides which authentication options it allows, the ssh client can be configured to decide in which order to try them.

The ssh client uses the PreferredAuthentications option in the ssh config file to determine this.

             Specifies the order in which the client should try protocol 2 authentication methods.  This allows a client to prefer
             one method (e.g. keyboard-interactive) over another method (e.g. password).  The default is:


I don't believe it's possible, without playing with the source, to tell the OpenSSH server to prefer a certain order - if you think about it, it doesn't quite make sense anyway.

share|improve this answer
If you are using Git Bash for Windows, save your ssh config to ~/.ssh/config – Spencer Williams Jan 13 '15 at 22:31

Adding this:

PreferredAuthentications keyboard-interactive,password,publickey,hostbased,gssapi-with-mic my /etc/ssh/ssh_config helped me to solve this, and saved a lot of time too!

You can check if it works by using ssh -v user@host command to connect, where -v stands for "verbose".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.