Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to configure sshd to require that a connection authenticate with both a key and a password.

I haven't looked at using PAM or other external authentication methods yet, but my guess at the moment (based on sshd_config(5) is that this is not possible. Prove me wrong. Please?

share|improve this question
up vote 5 down vote accepted

If you are using openssh, I don't believe you can do this. There are other SSH2 daemons out there which allow extended SSH2 directives giving you a directive called "RequiredAuthentications" and "AllowedAuthentications"; both of which are comma separated lists. You can see a nifty chart of compatibility at:

If this is a requirement you have, you should change out your ssh daemon. The config would then be:

AllowedAuthentications password,publickey
RequiredAuthentications password,publickey


share|improve this answer
Keep in mind that doing it this way will require you to initiate the initial allowed public key, either by them providing their public key to you or you providing them with the private key. – Michael Nov 17 '09 at 8:00
OpenSSH does follow the SSH2 standard too, it simply doesn't implement "RequiredAuthentications". – grawity Nov 17 '09 at 9:57
@grawity - You're correct. I have edited my answer to spread less FUD, thanks. :) – Michael Nov 17 '09 at 10:28
This is exactly what I'm looking for. Thanks! – thsutton Nov 18 '09 at 8:29
Also see this answer over at It looks like RHEL have patched openssh with similar functionality. – Robie Basak Jan 18 '13 at 19:16

If you create an certificate with a pass phrase on it, then it will require you to enter that pass phrase when you log in with certificate authentication.

share|improve this answer
The command to do what Zypher mentioned above is "ssh-keygen". Here is the synopsis for the parts you would need: ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment] [-f output_keyfile] – jemmille Nov 17 '09 at 3:52
However that is not actually a "key + password" setup for the SSH server, it is just a "key" setup. The CLIENT is requesting a pass-phrase in order to access the private key when connecting to the SSH server. – Ryan Fisher Nov 17 '09 at 4:24
Unfortunately this won't work because the passfrase can be trivially removed eg. ssh-keygen -P "old pass frase" -N "new pass frase" -f ssh-key-file – pyhimys Nov 17 '09 at 9:57
Thanks, but I only care about the server side. Key pass phrases have nothing to do with authentication, they just protect the key. – thsutton Nov 18 '09 at 8:27

Pay particular attention to 'Key Generation' for generating a key with a passphrase, and to 'Key Distribution' for enabling login to a given server with that passphrase-protected key

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.