Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I setup ssh with both private key and password?

In /etc/ssh/sshd_config, I currently have:

RSAAuthentication yes
PubkeyAuthentication yes
PasswordAuthentication yes

But apparently this allows a user to login using either a private key or password.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

You need to setup an SSH gatekeeper. This allows openssh to permit multifactor authentication.

Here's a great link: https://calomel.org/openssh.html

Essentially, you use the ForceCommand directive to run a script when the user logs in. That script then prompts the user for the password. I'm currently looking for a method to verify a given password against the system password, but I'm coming up (understandably) blank.

If the user account is stored in an LDAP directory, you could attempt to bind to the directory using those credentials, but the problem is going to be that the program running will be running as the user, not as root. I don't know the security implications of writing the compiled code and setting it SUID.

Hopefully someone will give you a better answer.

but since I've typed this much, are you in an ultra-secure site? Because that's really the only reason for this. Normal public keys with passphrases should be more than adequate for 99% of cases out there.

share|improve this answer
    
You don't need root privileges to bind to a LDAP server. What you need is an account with very limited privileges (just bind and search uid, cn) to find the user's CN. When you have the CN you bind again and provide the password prompt to the user. The downside is that this will not enforce password aging unless you use ppolicy. –  Hubert Kario Jul 11 '11 at 12:56
    
Isn't there a way to trick PAM to ask for the user password once you're signed in using SSH and PKI? –  cwo Feb 21 '12 at 12:39
add comment

Two-factor authentication? Not quite. The certificate is a stronger authentication method than a password.

If you are afraid that the certificate can be compromised, then set up the private keys to be password protected. This ensures that the user is prompted for a password before the certificate can be used. That gives you two-factor authentication. You will know that the connection comes from someone who has both possession of the private key and also the password to unlock it.

And disable password authentication on your ssh server. This stops people from using dictionary/brute-force attacks.

share|improve this answer
5  
Putting a password on the private key really isn't the same as requiring both key and password from the server. The later is something which is forced server side while the protected key file is something left up to the user. –  andol Dec 13 '09 at 3:02
    
What I don't agree with is that this form of two-factor authentication is more secure than certificates. I'm afraid of the pseudo-security feeling that it may give. –  sybreon Dec 14 '09 at 0:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.