Two factor authentication for password login but not for login using keys files

Question

I configured ssh to using keys files situated in ~/.ssh to login. Now I'd like to install a two factor authentication when using password, but not required when using key files. I've seen how to install two factor authentication here: DigitalOcean: How To Protect SSH With Two-Factor Authentication.

But it applies for both keys logins and password login, I'd like to use it only for password login.

I'd like:

• public-key -> ok to enter server

or

• password -> one-time password -> ok to enter server

Maybe it is possible to do something with the AuthenticationMethods in sshd_config? I've found this: OpenSSH use (public key or password) + google authenticator

Answer 1

AuthenticationMethods accepts multiple choices. AND operations use a comma, OR operations use spaces. So the example at the link you had above was:

AuthenticationMethods publickey,keyboard-interactive:pam password,keyboard-interactive:pam

This says to allow either a key and challenge-response, or a password and challenge-response. This will do what you're requesting.

I do highly advise that you limit key authentication to known hosts using Match blocks as shown at https://blog.tinned-software.net/restrict-ssh-logins-using-ssh-keys-to-a-particular-ip-address/

Answer 2

That's how it works by default.

By default, the auth stack of PAM is not consulted by sshd when key based authentication is in use. The other stacks will still fire (i.e. account will still enforce your access policies), but it requires additional configuration (customizing AuthenticationMethods) to even end up in a situation where PAM and non-PAM authentication methods are mixed.