10

I'd like to be able to have one set of users authenticating using public key auth and other users to use password authentication.

Is this possible in OpenSSH on Linux? If so how do I go about it?

After looking through /etc/ssh/sshd_config, it seems like I am limited to either enabling key authentication or using PAM.

2 Answers 2

15

The Match directive (described in man sshd_config) allows to specify different authentication methods for different users in one instance of sshd server. As a bonus to enumerating individual users and groups, it also allows selecting them via wildcards.

Match Group wheel                # for users from group wheel:
PubkeyAuthentication
Match Group !wheel,*             # for other users:
PasswordAuthentication
# caution: don't add directives here - they will be caught by "Match" block
# (end of file /etc/ssh/sshd_config)
0

It is possible to run two different instances of OpenSSH. One would be configured for PasswordAuthentication and the other for PubkeyAuthentication (each bound to a different address). Then the AllowGroups configuration directive would be used to control which groups can use which server.

But I may be misunderstanding the question because you say "it's either PAM or PublicKey authentication." Both can be enabled at the same time. They are not mutually exclusive.

You must log in to answer this question.