I would like for sshd to verify the users' public key and then prompt for their password, rather than just one or the other. Is this possible?
Not presently. But there are some patches floating around that are supposed to add this.
This is finally available as of OpenSSH 6.2 (released March 2013), using the
AuthenticationMethods configuration option.
For instance, you may add the following line to
sshd_config to require both public-key and password authentication:
When logging in,
scp will first perform public-key authentication, and then prompt for a password:
$ ssh firstname.lastname@example.org Authenticated with partial success. email@example.com's password:
If you have a password on your private key file, you will of course first be prompted for that. Example using PuTTY:
Using username "user". Authenticating with public key "rsa-key-20131221-user" Passphrase for key "rsa-key-20131221-user": Further authentication required firstname.lastname@example.org's password:
OpenSSH in RHEL/CentOS 6.3 now supports this feature, although I can't find it mentioned in the OpenSSH release notes. From the RHEL release notes:
SSH can now be set up to require multiple ways of authentication (whereas previously SSH allowed multiple ways of authentication of which only one was required for a successful login); for example, logging in to an SSH-enabled machine requires both a passphrase and a public key to be entered. The
RequiredAuthentications2options can be configured in the
/etc/ssh/sshd_configfile to specify authentications that are required for a successful log in. For example:
~]# echo "RequiredAuthentications2 publickey,password" >> /etc/ssh/sshd_config
For more information on the aforementioned
/etc/ssh/sshd_configoptions, refer to the
It is possible but in a kludgish and limited sort of way. First you only allow public key authentication. Then in
/etc/ssh/sshd_config add a
ForceCommand that executes a script that will check the password.
The script will break SFTP unless you check that the command is sftp and allow it through without a password.
I've never tried this so somebody may be able to see more issues.