I was wondering if it is possible to accomplish the following, all at the same time:
- Disable root logins
- Enable SSH login for personal user, only via SSH keys
- Enable SSH login for unprivileged user, with password authentication and two-factor authentication only
Match block in
sshd_config I was able to set this up so that in general
PasswordAuthentication was disabled except for the unprivileged user (lets call it
peon). SSH keys were required for logging in to the personal user (who has sudo capabilities).
However, when I try to enable two-factor authentication (
pam_google_authenticator) I have to turn on
ChallengeResponseAuthentication which seems to not work in a
Match block, and is therefore turning password authentication back on for everyone.
Is there a way to accomplish this? I'm not overly great with this type of stuff, so detailed explanations would be really appreciated.