3

This question already has an answer here:

I'm currently disabling password authentication on all my ssh servers (good idea of the day!). Some of my servers are shared with other people and I want to force them to use a ssh key with a passphrase. Is it possible to disallow ssh login for ssh keys without passphrase?

marked as duplicate by MadHatter, dawud, faker, Rex, Ward Apr 17 '14 at 19:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

7

As mentioned in the other answers you cannot enforce a passphrase on a key. However, to enforce two-factor authentication (something you have, the key, and something you know, the password) you can use another option.

In newer versions of OpenSSH you can set the RequiredAuthentications2 pubkey,password parameter in /etc/ssh/sshd_config. This will force the user to use both public key AND password authentication, effectively giving you two-factor authentication.

  • 1
    Something like duo would be even better – Iain Apr 17 '14 at 10:17
  • 1
    Just to add a small thing to add, it is not the most effective 2fa because usually people do not have very good management and security of their private SSH keys (like the question says, they use it without a password or things like this). That's why nobody really uses 2fa like this in practice but you get codes on your phone or hardware tokens, things that you need to have in physical possession, rather than the keys which, if they don't have a password, could easily be stolen from an infected computer. – Florin Asăvoaie Apr 17 '14 at 12:42
  • 1
    You definitely have a point. I am in favour of hardware tokens. Smartphones I'm not so giddy about, because they are vulnerable to lots of security holes as well (perhaps even more than desktops nowadays). However, the result is the same, you require a password(know) and a key(have). This is not different from encrypting a key with a passphrase. Actually, one could argue it's better, because if you steal a keyfile, you can try infinite times to unlock the key, but you can only try to log on to a server finite times (if properly set up). – mtak Apr 17 '14 at 12:56
6

Unfortunately you can't do this as it is all managed on the client side. Perhaps this would be a good time to introduce people to ssh-agent or pageant if you use putty/kitty or something similar. The passphrase only needs to be supplied once when the key is added to the agent using this method.

5

No, this is not possible as it is handled 100% on client side of SSH.

Not the answer you're looking for? Browse other questions tagged or ask your own question.