I am reviewing the security of one of our servers and wanted to see if SSH can ask for public keys when authenicating or use password & challenge response if no key exists.

I cannot seem to work out how to do this. Any ideas?

2 Answers 2


That's the way it already works. Check the manpage. Note that public key authentication comes before challenge-response authentication.

From the AUTHENTICATION section from the manage:

 The methods available for authentication are: GSSAPI-based authentication, host-based authentication, public key authentication,
 challenge-response authentication, and password authentication.  Authentication methods are tried in the order specified above,
 though protocol 2 has a configuration option to change the default order: PreferredAuthentications.

Try ssh in verbose mode

ssh -v user@server

You should see a line like this:

debug1: Authentications that can continue: publickey,keyboard-interactive

You can disable certain authentications methods on server and client side. An you can change the order.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.