I configured ssh to using keys files situated in ~/.ssh to login. Now I'd like to install a two factor authentication when using password, but not required when using key files. I've seen how to install two factor authentication here: DigitalOcean: How To Protect SSH With Two-Factor Authentication.

But it applies for both keys logins and password login, I'd like to use it only for password login.

I'd like:

  • public-key -> ok to enter server


  • password -> one-time password -> ok to enter server

Maybe it is possible to do something with the AuthenticationMethods in sshd_config? I've found this: OpenSSH use (public key or password) + google authenticator

  • When you set it up according to the linked article, how does it work?
    – Jakuje
    Oct 16, 2016 at 18:45

2 Answers 2


AuthenticationMethods accepts multiple choices. AND operations use a comma, OR operations use spaces. So the example at the link you had above was:

AuthenticationMethods publickey,keyboard-interactive:pam password,keyboard-interactive:pam

This says to allow either a key and challenge-response, or a password and challenge-response. This will do what you're requesting.

I do highly advise that you limit key authentication to known hosts using Match blocks as shown at https://blog.tinned-software.net/restrict-ssh-logins-using-ssh-keys-to-a-particular-ip-address/


That's how it works by default.

By default, the auth stack of PAM is not consulted by sshd when key based authentication is in use. The other stacks will still fire (i.e. account will still enforce your access policies), but it requires additional configuration (customizing AuthenticationMethods) to even end up in a situation where PAM and non-PAM authentication methods are mixed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .