0

I configured ssh to using keys files situated in ~/.ssh to login. Now I'd like to install a two factor authentication when using password, but not required when using key files. I've seen how to install two factor authentication here: DigitalOcean: How To Protect SSH With Two-Factor Authentication.

But it applies for both keys logins and password login, I'd like to use it only for password login.

I'd like:

  • public-key -> ok to enter server

or

  • password -> one-time password -> ok to enter server

Maybe it is possible to do something with the AuthenticationMethods in sshd_config? I've found this: OpenSSH use (public key or password) + google authenticator

  • When you set it up according to the linked article, how does it work? – Jakuje Oct 16 '16 at 18:45
1

That's how it works by default.

By default, the auth stack of PAM is not consulted by sshd when key based authentication is in use. The other stacks will still fire (i.e. account will still enforce your access policies), but it requires additional configuration (customizing AuthenticationMethods) to even end up in a situation where PAM and non-PAM authentication methods are mixed.

0

AuthenticationMethods accepts multiple choices. AND operations use a comma, OR operations use spaces. So the example at the link you had above was:

AuthenticationMethods publickey,keyboard-interactive:pam password,keyboard-interactive:pam

This says to allow either a key and challenge-response, or a password and challenge-response. This will do what you're requesting.

I do highly advise that you limit key authentication to known hosts using Match blocks as shown at https://blog.tinned-software.net/restrict-ssh-logins-using-ssh-keys-to-a-particular-ip-address/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.