OpenSSH: Different Authentication Methods

Question

I have the need of having users logging in to a CentOS system with different authentication methods. Some using password and others using public key.

I followed the methods mentioned here: How can I setup OpenSSH per-user authentication methods?

However, I am not successful in having successful password based login.

In the sshd_config file, I have:

AuthenticationMethods keyboard-interactive,publickey
PasswordAuthentication no

Match User newton
    PasswordAuthentication yes
Match all

Update: I see that the issue is only when I have 2FA enabled with google authentication and I have the line:

AuthenticationMethods keyboard-interactive,publickey

Though for the user newton, I have set password authentication I see the following error:

[root@localhost]# ssh [email protected]
Permission denied (publickey).

Any suggestions are appreciated.

Answer 1

Although @Tolsadus answer probably points to the correct solution, it does not answer the question clearly.

In short, manual page for ssh_config is a good start to understand how the config parser in ssh works (the same rules apply for sshd_config):

For each parameter, the first obtained value will be used

This means that your example will set PasswordAuthentication to no for all users and for newton user will not overwrite it (because it is already set). To work it around, you should set the default values in the Match block. This will have the expected effect on newton user:

Match User newton
    PasswordAuthentication yes
Match all
    PasswordAuthentication no

Answer 2

Perfect explanation how to use the match option in /etc/ssh/sshd_config

In your case, you should do like that "real" world example https://gist.github.com/kjellski/5940875

You can find that match with addresses, but also users that is commented.

EDIT / UPDATE

@Jakuje properly answered the question, way more precise than mine.