As described in the
For example, “
publickey,password publickey,keyboard-interactive” would
require the user to complete public key authentication, followed by
either password or keyboard interactive authentication. Only methods
that are next in one or more lists are offered at each stage, so for
this example it would not be possible to attempt password or
keyboard-interactive authentication before public key.
You either require password authentication after public key authentication or you don't. You can't have both matching same condition, as
publickey,password publickey would always allow authentication with public key alone, being equal to
That being if you don't have another matching criteria than the username.
The arguments to
Match are one or more criteria-pattern pairs or the
single token All which matches all criteria. The available criteria
Address. The match
patterns may consist of single entries or comma-separated lists and
may use the wildcard and negation operators described in the PATTERNS
section of ssh_config(5).
The patterns in an
Address criteria may
additionally contain addresses to match in CIDR address/masklen
format, such as
2001:db8::/32. Note that the mask
length provided must be consistent with the address - it is an error
to specify a mask length that is too long for the address or one with
bits set in this host portion of the address.
If you have a static IP at home or static IP block at work, you can use it as another criteria. Best practice is to use more demanding authentication methods on untrusted networks.
Here's an example of using three different combination of authentication methods in four different conditions. (John and Jane are users belonging to group
# Static IP address, John at home
Match User john Address 198.51.100.78
# Static IP address, Jane at home
Match User jane Address 192.0.2.90
# Require also password for all employees on company network 203.0.113.0/24
Match Group employee Address 203.0.113.0/24
# Require public key and Google Authenticator for employees anywhere else
Match Group employee
The Google Authenticator in the last example requires
libpam-google-authenticator installed and configured in
/etc/pam.d/sshd with line
auth required pam_google_authenticator.so.
Another method for a single user without access to
publickey authentication without
password authentication in use: use the same key without password on home computer and with password at work. Depending on the situation with the original key:
- Remove passphrase with
openssl rsa -in work-encrypted.key -out open-home.key
- Add passphrase with
openssl rsa -des3 -in open-home.key -out work-encrypted.key