2

I want to configure sshd to require that a connection authenticate with both a key and a password.

I haven't looked at using PAM or other external authentication methods yet, but my guess at the moment (based on sshd_config(5) is that this is not possible. Prove me wrong. Please?

Improve this question

3 Answers 3

Reset to default
5

If you are using openssh, I don't believe you can do this. There are other SSH2 daemons out there which allow extended SSH2 directives giving you a directive called "RequiredAuthentications" and "AllowedAuthentications"; both of which are comma separated lists. You can see a nifty chart of compatibility at:

http://hell.org.ua/Docs/oreilly/tcpip2/ssh/ch05_05.htm

If this is a requirement you have, you should change out your ssh daemon. The config would then be:

AllowedAuthentications password,publickey
RequiredAuthentications password,publickey

Cheers

Improve this answer
4
  • Keep in mind that doing it this way will require you to initiate the initial allowed public key, either by them providing their public key to you or you providing them with the private key.
    – Michael
    Nov 17, 2009 at 8:00
  • OpenSSH does follow the SSH2 standard too, it simply doesn't implement "RequiredAuthentications".
    – u1686_grawity
    Nov 17, 2009 at 9:57
  • @grawity - You're correct. I have edited my answer to spread less FUD, thanks. :)
    – Michael
    Nov 17, 2009 at 10:28
  • Also see this answer over at serverfault.com. It looks like RHEL have patched openssh with similar functionality.
    – Robie Basak
    Jan 18, 2013 at 19:16
1

If you create an certificate with a pass phrase on it, then it will require you to enter that pass phrase when you log in with certificate authentication.

Improve this answer
4
  • The command to do what Zypher mentioned above is "ssh-keygen". Here is the synopsis for the parts you would need: ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment] [-f output_keyfile]
    – jemmille
    Nov 17, 2009 at 3:52
  • 1
    However that is not actually a "key + password" setup for the SSH server, it is just a "key" setup. The CLIENT is requesting a pass-phrase in order to access the private key when connecting to the SSH server.
    – Ryan Fisher
    Nov 17, 2009 at 4:24
  • Unfortunately this won't work because the passfrase can be trivially removed eg. ssh-keygen -P "old pass frase" -N "new pass frase" -f ssh-key-file
    – pyhimys
    Nov 17, 2009 at 9:57
  • Thanks, but I only care about the server side. Key pass phrases have nothing to do with authentication, they just protect the key.
    – user18176
    Nov 18, 2009 at 8:27
0

http://novosial.org/openssh/publickey-auth/

Pay particular attention to 'Key Generation' for generating a key with a passphrase, and to 'Key Distribution' for enabling login to a given server with that passphrase-protected key

Improve this answer

You must log in to answer this question.