5

Is it possible to enable ssh to use both key pair and password at the same time, so the client need the key file and also know the password ? In order that having only one wouldn't work.

I don't to have a 2 step authentication using radius or anything. Just want to improve a bit the security.

Thanks

Improve this question

1 Answer 1

Reset to default
7

From https://security.stackexchange.com/questions/17931/possible-to-use-both-private-key-and-password-authentication-for-ssh-login

Now on RHEL / CentOS 7, and any system with a recent version of OpenSSH, you can use:

AuthenticationMethods "publickey,password" "publickey,keyboard-interactive"

Also see: https://lwn.net/Articles/544640/

It is also important to note that the AuthenticationMethods feature applies only to the SSH 2 protocol, and that each authentication method listed must also be explicitly enabled in the sshd_config file.

And a great explanation in detail here:

https://sysconfig.org.uk/two-factor-authentication-with-ssh.html

Match User johndoe
AuthenticationMethods publickey,keyboard-interactive

Read the commas as logical AND. On login, johndoe's key pair will be checked first and if it's a match, you'll see this:

Authenticated with partial success.

Then, he will be asked for his password. So without realising, you have just set up MFA. Your key pair being what you have, the account password being what you know. This is possibly the simplest way of setting up MFA with SSH, and already better than single-factor authentication.

Improve this answer
4
  • Sounds great, after reading the manual I thought this option was the order that the authentication would take place (e.g first through public key, if not password). Thanks for that.
    – Adonist
    Aug 9, 2017 at 14:05
  • 1
    It seems confusing indeed, I updated the answer with another link and example. The comma is like AND and the space is like OR.
    – JayMcTee
    Aug 9, 2017 at 14:09
  • Public key + password is not proper 2FA, as I've had cause to note before around here. That's not your fault, tough, so +1 from me for a good answer, even though I disagree with some of the sources you've quoted.
    – MadHatter
    Aug 22, 2017 at 19:37
  • The question wasn't necessarily about achieving two factor authentication and I suppose semantically you are right, this isn't. Proper 2FA would involve two diverse means, not two through effectively the same channel. So point taken.
    – JayMcTee
    Aug 22, 2017 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.