4

I am running Debian Linux jessie with OpenSSH version 6.7. I use the AuthenticationMethods directive in /etc/ssh/sshd_config. I know that these strings are recognized by AuthenticationMethods:

keyboard-interactive
gssapi-with-mic
password
publickey

Where can I find a list of all the valid strings that can be used with AuthenticationMethods? (Such a list is not in the man page for sshd_config.)

2

This isn't documented very clearly (or at all). But here's what I was able to find. In OpenSSH 6.2, there were only 4 methods

There are just four allowable methods: publickey, password, hostbased, and keyboard-interactive.

Others have felt the need for more documentation as well. See Attachment 3045 which states for OpenSSH 7.5:

The available authentication methods are: gssapi-with-mic, hostbased, keyboard-interactive, none (used for access to password-less accounts when PermitEmptyPassword is enabled),, password, and publickey.

Hope that helps.

1
2

There isn't a way to list the methods of authentications in OpenSSH ... yet. So, I'll expand the list even further as I've been code-reviewing OpenSSH for some time.

The available authentication methods are:

  • "gssapi-with-mic",
  • "hostbased",
  • "keyboard-interactive",
  • "none" (used for access to password-less accounts when PermitEmptyPassword is enabled),
  • "password" and
  • "publickey".

AuthenticationMethods specifies the authentication methods that must be successfully completed for a user to be granted access. This option must be followed by one or more lists of comma-separated authentication method names, or by the single string any to indicate the default behavior of accepting any single authentication method. If the default is overridden, then successful authentication requires completion of every method in at least one of these lists.

Pubkey Authentication

For example,

AuthenticationMethods publickey,password publickey,keyboard-interactive

would require the user to complete public key authentication, followed by either password or keyboard interactive authentication. Only methods that are next in one or more lists are offered at each stage, so for this example it would not be possible to attempt password or keyboard-interactive authentication before public key.

Keyboard Interactive Authentication

For keyboard interactive authentication it is also possible to restrict authentication to a specific device by appending a colon followed by the device identifier bsdauth or pam depending on the server configuration. For example,

AuthenticationMethods keyboard-interactive:bsdauth

would restrict keyboard interactive authentication to the bsdauth device.

Multiple Pubkey Authentication

If the publickey method is listed more than once, sshd(8) verifies that keys that have been used successfully are not reused for subsequent authentications.

For example,

AuthenticationMethods publickey,publickey

requires successful authentication using two different public keys.

Note

A comma that separates auth options are tried together (AND-logic).

A whitespace that separates auth options are tried separately (OR-logic).

Note that each authentication method listed should also be explicitly enabled in the configuration.

Details for code reviewers of OpenSSH

  • Channel type: preauth (pre-channel)
  • CLI option: -oAuthenticationMethods=XXXX"
  • Process context: main
  • SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
  • options.auth_methods[]/auth2_setup_methods_lists()/input_userauth_request()
  • AuthenticationMethods defaults to 'any'.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.