There isn't a way to list the methods of authentications in OpenSSH ... yet. So, I'll expand the list even further as I've been code-reviewing OpenSSH for some time.
The available authentication methods are:
- "none" (used for access to password-less accounts when
PermitEmptyPassword is enabled),
- "password" and
AuthenticationMethods specifies the authentication methods that must be successfully completed for a user to be granted access. This option must be followed by one or more lists of comma-separated authentication method names, or by the single string any to indicate the default behavior of accepting any single authentication method. If the default is overridden, then successful authentication requires completion of every method in at least one of these lists.
AuthenticationMethods publickey,password publickey,keyboard-interactive
would require the user to complete public key authentication, followed by either password or keyboard interactive authentication. Only methods that are next in one or more lists are offered at each stage, so for this example it would not be possible to attempt password or keyboard-interactive authentication before public key.
Keyboard Interactive Authentication
For keyboard interactive authentication it is also
possible to restrict authentication to a specific
device by appending a colon followed by the device
identifier bsdauth or pam depending on the server
configuration. For example,
would restrict keyboard interactive authentication to the bsdauth device.
Multiple Pubkey Authentication
If the publickey method is listed more than once, sshd(8) verifies that keys that have been used successfully are not reused for subsequent authentications.
requires successful authentication using two different public keys.
A comma that separates auth options are tried together (AND-logic).
A whitespace that separates auth options are tried separately (OR-logic).
Note that each authentication method listed should also be explicitly enabled in the configuration.
Details for code reviewers of OpenSSH
- Channel type: preauth (pre-channel)
- CLI option: -oAuthenticationMethods=XXXX"
- Process context: main
- SSH service: ssh-userauth (SSH2_MSG_USERAUTH_REQUEST)
- AuthenticationMethods defaults to 'any'.