I have a FreeBSD hosted server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over SSH. However, when logging in from an untrusted machine there's always the risk of a keylogger capturing my password as I type it.

FreeBSD already has support for OPIE which is a one-time password scheme. This works great, but the one-time password is the only authentication needed. If I print out a list of one-time passwords to use later, then if I lose that list then that's all somebody needs.

I'd like to set up the authentication so that I need a one-time password plus something I know (a password, except not my usual login password). I have a feeling the answer has something to do with PAM (and /etc/pam.d/sshd) but I'm not certain on the details.

How can I set up authentication where two methods are required?

4 Answers 4


Since you want to use a password that is something other than the one for your normal account, try security/pam_pwdfile from the ports tree.
Basically, it allows you to use an alternate file (format: username:crypted_password) to authenticate against.
To use it, put the following line in /etc/pam.d/sshd right before the line for pam_opie:

auth    required    /usr/local/lib/pam_pwdfile.so    pwdfile    /path/to/pwd/file

Duo Security (our company) offers an open-source package that supports OTP, phone callback, SMS, and smartphone push authentication for SSH with passwords, pubkey, or any primary auth mechanism - with or without PAM:



Assuming this uses pam, it should be as simple as putting two required modules in /etc/pam.d/. One for Opie, and one for your other auth. (say, normal UNIX password)


Consider using pam-radius. It should compile on BSD. All enterprise-capable two-factor authentication systems support radius. Radius is a very standard standard so you will gain great flexibility.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .