I'm trying to setup 2 Factor Authentication. I want the user to login successfully if:

  • The public private/public key matches (authentication method: publickey) or the password is correct
  • My pam authentication method is successful.

The second authentication method is a PAM file. So I place it into /usr/lib/pam/ and added auth required my_pam_module.so in /etc/pam.d/sshd.
So far I can either log in using the (publickey method) or (a password and whatever is required by me pam module). So I added AuthenticationMethods publickey,keyboard-interactive in /etc/sshd_config and now I'm required to have the public key, password, and "whatever is required by me pam module".

What lines do I need to change in order to achieve what I described above? I'm using Mac OS X Mavericks (10.9). If you aren't familiar with Mac, it could also help what you'd do on your Linux system.

1 Answer 1


It's quite easy for "publickey->password->your_module" or "password->your_module". Can't find the way to remove password from the first chain

publickey,keyboard-interactive - means that publickey auth will be used and keyboard-interactive after that (kind of logical AND), replace comma with space for logical OR, like

AuthenticationMethods publickey,keyboard-interactive:pam keyboard-interactive:pam

  • When I write keyboard-interactive:pam in the config, I'm getting this error: ssh_exchange_identification: Connection closed by remote host
    – Matt3o12
    Jul 22, 2014 at 11:16
  • Try to run ssh client in verbose mode, it will give you more information what's going wrong. Like, 'ssh -vvv <hostname>' Jul 23, 2014 at 4:55
  • here is the verbose log of ssh: pastebin.com/hXTaCJ6f. You can also find relevant parts of my server log below (the most recent things sshd was reporting). Do I need to replace pam by "my_pam_method"?
    – Matt3o12
    Jul 23, 2014 at 11:56
  • Just wondering, have you added "ChallengeResponseAuthentication yes" and "UsePAM yes" to sshd config? Jul 28, 2014 at 10:54
  • It wasn't set to yes but I changed it, although nothing has changed (still getting the same error). Did it work for you? And if so, what OpenSSL are you using?
    – Matt3o12
    Jul 29, 2014 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.