How do I configure sshd to 1) require public key and 2) require a password for login? Note that I am not referring to the symmetric encryption of the client's key here. I am referring to a server-side password.
Is this possible?
The linked answer in the other answer is really old and there are many changed things since then. So once again:
If you read through the manual page for
sshd_config(5), there is option
AuthenticationMethods, which takes the list of methods you need to pass before you are granted access. Your required setup is:
This method should work all the current Linux systems with recent openssh (openssh-6, openssh-7).
The only exception I know about is RHEL 6 (openssh-5.3), which requires setting different option with same values (as described on information security answer):
If you're using recent versions of RHEL (Red Hat Enterprise Linux) or Fedora, see the accepted answer to this question. That solution may work on other distributions as well, if your SSH daemon is new enough.