Keyboard-interactive authentication(RFC 4256), which is implemented as ChallengeResponseAuthentication in OpenSSH configuration file, allows one to chain multiple authentication methods. For example password and TOTP. Is it also possible to chain multiple passwords, i.e. when user connects to a server, then he is asked for password1 and then for password2? Or does this depend solely on PAM modules and PAM configuration? The reason I ask is that such setup would break most if not all automatic SSH brute-force tools while still does not require user to have anything.

2 Answers 2


Answer is yes. You are pointing to the correct target, but you miss few pieces:

Using ChallengeResponseAuthentication, you can define more authentication methods, but to make sure they are requested from user, you need to specify the list of them in AuthenticationMethods, for example like this in sshd_config (doing pam two times is just example to try how does it work):

ChallengeResponseAuthentication yes
AuthenticationMethods keyboard-interactive:pam,keyboard-interactive:pam

But to note, you can do the same only in PAM by adding additional method into /etc/pam.d/sshd.

As a footnote, yes. It would probably make most of the normal ssh scans fail. But brute-force attacks, if they are targeted, can guess one or two passwords. It doesn't matter. But all of them will still waste your computer time. And you still need strong passwords, if you don't want to disable them (which should be preferred).


Theoretically it is possible, but using something like a Radius server for one of the two authentications. Otherwise it should draw a second database for password2.

But if the intention is to avoid the automated brute force tools I believe that the best approach is that of security through obscurity, or quite simply, to change the standard port for ssh from 22 to, for example, 2233. To me this solution worked and the "attacks" brute force are completely gone ...

  • 4
    Readers should note that "security through obscurity" usually means "ignoring Kerckhoffs's principle" and is almost always a bad idea. An idea like this one might better be described as "avoiding the low-level attackers". It's useful, but beware a false sense of security: it won't fool a skilled attacker for long.
    – Tom Zych
    Nov 5, 2015 at 10:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .