I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password.
I realise other combinations are possible through
AuthenticationMethods, but this combination does not appear to be possible with that method.
password were independent of PAM,
sshd_config would look like this:
UsePAM yes ChallengeResponseAuthentication yes AuthenticationMethods publickey,keyboard-interactive password,keyboard-interactive
/etc/pam.d/sshd must include the Yubico PAM for SSHD to utilise it:
auth required pam_yubico.so id=foo key=bar
The above example will fail to achieve the desired combinations because password-auth and yubico-auth are performed through the same mechanism (PAM) defined in the same file (
pam.d/sshd) using the same interface (
keyboard-interactive), with the only difference being the later's capability to handle multiple user inputs via challenge-response.
publickey,keyboard-interactive results in publickey + yubikey + password and
password,keyboard-interactive results in yubikey + password + yubikey + password - except it is not possible to satisfy due to
passwords single input limit. Disabling
pam.d/sshd will satisfy the first combination but make the second impossible.
The crux of this problem seems to be both the inability of OpenSSH
AuthenticationMethods to separate PAM requirements from each other, and the inability of PAM to understand SSH publickey auth (which would allow the "publickey OR password" condition to be defined in PAM instead and just use
keyboard-interactive alone in sshd).
Is there another way to achieve this with OpenSSH and pam_yubico.so?
Alternatively if it were possible to distinguish
password mode from
keyboard-interactive mode from within
pam_succeed_if.so could be used to to exclude