2
  • I have a server running sshd.
  • I have a secure machine with a ssh key. I want to allow direct public key login to the server with the secure machine's key.
  • I also have a laptop with a different ssh key, which may get compromised if I lose it. I want to require password on top of public key authentication, in case the key has been compromised.

Is this configuration possible to achieve modifying sshd_config?

Please note that this question is not about setting both public key and password for login. Instead I'm looking for a way to choose different combinations depending on the public key.

  • @RubberStamp Please note that this question is not about setting both public key and password for login. Instead I'm looking for a way to choose different combinations depending on which public key is used. – AndresR Apr 7 at 1:17
  • I haven't tried this yet... but, you might get away with putting command="login" in front of the public key listed in ~/.ssh/authorized_keys ... actually, just tried it... it does work... command="login username" ssh-rsa AAAA... – RubberStamp Apr 7 at 1:31
  • @RubberStamp I'm trying login username but, after introducing a wrong password I'm able to login as any user, not just the username. Is there any way to prompt for login for only a given user? – AndresR Apr 7 at 21:41
0

Using MATCH to require multiple authentication methods

Unfortunately, it doesn't appear that sshd_config supports using a given public key as Match criteria. However, if your secure machine and your laptop always connect to the server using separate host addresses, a Match section can be used to require multiple authentication methods for a given user.

Add the following Match section to sshd_config

Match Host laptop.host.ip.addr, User sshuser
    PasswordAuthentication yes 
    AuthenticationMethods publickey,password

Each authentication method needs to be explicitly enabled within the sshd_config configuration. This can be done within the Match section in order to avoid changing global authentication settings.

The AuthenticationMethods option is a list of comma delimited lists. So, AuthenticationMethods publickey,password is different than AuthenticationMethods publickey password. In the former example, both publickey and password authentication are required. In the latter example either publickey or password authentication are required.

  • Unfortunately I dont see a way to match the laptop IP. Could host-based authentication be used to identify the laptop? – AndresR Apr 7 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.