iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To require two sequential checks for an OpenSSH login, set AuthenticationMethods publickey,password in the server’s effective sshd configuration. The client must first prove possession of an accepted private key and then complete the account’s password check. Authentication is not granted if either step fails.
Before changing the policy, keep a working administrator session open. Distribution defaults, included configuration files, service names, and password/PAM behavior vary, so verify the effective configuration and test a separate new connection before closing your original session.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
What the setting does
AuthenticationMethods defines the authentication methods that must be completed before OpenSSH grants access. The comma-separated value publickey,password creates one required sequence:
- The server offers public-key authentication.
- The client proves that it controls the private key corresponding to an authorized public key.
- Only after that succeeds does the server offer password authentication.
- The account password check must then succeed.
A failed key step prevents the password step from completing. A successful key step followed by an incorrect password also denies the login.
#1 Best Overall
Commas mean “all of these”; spaces mean alternatives
In an AuthenticationMethods value, commas join methods that must all succeed in sequence. Separate, space-delimited lists are alternatives. Therefore, publickey,password requires both methods, while separate alternatives can allow one complete list or another. This distinction is easy to miss and is the most important syntax detail in the policy.
The order is enforced
With publickey,password, the password cannot be completed first. OpenSSH offers only the next method in the selected sequence. A client cannot satisfy the requirement by supplying a password and skipping the key.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePrerequisites and decisions before editing
Confirm that the server uses OpenSSH
The directive belongs to the OpenSSH server. Confirm that the machine’s SSH daemon supports AuthenticationMethods and that you are editing the configuration read by that daemon, not a client-only configuration file.
Have a working key login
Use a normal OpenSSH public/private key pair, or an optional FIDO-backed key. The public key must already be accepted for the target account, and the client must be able to use the corresponding private or hardware-backed key. Do not begin by disabling password access or closing your only administrative session.
Decide where the rule should apply
A global rule affects every account covered by the server configuration. A rule inside an applicable Match block can limit the requirement to a user, group, address, or other condition supported by the daemon. Start with a narrow scope when you are validating the policy, then expand it only after a separate test login succeeds.
Choose the password method deliberately
The password method uses the account password processing configured for the server, which may involve the distribution’s password or PAM stack. Prompt wording and additional checks can therefore differ between distributions. Keyboard-interactive/PAM is a distinct authentication method; do not substitute it for password unless you intentionally want that different behavior and have enabled it in the effective configuration.
Free tools Windows power users keep installed
One-click scans. No signup required.
Inspect the effective SSH configuration
OpenSSH can read a main configuration file plus included snippets and conditional Match sections. The setting you see in one file may not be the setting that applies to a particular connection. Inspect the complete effective configuration for the target user and connection conditions before editing.
- Locate the main server configuration used by your distribution. It is commonly under
/etc/ssh/, but the exact path and included-file layout vary. - Review any
Includesnippets, drop-in directories, andMatchblocks. - Check the effective values of
PubkeyAuthentication,PasswordAuthentication, andAuthenticationMethods. - Look for a later or more specific rule that overrides an earlier global value.
For a read-only effective-configuration check, distributions commonly provide the daemon’s expanded configuration query, often invoked as sshd -T with the appropriate connection-test options. Use the syntax and options documented for your installed OpenSSH version. The important result is that the target connection has public-key and password authentication enabled, and that the intended AuthenticationMethods value is effective.
Rank #2
Configure the two-step requirement
1. Keep an emergency session open
Connect through SSH as an administrator and leave that session running. If the new policy is invalid or a key is rejected, the existing session normally remains usable, giving you a way to correct the configuration.
2. Back up the configuration
Make a restorable copy of the server configuration and note which included file you are changing. This is especially important when a distribution manages drop-ins separately from the main file.
Recommended Free Tools
3. Enable both methods
In the effective configuration, ensure that settings equivalent to the following are enabled:
PubkeyAuthentication yes
PasswordAuthentication yesDo not assume that a compiled default or a setting in another file is sufficient. OpenSSH’s rule is that every method named in AuthenticationMethods must also be explicitly enabled in the applicable configuration.
4. Add the ordered policy
Add this directive in the global section or in the intended Match scope:
AuthenticationMethods publickey,passwordKeep the value on one logical line. If another applicable AuthenticationMethods line exists, determine which one wins for the target connection and remove or adjust conflicting policy rather than leaving the result ambiguous.
5. Save without terminating the current session
Saving the file does not change an already-established connection. It does change what a new connection will be allowed to do after the daemon reloads, so continue to use the open session for recovery until testing is complete.
Validate and reload safely
Run the daemon’s configuration test
Use the syntax/configuration test supplied by your distribution before reloading. A common OpenSSH invocation is:
sudo sshd -tThe exact command, binary path, and privilege requirements can differ. A successful test means the file can be parsed; it does not prove that the selected account has a usable authorized key or that the password stack will accept the account password.
Reload rather than restart when supported
Use the service-management command documented for your distribution to reload the SSH daemon. A common systemd form is:
sudo systemctl reload sshdSome systems use a different unit name, such as ssh, or a different service manager. Use the name that controls the running daemon. A reload applies the configuration to new connections while avoiding unnecessary termination of existing sessions.
Open a completely new connection
From a second terminal, start a new SSH connection to the server. Do not rely on an existing connection, connection multiplexing, or an agent session that bypasses the normal test. The expected interaction is:
- The client offers the configured public key.
- The server accepts the key authentication.
- The server then requests the account password.
- Access opens only after the password succeeds.
Test both a successful login and a deliberate wrong-password attempt. Also test from the client environment that administrators will actually use, because key agents, FIDO devices, and client configuration can affect which key is offered.
Close the old session only after success
Keep the original administrative connection until the separate test has completed the key and password steps and reached the expected account. Only then close the recovery session.
Software keys versus FIDO-backed keys
| Implementation | What satisfies the public-key step | Operational considerations |
|---|---|---|
| Software OpenSSH key | A normal public/private key pair, with the public key authorized for the account | Usually the simplest path; protect and back up the private key according to your organization’s procedures. |
| FIDO-backed OpenSSH key | A compatible hardware authenticator using an OpenSSH security-key algorithm such as ecdsa-sk or ed25519-sk |
Requires compatible hardware and client/server support. The device must be available whenever the two-step login is performed. |
Both choices satisfy the public-key portion of publickey,password. A hardware key is optional; ordinary software-generated OpenSSH keys meet the configuration requirement. FIDO-backed keys can add a separate physical possession requirement, but they also create a recovery dependency if the device is lost, damaged, or unavailable.
Global, per-user, and conditional policies
Global enforcement
Place the directive in the global server configuration when every applicable account must complete both methods. This is straightforward to reason about, but it also means that a mistake affects every account covered by the daemon.
Per-user enforcement
For a pilot or for accounts that require stronger login controls, put the directive in the appropriate user-specific Match block:
Match User administrator
AuthenticationMethods publickey,passwordThe exact block syntax and the way subsequent settings return to global scope depend on the rest of the file. Review the effective configuration for the named user rather than assuming that the block applies as intended.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Group or connection-based enforcement
An organization may apply the same sequence to a group or to selected connection conditions. Treat each condition as a separate policy: verify which users match, which included files are read, and whether a later conditional rule changes the methods.
How to diagnose a failed login
No password prompt appears
- The key step failed. Check that the client is offering the intended key and that its public half is authorized for the account.
- Password authentication is disabled. Confirm the effective
PasswordAuthentication yesvalue for the connection. - A conditional rule changes the policy. Inspect included files and
Matchblocks for the target user and source. - The client is reusing a different connection. Start a fresh session without multiplexing so that both stages are negotiated again.
The server rejects the configuration during validation
Restore the last known-good copy through the open administrative session, correct the syntax, and rerun the daemon’s configuration test. Common causes include a misspelled directive, an incorrectly placed conditional block, or an unsupported method name.
The key works but the password is rejected
The two factors are independent checks. Verify the account name, password, expiration or lock state, and the configured password/PAM stack using your distribution’s normal administrative procedures. A successful key does not bypass the account’s password policy.
The password works when tested alone
A standalone password test does not prove the combined policy. The server must advertise and enforce the sequence for a new connection, and the public-key method must be enabled for the same account. Check the effective AuthenticationMethods value rather than testing only one factor.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe hardware key is unavailable
A FIDO-backed key cannot complete the public-key step without the compatible authenticator. Keep an approved recovery path, such as a separately protected software key or an administrative console, before making hardware presence mandatory. Do not remove your only usable factor while testing.
An administrator is locked out
Use the still-open session, an out-of-band console, or the organization’s documented recovery channel to restore a known-good configuration. Once access is restored, verify the key, password, and conditional scope separately before reapplying the two-step rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security and availability trade-offs
Two checks are stronger than one, but not automatically independent
Requiring a key and a password blocks an attacker who has only one of them. The protection is less independent if both credentials are stored on the same compromised workstation or if the private key is left unprotected. A hardware-backed key can separate possession of the authenticator from knowledge of the password, but it introduces device availability and recovery requirements.
Plan recovery before enforcement
- Maintain at least one tested administrative recovery path.
- Keep a second authorized factor available under controlled procedures when policy permits.
- Document who can replace an unavailable key and how the account is re-enrolled.
- Test the recovery process without deleting the working factor.
Apply the narrowest scope that meets the requirement
A global rule is appropriate when every SSH account must use both methods. A Match-scoped rule is safer for staged deployment or for accounts with different operational needs. Whichever scope you select, record it and verify the effective result for representative accounts.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Verification checklist
- There is an active administrative session that has not been closed.
- The target account has a working authorized public key.
PubkeyAuthenticationis enabled for the target connection.PasswordAuthenticationis enabled for the target connection.AuthenticationMethods publickey,passwordis effective in the intended scope.- Included files and conditional blocks have been reviewed.
- The daemon’s syntax/configuration test passes.
- The SSH service has been reloaded using the distribution’s documented command.
- A separate, fresh connection prompts for the key step and then the password.
- A deliberate wrong-password test is rejected.
- The recovery path remains available until verification is complete.
What this policy does not change
This setting does not create a new password, generate an SSH key, or replace account authorization. It combines two authentication methods that must already be configured and enabled. It also does not make every SSH connection a two-factor login if another conditional rule selects a different authentication list for that connection.
Likewise, it does not guarantee a particular prompt layout. The key may be handled by an agent, a desktop prompt, or a FIDO authenticator, while the password may be requested by the SSH client or by the configured PAM stack. The enforceable outcome is the successful completion of both methods, not a specific visual prompt.
Frequently Asked Questions
What exact line requires both an SSH key and a password?
Use AuthenticationMethods publickey,password in the effective OpenSSH server configuration, with both public-key and password authentication enabled.
Can a user enter the password before the SSH key?
Not with this sequence. OpenSSH offers only the next method, so public-key authentication must succeed before the password method is offered.
Does an existing SSH session get disconnected after a reload?
A reload normally applies the new policy to new connections while leaving established sessions in place. Keep an existing administrative session open until a fresh login has been verified.
Can a FIDO security key satisfy the SSH-key part?
Yes, if the client and server support OpenSSH security-key algorithms such as ecdsa-sk or ed25519-sk. Hardware is optional; a normal OpenSSH key pair also satisfies the public-key step.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
