To make OpenSSH prompt for an account password for one connection, run ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host, replacing user and host with the remote account and server. This tells the client to prefer password authentication and not offer a public key. It works only if the server permits that method.
Use password authentication for one connection
Run this command in a terminal:
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@hostThe -o option passes configuration settings to the SSH client. PreferredAuthentications=password puts the password method first, while PubkeyAuthentication=no prevents public-key authentication for this connection. OpenSSH describes PreferredAuthentications as the order in which the client should try authentication methods, not a way to enable a method the server has disabled (OpenBSD ssh_config(5)).
As an Amazon Associate I earn from qualifying purchases.
If you want to see what the client and server negotiate, try ssh -v user@host. Add -v up to three times for more detail. OpenSSH documents verbose mode as useful for diagnosing connection, authentication, and configuration problems (OpenBSD ssh(1)).
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Save the preference for one host
To apply the setting when you use a particular SSH alias, add a host block to ~/.ssh/config:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Host myserver
HostName example.com
User alice
PreferredAuthentications password
PubkeyAuthentication noReplace example.com and alice with the server name and account. Connect using the alias:
ssh myserverThe per-user configuration file is ~/.ssh/config. Keeping the options in a matching Host block scopes them to that alias instead of changing how the client connects to every host (OpenBSD ssh_config(5)).
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Know what the client settings can—and cannot—do
These commands control what your client tries; they cannot change the remote server’s authentication policy. The OpenBSD sshd_config(5) manual describes PasswordAuthentication as specifying whether password authentication is allowed. Its current manual lists yes as the default, but distribution settings, included configuration files, or a hosting provider can override it. Check the target server’s own policy rather than assuming that default applies everywhere (OpenBSD sshd_config(5)).
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOn a server you administer, an administrator can allow password authentication with PasswordAuthentication yes in the effective sshd_config configuration. That setting remains subject to other server policy and account controls. The location, included files, validation method, and service reload command vary by operating system and provider; do not assume a configuration change has taken effect without checking the host’s own documentation.
Password and keyboard-interactive are different methods
OpenSSH has separate password and keyboard-interactive authentication methods. Keyboard-interactive can present one or more server prompts and may be backed by PAM or another challenge-response flow. If a server’s expected prompt uses that method, forcing only PreferredAuthentications=password may not work (OpenBSD ssh_config(5); OpenBSD sshd_config(5)).
When the server administrator confirms that keyboard-interactive is the intended route, test it separately:
ssh -o PreferredAuthentications=keyboard-interactive -o PubkeyAuthentication=no user@hostA server may also require multiple methods in sequence. For example, the OpenBSD manual’s AuthenticationMethods example requires a public key before either a password or keyboard-interactive method. A client-side preference cannot bypass that requirement (OpenBSD sshd_config(5)).
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot a password prompt that does not appear
- The server says only public key is available: ask the server administrator whether password and keyboard-interactive authentication are disabled, or whether policy requires a key first. Client options cannot override the server’s allowed methods.
- You use a PAM or one-time-code prompt: ask which method the server expects. It may be keyboard-interactive rather than ordinary password authentication.
- You administer the server: check its effective configuration, including
Includefiles and any user- or host-specificMatchrules. The applicable settings can depend on those rules; inspection and reload commands vary by operating system. - You are logging in as root: the current OpenBSD manual lists
PermitRootLogin prohibit-passwordas its default, which disables password and keyboard-interactive login for root under that setting. Other operating systems and managed images may use different policies.
Which approach should you use?
| Approach | Scope | Who controls it | Use it when |
|---|---|---|---|
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host |
One command | Your client settings | You want to try password authentication for a single connection. |
A matching Host block in ~/.ssh/config |
Connections using that alias | Your client settings | You want the preference saved for one host. |
| Server-side authentication configuration | Accounts and connections governed by the server’s policy | The server administrator or provider | Password authentication is disabled, or the server requires a different authentication flow. |
These options change the authentication method, not the encryption of the SSH connection. Whether a login succeeds still depends on the remote account and server policy. The OpenSSH manuals cited here reflect the OpenBSD manuals available on October 4, 2026; defaults and configuration details are not guaranteed to be identical on every Linux distribution, BSD release, or cloud image (OpenSSH manual index).
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
