To require two sequential checks for an OpenSSH login, place this directive in the server’s effective sshd configuration:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
AuthenticationMethods publickey,passwordThe client must first complete public-key authentication and then enter the account password. A key alone or a password alone is not sufficient. The directive works only when both methods are also enabled elsewhere in the effective configuration.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat AuthenticationMethods publickey,password enforces
AuthenticationMethods defines the authentication methods that must be completed before OpenSSH grants access. In the value publickey,password, the comma creates one sequence: public key first, password second.
OpenSSH offers only the next method in the selected sequence. Because publickey comes first, the user cannot satisfy this policy by entering a password before proving possession of the private key. After the key exchange succeeds, the server offers password authentication.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Whitespace has a different meaning from a comma. Comma-separated methods are all required in that order. Separate whitespace-delimited lists are alternatives; completing any one complete list can be enough. For a strict two-step policy, keep the value as one comma-separated list rather than adding an alternative list unintentionally.
Prerequisites before changing the server
An OpenSSH server and an account password
This policy applies to OpenSSH server authentication. The second factor is the account password handled by the server’s configured password or PAM stack. The exact prompt and password checks therefore depend on the distribution and its authentication configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A working public-key login
Have a normal OpenSSH public/private key pair and make sure the public key is already authorized for the target account. The private key must be available to the client at login time. A software-generated key is sufficient; a hardware-backed key is optional.
Both methods must be enabled
Every method named in AuthenticationMethods must also be explicitly enabled in the effective configuration. Check for settings equivalent to:
PubkeyAuthentication yes
PasswordAuthentication yesDo not assume the main configuration file tells the whole story. OpenSSH installations commonly load included snippets, and defaults and file locations vary by distribution. A later setting, an included file, or a Match block can change the value that applies to a particular connection.
Configure the requirement safely
1. Keep a known-good administrative session open
Do not close your current working SSH connection while changing authentication. If the new policy is malformed or a method is unavailable, the existing session may be the only immediate way to correct the configuration. Keep it open until a separate login has completed both steps.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Inspect the effective configuration
Review the complete server configuration, including included files and any conditional Match sections. On systems that provide it, sshd -T prints the daemon’s effective settings; when a policy is conditional, evaluate it for the relevant user, address, and connection context rather than checking only the global file.
Confirm that public-key and password authentication are enabled for the account you intend to protect. If a distribution uses a different service name or authentication stack, follow that distribution’s documented configuration layout.
3. Add the two-step policy
In the global configuration, add or set:
AuthenticationMethods publickey,passwordPlace the setting where it applies to the intended connection. If an existing AuthenticationMethods line is present, replace it deliberately; leaving competing lines in different included files can make the effective result unclear.
4. Recheck method enablement
Make sure the effective configuration still contains settings equivalent to:
PubkeyAuthentication yes
PasswordAuthentication yesThe directive does not turn either method on by itself. If password authentication is disabled, the server cannot complete the second step even though the sequence names password.
5. Run the daemon’s syntax test
Use the configuration-validation command documented for your distribution before reloading the service. A common OpenSSH installation accepts:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sudo sshd -tA successful syntax check means the file can be parsed; it does not prove that the policy applies to the user you plan to test or that the key and password are usable.
6. Reload, do not terminate the existing service unnecessarily
Reload the SSH service with the command documented by your distribution. Common service managers use a command equivalent to:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo systemctl reload sshdSome distributions register the service under a different name. Use the service name shown by that system’s documentation and confirm that the reload completed without an error.
7. Test from a completely new connection
Open a second terminal or a new connection that is not reusing an existing multiplexed session. Authenticate with the private key. After the key is accepted, verify that the server asks for the account password and that the session opens only after the correct password is supplied.
Test the failure cases as well: a connection without the private key should not reach a successful login, and a wrong password after a valid key should be rejected. Keep the original administrative session open until this new connection has passed the complete sequence.
Global, per-user, and conditional policies
Global enforcement
A global AuthenticationMethods publickey,password setting requires the sequence for every connection to which no more-specific rule applies. This is appropriate when all SSH users should use both factors, but it can also affect service accounts, automation, or recovery accounts that were not prepared for the change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Per-user or group-scoped enforcement
A Match block can apply the requirement only to selected users or another condition supported by the OpenSSH configuration. For example, a user-specific block can contain the same directive while other accounts retain their existing policy:
Match User administrator
AuthenticationMethods publickey,passwordThe exact Match conditions and their interaction with included files depend on the OpenSSH version and distribution. Test the effective configuration for the actual username and connection context. Also remember that settings following a Match line remain conditional until another appropriate scope is reached.
Why staged scope is safer
Applying the rule to one prepared account first limits the blast radius. After that account has successfully completed a fresh key-and-password login, expand the policy to additional users or to the global scope. Maintain a documented recovery path before extending enforcement to administrators who are not present to fix a mistake.
Software keys and hardware-backed FIDO keys
Software-generated OpenSSH keys
A conventional OpenSSH key pair satisfies the public-key portion of the requirement. The private key remains on the client, while the server stores the corresponding public key in the account’s authorized-key configuration. This is the simplest implementation and does not require special server hardware.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →FIDO-backed SSH keys
Current OpenSSH documentation lists FIDO authenticator algorithms including ecdsa-sk and ed25519-sk. A compatible hardware security key can therefore provide the public-key step while keeping the private operation backed by the authenticator.
FIDO hardware is optional, not a prerequisite for two-step SSH login. The same AuthenticationMethods publickey,password policy can use an ordinary software key. Before deploying a FIDO-backed key, verify that the client OpenSSH build, server version, operating system libraries, and security-key support are compatible. Keep an approved recovery method for a lost, damaged, or unavailable authenticator.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Password authentication versus keyboard-interactive and PAM
The method name password refers to password authentication as enabled by the server. A distribution may also use keyboard-interactive authentication to reach PAM modules or another challenge system. Those methods are not interchangeable merely because both can display a prompt.
If your environment uses PAM-based prompts, multi-step challenges, or a policy that disables direct password authentication, determine which method is actually enabled and which method name the server expects. The prompt sequence is controlled by the configured method and PAM stack. Do not assume that replacing password with another method produces the same user experience or the same security property; validate it with a new connection.
Common configuration mistakes and recovery paths
The server accepts a key but never asks for a password
- Check that the effective value is exactly a single sequence containing
publickey,password, not an alternative list that permits the key alone. - Confirm that
PasswordAuthentication yesapplies to the tested user and is not overridden by an included file orMatchblock. - Start a genuinely new connection rather than reusing an already authenticated control session.
The server asks for a password but rejects every attempt
- Verify that the password belongs to the target Linux account and that the account’s password or PAM stack permits interactive authentication.
- Check whether the account is restricted by distribution-specific password, shell, or access policy.
- Inspect the server’s authentication logs using the distribution’s documented location and logging tools while preserving the open administrative session.
The key step fails before a password is offered
- Confirm that the client is offering the intended private key and that the matching public key is authorized for the target account.
- Check that public-key authentication remains enabled in the effective configuration.
- For a FIDO-backed key, verify hardware presence and compatibility before changing the server policy.
The configuration test passes but behavior is unchanged
Syntax validation checks whether the file parses; it does not guarantee that the edited file is the one the running service loaded. Recheck included files, conditional blocks, the service name that was reloaded, and the effective settings for the tested user. Then make a fresh connection.
An administrator is locked out
Keep an existing session, out-of-band console, or other documented administrative path available before rollout. If all SSH sessions are closed and the factors are unavailable, use the system’s console or hosting recovery procedure to restore a known-good configuration. Do not rely on a second SSH attempt when the policy itself is what prevents authentication.
Operational decisions before enforcing two factors
Choose the scope
- Global: simplest to understand, but every affected account must be ready.
- Per-user or conditional: better for staged deployment and exceptions, but requires careful evaluation of
Matchordering and included files.
Plan factor replacement
Document how an administrator receives a replacement software key, how a FIDO authenticator is replaced, and how access is restored if the password is reset or the account’s PAM policy changes. The policy intentionally requires both methods, so losing either one can prevent login even when the other remains valid.
Test the exact client paths
Test the operating systems, SSH clients, key types, and account policies that users actually employ. Confirm the order of prompts, failed-factor behavior, and logging. A successful test with one client does not prove that every distribution, FIDO device, or PAM configuration will present the same prompts.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsConfiguration reference
| Setting or choice | Effect | Important qualification |
|---|---|---|
AuthenticationMethods publickey,password |
Requires public-key authentication followed by password authentication. | Both methods must also be enabled elsewhere in the effective configuration. |
PubkeyAuthentication yes |
Enables the public-key method used by the sequence. | Its effective value can be changed by includes or conditional configuration. |
PasswordAuthentication yes |
Enables the password method used by the sequence. | The actual check and prompt depend on the account password or PAM stack. |
| Software OpenSSH key | Provides the public-key step with a normal private/public key pair. | No hardware authenticator is required. |
| FIDO-backed key | Provides a hardware-backed public-key step using supported -sk algorithms such as ecdsa-sk or ed25519-sk. |
Client, server, operating-system, and authenticator compatibility must be verified. |
| Comma-separated methods | All methods in that sequence must succeed, in order. | Only the next method in the sequence is offered. |
| Whitespace-separated lists | Defines alternative authentication sequences. | An unintended alternative can allow login without both factors. |
Final verification checklist
- The intended users have a working authorized public key.
- The effective configuration enables both public-key and password authentication.
- The policy is exactly
AuthenticationMethods publickey,passwordwherever two factors are required. - Included files and
Matchblocks have been checked for overrides. - The daemon’s syntax/configuration test succeeds.
- The service has been reloaded with the distribution’s documented command.
- A new, independent connection completes the key prompt and then the password prompt.
- The original administrative session remains open until that test succeeds.
- A console or other recovery path exists if a key, authenticator, or password becomes unavailable.
With those checks complete, OpenSSH will grant the protected login only after the user proves possession of the configured private key and then satisfies the account’s password authentication step.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
