4 ms·

> Personally I would like to have both, in succession Key files can be password protected. Do you mean "(key+password) + password" or just not aware of passwor

• ds9 13y ago
  Different issue. It is definitely best practice to use a long passphrase to protect every secret key, this is off topic. What I meant was, you connect to the SSH server and authenticate cryptographically (use passphrase locally when prompted) - then you also need a logon + password for the SSH server to complete the authentication. This would reject the internet noise banging on the port, but impose a 2 factor test.
  • tptacek 13y ago
    If you want two factors for SSH authentication, you can and should set up a two-factor auth system, like Duo.
• thwarted 13y ago
  If you can force authentication via both private key and a password, then you're authenticating via both "something you have" (the key), and "something you know" (the password). Having a passphrase on the key protects access to the key, but it doesn't provide any additional levels of authentication to the (remote) system that is requesting authentication — after all, the user could have removed the passphrase from the key file, there's no way for the remote system to know. Unfortunately, there doesn't seem to be a way to require both a key and a passphrase to be entered. There may be a way to do it with some (custom?) pam configuration/modules, but as far as I know, nothing in sshd itself.
  • phamilton 13y ago
    Not sure how robust it would be, but you can set a default shell that would be a simple script requiring log in before launching bash. That would give you both.