0

I want to set the authentication order when a user wants to log in.

Match User user
    PasswordAuthentication no
    MaxAuthTries 5
    AuthenticationOrder "publickey,password"
Match all
    PasswordAuthentication yes
    AuthenticationMethods "publickey,password" "publickey,keyboard-interactive"

I want to set for user, if he doesn't have publickey, then use the password. If he has publickey then logs in.

All user needs to have a publickey and a password to log in.

1 Answer 1

0

You could try modifying the Allow User user section like so:

Match User user
    PasswordAuthentication yes
    MaxAuthTries 5
    AuthenticationMethods publickey password

When you list authentication methods as a comma-separated list the user must complete all of the listed methods. Listing the methods as a space-separated list will try each method until one is successful. So in my suggestion if publickey authentication is successful the user is given access, if it does not work it will ask for a password.

Also make sure to change the PasswordAuthentication bit to yes since you have to explicitly enable any authentication method listed.

Check out the sshd man page for more info: OpenSSH sshd_config man page#AuthenticationMethods

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .