Configuring SSH To Use Both Public Keys and Passwords for 2FA

Lumenyx

4 min read

·

Aug 4, 2025

--

Listen

Share

Recently I had a penetration tester friend of mine tell me that it’s recommended that I switch from the default password-only authentication for SSH to BOTH password and public key authentication.

I’ll show you how I did that with my Linux box.

tardis will be my remote host, and lubuntu will be the server I want to SSH into.

REMOVING PASSWORD-BASED AUTHENTICATION AND REPLACING IT WITH PUBLIC KEY AUTHENTICATION

Firstly you want to configure the sshd_config file on the server to authenticate using public/private key pairs. This file dictates how your server handles incoming SSH connections.

Edit the sshd_config file by using this command:

sudo nano /etc/ssh/sshd_config

Uncomment these lines and change their values to enable both password and public key authentication:

Press enter or click to view image in full size

• PermitRootLogin no: This setting allows the root user to log in via SSH. It’s now configured to block any type of SSH login as root.
• PubkeyAuthentication yes: This setting enables authentication using public keys, which is generally more secure than passwords.
• PasswordAuthentication yes: We want to enable password checking for MFA.
• PermitEmptyPasswords no: This setting prevents users from logging in via SSH if their account has an empty (blank) password.
• UsePAM no: This setting disables the use of Pluggable Authentication Modules (PAM) for authentication, meaning SSH will rely on it’s internal authentication mechanisms instead of external PAM services.
• AuthenticationMethods “publickey,password”: This explicitly limits the allowed authentication methods for SSH connections to BOTH public key and password authentication (the comma means AND).
• AllowUsers lumenyx: This restricts SSH access to the server to only the specified users (lumenyx in this case).

Ensure you save the file with Ctrl+x, then Y, then Enter.

Now restart the SSH service:

sudo systemctl restart ssh

Now your server should require both password and public key authentication.

CREATING SSH KEYS

Have the remote user create an SSH key-pair:

ssh-keygen

If you’re using Windows, the default location that the public and private keys will be stored is C:\Users\[User]\.ssh

• The .pub file will be the public key.
• The file without .pub will be the private key. Ensure that this key does not become known.

USING THE PUBLIC KEY TO SSH INTO THE SERVER

There are two methods that I will show you on how to place the client’s public key within the server. The first method is simple. The second method is overly complicated but it will help you understand some other basic Linux concepts.

The first method is by using this command on the client:

ssh-copy-id [username]@[ip-address-of-server]

This will place your public key within the authorized_keys file.

The second method is a lot more tedious and involves placing the public key in the authorized_keys file manually:

Have the remote user tell you their public key. This is okay as public keys are meant to be known.

Press enter or click to view image in full size

On the server (lubuntu) I went into lumenyx’s home directory, then created the .ssh directory (as it wasn’t there originally) and the authorized_keys file within it:

sudo chown [new owner] [file/directory]
sudo chown :[groupname] [file/directory]
sudo chmod 700 .ssh/

Press enter or click to view image in full size

sudo chown [user] [file/directory]
sudo chown :[group] [file/directory]
sudo chmod 600 authorized_keys

I’m coming across an error where I still cannot sign in:

There could be many reasons why I was denied, so I looked at the logs:

sudo tail -f /var/log/auth.log

What’s cool about the -f option is that it will continue to sniff the logs, and it will update itself in real time if someone made an authentication error.

Press enter or click to view image in full size

Press enter or click to view image in full size

Congratulations! You can now log into your server using both SSH keys and passwords!