To require more than one step for SSH, set AuthenticationMethods in sshd_config to a sequence such as publickey followed by a second method. Each comma separated list is a set of methods that must all succeed, and space separated lists are alternatives. Enable each method separately, and test with a second session open.
What the setting does
The OpenBSD man page for sshd_config says AuthenticationMethods sets the methods a user must complete. It takes comma separated lists, where each list is a set of methods that must all succeed. The single value any, which is the default, accepts any one method. Valid method names include gssapi-with-mic, hostbased, keyboard-interactive, none, password and publickey.
The man page example is publickey,password publickey,keyboard-interactive. It reads as: public key followed by password, or public key followed by keyboard-interactive. The space separates alternatives, and the comma chains steps.
One more rule from the page: methods must also be enabled separately. Listing keyboard-interactive in AuthenticationMethods does nothing if the server has it turned off.
What counts as a second factor
A key plus a password is two steps, but they are not always independent factors. If the key is stored unprotected on the same laptop that holds your password manager, the gain is small. Better pairings:
- A private key protected by a passphrase, plus a one time code through keyboard-interactive, if your server is set up with a code module.
- A hardware backed key, so the private key cannot be copied off the device.
- A key from a signed-in session plus an approval from a separate device.
Which keyboard-interactive modules exist depends on your system, so follow your distribution's documentation for the code module you choose.
A safe rollout
- Open two sessions to the server. Keep one open for the whole process.
- Edit sshd_config with the new AuthenticationMethods line.
- Run a configuration test with
sshd -t, which checks syntax without restarting. - Reload the service.
- From a third terminal, log in as a test user and confirm it asks for both steps.
- Only then close your safety session.
If you lock yourself out of a remote host, you need console access. Know how to reach it before you start.
Common mistakes
- Setting a new method list but leaving password login on in another block, so users bypass the sequence. Check the effective configuration with
sshd -T. - Applying the setting globally when only admins need it. A Match block can scope rules to a user or group.
- Forgetting service accounts. Automation that logs in with a key alone will fail the moment you require a second step. Give those accounts their own Match block with a tight source address list, using AllowUsers entries of the USER@HOST form with CIDR ranges.
- Testing only from the machine you set it up on.
When this is not the right tool
If you have many hosts and many people, per host settings become hard to maintain. At that scale, consider short lived certificates or a central access broker, and see our post on setting up a bastion host. The goal is the same: make the server demand more than a stolen file.
Quick check
What is the difference between a comma and a space in AuthenticationMethods?
A comma chains methods that must all succeed in order. A space separates alternative lists, any one of which is enough.
Why do my users still log in with only a key?
Another setting or Match block may allow it, or the value may still be any. Print the effective configuration with sshd -T for that user and check which methods apply.
Sources
Last reviewed: 19 October 2026.
