On 15/11/2024 15:48, Richard Allen via openssh-unix-dev wrote:
As I understand it, using keys results in the PAM stack not getting
called and thus something like pam_duo never get's a chance to work in
that scenario.
No, it depends on how you configure sshd. You can require both ssh key
auth and PAM auth:
|AuthenticationMethods publickey,keyboard-interactive:pam|
(Note that the methods must be comma-separated, not space-separated, to
require both).
I don't know about integrating with Duo, but I've it with TOTP from Vault:
https://github.com/candlerb/vault-totp-helper
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
