Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For SSH authentication, which is more secure?
2 Factor Authentication using a USB token/Google Authenticator(time based)
Public/private key with password

Or could they be both used at the same time? If it is possible, are there any downsides in using a multi-factor authentication like this?

Also, could anyone post an example or a link to show how I could implement both public key and 2 Factor together if it's possible. Thankyou!

share|improve this question

This is not a "one is better than the other" issue. Both increase the burden of an attacker to break into your system:

  • Using (and enforcing) keys increases the "quality of the password" ("mypassword123" vs "long_binary_asymetric_keypair_here"). Humans are very bad at remembering long passphrases with good entropy.

  • Using 2Factor auth ensures that an attacker would have to get 2 properties under control: one password-mechanism (usual passwords, PK) and another one which is (usually) not at the same physical location as the first one. With 2Factor mode the system you are trying to authenticate against will challenge you a second time after you succeeded at the first challenge. But if both challenges are silly / simple / easy to break the whole 2Factor thingy is pointless.

So, both mechanisms supplement each other.

Good tutorial on the 2Factor part:

Combine that with any other tutorial which explains how to use ssh-keys (and there are LOTS in the internets). The flow of the authentication is then as follows:

  1. Client triggers mechanism to unlock the private ssh-key (password) on his machine
  2. Client contacts Server to ensure public and private key match. From here on the ssh-server is basically not involved in the authentification any more.
  3. Server routes Client to the second challenge
  4. Client responds to the second challenge correctly
  5. Client gets access to the shell on the Server
share|improve this answer
Thanks for writing the flow of authentication. It helps a lot in understanding the process. Coincidentally, I've used that guide to set up Google Auth on a lightweight linux server. – Lelouch Lamperouge Dec 19 '12 at 7:41
I manage to set up private-key auth, and 2 Factor. The problem is that I can only use either one of them. What option do I use in order to check for the PrivateKey first, then prompt user for Google Auth? – Lelouch Lamperouge Dec 23 '12 at 14:55
I did some research into this a little while ago. Unfortunately, OpenSSH doesn't as of yet support the ability to use both, except in a patch for the version distributed with RedHat Enterprise Linux. Your only real options at this point are to use RHEL, or forego package management and build from source, forward-porting the patch. – Stephen Touset Jan 7 '13 at 18:13
@LelouchLamperouge OpenSSH supports using both methods since version 6.3 – Amir Ali Akbari May 1 '14 at 10:23

In addition to the other answer, I can also add that pubkey-based authentication can be 2-factor in itself if your private key is on a smartcard (e.g. OpenPGP card). In my experience, adding google-authenticator at the ssh level makes admin's life too cumbersome -- you have to enter the code each time you need to scp things around. My preferred approach is ssh key on OpenPGP card and google-authenticator when doing sudo.

These two links will be of use to you:

  1. Setting up OpenPGP card to handle your ssh authentication.
  2. Setting up centralized google-authenticator infrastructure.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.