MFA and PubKeys

[Brian Candler]

On 15/11/2024 15:48, Richard Allen via openssh-unix-dev wrote:
> As I understand it, using keys results in the PAM stack not getting
> called and thus something like pam_duo never get's a chance to work in
> that scenario.

No, it depends on how you configure sshd. You can require both ssh key 
auth and PAM auth:

|AuthenticationMethods publickey,keyboard-interactive:pam|

(Note that the methods must be comma-separated, not space-separated, to 
require both).

I don't know about integrating with Duo, but I've it with TOTP from Vault:

https://github.com/candlerb/vault-totp-helper