我正在尝试使用 fedora 软件包启用 google 2FA google-authenticator(https://github.com/google/google-authenticator-libpam）。 这是我的/etc/ssh/sshd_config：
# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf
# Authentication:
PermitRootLogin no
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys
# override default of no subsystems
Subsystem sftp /usr/libexec/openssh/sftp-server
ChallengeResponseAuthentication yes
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
这是/etc/pam.d/sshd
#%PAM-1.0
#auth substack password-auth
auth include postlogin
account required pam_sepermit.so
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session optional pam_motd.so
session include password-auth
session include postlogin
auth sufficient pam_google_authenticator.so
重新启动 ssh 守护程序时，出现以下错误：
Oct 31 21:14:10 personal systemd[1]: Starting sshd.service - OpenSSH server daemon...
░░ Subject: A start job for unit sshd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ A start job for unit sshd.service has begun execution.
░░
░░ The job identifier is 8247.
Oct 31 21:14:10 personal sshd[10265]: Disabled method "keyboard-interactive" in AuthenticationMethods list "publickey,keyboard-interactive"
Oct 31 21:14:10 personal sshd[10265]: AuthenticationMethods cannot be satisfied by enabled authentication methods
Oct 31 21:14:10 personal systemd[1]: sshd.service: Main process exited, code=exited, status=255/EXCEPTION
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ An ExecStart= process belonging to unit sshd.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 255.
Oct 31 21:14:10 personal systemd[1]: sshd.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░
░░ The unit sshd.service has entered the 'failed' state with result 'exit-code'.
Oct 31 21:14:10 personal systemd[1]: Failed to start sshd.service - OpenSSH server daemon.
Disabled method "keyboard-interactive"我不知道为什么它即使已启用也会抛出错误。您对我的配置可能出了什么问题有什么想法吗？
答案1
尝试删除您的修改/etc/ssh/sshd_config并输入以下几行/etc/ssh/sshd_config.d/50-redhat.conf（如果此文件存在）：
# This system is following system-wide crypto policy. The changes to
# crypto properties (Ciphers, MACs, ...) will not have any effect in
# this or following included files. To override some configuration option,
# write it before this block or include it before this file.
# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
Include /etc/crypto-policies/back-ends/opensshserver.config
SyslogFacility AUTHPRIV
ChallengeResponseAuthentication yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
UsePAM yes
ChallengeResponseAuthentication yes
PasswordAuthentication yes
PubkeyAuthentication yes
KbdInteractiveAuthentication yes
...
...
如果您需要 PW + 2FA，请将以下行放在底部/etc/pam.d/sshd（也许您不需要 nullok、debug 等）：
auth required pam_google_authenticator.so nullok debug [authtok_prompt=Enter your secret token: ]
如果您只需要 2FA，请在底部备注auth substack password-auth并/etc/pam.d/sshd保留以下行：
auth required pam_google_authenticator.so nullok debug [authtok_prompt=Enter your secret token: ]
就我而言，这适用于 Rocky9 中的 SSSD-AD-Auth + Google-Authenticator-2FA。
答案2
如果指令：
ChallengeResponseAuthentication no
的
KbdInteractiveAuthentication no
位于任何地方，包括/etc/ssh/sshd_config.d/50-redhat.conf都可能导致Disabled method "keyboard-interactive"错误消息。自 OpenSSH 8.6 起，ChallengeResponseAuthentication是 的弃用别名KbdInteractiveAuthentication。