From 40dfda47f2fb16b695bf7b4248a2ce9c0c11eb5d Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 27 Jul 2026 10:37:18 -0500 Subject: [PATCH] fix(security): enable KbdInteractiveAuthentication for SSH 2FA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit configure_ssh_2fa only enabled the deprecated ChallengeResponseAuthentication directive (removed as a usable knob in modern OpenSSH; it no longer controls keyboard-interactive). The base tsys-sshd-config ships KbdInteractiveAuthentication no, so on Debian 13 (OpenSSH 9.x/10.x) keyboard-interactive stayed disabled. With AuthenticationMethods set to "publickey,keyboard-interactive", sshd -t then failed: Disabled method "keyboard-interactive" in AuthenticationMethods list ... AuthenticationMethods cannot be satisfied by enabled authentication methods which aborted provisioning under errexit. Add the modern KbdInteractiveAuthentication yes directive alongside the legacy one so 2FA works on both current and older OpenSSH. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush --- ProjectCode/Modules/Security/secharden-2fa.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ProjectCode/Modules/Security/secharden-2fa.sh b/ProjectCode/Modules/Security/secharden-2fa.sh index f94352d..7b5584c 100644 --- a/ProjectCode/Modules/Security/secharden-2fa.sh +++ b/ProjectCode/Modules/Security/secharden-2fa.sh @@ -92,6 +92,11 @@ function configure_ssh_2fa() { sed -i 's/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' "$SSH_CONFIG" || \ echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG" fi + + if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then + sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \ + echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG" + fi # Enable PAM authentication if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then