KNEL/KNELServerBuild
2
0
Fork 0
Code Pull Requests Actions Packages Releases 1 Activity

fix(security): enable KbdInteractiveAuthentication for SSH 2FA

Browse Source 
configure_ssh_2fa only enabled the deprecated ChallengeResponseAuthentication
directive (removed as a usable knob in modern OpenSSH; it no longer controls
keyboard-interactive). The base tsys-sshd-config ships
KbdInteractiveAuthentication no, so on Debian 13 (OpenSSH 9.x/10.x)
keyboard-interactive stayed disabled. With AuthenticationMethods set to
"publickey,keyboard-interactive", sshd -t then failed:

  Disabled method "keyboard-interactive" in AuthenticationMethods list ...
  AuthenticationMethods cannot be satisfied by enabled authentication methods

which aborted provisioning under errexit.

Add the modern KbdInteractiveAuthentication yes directive alongside the
legacy one so 2FA works on both current and older OpenSSH.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
mrcharles
2026-07-27 10:37:18 -05:00
parent 21cc6ee54c
commit 40dfda47f2
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ProjectCode/Modules/Security/secharden-2fa.sh
+5
View File
@@ -93,6 +93,11 @@ function configure_ssh_2fa() {
echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG" echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG"
fi fi
if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then
sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \
echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG"
fi
# Enable PAM authentication # Enable PAM authentication
if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then
sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \ sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \