[Bug] - ssh keyboard-interactive not longger support

[sicute]

Describe the bug I try using Amazon linux 2023 with duo 2fa applicatio linux need update sshd_config :

UsePAM yes
ChallengeResponseAuthentication yes
KbdInteractiveAuthentication yes
UseDNS no

PubkeyAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive

but when i use that config previous working in ami 2 and ubuntu , i get error :

 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal systemd[1]: Reached target sshd-keygen.target.
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal systemd[1]: Starting sshd.service - OpenSSH server daemon...
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal sshd[44718]: Disabled method "keyboard-interactive" in AuthenticationMethods list "publickey,keyboard-interactive"
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal sshd[44718]: AuthenticationMethods cannot be satisfied by enabled authentication methods
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal systemd[1]: sshd.service: Main process exited, code=exited, status=255/EXCEPTION
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal systemd[1]: sshd.service: Failed with result 'exit-code'.
Oct 19 06:26:28 ip-172-31-92-127.ap-southeast-1.compute.internal systemd[1]: Failed to start sshd.service - OpenSSH server daemon.

The error gone with remove keyboard-interactive , but since that can't use 2fa for access amazon linux 2023. any step or clue this 2fa duo can back working ... thanks

• AMI ami-0556fb70e2e8f34b7

• ip-172-31-92-127 ~]$ ssh -V OpenSSH_8.7p1, OpenSSL 3.0.8 7 Feb 2023 [ec2-user@ip-172-31-92-127 ~]$

• https://duo.com/docs/duounix

[szarkos]

Hello,

ChallengeResponseAuthentication is turned off in /etc/ssh/sshd_config.d/50-redhat.conf (inherited from Fedora). Please try enabling this feature by editing that file instead of sshd_config directly, and changing ChallengeResponseAuthentication no to ChallengeResponseAuthentication yes and restarting the OpenSSH service (sudo systemctl restart sshd).

Alternatively you can use the keyword KbdInteractiveAuthentication, which is the more current alias for ChallengeResponseAuthentication.

Thanks!