OMV 8 / Debian 13: KbdInteractiveAuthentication yes ignored, effective config always no (sshd -T)

aLitschgy · Apr 1st 2026

Environment

OpenMediaVault: 8.1.5-1
Debian: 13
OpenSSH server: OpenSSH_10.0p2 Debian-7+deb13u1, OpenSSL 3.5.5 27 Jan 2026
Date observed: 2026-04-01

Problem

I’m trying to enable SSH keyboard-interactive authentication (for PAM TOTP / Google Authenticator prompts).

Even with explicit configuration set to yes, effective SSH config remains kbdinteractiveauthentication no.

This prevents interactive OTP prompts (password + OTP as separate prompts), which worked before upgrade (Debian 11).

What I configured

/etc/ssh/sshd_config.d/99-custom.conf:

Code

UsePAM yes
PubkeyAuthentication yes
PasswordAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods any

Also tried OMV environment overrides in /etc/default/openmediavault:

Code

OMV_SSHD_KBDINTERACTIVEAUTHENTICATION="yes"
OMV_SSHD_CHALLENGERESPONSEAUTHENTICATION="yes"
OMV_SSHD_USEPAM="yes"
OMV_SSHD_PASSWORDAUTHENTICATION="yes"
OMV_SSHD_PUBKEYAUTHENTICATION="yes"

Observed behavior

Config syntax is valid:

Code

sshd -t
# no error

But effective config still says keyboard-interactive is disabled:

Code

sshd -T | grep -Ei 'kbdinteractiveauthentication|challenge|usepam|passwordauthentication|pubkeyauthentication|authenticationmethods'
usepam yes
pubkeyauthentication yes
passwordauthentication yes
kbdinteractiveauthentication no
authenticationmethods any

No SSHD options are injected from systemd/defaults:

Code

cat /etc/default/ssh
SSHD_OPTS=

systemctl show ssh -p Environment
Environment=

Service unit:

Code

systemctl cat ssh.service
# ExecStart=/usr/sbin/sshd -D $SSHD_OPTS

Includes/overrides checked:

Code

grep -RniE '^\s*KbdInteractiveAuthentication|^\s*Match\b|^\s*Include\b' /etc/ssh/sshd_config /etc/ssh/sshd_config.d
/etc/ssh/sshd_config:34:Include /etc/ssh/sshd_config.d/*.conf
/etc/ssh/sshd_config.d/99-custom.conf:4:KbdInteractiveAuthentication yes

Expected behavior

If KbdInteractiveAuthentication yes is set (and no later override exists), sshd -T should show:

Code

kbdinteractiveauthentication yes

Actual behavior

sshd -T always reports:

Code

kbdinteractiveauthentication no

Impact

Cannot use interactive PAM OTP flow (Google Authenticator prompt) after upgrading to OMV 8 / Debian 13, although it worked previously on Debian 11.

Request

Please confirm if this is:

an OMV 8 ssh deploy template issue,
an OMV policy intentionally forcing this to no,
or a Debian/OpenSSH 10 interaction/regression.

If intentional, please document supported MFA path for OMV 8 when keyboard-interactive is unavailable.

Thank you

votdev · Apr 1st 2026

Add the custom values into the "Extra Options" field.

aLitschgy · Apr 1st 2026

I removed my file /etc/ssh/sshd_config.d/99-custom.conf and added the configuration into the "extra options" field as recommended.

Now my configuration is in /etc/ssh/sshd_config

Code

# This file is auto-generated by openmediavault (https://www.openmediavault.org)
# WARNING: Do not edit this file, your changes will get lost.


Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
StrictModes yes
IgnoreRhosts yes
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
AcceptEnv LANG LC_* COLORTERM NO_COLOR
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
AllowGroups root _ssh
AddressFamily any
Port 22
PermitRootLogin no
AllowTcpForwarding no
Compression no
PasswordAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /var/lib/openmediavault/ssh/authorized_keys/%u
PubkeyAuthentication yes
UsePAM yes
PubkeyAuthentication yes
PasswordAuthentication yes
KbdInteractiveAuthentication yes
AuthenticationMethods any

Display More

However the problem persit as KdbInteractiveAuthentification is still set to no

Code

sshd -T | grep -Ei 'kbdinteractiveauthentication'
#kbdinteractiveauthentication no

votdev · Apr 1st 2026

Sounds impossible, but maybe a bug in sshd. As you see the config is correct. Have you checked for a typo?

cubemin · Apr 2nd 2026

I'm seeing in line 16: ChallengeResponseAuthentication no

A quick Google search seems to suggest that this is a deprecated alias for KbdInteractiveAuthentication - maybe it's overriding the latter option.

You could try removing it from sshd_config, but I'm guessing that change wouldn't be permanent.

In any case, I thought this might help.

votdev · Apr 2nd 2026

Fixed in openmediavault 8.2.0, see https://github.com/openmediava…92541a371520e381108175f02.

aLitschgy · Apr 2nd 2026

Quote from cubemin

I'm seeing in line 16: ChallengeResponseAuthentication no
A quick Google search seems to suggest that this is a deprecated alias for KbdInteractiveAuthentication - maybe it's overriding the latter option.
You could try removing it from sshd_config, but I'm guessing that change wouldn't be permanent.
In any case, I thought this might help.

Very helpful for now until the next version is available. ChallengeResponseAuthentication seems indeed to overwrite KbdInteractiveAuthentication

Thirawyn · Sep 2nd 2026

Hello,

I am encountering the same issue with the command:

sudo omv-env set OMV_SSHD_KBDINTERACTIVEAUTHENTICATION "yes"

This command line does not replace the "KbdInteractiveAuthentication no" line in the file /etc/ssh/sshd_config; instead, it simply appends the line "KbdInteractiveAuthentication yes" to the end of the file.

The same thing happens if I add the line as an option via the GUI.

At first glance, it appears that the first line is the one that takes effect.

OMV version : 8.5.7-1 (Synchrony)

Regards

votdev · Sep 2nd 2026

Quote from Thirawyn

it simply appends the line "KbdInteractiveAuthentication yes" to the end of the file.

That is only possible when you have added the line to the Extra Options field on the SSH service page. See https://github.com/openmediava…/files/sshd_config.j2#L35 also.

Quote from Thirawyn

sudo omv-env set OMV_SSHD_KBDINTERACTIVEAUTHENTICATION "yes"

You need to deploy the configuration with omv-salt deploy run ssh according to the docs.

Thirawyn · Sep 2nd 2026

Quote from votdev

That is only possible when you have added the line to the Extra Options field on the SSH service page. See https://github.com/openmediava…/files/sshd_config.j2#L35 also.

You need to deploy the configuration with omv-salt deploy run ssh according to the docs.

Thanks but I deply config with the command omv-salt deploy run ssh

Before deploy:

root@omv:~# cat /etc/ssh/sshd_config

# This file is auto-generated by openmediavault (https://www.openmediavault.org)

# WARNING: Do not edit this file, your changes will get lost.

Protocol 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

SyslogFacility AUTH

LogLevel INFO

LoginGraceTime 120

StrictModes yes

IgnoreRhosts yes

HostbasedAuthentication no

PermitEmptyPasswords no

KbdInteractiveAuthentication no

X11Forwarding yes

X11DisplayOffset 10

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes

AllowGroups root _ssh

AddressFamily any

Port 20022

PermitRootLogin no

AllowTcpForwarding yes

Compression yes

PasswordAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /var/lib/openmediavault/ssh/authorized_keys/%u

PubkeyAuthentication yes

# Include behaves slightly differently here than usual, since the above

# settings take precedence over all others.

Include /etc/ssh/sshd_config.d/*.conf

After Deploy no change the line KbdInteractiveAuthentication stay "no"

root@omv:~# cat /etc/ssh/sshd_config

# This file is auto-generated by openmediavault (https://www.openmediavault.org)

# WARNING: Do not edit this file, your changes will get lost.

Protocol 2

HostKey /etc/ssh/ssh_host_rsa_key

HostKey /etc/ssh/ssh_host_ecdsa_key

HostKey /etc/ssh/ssh_host_ed25519_key

SyslogFacility AUTH

LogLevel INFO

LoginGraceTime 120

StrictModes yes

IgnoreRhosts yes

HostbasedAuthentication no

PermitEmptyPasswords no

KbdInteractiveAuthentication no

X11Forwarding yes

X11DisplayOffset 10

PrintMotd no

PrintLastLog yes

TCPKeepAlive yes

AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

UsePAM yes

AllowGroups root _ssh

AddressFamily any

Port 20022

PermitRootLogin no

AllowTcpForwarding yes

Compression yes

PasswordAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /var/lib/openmedia

PubkeyAuthentication yes

# Include behaves slightly differently here than usual, since the above

# settings take precedence over all others.

Include /etc/ssh/sshd_config.d/*.conf

root@omv:~#

I need to change directly the file to accept 2FA

votdev · Sep 2nd 2026

Please read the docs how to correctly use omv-env set. The importan-- is missing.

Thirawyn · Sep 2nd 2026

Quote from votdev

Please read the docs how to correctly use omv-env set. The importan-- is missing.

Thanks,

I use :

Code

# monit restart omv-engined
# omv-salt stage run prepare
# omv-salt stage run deploy

and now it's fine

OMV 8 / Debian 13: KbdInteractiveAuthentication yes ignored, effective config always no (sshd -T)

ryecoaaron Apr 1st 2026

votdev Apr 1st 2026

votdev Apr 2nd 2026

Participate now!