ssh -o PreferredAuthentications: What's the difference between "password" and "keyboard-interactive"?

The SSH protocol has numerous authentication methods. The password and keyboard-interactive are two of them.

The password authentication is a simple request for a single password. There's no specific prompt sent by the server. So it's the client that chooses how to label the prompt (The "user@host's password" prompt is from the OpenSSH clients, like ssh, sftp, etc).

The keyboard-interactive authentication is a more complex request for arbitrary number of pieces of information. For each piece of information the server sends the label of the prompt. Moreover it allows the server to provide lenghty description of the overall "form". The server can also specify, which inputs are secret (needs to be obfuscated when user types them) and which are not.

Though in majority of cases the keyboard-interactive authentication is used to request a single "secret" password prompt, so there's hardly any difference to the password authentication.

That's the difference from protocol perspective.


From implementation perspective, with OpenSSH server, the keyboard-interactive authentication can be hooked to two-factor (or multi-factor) authentications, e.g. provided by generic PAM mechanism or Kerberos.

From client perspective, another difference is localization. With password authentication, the client can localize the "Password" label, because it knows the server is asking for a password. With keyboard-interactive authentication, even when the server is asking just for a single password, the client cannot localize the prompt (unless it employs AI), because it's a generic prompt.