← All posts Networking

SSH MFA prompt missing on Hetzner Cloud Practical Guide

The Tryssh team ·

SSH compresses several trust decisions into one command. When ssh mfa keyboard interactive appears on Hetzner Cloud, the safest shortcut is to identify which decision failed—not to weaken all of them.

TL;DR: The expected TOTP, push, or broker challenge never appears because client methods, sshd AuthenticationMethods, PAM, or non-interactive execution do not align. On Hetzner Cloud, write the required authentication sequence, verify each effective directive and PAM module, test with one recovery account, then roll out with an emergency bypass procedure. Keep an existing recovery path open until the original action succeeds from a fresh session.

Audience: developers, founders, homelab users, and operators who use SSH but may not administer this platform every day. Commands are diagnostic examples; replace names and paths, and test state-changing work on a safe host first.

What ssh mfa keyboard interactive actually means

The expected TOTP, push, or broker challenge never appears because client methods, sshd AuthenticationMethods, PAM, or non-interactive execution do not align. This is narrower than “SSH is broken.” It identifies a boundary that can be tested without rotating every key, restarting every service, or disabling a security control.

On Hetzner Cloud, the environment is a Hetzner Cloud server whose initial root key, cloud firewall, rescue environment, and rebuilt addresses affect SSH identity. That platform fact changes which file, service, identity provider, network rule, or recovery console is authoritative. A copied fix that ignores this layer can appear successful locally while leaving the user-facing path broken.

The primary technical reference for this topic is Ubuntu SSH two-factor authentication. For the platform-specific contract, use Hetzner connection guide. Both are preferable to an undated command copied from a forum because defaults and compatibility behavior change.

Build a precise failure statement

Write down the local machine, effective target hostname and address, SSH user, first observed UTC time, and last known successful attempt. Then finish this sentence: “The connection reaches ___, but fails before ___.”

That sentence separates name resolution, TCP connection, SSH identification, key exchange, host verification, user authentication, channel creation, and the remote program. It also lets another operator reproduce the same path instead of debugging a different machine.

Diagnostic and rehearsal commands for Hetzner Cloud

Run one command at a time from the same account and network that sees the problem. Many lines only inspect state; some deliberately create a test key, import a credential, update local SSH state, or rehearse the documented repair. Read each command first, substitute safe test paths and identities, and do state-changing work only on a disposable or recoverable system.

ssh -vvv -o PreferredAuthentications=keyboard-interactive user@example-host; sshd -T | grep -iE 'authenticationmethods|kbdinteractiveauthentication|usepam'; sed -n '1,200p' /etc/pam.d/sshd
hostnamectl; ip route; systemctl status sshd ssh --no-pager

Record exit status and the first decisive error. Do not include private keys, passphrases, tokens, complete environment dumps, or unredacted authentication logs in a shared transcript.

Interpret the evidence

  • keyboard-interactive is the SSH method commonly used to carry PAM challenges.
  • AuthenticationMethods can require publickey followed by keyboard-interactive in a specific sequence.
  • Batch jobs cannot answer an interactive factor unless a separate machine identity flow exists.
  • PasswordAuthentication no does not necessarily disable PAM keyboard-interactive authentication.
  • The Hetzner Cloud boundary to keep visible is: a Hetzner Cloud server whose initial root key, cloud firewall, rescue environment, and rebuilt addresses affect SSH identity.
  • If a text configuration and runtime output disagree, effective configuration and timestamped runtime logs win.

A good conclusion for this investigation is: “The expected TOTP, push, or broker challenge never appears because client methods, sshd AuthenticationMethods, PAM, or non-interactive execution do not align. Therefore the smallest safe next step is to write the required authentication sequence, verify each effective directive and PAM module, test with one recovery account, then roll out with an emergency bypass procedure.” If the collected facts do not support both halves, keep investigating rather than turning the hypothesis into a change request.

Decision tree

  1. Confirm identity and destination. Expand the configuration and verify hostname, port, user, address, and selected credential.
  2. Classify the boundary. Decide whether the evidence belongs to client state, network transport, SSH negotiation, authentication, session setup, or the invoked program.
  3. Consult the authority. Use the topic reference and the Hetzner Cloud reference for current behavior.
  4. Reproduce once. Match one client attempt to one server or platform event by UTC time and source address.
  5. Disprove the leading explanation. Name one observation that would make it wrong.
  6. Prepare recovery. Keep an existing session, provider console, physical path, or second administrator available.
  7. Apply one narrow change. Write the required authentication sequence, verify each effective directive and PAM module, test with one recovery account, then roll out with an emergency bypass procedure.
  8. Verify externally. Repeat the original user action from a fresh connection and check adjacent security controls still work.

Repair and rollback

Before changing access, capture effective configuration and relevant file metadata. For sshd changes, validate syntax using the platform-supported method before reload. For credentials, record fingerprints rather than secret material. For routing and forwarding, write both endpoints and listening addresses explicitly.

The topic-specific caution is: Do not mandate MFA before every operator has enrolled and a break-glass path has been tested. A rollback must use a path independent of the control being edited. An SSH command that reverts sshd is not a recovery plan when sshd no longer accepts connections.

After recovery, remove temporary exceptions, expire test credentials, close unused forwards, and record ownership. NIST's SSH access-management guidance emphasizes provisioning, termination, and monitoring because unattended keys and forgotten machine access outlive the incident that created them.

Investigate it in Tryssh

Tryssh separates the copilot's SSH exec channel from the visible terminal PTY.

Tryssh is a native macOS SSH workspace built around this evidence-first loop. Hosts and conversations are local, SSH secrets stay in the macOS Keychain, and the copilot cannot type into the visible terminal. Bounded read-only commands can gather evidence; state-changing commands are displayed exactly and wait for human approval.

That design helps someone who knows the symptom but not every platform-specific command. It does not turn the agent into the incident owner. The operator still decides scope, protects sensitive output, validates citations, and owns rollback.

Questions before the change

Is the first error line always the root cause?

No. It is a boundary marker. Correlate it with effective configuration, the same timestamp on the other endpoint, and the platform control plane. The loudest log line may be old or unrelated.

Can Tryssh apply the repair automatically?

It can accelerate read-only evidence collection and draft a precise repair. Authentication, firewall, certificate, account, forwarding, and service changes should remain explicit approvals because their blast radius extends beyond one terminal.

Should this setting be changed globally?

Usually not for an initial repair. Prefer a host, user, Match block, key, or single workflow scope. Expand only after a canary succeeds and the compatibility/security trade-off is documented.

When should the investigation stop?

Stop before changing access if there is no independent recovery path, the target identity is uncertain, or the evidence requires exposing secrets. Establish the missing boundary first.

Limits and trade-offs

This guide cannot observe your provider policy, identity lifecycle, or undocumented appliance behavior. Commands may differ between Unix shells and PowerShell. Managed services can replace local files with IAM, metadata, or generated configuration. First-party documentation remains the authority.

One successful host does not authorize a fleet rollout. Use canaries, bounded concurrency, stop conditions, and separate rollback. Refresh the article date only after commands and citations are materially reviewed.

Related Tryssh guides

Continue with SSH root login denied on Hetzner Cloud Practical Guide, SSH PAM authentication failure on Hetzner Cloud Guide, SSH MFA prompt missing on Akamai Linode Practical Guide, SSH MFA prompt missing on home lab Practical Guide, SSH config guide, SSH hardening checklist. These links cover adjacent problems on the same environment and the same problem across materially different platforms.

Sources

Sources were selected for direct technical authority: upstream OpenSSH or protocol documentation, the named platform owner, and access-management guidance. Product behavior changes, so validate the current version before publishing or executing a repair.

Try it on a host you control

Download Tryssh for macOS and reproduce the diagnostic path on a non-production host. The first 200 agent turns are included to start; the normal SSH terminal does not consume credits.