ssh -o PreferredAuthentications: What's the difference between "password" and "keyboard-interactive"?

Question

Both PreferredAuthentications=password and PreferredAuthentications=keyboard-interactive would prompt for the password, so what's the difference between them?

I Google'd with the keywords ssh PreferredAuthentications password keyboard-interactive difference but found no answers.

The only difference I noticed is the prompt strings (user@host's password: vs. Password:):

$ ssh -o PreferredAuthentications=password,keyboard-interactive my-host
root@my-host's password:
Password:
Permission denied (gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive).

---

UPDATE (2018-04-09):

For easy reference, the following is from the SSH:TDG book as mentioned in jouell's answer.

"keyboard-interactive" user authentication is intended primarily to accomodate PAM authentication on the server side. It provides for a multiple challenge-response dialog with the user in which the server sends a text query to the user, the user types in a response, and this process can repeat any number of times. So for example, you might configure PAM for SSH with a module which performs authentication using an RSA security token, or a one-time password scheme. People become confused by this because by default, "keyboard-interactive" authentication usually just implements password authentication in a single challenge-response cycle, which just prompts for a password, thus looking exactly the same as "password" authentication. If you're not deliberately using both for different purposes, you may want to disable one or the other to avoid end-user confusion.

Answer 1

The SSH protocol has numerous authentication methods. The password and keyboard-interactive are two of them.

The password authentication will only ever ask for a single password. There's no specific prompt sent by the server. So it's the client that chooses how to label the prompt (The "user@host's password" prompt is from OpenSSH clients, like ssh, sftp, etc).

The keyboard-interactive authentication is a more complex request for arbitrary number of pieces of information. For each piece of information the server sends the label of the prompt. Moreover it allows the server to provide lenghty description of the overall "form". The server can also specify which inputs are secret (need to be obfuscated when user types them) and which are not.

The latter is often simply used to request a single "secret" password prompt, so you will often find that there is hardly any apparent difference to password authentication on the user side.

That's the difference from a protocol perspective.

---

From implementation perspective, with OpenSSH server, the keyboard-interactive authentication can be hooked to two-factor (or multi-factor) authentications, e.g. provided by generic PAM mechanism or Kerberos.

From a client perspective, another difference is localization. With password authentication, clients can localize the "Password" label, because they know the server is asking for a password. With keyboard-interactive authentication, even when the server is only asking for a single password, clients cannot localize the prompt (unless they employ AI), because it's a generic prompt.

Answer 2

You already know what 'password' is. From a very high level (not brick level protocol stuff) , think of 'keyboard-interactive' as the method that you to use 2FA using Radius and/or SecurID etc. It provides for challenge and response dialogs: ssh.com has a nice short description on it. It goes a steps further to highlight keyboard-interactive is the umbrella which password falls under. Respectfully to the authors, it's bit confusing.

Also see the Snail Book definition. We use this frequently for our RSA protected boxes.