More and more secure environments require Multi-Factor Authentication (MFA) to access servers. If your server is configured with PAM (Pluggable Authentication Modules), it will present a keyboard-interactive authentication challenge.
Instead of a simple password prompt, the server sends one or more text prompts sequentially, asking for things like your password, followed by a one-time passcode (TOTP) from Google Authenticator, Duo, or an SMS code.
How keyboard-interactive challenges work
Keyboard-Interactive is an SSH protocol authentication method (keyboard-interactive). It is designed to support arbitrary login dialogs.
During the connection handshake:
- The server asks for username.
- The server prompts:
Password: - The server prompts:
Verification code (2FA):
Because the prompts are dynamic and depend on the server’s PAM module configuration, GUI clients must parse the interactive messages in real-time and render appropriate text input fields.
In Upshell, this is handled by a custom KeyboardInteractiveBridge which maps multi-round authentication challenges into smooth macOS sheets, prompting you for credentials only when requested by the server pipeline.
Verifying host identity (TOFU)
Since 2FA code entry is a high-value authentication step, it is vital to ensure you are not talking to a malicious gateway (MITM attack).
Before you type your OTP code:
- Upshell checks the server’s host key fingerprint.
- If the server’s fingerprint matches the saved one (Trust-On-First-Use), connection proceeds.
- If the fingerprint has changed, Upshell instantly blocks the keyboard input panel, preventing you from typing your credentials.
Step by step in Upshell
- Configure the host — Set the authentication type to Keyboard-Interactive (or SSH key + Interactive if the server requires both key and OTP).
- Connect — When the sheet pops up, type your password.
- Enter OTP — A second prompt will request the 6-digit verification code. Open your authenticator app (like 1Password or Google Authenticator) and enter it to log in.