title: How to Setup SFTP with Publickey and Password on Ubuntu
body: <p>I am having difficulty setting up "SFTP Only" login with two factor authentication of "Public Key" and "Password".</p>
  
  <p>I am running on Ubuntu 16 and using openssh-server.</p>
  
  <p>Regular users are able to log in successfully using a Public Key and Password. However, my "SFTP Only" users are getting errors logging in.</p>
  
  <p>vim /etc/ssh/sshd_config</p>
  
  <pre><code>AuthenticationMethods publickey,password
  PubkeyAuthentication yes
  PasswordAuthentication yes
  
  Match Group sftponly
      ChrootDirectory /home/%u
      ForceCommand internal-sftp
      X11Forwarding no
      AllowTcpForwarding no
  </code></pre>
  
  <p>Other System Commands:</p>
  
  <pre><code>addgroup --system sftponly
  usermod -G sftponly username
  usermod -s /bin/false username
  service ssh restart
  </code></pre>
  
  <p>Below is a WinSCP log of one of my "SFTP Only" user login attempts.</p>
  
  <pre><code>. 2019-02-01 13:45:42.060 --------------------------------------------------------------------------
  . 2019-02-01 13:45:42.060 WinSCP Version 5.13.4 (Build 8731) (OS 10.0.17134 - Windows 10 Enterprise)
  . 2019-02-01 13:45:42.060 Configuration: HKCU\Software\Martin Prikryl\WinSCP 2\
  . 2019-02-01 13:45:42.060 Log level: Normal
  . 2019-02-01 13:45:42.060 Local account: MY-PC\User
  . 2019-02-01 13:45:42.060 Working directory: C:\Program Files (x86)\WinSCP
  . 2019-02-01 13:45:42.060 Process ID: 8160
  . 2019-02-01 13:45:42.060 Command-line: "C:\Program Files (x86)\WinSCP\WinSCP.exe" 
  . 2019-02-01 13:45:42.060 Time zone: Current: GMT-7, Standard: GMT-7 (Mountain Standard Time), DST: GMT-6 (Mountain Daylight Time), DST Start: 3/10/2019, DST End: 11/3/2019
  . 2019-02-01 13:45:42.060 Login time: Friday, February 01, 2019 1:45:42 PM
  . 2019-02-01 13:45:42.060 --------------------------------------------------------------------------
  . 2019-02-01 13:45:42.060 Session name: SFTP Testing (Site)
  . 2019-02-01 13:45:42.060 Host name: x.x.x.x (Port: 22)
  . 2019-02-01 13:45:42.060 User name: username (Password: No, Key file: Yes, Passphrase: No)
  . 2019-02-01 13:45:42.060 Tunnel: No
  . 2019-02-01 13:45:42.060 Transfer Protocol: SFTP (SCP)
  . 2019-02-01 13:45:42.060 Ping type: Off, Ping interval: 30 sec; Timeout: 15 sec
  . 2019-02-01 13:45:42.060 Disable Nagle: No
  . 2019-02-01 13:45:42.060 Proxy: None
  . 2019-02-01 13:45:42.060 Send buffer: 262144
  . 2019-02-01 13:45:42.060 SSH protocol version: 2; Compression: No
  . 2019-02-01 13:45:42.060 Bypass authentication: No
  . 2019-02-01 13:45:42.060 Try agent: Yes; Agent forwarding: No; TIS/CryptoCard: No; KI: Yes; GSSAPI: Yes
  . 2019-02-01 13:45:42.060 GSSAPI: Forwarding: No; Libs: gssapi32,sspi,custom; Custom: 
  . 2019-02-01 13:45:42.060 Ciphers: aes,chacha20,blowfish,3des,WARN,arcfour,des; Ssh2DES: No
  . 2019-02-01 13:45:42.060 KEX: ecdh,dh-gex-sha1,dh-group14-sha1,rsa,WARN,dh-group1-sha1
  . 2019-02-01 13:45:42.060 SSH Bugs: Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto
  . 2019-02-01 13:45:42.060 Simple channel: Yes
  . 2019-02-01 13:45:42.060 Return code variable: Autodetect; Lookup user groups: Auto
  . 2019-02-01 13:45:42.060 Shell: default
  . 2019-02-01 13:45:42.060 EOL: LF, UTF: Auto
  . 2019-02-01 13:45:42.060 Clear aliases: Yes, Unset nat.vars: Yes, Resolve symlinks: Yes; Follow directory symlinks: No
  . 2019-02-01 13:45:42.060 LS: ls -la, Ign LS warn: Yes, Scp1 Comp: No
  . 2019-02-01 13:45:42.060 SFTP Bugs: Auto,Auto
  . 2019-02-01 13:45:42.060 SFTP Server: default
  . 2019-02-01 13:45:42.060 Local directory: default, Remote directory: /home/username, Update: Yes, Cache: Yes
  . 2019-02-01 13:45:42.060 Cache directory changes: Yes, Permanent: Yes
  . 2019-02-01 13:45:42.060 Recycle bin: Delete to: No, Overwritten to: No, Bin path: 
  . 2019-02-01 13:45:42.060 DST mode: Unix
  . 2019-02-01 13:45:42.060 --------------------------------------------------------------------------
  . 2019-02-01 13:45:42.107 Looking up host "x.x.x.x" for SSH connection
  . 2019-02-01 13:45:42.107 Connecting to x.x.x.x port 22
  . 2019-02-01 13:45:42.138 We claim version: SSH-2.0-WinSCP_release_5.13.4
  . 2019-02-01 13:45:42.170 Server version: SSH-2.0-OpenSSH_7.6p1 Ubuntu-4
  . 2019-02-01 13:45:42.170 Using SSH protocol version 2
  . 2019-02-01 13:45:42.170 Have a known host key of type ssh-ed25519
  . 2019-02-01 13:45:42.185 Doing ECDH key exchange with curve Curve25519 and hash SHA-256
  . 2019-02-01 13:45:42.670 Server also has ecdsa-sha2-nistp256/ssh-rsa host keys, but we don't know any of them
  . 2019-02-01 13:45:42.670 Host key fingerprint is:
  . 2019-02-01 13:45:42.670 ssh-ed25519 256 73:39:d8:0c:ed:dc:4b:ed:da:8f:a8:e8:20:ed:9e:1d 0Uaf91MV9sMQESUTp8X9a8l4nHeUKohN/XuDBAI+jG4=
  . 2019-02-01 13:45:42.716 Host key matches cached key
  . 2019-02-01 13:45:42.716 Initialised AES-256 SDCTR client-&gt;server encryption
  . 2019-02-01 13:45:42.716 Initialised HMAC-SHA-256 client-&gt;server MAC algorithm
  . 2019-02-01 13:45:42.716 Initialised AES-256 SDCTR server-&gt;client encryption
  . 2019-02-01 13:45:42.716 Initialised HMAC-SHA-256 server-&gt;client MAC algorithm
  . 2019-02-01 13:45:42.810 Reading key file "C:\Users\User\Documents\ssh-keys\username_private.ppk"
  ! 2019-02-01 13:45:42.810 Using username "username".
  . 2019-02-01 13:45:42.873 Server offered these authentication methods: publickey
  . 2019-02-01 13:45:42.873 Offered public key
  . 2019-02-01 13:45:42.904 Offer of public key accepted
  ! 2019-02-01 13:45:42.904 Authenticating with public key "imported-openssh-key"
  . 2019-02-01 13:45:43.029 Sent public key signature
  ! 2019-02-01 13:45:43.060 Further authentication required
  . 2019-02-01 13:45:43.107 Further authentication required
  . 2019-02-01 13:45:43.107 Server offered these authentication methods: password1ä³3}pÒÂuÃ6×rwÕ½i?¢,ºk¨¯Wú^k+¾
  . 2019-02-01 13:45:43.107 ¯’%VÞ&gt;âºé
  . 2019-02-01 13:45:43.107 Prompt (password, "SSH password", &lt;no instructions&gt;, "&amp;Password: ")
  . 2019-02-01 13:45:45.967 Sent password
  . 2019-02-01 13:45:45.999 Access granted
  . 2019-02-01 13:45:45.999 Opening session as main channel
  . 2019-02-01 13:45:46.514 Network error: Software caused connection abort
  * 2019-02-01 13:45:46.530 (EFatal) Network error: Software caused connection abort
  * 2019-02-01 13:45:46.530 Authentication log (see session log for details):
  * 2019-02-01 13:45:46.530 Using username "username".
  * 2019-02-01 13:45:46.530 Authenticating with public key "imported-openssh-key".
  * 2019-02-01 13:45:46.530 Further authentication required
  * 2019-02-01 13:45:46.530 
  * 2019-02-01 13:45:46.530 Authentication failed.
  </code></pre>
  
  <p>Users who are not a member of the "sftponly" group are able to use two factor authentication as intended.</p>
  
  <p>Anyone know why users that are members of the "sftponly" group are unable to log in with two factor authentication?</p>