See also: http://bugzilla.mindrot.org/show_bug.cgi?id=688 This is apparently a known issue (ChallengeResponseAuthentication does not work properly with PAM). It's in the FAQ: http://www.openssh.com/faq.html#3.15 -Chris