(pam_unix(8)), and PAM will consider this sufficient to authenticate the user.If you duplicate the pam_unix.so line and change PAM's view of this check to required instead of sufficient, you will effectively ask PAM to check the traditional authentication sources twice.Note, however, that the comments in /etc/pam.d/password-auth state that this file is auto-generated and that "changes will be destroyed the next time authconfig is run". Additionally, this file is used by many other programs and daemons when authenticating users and changing it would alter the behavior of authentication for all those other programs and daemons.The only safe path is to copy the auth lines from this file to sshd's specific file, i.e. /etc/pam.d/sshd, and comment out the line that called /etc/pam.d/password-auth. This is what you get:# /etc/pam.d/sshd#%PAM-1.0auth required pam_sepermit.so# auth include password-auth# The following lines have come from the password-auth fileauth required pam_env.soauth sufficient pam_unix.so nullok try_first_passauth requisite pam_succeed_if.so uid >= 500 quietauth required pam_deny.so# End of lines coming from password-authaccount required pam_nologin.so...Now you can duplicate the pam_unix.so line and ask PAM to require this check to pass before it is tested a second time:# /etc/pam.d/sshd#%PAM-1.0auth required pam_sepermit.so# auth include password-auth# The following lines have come from the password-auth fileauth required pam_env.soauth required pam_unix.so nullok try_first_passauth sufficient pam_unix.so nullok try_first_passauth requisite pam_succeed_if.so uid >= 500 quietauth required pam_deny.so# End of lines coming from password-authaccount required pam_nologin.so...You are almost there. If you try to ssh to this machine right now, you'll only be prompted for the password once. That's because the try_first_pass argument to the pam_unix.so module tells the sufficient line to try the password that has just been given, which defeats the purpose of the duplicate password prompt.So, remove the try_first_pass argument from the second line to make it actually ask for the password a second time:# /etc/pam.d/sshd#%PAM-1.0auth required pam_sepermit.so# auth include password-auth# The following lines have come from the password-auth fileauth required pam_env.soauth required pam_unix.so nullok try_first_passauth sufficient pam_unix.so nullokauth requisite pam_succeed_if.so uid >= 500 quietauth required pam_deny.so# End of lines coming from password-authaccount required pam_nologin.so...That's it. Try to ssh to the target system and check if everything goes as planned. Feel free to use ssh -v (repeated v's for more verbosity) if something goes wrong.Further stalling the attackerAs the attacker may come prepared to try every single password twice, you can at least stall them by running /usr/bin/sleep 2 between password prompts. PAM allows you to do this with the pam_exec.so module (pam_exec(8)). Your /etc/pam.d/sshd file should then look like this:# /etc/pam.d/sshd#%PAM-1.0auth required pam_sepermit.so# auth include password-auth# The following lines have come from the password-auth fileauth required pam_env.soauth required pam_unix.so nullok try_first_passauth optional pam_exec.so quiet /usr/bin/sleep 2auth sufficient pam_unix.so nullokauth requisite pam_succeed_if.so uid >= 500 quietauth required pam_deny.so# End of lines coming from password-authaccount required pam_nologin.so...Now your system is ready to offer the convenience of password authentication with reduced a risk of giving in to brute-force attacks.