How to Enable Password Authentication in Lima VM and Configure SSH MFA?

[alehholiveira]

Hello,

I am working with a fresh Lima VM (Ubuntu-lts) and I am trying to enable password-based SSH authentication instead of relying exclusively on the default SSH key provisioning.

Context

• Lima instance created from scratch (no custom cloud-init config).
• Default user automatically created by Lima.
• I manually set a password for the user using passwd.
• I updated /etc/ssh/sshd_config.d/60-cloudimg-settings.conf to:

PasswordAuthentication yes

• Restarted the SSH service.
• Confirmed the user account is not locked (passwd -S shows P).

However, SSH login with password still fails:

Permission denied (publickey,password).

When I force:

PreferredAuthentications=password
PubkeyAuthentication=no

The connection is denied without prompting for a password.

---

Questions

1. Is password authentication intentionally restricted by Lima or by the default Ubuntu-lts configuration?
2. Are there additional SSH or PAM settings required to properly enable password login in a Lima VM?
3. Does Lima override SSH authentication behavior through cloud-init at boot time?
4. What is the recommended way to enable password authentication cleanly in Lima?

---

Additional Goal: Enabling MFA

My final objective is not just password authentication, but enabling SSH access with MFA (e.g., password + TOTP using libpam-google-authenticator or similar).

So specifically:

• What is the recommended approach to enable multi-factor authentication in a Lima-managed VM?
• Is there an officially supported way to configure PAM-based MFA via Lima configuration (e.g., through lima.yaml or cloud-init)?
• Are there known limitations when combining Lima's SSH provisioning model with PAM-based MFA?

---

Any clarification on the intended authentication model and best practices would be appreciated.

Thank you.

[afbjorklund]

I can't reproduce this, the ssh login prompts for a password:

$ ssh -o Port=43757 anders@127.0.0.1

The authenticity of host '[127.0.0.1]:43757 ([127.0.0.1]:43757)' can't be established.
ED25519 key fingerprint is SHA256:zlHrSVMkXWDMCUXV56LspoQe+TCIJre8y/0IxNzynbc.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[127.0.0.1]:43757' (ED25519) to the list of known hosts.
anders@127.0.0.1's password: 
Welcome to Ubuntu 25.10 (GNU/Linux 6.17.0-8-generic x86_64)

The default ssh config has some incompatible options, though...

     BatchMode
             If set to yes, user interaction such as password prompts and host key confirmation requests will be disabled.