This question already has an answer here:
I have a fresh Ubuntu 16.04.1 LTS system and have noticed that key-based SSH authentication asks for the account's password the first time I login to the machine and subsequent SSH attempts work without prompting for a password.
So far, the behavior can be reproduced by rebooting the machine. There may be a timeout as well, but I'm in the process of setting up the machine and haven't encountered it yet.
In general this is pretty neat as it mitigates a compromised SSH key, though it has a drawback for automated processes; in my case config management with Ansible.
Where is the SSH server behavior configured? Specifically, to ask for password authentication even if a key-based auth succeeds, but only the first time the key is used to open a session.
I'd like to keep this "two-factor"ish behavior for interactive sessions, but disable it (i.e. do not prompt for password) for certain accounts (e.g. a dedicated