diff --git a/templates/ssh/sshd_config.erb b/templates/ssh/sshd_config.erb
index c0bcaabb8b818153402ec3e73e1bb7f2a8333d99..a2171caf470cd43b9d03c624d40637d5bbb06c24 100644
--- a/templates/ssh/sshd_config.erb
+++ b/templates/ssh/sshd_config.erb
@@ -84,7 +84,7 @@ GSSAPIStoreCredentialsOnRekey yes
 <% if (@pam_duo) then -%>
 
 # Require both (GSS-API|PASSWORD) and PAM.
-AuthenticationMethods gssapi-with-mic,keyboard-interactive:pam password,keyboard-interactive:pam
+AuthenticationMethods gssapi-with-mic,keyboard-interactive:pam<% if password then %> password,keyboard-interactive:pam<% end %>
 KerberosAuthentication yes
 <% end -%>