Require SSH keys and then the user’s password; makes a lot of sense, though would get in the way of using keys for automation.

Forcing public key and password in OpenSSH | linuxconnect