diff --git a/ssh/client_test.go b/ssh/client_test.go
index 9dbe042..ef95069 100644
--- a/ssh/client_test.go
+++ b/ssh/client_test.go
@@ -89,7 +89,9 @@ func TestBannerCallback(t *testing.T) {
 	defer c2.Close()
 
 	serverConf := &ServerConfig{
-		NoClientAuth: true,
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			return &Permissions{}, nil
+		},
 		BannerCallback: func(conn ConnMetadata) string {
 			return "Hello World"
 		},
@@ -98,10 +100,15 @@ func TestBannerCallback(t *testing.T) {
 	go NewServerConn(c1, serverConf)
 
 	var receivedBanner string
+	var bannerCount int
 	clientConf := ClientConfig{
+		Auth: []AuthMethod{
+			Password("123"),
+		},
 		User:            "user",
 		HostKeyCallback: InsecureIgnoreHostKey(),
 		BannerCallback: func(message string) error {
+			bannerCount++
 			receivedBanner = message
 			return nil
 		},
@@ -112,6 +119,10 @@ func TestBannerCallback(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	if bannerCount != 1 {
+		t.Errorf("got %d banners; want 1", bannerCount)
+	}
+
 	expected := "Hello World"
 	if receivedBanner != expected {
 		t.Fatalf("got %s; want %s", receivedBanner, expected)
diff --git a/ssh/server.go b/ssh/server.go
index 148d2cb..d4df916 100644
--- a/ssh/server.go
+++ b/ssh/server.go
@@ -316,6 +316,7 @@ func (s *connection) serverAuthenticate(config *ServerConfig) (*Permissions, err
 
 	authFailures := 0
 	var authErrs []error
+	var displayedBanner bool
 
 userAuthLoop:
 	for {
@@ -348,7 +349,8 @@ userAuthLoop:
 
 		s.user = userAuthReq.User
 
-		if authFailures == 0 && config.BannerCallback != nil {
+		if !displayedBanner && config.BannerCallback != nil {
+			displayedBanner = true
 			msg := config.BannerCallback(s)
 			if msg != "" {
 				bannerMsg := &userAuthBannerMsg{