Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

There has a been a similar question, but that's not exactly what I want.

I'd like to know if there is a plugin, or add-on, for lightdm or gdm that allows me to authenticate using my password AND google authenticator. I'm talking about entering your GA code into the desktop login -- both GUI or command line, shell login -- in order to gain access to your local desktop.

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

http://www.sharpley.org.uk/lightdm-google-authentication

share|improve this answer
2  
Welcome to AskUbuntu. Can you include the essential parts of the link here? Thanks! –  penreturns Oct 8 '12 at 16:28
    
Excellent! Will this make all users require GA? How would that work on a recovery boot? I guess the root user will need to have this correctly configured as well in case you need to drop back to a recovery console. –  JulioHM Oct 17 '12 at 20:48
    
@JulioHM, see my answer on that. There is a "migration" option that will not make GA a requirement for all users. –  mniess Apr 26 '13 at 14:29
add comment

Installation

Install the Google Authenticator PAM-module like this:

sudo apt-get install libpam-google-authenticator

Now run google-authenticator (inside a terminal) for every user you want to use Google Authenticator with and follow the instructions. You will get a QR-Code to scan with your smartphone (or a link) and emergency-codes.

Configuration

To activate Google Authenticator look inside the directory /etc/pam.d/. There is a file for every way to authenticate with your computer. You need to edit the configuration files for every service you want to use with Google Authenticator with. If you want to use it with SSH, edit sshd, if you want to use it in LightDM, edit lightdm. In those files, add one of the following lines:

auth required pam_google_authenticator.so nullok
auth required pam_google_authenticator.so

Use the first line, while you're still migrating your users to Google Authenticator. Users who don't have it configured can still log in. The second line will force the usage of Google Authenticator. Users who don't have it, can't log in anymore.

To add it to LightDM you could run this:

echo "auth required pam_google_authenticator.so nullok" | sudo tee -a /etc/pam.d/lightdm

Now when you log in you will get seperately asked for your password and the 2-step authentication code.

Encrypted home directories

If you use home-encryption (ecryptfs) the file *$HOME/.google_authenticator* will not be readable for the PAM-module (because it is still encrypted). In this case you need to move it somewhere else and tell PAM where to find it. A possible line could look like this:

auth required pam_google_authenticator.so secret=/home/.ga/${USER}/.google_authenticator

You need to create a directory for every user in /home/.ga that has the users name and change the ownership of that directory to the user. Then the user can run google-authenticator and move the created .google-authenticator file to that directory. The user could run the following lines:

sudo install -g $(id -rgn) -o $USER -m 700 -d /home/.ga/$USER
google-authenticator
mv $HOME/.google_authenticator /home/.ga/$USER

This will allow the module to access the file.

For other options, check out the README.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.