Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up an authentication scheme for Ubuntu using the pam files.

However, I cannot figure out how to have two separate methods of authentication.

I've set up a Yubikey authentication, however, no matter what, the console prompts for both password and yubikey OTP.

Both have to be correct, however, what I want is for a prompt for the Yubikey, if success, login.

If the Yubikey auth fails, then prompt for a password.

But no matter what, I get a prompt for both yubikey OTP and password.

required, sufficient keywords don't seem to make a difference.

I'm having trouble figuring out how to stack auth configurations like this.

To Summarize:

I want to authenticate by method A.

If A fails, attempt to authenticate by B.

share|improve this question

The first authentication method needs to be sufficient and the second one required.

Ubuntu uses the other configuration style. Take /etc/pam.d/common-auth and change it like this:

auth    [success=2 default=ignore]
auth    [success=1 default=ignore] nullok_secure
auth    requisite             
auth    required              
auth    optional               

Thus, if pam_yubikey succeeds it will skip the next two lines and you should get the bahaviour you want.

Kind regards Cornelius

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.