I'm trying to set up an authentication scheme for Ubuntu using the pam files.

However, I cannot figure out how to have two separate methods of authentication.

I've set up a Yubikey authentication, however, no matter what, the console prompts for both password and yubikey OTP.

Both have to be correct, however, what I want is for a prompt for the Yubikey, if success, login.

If the Yubikey auth fails, then prompt for a password.

But no matter what, I get a prompt for both yubikey OTP and password.

required, sufficient keywords don't seem to make a difference.

I'm having trouble figuring out how to stack auth configurations like this.

To Summarize:

I want to authenticate by method A.

If A fails, attempt to authenticate by B.

-

The first authentication method needs to be sufficient and the second one required.

Ubuntu uses the other configuration style. Take /etc/pam.d/common-auth and change it like this:

auth    [success=2 default=ignore]      pam_yubikey.so
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_cap.so


Thus, if pam_yubikey succeeds it will skip the next two lines and you should get the bahaviour you want.

Kind regards Cornelius

-