Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to set up an authentication scheme for Ubuntu using the pam files.

However, I cannot figure out how to have two separate methods of authentication.

I've set up a Yubikey authentication, however, no matter what, the console prompts for both password and yubikey OTP.

Both have to be correct, however, what I want is for a prompt for the Yubikey, if success, login.

If the Yubikey auth fails, then prompt for a password.

But no matter what, I get a prompt for both yubikey OTP and password.

required, sufficient keywords don't seem to make a difference.

I'm having trouble figuring out how to stack auth configurations like this.

To Summarize:

I want to authenticate by method A.

If A fails, attempt to authenticate by B.

share|improve this question

1 Answer 1

The first authentication method needs to be sufficient and the second one required.

Ubuntu uses the other configuration style. Take /etc/pam.d/common-auth and change it like this:

auth    [success=2 default=ignore]      pam_yubikey.so
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_cap.so 

Thus, if pam_yubikey succeeds it will skip the next two lines and you should get the bahaviour you want.

Kind regards Cornelius

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.