The following will make Google 2FA mandatory
for all users
except users belonging to the sudo and admin group
(meaning if a user from group sudo or admin does not have 2FA configured, it will authenticate him/her based on their public key):
File: /etc/pam.d/sshd
auth required pam_google_authenticator.so nullok
auth optional pam_succeed_if.so user ingroup sudo
auth optional pam_succeed_if.so user ingroup admin
File: /etc/ssh/sshd_config
AuthenticationMethods publickey,keyboard-interactive
UsePAM yes
ChallengeResponseAuthentication yes
Results:
| Belongs to sudo or | Has 2FA Already Setup | Authentication Result
| admin group | in ~/.google_authenticator |
----------+----------------------+-----------------------------+------------------------
User A | NO | NO | DENIED LOGIN UNTIL 2FA IS SETUP
User B | YES | NO | CAN LOGIN (PRIVATE/PUBLIC KEY USED)
User C | NO | YES | CAN LOGIN (PRIVATE/PUBLIC KEY AND 2FA USED)
User D | YES | YES | CAN LOGIN (PRIVATE/PUBLIC KEY AND 2FA USED)
According to Google Authenticator's README.md Documentation:
nullok
PAM requires at least one SUCCESS answer from a module, and nullok causes this module to say IGNORE. This means that if this option is used at least one other module must have said SUCCESS. One way to do this is to add auth required pam_permit.so to the end of the PAM config.
This makes the use of nullok
here safe.