I am trying to configure google-authentication on a Xubuntu host via lightdm. I only want to use the OTP code to login (i.e. the user does not supply a password, only their google auth code).
I amended /etc/pam.d/lightdm-greeter adding a line to use google authenticator. Initially, I omitted 'use_first_pass' and later added it. After each edit, I did a reboot on the machine to ensure the pam stack was configured correctly.
#%PAM-1.0
auth required pam_permit.so
auth optional pam_gnome_keyring.so
auth optional pam_kwallet.so
auth optional pam_kwallet5.so
auth sufficient pam_google_authenticator.so use_first_pass
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required pam_limits.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
session optional pam_gnome_keyring.so auto_start
session optional pam_kwallet.so auto_start
session optional pam_kwallet5.so auto_start
session required pam_env.so readenv=1
session required pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
(I also populated the keys for a couple of accounts)
But in both cases, when I type in the google auth code in password prompt of the greeter it simply reports a bad password (since the google module is just "sufficient" I can still log in using a password).
The googleauth pam module is not reporting anything in the syslog nor auth.log at startup nor authentication.
How do I get google authenticate to authenticate a code presented as a password?
Update
I added the same entry in /etc/pam.d/lightdm and now get...
Aug 28 18:28:44 ubuntu-jumpbox lightdm(pam_google_authenticator)[901]: Invalid verification code for administrator
Leaving aside the question of why there are 2 separate files in /etc/pam.d, I still have not achieved my objective.
(yes, I've got the right code setup on my mobile device, and the clocks on both the mobile and the host are in sync).
