I am trying to configure google-authentication on a Xubuntu host via lightdm. I only want to use the OTP code to login (i.e. the user does not supply a password, only their google auth code).

I amended /etc/pam.d/lightdm-greeter adding a line to use google authenticator. Initially, I omitted 'use_first_pass' and later added it. After each edit, I did a reboot on the machine to ensure the pam stack was configured correctly.

 auth    required        pam_permit.so
 auth    optional        pam_gnome_keyring.so
 auth    optional        pam_kwallet.so
 auth    optional        pam_kwallet5.so
 auth    sufficient      pam_google_authenticator.so use_first_pass
 @include common-account
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session required        pam_limits.so
 @include common-session
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
 session optional        pam_gnome_keyring.so auto_start
 session optional        pam_kwallet.so auto_start
 session optional        pam_kwallet5.so auto_start
 session required        pam_env.so readenv=1
 session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale

(I also populated the keys for a couple of accounts)

But in both cases, when I type in the google auth code in password prompt of the greeter it simply reports a bad password (since the google module is just "sufficient" I can still log in using a password).

The googleauth pam module is not reporting anything in the syslog nor auth.log at startup nor authentication.

How do I get google authenticate to authenticate a code presented as a password?


I added the same entry in /etc/pam.d/lightdm and now get...

  Aug 28 18:28:44 ubuntu-jumpbox lightdm(pam_google_authenticator)[901]: Invalid verification code for administrator

Leaving aside the question of why there are 2 separate files in /etc/pam.d, I still have not achieved my objective.

(yes, I've got the right code setup on my mobile device, and the clocks on both the mobile and the host are in sync).

1 Answer 1


After experimenting with different authenticator apps on my phone (none of which seemd to allow me to see the code scanned from the QR code, including Google's own one) I then changed "use_first_pass" to "try_first_pass" in /etc/pam.d/lightdm. It worked. Yay!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.