I am trying to configure google-authentication on a Xubuntu host via lightdm. I only want to use the OTP code to login (i.e. the user does not supply a password, only their google auth code).

I amended /etc/pam.d/lightdm-greeter adding a line to use google authenticator. Initially, I omitted 'use_first_pass' and later added it. After each edit, I did a reboot on the machine to ensure the pam stack was configured correctly.

 auth    required        pam_permit.so
 auth    optional        pam_gnome_keyring.so
 auth    optional        pam_kwallet.so
 auth    optional        pam_kwallet5.so
 auth    sufficient      pam_google_authenticator.so use_first_pass
 @include common-account
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
 session required        pam_limits.so
 @include common-session
 session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
 session optional        pam_gnome_keyring.so auto_start
 session optional        pam_kwallet.so auto_start
 session optional        pam_kwallet5.so auto_start
 session required        pam_env.so readenv=1
 session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale

(I also populated the keys for a couple of accounts)

But in both cases, when I type in the google auth code in password prompt of the greeter it simply reports a bad password (since the google module is just "sufficient" I can still log in using a password).

The googleauth pam module is not reporting anything in the syslog nor auth.log at startup nor authentication.

How do I get google authenticate to authenticate a code presented as a password?


I added the same entry in /etc/pam.d/lightdm and now get...

  Aug 28 18:28:44 ubuntu-jumpbox lightdm(pam_google_authenticator)[901]: Invalid verification code for administrator

Leaving aside the question of why there are 2 separate files in /etc/pam.d, I still have not achieved my objective.

(yes, I've got the right code setup on my mobile device, and the clocks on both the mobile and the host are in sync).

1 Answer 1


After experimenting with different authenticator apps on my phone (none of which seemd to allow me to see the code scanned from the QR code, including Google's own one) I then changed "use_first_pass" to "try_first_pass" in /etc/pam.d/lightdm. It worked. Yay!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .