1

I've followed several different guides on how to configure two factor authentication on my ssh server using the google's libpam-google-authenticator. I've been able to get it to work but when I try and log in from my desktop or any other device over the ssh I have to give it my ssh-key, user password, and then the authenticator token. But in my sshd_config file I have:

AuthenticationMethods publickey,keyboard-interactive  
ChallengeResponseAuthentication yes  
PasswordAuthentication no   
UsePAM yes

And in my /etc/pam.d/sshd I added

auth required pam_google_authenticator.so

So I think it should not ask for password as well. How can I fix it?

  • What is your question here? – cornelinux Oct 16 '16 at 9:07
  • I dont want it asking for the password only my ssh key and the authentication token – blackboxgeeks Oct 16 '16 at 10:46
0

Comment out the line @include common-auth from your /etc/pam.d/sshd. It will ask only for the second factor (if configured!).

0

Basically @Jakuje is right.

The common-auth contains a line with pam_unix.so. I would create a new file /etc/pam.d/google_auth and include this in your /etc/pam.d/sshd instead of common-auth. This way you are more modular.

The google-auth would basically look like this:

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]     pam_google_authenticator.so
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one    
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_cap.so
# end of pam-auth-update config

This way you can include the google-authin whichever service you like to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.