I recently enabled two-factor-authentication using google-authenticator on my SSH server. However I am now facing a problem:

I have a different group of users on my server which I am using for SFTP, but that group is no longer able to login since 2FA isn't set up for the users in the group. Is it possible to disable the google-authenticator module for that group? Enabling it for the users in the group is not an option because multiple users will be using this account.

PS: I use openssh-server


3 Answers 3


You can use pam_succeed_if module (see manual page) before the pam_google_authenticator to skip this part for your group:

# the other authentication methods, such as @include common-auth
auth [success=1 default=ignore] pam_succeed_if.so user ingroup group
auth required pam_google_authenticator ...
  • 2
    It should probably be [success=1 default=ignore] instead of required. Right now, a user not in group will lead to the authentication failing, I think. success=1 will make it skip the next method, default=ignore will mean users not in group will simply move on to the next method.
    – muru
    Dec 27, 2016 at 10:55
  • @muru yes, you are obviously right. Still learning the details and all the magic of the PAM stack :)
    – Jakuje
    Dec 27, 2016 at 11:00
  • Is this dependent on whether you have multiple "AuthenticationMethods" in /etc/ssh/sshd_config ? With the above line added, I still get 'Permission denied (keyboard-interactive)'
    – Arj
    May 15, 2018 at 14:06
  • @Arj this means you have different configuration so this specific answere does not apply for you.
    – Jakuje
    May 15, 2018 at 15:01

Some SFTP clients can handle 2FA. For example, I'm using 2FA with FileZilla and WinSCP and they works. Also I have setup ssh-key authentication and it works alongside of 2FA.

However your question is interesting and I made a short survey. I found this answer.

So, it is possible (and easy) to run separate ssh instances. I'm already tested it.

  1. Make separate copies of sshd_config file.

    $ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_pwd
    $ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_2fa
  2. Edit these new config files. One of the things you must change is the shh port. According to the example:

    2.a) sshd_config_pwd specific lines are:

    Port 1022
    PasswordAuthentication yes
    ChallengeResponseAuthentication no
    UsePAM no

    2.b) sshd_config_2fa specific lines are:

    Port 2022
    PasswordAuthentication no
    ChallengeResponseAuthentication yes
    UsePAM yes
  3. Open the necessary ports into the firewall. According to the example:

    $ sudo ufw limit 1022
    $ sudo ufw limit 2022
  4. Run the new ssh instances:

    $ sudo /usr/sbin/sshd -f /etc/ssh/sshd_config_pwd
    $ sudo /usr/sbin/sshd -f /etc/ssh/sshd_config_2fa

That's it.

  • How is this answering the question? What you modify in the sshd_config to use different PAM stack and not use 2FA?
    – Jakuje
    Dec 27, 2016 at 14:14
  • @Jakuje I've updated my answer.
    – pa4080
    Dec 27, 2016 at 15:49
  • Ok, so the point is "not using PAM". It might work in some cases, but PAM is not only about authentication, but also setting up session and lot more, therefore it might stop working from day to day. Also changing port is very confusing, especially if you want third party to connect to your server. Though yes, possible solution.
    – Jakuje
    Dec 27, 2016 at 15:53
  • Yes, it's just a possible solution, which still incomplete, because I don't know elegant way to start these separate ssh instances at system startup.
    – pa4080
    Dec 27, 2016 at 16:05

The following will make Google 2FA mandatory for all users
except users belonging to the sudo and admin group
(meaning if a user from group sudo or admin does not have 2FA configured, it will authenticate him/her based on their public key):

File: /etc/pam.d/sshd

auth required pam_google_authenticator.so nullok
auth optional pam_succeed_if.so user ingroup sudo
auth optional pam_succeed_if.so user ingroup admin

File: /etc/ssh/sshd_config

AuthenticationMethods publickey,keyboard-interactive
UsePAM yes
ChallengeResponseAuthentication yes


          |  Belongs to sudo or  |  Has 2FA Already Setup      |  Authentication Result
          |  admin group         |  in ~/.google_authenticator | 
User A    |          NO          |       NO                    | DENIED LOGIN UNTIL 2FA IS SETUP
User B    |          YES         |       NO                    | CAN LOGIN (PRIVATE/PUBLIC KEY USED)

User C    |          NO          |       YES                   | CAN LOGIN (PRIVATE/PUBLIC KEY AND 2FA USED)

User D    |          YES         |       YES                   | CAN LOGIN (PRIVATE/PUBLIC KEY AND 2FA USED)

According to Google Authenticator's README.md Documentation:


PAM requires at least one SUCCESS answer from a module, and nullok causes this module to say IGNORE. This means that if this option is used at least one other module must have said SUCCESS. One way to do this is to add auth required pam_permit.so to the end of the PAM config.

This makes the use of nullok here safe.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .