1

I've just activated the two factor authentication using Google authenticator and I'm now required to provide the verification code any time that I use sudo. How to avoid the authentication step when using sudo while preserving the layer of securing when logging in?

1

Just came across this question while looking for a solution to this problem myself. This is how I have managed to have Google Authentication in the existing services except when using sudo. I assume you have added the following line to /etc/pam.d/common-auth in order to enable the Google Authentication:

auth    required    pam_google_authenticator.so    nullok

In the same /etc/pam.d directory you should have a file called sudo which handles sudo authentication. This file should contain a line

@include common-auth

This is pulling the content of the common-auth file which is forcing the additional google authentication to be implemented.

NOTE -> you should make a backup of your sudo file before proceeding (just in case).

In order to solve this, copy the contents of the common-auth file into the sudo file below the @include common-auth line. Then comment/remove the lines

@include common-auth

and

auth    required    pam_google_authenticator.so    nullok

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.