I've just activated the two factor authentication using Google authenticator and I'm now required to provide the verification code any time that I use sudo. How to avoid the authentication step when using sudo while preserving the layer of securing when logging in?
Just came across this question while looking for a solution to this problem myself. This is how I have managed to have Google Authentication in the existing services except when using sudo. I assume you have added the following line to /etc/pam.d/common-auth in order to enable the Google Authentication:
auth required pam_google_authenticator.so nullok
In the same /etc/pam.d directory you should have a file called sudo which handles sudo authentication. This file should contain a line
@include common-auth
This is pulling the content of the common-auth file which is forcing the additional google authentication to be implemented.
NOTE -> you should make a backup of your sudo file before proceeding (just in case).
In order to solve this, copy the contents of the common-auth file into the sudo file below the @include common-auth line.
Then comment/remove the lines
@include common-auth
and
auth required pam_google_authenticator.so nullok
