I've just activated the two factor authentication using Google authenticator and I'm now required to provide the verification code any time that I use sudo. How to avoid the authentication step when using sudo while preserving the layer of securing when logging in?

1 Answer 1


Just came across this question while looking for a solution to this problem myself. This is how I have managed to have Google Authentication in the existing services except when using sudo. I assume you have added the following line to /etc/pam.d/common-auth in order to enable the Google Authentication:

auth    required    pam_google_authenticator.so    nullok

In the same /etc/pam.d directory you should have a file called sudo which handles sudo authentication. This file should contain a line

@include common-auth

This is pulling the content of the common-auth file which is forcing the additional google authentication to be implemented.

NOTE -> you should make a backup of your sudo file before proceeding (just in case).

In order to solve this, copy the contents of the common-auth file into the sudo file below the @include common-auth line. Then comment/remove the lines

@include common-auth


auth    required    pam_google_authenticator.so    nullok

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .