Skip to content

Instantly share code, notes, and snippets.

@mbohun

mbohun/SSH+PAM+google authentificator: publickey OR password+OTP

Forked from phryneas/SSH+PAM+google authentificator: publickey OR password+OTP
Created May 3, 2018 07:06
Show Gist options
  • Save mbohun/e06fe9bc6e50097a5cdfb6e64062f586 to your computer and use it in GitHub Desktop.
Save mbohun/e06fe9bc6e50097a5cdfb6e64062f586 to your computer and use it in GitHub Desktop.
Download ZIP
SSH+PAM+google authentificator: publickey OR password+OTP
Raw
pam_sshd
# /etc/pam.d/sshd
#add at the beginning of the file before @include common-auth
auth required pam_google_authenticator.so
Raw
SSH+PAM+google authentificator: publickey OR password+OTP
# at least in deb/untu
sudo apt-get install libpam-google-authenticator
# for each user
google-authenticator
Raw
sshd_config
# /etc/ssh/sshd_config
# Contains multiple comma separated lists, each separated by spaces. Auth is okay if one of the lists completely succeeds
# here we allow either pubkey or pam (pam will first invoke pam_google_authenticator.so and then include common-auth, which will ask for a password)
AuthenticationMethods publickey keyboard-interactive:pam
UsePAM yes
# From the man page: Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.
ChallengeResponseAuthentication yes
PasswordAuthentication no
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment