phryneas · February 25, 2023 06:31
diff --git a/pam_sshd b/pam_sshd
 # /etc/pam.d/sshd

 #add at the beginning of the file before @include common-auth
 auth required pam_google_authenticator.so
diff --git a/SSH+PAM+google authentificator: publickey OR password+OTP b/SSH+PAM+google authentificator: publickey OR password+OTP
 # at least in deb/untu
 sudo apt-get install libpam-google-authenticator

 # for each user
 google-authenticator
diff --git a/sshd_config b/sshd_config
 # /etc/ssh/sshd_config

 # Contains multiple comma separated lists, each separated by spaces. Auth is okay if one of the lists completely succeeds
 # here we allow either pubkey or pam (pam will first invoke pam_google_authenticator.so and then include common-auth, which will ask for a password)
 AuthenticationMethods publickey keyboard-interactive:pam
 UsePAM yes
 # From the man page: Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.
 ChallengeResponseAuthentication yes
 PasswordAuthentication no
	# /etc/pam.d/sshd

	#add at the beginning of the file before @include common-auth
	auth required pam_google_authenticator.so
	# at least in deb/untu
	sudo apt-get install libpam-google-authenticator

	# for each user
	google-authenticator
	# /etc/ssh/sshd_config

	# Contains multiple comma separated lists, each separated by spaces. Auth is okay if one of the lists completely succeeds
	# here we allow either pubkey or pam (pam will first invoke pam_google_authenticator.so and then include common-auth, which will ask for a password)
	AuthenticationMethods publickey keyboard-interactive:pam
	UsePAM yes
	# From the man page: Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.
	ChallengeResponseAuthentication yes
	PasswordAuthentication no