Skip to content

Instantly share code, notes, and snippets.

@phryneas

phryneas/SSH+PAM+google authentificator: publickey OR password+OTP

Last active February 25, 2023 06:31
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save phryneas/7c2b80e0c931d483bf20 to your computer and use it in GitHub Desktop.
Save phryneas/7c2b80e0c931d483bf20 to your computer and use it in GitHub Desktop.
Download ZIP
SSH+PAM+google authentificator: publickey OR password+OTP
Raw
pam_sshd
# /etc/pam.d/sshd
#add at the beginning of the file before @include common-auth
auth required pam_google_authenticator.so
Raw
SSH+PAM+google authentificator: publickey OR password+OTP
# at least in deb/untu
sudo apt-get install libpam-google-authenticator
# for each user
google-authenticator
Raw
sshd_config
# /etc/ssh/sshd_config
# Contains multiple comma separated lists, each separated by spaces. Auth is okay if one of the lists completely succeeds
# here we allow either pubkey or pam (pam will first invoke pam_google_authenticator.so and then include common-auth, which will ask for a password)
AuthenticationMethods publickey keyboard-interactive:pam
UsePAM yes
# From the man page: Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either PasswordAuthentication or ChallengeResponseAuthentication.
ChallengeResponseAuthentication yes
PasswordAuthentication no
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment