0

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.

The /etc/pam.d/sshd file is below:

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

# Standard Un*x password updating.
@include common-password

auth required pam_google_authenticator.so

I've already tried adding a

auth sufficient pam_exec.so /etc/pam.d/ip.sh

line above the google-authenticator line, but I can't understand how to check an IP adress in the bash script.

1
  • What bash script? I see no bash script in your question. Dec 20, 2012 at 0:54

2 Answers 2

2

You cannot allow or deny authentication with pam_exec. What you should do is add something like

account  sufficient pam_access.so

just above the google authetnicator line and in /etc/security/access.conf put

+:ALL:<ip>
3
  • That should work. AFAIK there is no pam module that can be used to check the IP address of the client. The keyword in your suggestion is "sufficient".
    – tore-
    Dec 20, 2012 at 8:47
  • Thank you! I never saw in the documentation that pam_exec could not allow or deny authentication, and kept trying to return exit codes from the bash script.
    – spudwaffle
    Dec 21, 2012 at 2:34
  • 1
    I have tried this receipt and it does not work for me. My logical explanation is that pam_google_authenticator.so is executed at auth cycle, while pam_access.so plays role on account cycle (later). I have changed the line to auth sufficient pam_access.so and it works reasonably OK.
    – dma_k
    Jan 4, 2015 at 1:41
0

I use google authenticator before account password. hence I can not use pam_access because of it bypass the account password. So I cloned and implement core whitelist functionality to the google authenticator.

You can get it from https://code.google.com/r/kazimsarikaya-google-authenticatior-withwhitelist/.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .