Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.

The /etc/pam.d/sshd file is below:

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

# Standard Un*x password updating.
@include common-password

auth required pam_google_authenticator.so

I've already tried adding a

auth sufficient pam_exec.so /etc/pam.d/ip.sh

line above the google-authenticator line, but I can't understand how to check an IP adress in the bash script.

share|improve this question
    
What bash script? I see no bash script in your question. –  Michael Hampton Dec 20 '12 at 0:54
add comment

2 Answers 2

up vote 2 down vote accepted

You cannot allow or deny authentication with pam_exec. What you should do is add something like

account  sufficient pam_access.so

just above the google authetnicator line and in /etc/security/access.conf put

+:ALL:<ip>
share|improve this answer
    
That should work. AFAIK there is no pam module that can be used to check the IP address of the client. The keyword in your suggestion is "sufficient". –  tore- Dec 20 '12 at 8:47
    
Thank you! I never saw in the documentation that pam_exec could not allow or deny authentication, and kept trying to return exit codes from the bash script. –  spudwaffle Dec 21 '12 at 2:34
add comment

I use google authenticator before account password. hence I can not use pam_access because of it bypass the account password. So I cloned and implement core whitelist functionality to the google authenticator.

You can get it from https://code.google.com/r/kazimsarikaya-google-authenticatior-withwhitelist/.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.