Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.

The /etc/pam.d/sshd file is below:

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional # [1]

# Print the status of the user's mailbox upon successful login.
session    optional standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required

# Set up SELinux capabilities (need modified pam)
# session  required multiple

# Standard Un*x password updating.
@include common-password

auth required

I've already tried adding a

auth sufficient /etc/pam.d/

line above the google-authenticator line, but I can't understand how to check an IP adress in the bash script.

share|improve this question
What bash script? I see no bash script in your question. – Michael Hampton Dec 20 '12 at 0:54
up vote 2 down vote accepted

You cannot allow or deny authentication with pam_exec. What you should do is add something like

account  sufficient

just above the google authetnicator line and in /etc/security/access.conf put

share|improve this answer
That should work. AFAIK there is no pam module that can be used to check the IP address of the client. The keyword in your suggestion is "sufficient". – tore- Dec 20 '12 at 8:47
Thank you! I never saw in the documentation that pam_exec could not allow or deny authentication, and kept trying to return exit codes from the bash script. – spudwaffle Dec 21 '12 at 2:34
I have tried this receipt and it does not work for me. My logical explanation is that is executed at auth cycle, while plays role on account cycle (later). I have changed the line to auth sufficient and it works reasonably OK. – dma_k Jan 4 '15 at 1:41

I use google authenticator before account password. hence I can not use pam_access because of it bypass the account password. So I cloned and implement core whitelist functionality to the google authenticator.

You can get it from

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.