I am about to make two-factor authentication mandatory for ssh logins using
libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses.
I have this in
auth required pam_google_authenticator.so
and this in
I thought about using the
Match directive in
sshd_config, but the manpage suggests that
ChallengeResponseAuthentication can't be used in that way. In any event, I'm not sure that would get around the
Is there a way of waiving the challenge-response for clients with certain IP addresses?