Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses.

I have this in /etc/pam.d/sshd:

auth       required

and this in /etc/ssh/sshd_config:

ChallengeResponseAuthentication yes

I thought about using the Match directive in sshd_config, but the manpage suggests that ChallengeResponseAuthentication can't be used in that way. In any event, I'm not sure that would get around the pam requirement.

Is there a way of waiving the challenge-response for clients with certain IP addresses?

share|improve this question
up vote 2 down vote accepted

I've not done this specifically with google auth, but I'm doing something similar with pam_access and a substack. The way I do it to create a file in /etc/pam.d named yubi-auth. It contains:

auth sufficient 
auth required 

Then in password-auth, I use auth substack yubi-auth. The result is that if a user is coming from an approved ip address in acceess.conf they don't have to use the yubikey, otherwise they have to use it. (and they CAN always use it if they wish).

I've not tested this method with google auth, but I think the same logic should work.

share|improve this answer
Thanks! -- but what is – Flup Mar 1 '13 at 14:57
Ah, maybe you meant -- I tried it with that, and it works, sort of. Clients connecting from an address listed in access.conf still get prompted for the verification code, but it is ignored. Is there any way to suppress the prompt? – Flup Mar 1 '13 at 15:10
(sorry for the long time in reply, I missed the question about pam_combo). Pam_combo is a combination of pam_access and pam_time. So can say things like "allow this ip address only during these hours." I assume there is some way to do that without writing your own pam module, but I once drove myself crazy trying to figure it out and decided it was easier to write my own pam module. On suppressing the google auth prompt, I'm not sure on that one -- you don't get any extra prompt with yubi, which is all I've done. – Ciclamino Apr 30 '13 at 17:17

You can run two instances of sshd with different configurations. In an extreme case: Use one patched version (as this is probably not possible via the config file) which uses a different PAM string than ssh so that you can create different PAM configurations for both instances. Or you start one instance in chroot / lxc so that it sees a different PAM configuration. That might be easier (to maintain).

The client selection can be done by iptables (DNAT) then. Just send the respective clients to the port of the second instance (or to the lxc IP).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.