I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator
. I'd like to be able to waive this requirement when users log in from certain IP addresses.
I have this in /etc/pam.d/sshd
:
auth required pam_google_authenticator.so
and this in /etc/ssh/sshd_config
:
ChallengeResponseAuthentication yes
I thought about using the Match
directive in sshd_config
, but the manpage suggests that ChallengeResponseAuthentication
can't be used in that way. In any event, I'm not sure that would get around the pam
requirement.
Is there a way of waiving the challenge-response for clients with certain IP addresses?