My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.

The /etc/pam.d/sshd file is below:

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

# Standard Un*x password updating.
@include common-password

auth required pam_google_authenticator.so

I've already tried adding a

auth sufficient pam_exec.so /etc/pam.d/ip.sh

line above the google-authenticator line, but I can't understand how to check an IP adress in the bash script.

  • What bash script? I see no bash script in your question. Dec 20 '12 at 0:54

You cannot allow or deny authentication with pam_exec. What you should do is add something like

account  sufficient pam_access.so

just above the google authetnicator line and in /etc/security/access.conf put

  • That should work. AFAIK there is no pam module that can be used to check the IP address of the client. The keyword in your suggestion is "sufficient".
    – tore-
    Dec 20 '12 at 8:47
  • Thank you! I never saw in the documentation that pam_exec could not allow or deny authentication, and kept trying to return exit codes from the bash script.
    – spudwaffle
    Dec 21 '12 at 2:34
  • 1
    I have tried this receipt and it does not work for me. My logical explanation is that pam_google_authenticator.so is executed at auth cycle, while pam_access.so plays role on account cycle (later). I have changed the line to auth sufficient pam_access.so and it works reasonably OK.
    – dma_k
    Jan 4 '15 at 1:41

I use google authenticator before account password. hence I can not use pam_access because of it bypass the account password. So I cloned and implement core whitelist functionality to the google authenticator.

You can get it from https://code.google.com/r/kazimsarikaya-google-authenticatior-withwhitelist/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.