I have an Ubuntu server with both a private, internal, IP and a public-facing IP. I want to set up two-factor authentication for SSH on just the public side. Is this possible? I was planning on using Google Authenticator, but am open to alternative ideas as well.


Yes, you can do this with pam_access.so. This recipe was taken from the wiki for the Google Authenticator:

A useful PAM recipe is to allow skipping two-factor authentication when the connection originates from certain sources. This is already supported by PAM. For example, the pam_access module can be used to check the source against local subnets:

# skip one-time password if logging in from the local network
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth       required     pam_google_authenticator.so

In this case, access-local.conf looks like:

# only allow from local IP range
+ : ALL :
- : ALL : ALL

Thus login attempts from will not require two-factor authentication.

  • 1
    That's exactly what I was looking for. Not sure why I didn't see it earlier. Thanks! – Brett F. Jun 26 '13 at 17:56
  • 4
    Michael Hampton Thanks for the example, but that did not work for me because I kept getting the error Permission denied (keyboard-interactive). I figured it out because I used AuthenticationMethods publickey,keyboard-interactive in my /etc/ssh/sshd_config. So I changed the following to fix it: auth [success=done default=ignore] pam_access.so accessfile=/etc/security/access-local.conf auth optional pam_google_authenticator.so nullok – Jeremy Laird Dec 3 '14 at 21:42
  • @JeremyLaird those lines are munged .. where is the newlines? – shadowbq Sep 22 '17 at 18:38
  • @user2672052 You should ask a question about your situation. – Michael Hampton Aug 3 '20 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.