We're using public key authentication in combination with the Yubico pam for our servers.

Is it possible to temporarily (e.g. 1 minute) skip the Yubico pam for subsequent authentications when a user has authenticated successfully once?

Background: Our deployment script is opening multiple SSH connections, each requiring the user to supply his Yubikey token. In the best case this is just inconvenient, in the worst case this is breaking our deployment currently (due to timing issues).

The deploy user is non-privileged, but still I cannot (and don't want to) deactivate the Yubikey requirement.

Changing the deployment script may be possible but requires lots of work. So if it's possible to cover this with the PAM only, that would be a huge advantage.

Open to other suggestions/workarounds for this.


Can you possibly re-use the first ssh connection?


subsequent connections to $REMOTEHOST will "piggyback" on the connection established by the master ssh.


  • 1
    -M is not required when ControlMaster is set in ssh_config (as is recommended when you want to do this). – Michael Hampton Nov 28 '18 at 15:59
  • Awesome, solves the problem right away. Didn't think of checking SSH for possible solutions. Thanks! – herrherr Nov 28 '18 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.