Is it possible to have multiple 2FA pam's setup and give the user the choice of which to use on login?

I have google-authenticator setup. I have successfully used my yubiko key as a second factor. I would like to have the choice of which to use on login so I can go with whatever is more convenient or to use one as a backup method.


There is, as far as I know, no standard/method that allows a user to select which MFA they want to use to login with from the commandline prompt during login. (But you could always write your own PAM module to do so ... #CurrentTeam did but didn't release that to the public domain.)

Not the most transparent for end-users, but something you can do with stock tools is to use PAM chaining to configure a fallback method.

Set the Yubico PAM module as sufficient and when you pass a valid One-Time-Password (OTP) you'll be granted access.

When what you entered does not validate as a correct Yubikey OTP, then authentication will fall through to the next allowed method, the Google-Authenticator PAM module.
That PAM module should be set to required.

If you then, after failing to enter a valid Yubibey OTP, enter a valid Google Authenticator code, you will be granted access and otherwise if you don't your authentication will be rejected.

That should somewhat similar to adding the following:

auth sufficient pam_yubico.so id=16 debug authfile=/path/to/mapping/file
auth required pam_google_authenticator.so
  • 4
    Also you can remove the double prompt using use_first_pass / forward_pass which can make both pams try same input – Aroly7 Apr 26 at 11:05
  • Nice!!! @Aroly7 – HBruijn Apr 26 at 11:07
  • 1
    @Aroly7, can you say more about that? Where would I specify use_first_pass? – DasPete Apr 26 at 15:52
  • @HBruijn, thanks for the suggestion on sufficent/required, that works well for now – DasPete Apr 26 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.