Skip to main content

Questions tagged [google-authenticator]

Google Authenticator is a TOTP (Time based One Time Password) PAM (Pluggable Authentication Module) which is supported and serviced by Google.

Filter by
Sorted by
Tagged with
1 vote
1 answer
80 views

How do I enable Google Authenticator (TOTP) with SSH keys with a passphrase on Debian 12?

TL;DR: I ran google-authenticator when logged in as the root user. I should've run it as my normal user account instead. I have just installed Debian 12 on a spare Apple Mac Mini. I want to control it ...
ZPMMaker's user avatar
0 votes
1 answer
123 views

SSH not doing MFA when logging in

I followed the steps here https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview to set up SSH to do multi factor authentication using Google Authenticator app, on Ubuntu server 24.01. However ...
Paul's user avatar
  • 115
0 votes
1 answer
86 views

google-autenticator openvpn not working pam?

Hy All. I have been struggling with google-authenticator + pam.. Ubuntu 24.04 openvpn2.6.9-1ubuntu4 amd64. server.conf .... plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so "openvpn login ...
Paulo Ricardo Bruck's user avatar
0 votes
0 answers
57 views

pam.d with MFA skips public-key authentication

I have a pam.d configuration with MFA authentication on a test server. I noticed that the IP addresses that are in file access-without-MFA.conf mentioned, can login without password and without ...
Andrew_ram's user avatar
0 votes
1 answer
193 views

Server error 502 - problems with .net core web app deploy made on GCloud's GKE using OAuth 2.0 Authentication

I have an MVC .net core 6 web application that uses Google's OAuth2.0 authentication and I cannot publish it with Kubernetes. Project context: Locally it compiles and runs normally, including creating ...
LostMyMind's user avatar
0 votes
0 answers
148 views

how to set up eat /etc/pam.d/radiusd file to authenticate a user with his username, password and Google Authenticator token. Using Freeradius for 2FA

i have a problem about configuring the “/etc/pam.d/radiusd” file. I am working on a Linux Debian System. rn this is my configuration: auth requisite pam_google_authenticator.so forward_pass auth ...
tristesse11's user avatar
0 votes
1 answer
725 views

Google Credential Provider for Windows with Yubikey 2FA

Can I use my Yubikey hardware 2FA with Google Credential Provider for Windows (GCPW)? At the moment I am asked to sign in again the only option is Google Authenticator, and a few more but the Yubikey ...
Damian's user avatar
  • 113
1 vote
1 answer
560 views

Enforcing 2FA configuration on next SSH login for every user

I have found numerous tutorials on how to enable 2FA (TOTP, RFC 6238) but is there also a way to force SSH users to configure it on the first login? (I am using OpenSSH server) I guess I could create ...
phk's user avatar
  • 65
2 votes
1 answer
587 views

SSH authentication: (public key xor password) + google authenticator code

I'm using Debian bullseye. I'm trying to set up SSH two types logins: password + code from Google's Authenticator (if user set it, "nullok" option), public key + code from Google's ...
Karol's user avatar
  • 21
0 votes
1 answer
303 views

PAM permit works only when dummy suffix is added

I am trying to use PAM to authenticate OpenVPN against 2FA (not important info). Here is my PAM configuration: account required pam_permit.so auth required pam_google_authenticator.so ...
Mohammed Noureldin's user avatar
6 votes
2 answers
4k views

SSH public key authentication with google authenticator still asks for password

I'm trying to enable 2FA with ssh using libpam-google-authenticator. Not all users need authenticator enabled. Everybody uses ssh public keys, and nobody has a password. I'm running Debian buster, and ...
Hamish Moffatt's user avatar
0 votes
0 answers
1k views

Google Authentication works on localhost, but not on domain

Google Authentication works on localhost, but not on domain (see attached gifs). Why does authentication work for localhost but not on domain cpspmo.com? I have added https://www.cpspmo to as an ...
Chris's user avatar
  • 3
1 vote
1 answer
1k views

MS RRAS + MS VPN Client + Google Authenticator + SecureMFA

I'm running on-premise Windows Server 2019 domain, and Microsoft RRAS to allow remote users access to the local network. Remote users are using the built-in Microsoft VPN SSTP for Windows 10 clients ...
SpecProd's user avatar
0 votes
1 answer
3k views

sshd_config changes in Ubuntu 20.04

I noticed in in Ubuntu 20.04 in /etc/ssh/sshd_config what appears to be the introduction of a new line on the very 1st line of sshd_config. It reads: Include /etc/ssh/sshd_config.d/*.conf What is ...
user1709076's user avatar
2 votes
2 answers
25k views

How to configure PAM to authenticate SSH logins with (password & OTP) or (public key & OTP)

My goal is to develop an ansible playbook to deploy multifactor ssh logins of the type (public key and OTP) or (password and OTP) on Ubuntu Server 18.04 hosts. I followed the guide here and it ...
AMiller's user avatar
  • 121
0 votes
2 answers
673 views

GSuite: how to change authenticator device?

I'm GSuite admin for my domains. I have a new phone. How do I get a new QR for Google Authenticator. I've been clicking around and don't see it anywhere.
Ty Kroll's user avatar
  • 101
1 vote
0 answers
743 views

How to disable global 2FA policy with CLI

I would like to ask if it's possible to disable the global 2FA policy (everyone need to activate 2FA before accessing gitlab) but I can't disable on the web interface because I can't activate it, it ...
executable's user avatar
0 votes
1 answer
3k views

Linux PAM: SSH key + 2FA (google authenticator) + password - Specify auth requirements per user

I have installed and configured PAM on my Ubuntu server which is working correctly. To log in I want to require an SSH Key to be installed, a password to be provided and a valid code from an ...
Ben Turner's user avatar
1 vote
0 answers
2k views

SSH disabling google-authenticator from specific IP

I have setup google-authenticator as 2FA together with publickey authentication. What I need is to skip the 2FA when connecting by SSH from specific IP. I'm running Ubuntu 18.04. Relevant snippet ...
J91321's user avatar
  • 176
1 vote
1 answer
1k views

google-authenticator codes not working while emergency scratch codes do it right

Installing google-authenticator on a Debian behind another Debian firewall in a very restricted configuration on connectivity (NetinVM, a virtual machine constellation inside a VM) Installation goes ...
pGrnd2's user avatar
  • 15
0 votes
0 answers
675 views

Is using HOTP only authorization considered weak?

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual ...
ZioByte's user avatar
  • 296
3 votes
1 answer
2k views

Require SSH key + Google Authenticator for one account, SSH key only for another

I am trying to setup an SSH authentication structure, but I'm struggling with issues in /etc/ssh/sshd_config vs /etc/pam.d/sshd. Requirements: Accounts with root/sudo privileges require public key ...
Ed Peguillan III's user avatar
2 votes
1 answer
1k views

Ubuntu-18.04 and libpam-google-authenticator not prompting for keyboard-interactive

On a new Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-1017-aws x86_64), I have installed Google Authenticator [1] and configured it in the following way /etc/pam.d/sshd #@include common-auth ... auth ...
Christian's user avatar
  • 806
6 votes
1 answer
3k views

OpenVPN 2.4 + Google Authenticator = authentication failure

We have a corporate VPN server running OpenVPN 2.3 on an AWS instance with Ubuntu 16.04 Xenial. The server has been configured using an Ansible playbook. I'm planning to upgrade to Ubuntu 18.04 ...
Vlad Nikiforov's user avatar
2 votes
1 answer
238 views

Access of users using google-authenicator without token

I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
Francisco Juarez ZAMora's user avatar
0 votes
0 answers
171 views

Is the configuration I want possible? Problems with SSH to Redhat server using google authentication 2fa

I'm attempting to configure two factor authentication when using SSH to connect to my redhat ec2 instance. I would like to configure it like this: If user has both ssh key and google auth set up, ...
Jquinn's user avatar
  • 1
1 vote
1 answer
431 views

OpenVPN MFA without unix users

Have you guys have an idea is it possible to configure OpenVPN with pam_google_authenticator.so with no need to authenticate using username/password but only cert + TOTP? I don't want to create a new ...
YasiuMaster's user avatar
0 votes
0 answers
29 views

Multi-Factor Authentication varieties and is there a universal bridge for them

I am trying to research a project on how to connect to multiple enterprise environments that employ multi-factor authentication using a singular approach. My question is, are there any systems out ...
spinon's user avatar
  • 101
1 vote
0 answers
332 views

Google authenticator on Windows

I need to setup Google Authenticator on MS Windows server to implement 2-factor authentication for a web application. Which server software is the best to use for this purpose?
Gwidion's user avatar
  • 371
0 votes
1 answer
1k views

RHEL 7 google-authenticator publickey only with optional MFA

I am trying to setup MFA on RHEL 7 and running into a chicken and egg problem. If I enable MFA in pam you can't login to setup your .google-authenticator file. I understand that the nullok option in ...
MFG's user avatar
  • 1
2 votes
3 answers
4k views

Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED

I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix. My server.conf file reads as follows: ...
Arjun Balakrishnan's user avatar
2 votes
1 answer
3k views

Google Authenticator PAM on SSH blocks root login without 2FA

Situation: I have activated Google Authenticator 2FA for SSH logins on Ubuntu 16.04 but made it optional in the /etc/pam.d/sshd: auth required pam_google_authenticator.so nullok I have setup the ...
Arno's user avatar
  • 23
0 votes
0 answers
2k views

Google Authenticator on Nginx

I built Nginx with ngx_http_auth_pam_module and edited Nginx configurations and /etc/pam.d/nginx like this Part of virtual host setting location / { root /projects/admin; index index.html ...
maxswjeon's user avatar
2 votes
1 answer
4k views

Google Authenticator FreeRADIUS

I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7. I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth The reason I say ...
Justin Whelan's user avatar
0 votes
1 answer
52 views

Google authenticator QR code scan work in any mobile

I'm using google authenticator code for 2FA in my website. Can able to check QR code is scanned from registered mobile number? Now, i can able to scan the code from any mobile
user419482's user avatar
0 votes
1 answer
143 views

PAM Ignore Password Prompt Upon Successful Login

I have a CentOS 7 server that uses key based authentication for login, along with using Google Authenticator for two-factor authentication. I am wishing to set it up, so that upon a successful login (...
l00kadiversion's user avatar
1 vote
1 answer
3k views

Tacacs+ with PAM two-factor Google authentication?

I'm working on a tacacs+ server for my campus network, and I have been wondering how I could set up a tacacs+ server to communicate to PAM running google's two-factor authentication. I've done quite a ...
Disco King's user avatar
1 vote
1 answer
341 views

Logout user if they break a bashrc command

I'm running a small script when a user accesses my Linux host via SSH. This script should verify and/or set up Google Authenticator MFA access for the user. Right now it works as intended with one ...
Joum's user avatar
  • 151
1 vote
2 answers
6k views

How to automate google-authenticator MFA configuration for SSH access

At my company we currently have a SSH jump server of sorts, through which our workers access our clients' server endpoints. We have setup a couple of Ansible playbooks that essentially create/remove/...
Joum's user avatar
  • 151
4 votes
1 answer
6k views

SSH Google Authenticator Ignore/Whitelist ips

I installed google authenticator (two step verification), "libpam-google-authenticator" package, although it asks for a code for every single connection to SSH. I want to put localhost and my own ip ...
PhysiOS's user avatar
  • 442
6 votes
1 answer
617 views

How to set-up google-authenticator and set specific match rules to allow different login rules?

I'm trying to set Google-Authenticator (google 2 factor authentication). The relevant files are: [root@srv01 ~]# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_google_authenticator.so auth ...
Itai Ganot's user avatar
  • 10.9k
2 votes
1 answer
1k views

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

I'm trying to secure an outbound server with Google 2FA solution. For the time being, I'm first configuring everything on a local Vagrant machine and once everything works as intended I'll run it as ...
Itai Ganot's user avatar
  • 10.9k
2 votes
2 answers
7k views

How to configure pam sshd to allow different rules on different users/groups?

I'm configuring google two-factor authentication on an outbound server in the company I work for. Here are the relevant configurations: /etc/ssh/sshd_config: ubuntu@stage-itai-1:~$ egrep -v '^#' /...
Itai Ganot's user avatar
  • 10.9k
0 votes
1 answer
216 views

Google-2fa: How to recover an account when emergency codes are not available? [closed]

There's a server in my company which is configured with Google two-factor authentication. A user from the company has lost his phone and can't find his emergency codes. What can be done in order to ...
Itai Ganot's user avatar
  • 10.9k
1 vote
1 answer
88 views

What is the right way to back up google authenticator emergency keys?

I'm implementing Google 2-Factor Authentication on some servers in my company. When configuring Google 2FA on client computers, 5 emergency codes are generated to be used if a user forgets his master ...
Itai Ganot's user avatar
  • 10.9k
1 vote
0 answers
1k views

MS Active Directory with Google Authenticator

I am currently designing our new internal IT services, including IAM and e-mail. We currently use more or less no IAM or single sign-on solution. We have a WordPress based website, postfix + dovecot ...
Mark's user avatar
  • 63
4 votes
2 answers
247 views

industry standards for using google-authenticator with linux users?

Would like to ask, particularly those who run large environments with lots of users, if there are any standardized- or industry-recommended ways to securely distribute the verification codes to remote ...
Michael Martinez's user avatar
0 votes
1 answer
130 views

How to enable Google Authenticator over sshd when already using public key?

I'm running Debian Jessie on a VPS. I want to enable both private key and Google Authenticator to get into the server via SSH. I enabled auth required pam_google_authenticator.so in ...
goog's user avatar
  • 19
11 votes
2 answers
17k views

How to enable 2-factor auth using Google Authenticator for .ovpn file based openVPN access?

I have an openVPN setup where the users do not have shell accounts on the Debian VM running openVPN. The articles I found while Googling all have instructions of setting up Google Authenticator for a ...
Animesh's user avatar
  • 249
1 vote
1 answer
4k views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
noderunner's user avatar