Skip to main content
Share Your Experience: Take the 2024 Developer Survey
7 votes
Accepted

SSH Google Authenticator Ignore/Whitelist ips

In "/etc/pam.d/sshd" auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf auth required pam_google_authenticator.so Then on "/etc/security/access-local.conf" #...
PhysiOS's user avatar
  • 432
4 votes

How to enable 2-factor auth using Google Authenticator for .ovpn file based openVPN access?

No. Of course you can't do that. This would defeat the very purpose of 2FA. Your server must have a way to verify the user credentials, and this info shouldn't be sent over the network (ie. you can't ...
goteguru's user avatar
  • 302
4 votes
Accepted

Google Authenticator PAM on SSH blocks root login without 2FA

This is the expected behavior. Assuming you had PermitRootLogin without-password, the man page for the PermitRootLogin says: If this option is set to prohibit-password or without-password, password ...
nullUser's user avatar
  • 236
4 votes

Linux PAM: SSH key + 2FA (google authenticator) + password - Specify auth requirements per user

Let's break down these requirements a bit. Configuring SSH First, in order to require public keys and password to provide, you need to modify your /etc/ssh/sshd_config by adding this line: ...
Lacek's user avatar
  • 7,473
4 votes

How to automate google-authenticator MFA configuration for SSH access

You can do whatever you like in Ansible, it just may take some shell scripts where there is not a module that does what you want. Copying over a pre-existing ~/.google_authenticator file is easy. If ...
John Mahowald's user avatar
3 votes
Accepted

SSH public key authentication with google authenticator still asks for password

Here is my working configuration. Some users have authenticator enabled and some don't, and only SSH logins with public keys are permitted, never passwords. In /etc/ssh/sshd_config, UsePAM yes ...
Hamish Moffatt's user avatar
3 votes
Accepted

google-authenticator codes not working while emergency scratch codes do it right

Google Authenticator is time-dependent. Make sure your date/time settings, from the server and the phone, (also including their timezones) are correct.
JucaPirama's user avatar
3 votes
Accepted

Logout user if they break a bashrc command

You can add line trap '' 2 at start of you script to disable CTRL+C and trap 2 in end to enable CTRL+C functional. This will prevent user from brake you script execution. Note that this should ...
Slipeer's user avatar
  • 3,313
2 votes

Google Authenticator PAM for specific users

When playing around with the PAM stack I usually do not use the service, that I in fact want to modify, since this is a "productive" service. So in this case I would test with /etc/pam.d/login ...
cornelinux's user avatar
2 votes
Accepted

How to configure pam sshd to allow different rules on different users/groups?

You need to use multiple Match Group directives: Match Group foo # blah settings Match Group bar # blah settings ... Standard settings
FaCE's user avatar
  • 201
2 votes
Accepted

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

For some reason, users which are not members of the gauth group are able to log into the machine without supplying any password at all You removed from the PAM stack @include common-auth line in the ...
Jakuje's user avatar
  • 10.1k
2 votes

How to automate google-authenticator MFA configuration for SSH access

You can use any BASE32 secret key for the seed. [2-7A-Z] Use Google Charts to generate the QR and you can put that file anywhere you want and owned by a different user. auth required ...
Jacob Evans's user avatar
  • 8,046
2 votes
Accepted

OpenVPN 2.4 + Google Authenticator = authentication failure

Ubuntu 18.04 and higher use a more strict sandboxing config in systemd which interferes with google-authenticator. Simply edit /lib/systemd/system/[email protected] and remove this line: [Service] ... ...
nbailey's user avatar
  • 171
1 vote
Accepted

Server error 502 - problems with .net core web app deploy made on GCloud's GKE using OAuth 2.0 Authentication

We found the solution to the problem described above. Basically, the container within Kubernetes needs that, in addition to the health check end-points, the base url of the application is also up, ...
LostMyMind's user avatar
1 vote
Accepted

Google Credential Provider for Windows with Yubikey 2FA

Same issue here. Unfortunately this ist not supported :( Note: USB security keys aren’t supported by GCPW. If you enforce security keys, users can still sign in to their device with Android and iOS ...
Chris7b5's user avatar
1 vote
Accepted

Enforcing 2FA configuration on next SSH login for every user

I am not sure if someone already wrote script for general purpose because these things sometime specific to requirement. What I can suggest is use env files(.bashrc,.bash_profile etc) to alter your ...
asktyagi's user avatar
  • 2,934
1 vote

MS RRAS + MS VPN Client + Google Authenticator + SecureMFA

You can setup this up with Cisco DUO by: Username: [username] password: [password] , [6 digit code] This is called append method this also works with OTP Username: [username] password: [password] ,...
neil's user avatar
  • 11
1 vote
Accepted

sshd_config changes in Ubuntu 20.04

It can be used to include additional configuration files allowing you to override some settings without changing the stock sshd_config file. Which should make upgrading your system easier. You don't ...
Zoredache's user avatar
  • 132k
1 vote

How to configure PAM to authenticate SSH logins with (password & OTP) or (public key & OTP)

The problem stems from PAM and it almost makes it impossible. The core problem is that the publickey stuff is handled by the ssh daemon, while keyboard-interactive is always handled by PAM (and ...
thomasafine's user avatar
1 vote

RHEL 7 google-authenticator publickey only with optional MFA

I'm no pam expert, but your pam config doesn't look right for google auth. This is my file with nullok added. cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth ...
Jacob Evans's user avatar
  • 8,046
1 vote

Google authenticator QR code scan work in any mobile

Google Authenticator does not perform network operations of any kind. The QR code is merely a way to easily seed the TOTP algorithm. To answer your question directly, no, there is no way to either ...
EEAA's user avatar
  • 110k
1 vote
Accepted

Tacacs+ with PAM two-factor Google authentication?

Breaking this into two pieces, the pam directory is for your authentication for services: tac_plus. The tac_plus configuration file is for the the service: tacacs+ PAM Pam is your pluggable ...
Jacob Evans's user avatar
  • 8,046
1 vote

How to set-up google-authenticator and set specific match rules to allow different login rules?

You missed one small detail from the manual: nullok Allow users to log in without OTP, if they haven't set up OTP yet. Your pam.d/sshd file should include this: auth required ...
ThoriumBR's user avatar
  • 5,332
1 vote

How to configure pam sshd to allow different rules on different users/groups?

Match Group guath PasswordAuthentication no ChallengeResponseAuthentication yes AuthenticationMethods publickey,keyboard-interactive Not sure about your Ubuntu version, but on Debian ...
A.P.'s user avatar
  • 111
1 vote

What is the right way to back up google authenticator emergency keys?

@MichaelHampton is right. But I would probably not use an USB stick but a printed sheet of paper in a sealed envelope. In the scenario of a lost smartphone and missing Google Authenticator it might ...
cornelinux's user avatar
1 vote

How to enable 2-factor auth using Google Authenticator for .ovpn file based openVPN access?

Setup: OpenVPN Server with 2FA (Google Authenticator) on Ubuntu Server 18.04.4 LTS for Raspberry Pi Hardware: Raspberry Pi 3 Model B+ Rev 1.3 you have to login with a linux user with no active 2FA ...
Wolfgang Reidlinger's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible