Closed Keruspe closed 4 years ago
Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
:memo: Please visit https://cla.developers.google.com/ to sign.
Once you've signed (or fixed any issues), please reply here with @googlebot I signed it!
and we'll verify it.
ℹ️ Googlers: Go here for more info.
@googlebot I signed it!
Does this not belong in the PAM config?
Something like:
auth [success=1,default=ok] pam_listfile.so item=user sense=deny file=/etc/otp_disabled
That way users can't "opt out" of OTP. And if they can opt out, then this option is the same as having nullok
in your config, no?
Hmm, it seems I misunderstood how nullok worked here, it's sufficient for what I want, thanks!
This allows enforcing OTP for "privileged" users while disabling it for "guest" users