Unless I remove the last three lines (effectively disabling faillock, so not a great idea...), I am no longer asked for a TOTP at all, ie I can login with just the password.
A quick workaround for me was to move the pam_google_authenticator line for sshd to the beginning (which asks for a TOTP before asking for a password), but the fact that I had to do this at all was a nasty surprise as I would not expect an update to suddenly and silently remove the 2FA requirement from my system,I wonder if this may be a bug, either in this module or in Gentoo's pam config.
With the old default Gentoo PAM
auth
config (in/etc/pam.d/system-auth
):and this module being loaded at the end of
/etc/pam.d/sshd
:I am first asked for the password, and then for a TOTP.
However, now Gentoo updated
system-auth
to this:Unless I remove the last three lines (effectively disabling faillock, so not a great idea...), I am no longer asked for a TOTP at all, ie I can login with just the password.
A quick workaround for me was to move the
pam_google_authenticator
line for sshd to the beginning (which asks for a TOTP before asking for a password), but the fact that I had to do this at all was a nasty surprise as I would not expect an update to suddenly and silently remove the 2FA requirement from my system,I wonder if this may be a bug, either in this module or in Gentoo's pam config.