Closed GGEZLOLLLLLLLLLLLLLLLLXD closed 3 years ago
This is an OpenSSH config question. See the option https://man.openbsd.org/sshd_config#AuthenticationMethods
But I'm not aware of a way to make PAM not ask for password, only OTP, when key is correct. If you're fine with OTP+key only, then that's no problem.
Are per-user pam requirements a thing? Then I could write a bash script or something so users can switch between the two
Kinda yes. You could do something like:
auth [success=1 default=ignore] pam_listfile.so item=user sense=allow file=/etc/users-allowed-to-skip-otp.txt
auth required pam_google_authenticator.so [...]
Or something like that. The "1" is "skip next 1 lines".
Maybe that answers your question? I'm not quite sure what you're trying to do.
I'm trying to make it so that key logins and password logins both require the extra otp code.
@GGEZLOLLLLLLLLLLLLLLLLXD but also not require a password when a key was used, right?
Sounds like you'd want a PAM module that can check if a key was used to log in thus far, and then use that in your PAM config to skip pam_unix
.
Maybe this info is in SSH_USER_AUTH
if ExposeAuthInfo
is enabled. Hopefully that's set before calling PAM.
But this would be a question for PAM and OpenSSH. I don't think it should be baked into this GA PAM module, since that would prevent reuse with other modules.
A verification code isn't prompted if logging in with a key using
ssh -i minecraft-server-key minecraft@raspberrypi
, skipping straight to the command line prompt. I don't key based login to skip the authentication process as the keyfile and passphrase may be stolen./var/log/auth.log (minecraft is a user that I host servers on)
/etc/pam.d/sshd
/etc/sshd/sshd_config