new user create and password change of users fails

[raviteja-b]

Describe the bug

After configuring google authentication pam configuration on my system, totp based authentication works fine but changing password of users on the system fails and new user creation also fails

To Reproduce

Steps to reproduce the behavior:

1. configured Google-authenticator pam modules on system
2. totp login for users works
3. new user create or password change operations fails after enabling Google-authenticator pam configuration

4. started hitting this error after modifying common-password pam config file to include password [success=ok default=die] pam_google_authenticator.so debug

   here is error passwd command error on system,

    passwd root        
    passwd: Module is unknown
    passwd: password unchanged

   if I remove above mentioned config line in common-password, I am able to change password of users.

   Expected behavior

   Password change of users should work after enabling google-authentcator pam configuration.

Config. E.g. /etc/ssh/sshd_config

Paste the config here

Logs: /var/log/auth.log or equivalent

Paste the relevant log lines here

Environment

• OS: .Ubuntu
• Version 22.04
  • Do you use selinux? (check with e.g. sestatus): NO

Additional context

Add any other context about the problem here.

[ThomasHabets]

The template only works if you fill it out.

And passwd root. You run that as root?

[raviteja-b]

The template only works if you fill it out.

And passwd root. You run that as root?

yes user management application runs with root privilege and uses linux pam calls to set/change password which is failing... to recreate this issue, I just gave example of passwd command but linux pam call also fails to set password for users on system after google_authenticator setup.

can you please share what should be common-password pam configuration to enable pam google authenticator library

[ThomasHabets]

You still did not fill out the template. At least I fixed the formatting errors.

What do you expect to happen for someone who already has root, if they want to change the password?

But yes, it does seem like PAM needs pam_sm_chauthtok to be implemented for password changing to work with OTPs. It can be filed as a feature request.