search

huashengdun / webssh

:seedling: Web based ssh client
https://webssh.huashengdun.org/
MIT License
4.46k stars 1.25k forks source link

Google Authenticator 2FA is not working #351

Open biswaKL opened 1 year ago

biswaKL commented 1 year ago

I Am trying to do ssh using console with 2FA TOTP, I am able to login. But From webssh I am unable to login, I am getting Authentication Failed.

Its trying for password auth, not even going to 2FA auth

Please find the below Logs:

[I 230526 13:06:49 transport:1893] Connected (version 2.0, client OpenSSH_9.0p1)
[I 230526 13:06:49 handler:86] Trying password authentication
[I 230526 13:06:52 transport:1893] Authentication (password) failed.
[E 230526 13:06:52 handler:516] Traceback (most recent call last):
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 455, in ssh_connect
        ssh.connect(*args, timeout=options.timeout)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/client.py", line 485, in connect
        self._auth(
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 100, in _auth
        raise saved_exception
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 88, in _auth
        self._transport.auth_password(username, password)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/transport.py", line 1587, in auth_password
        return self.auth_handler.wait_for_response(my_event)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/auth_handler.py", line 263, in wait_for_response
        raise e
    paramiko.ssh_exception.AuthenticationException: Authentication failed.

    During handling of the above exception, another exception occurred:

    Traceback (most recent call last):
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 514, in post
        worker = yield future
      File "/usr/local/lib/python3.10/dist-packages/tornado/gen.py", line 767, in run
        value = future.result()
      File "/usr/lib/python3.10/concurrent/futures/_base.py", line 451, in result
        return self.__get_result()
      File "/usr/lib/python3.10/concurrent/futures/_base.py", line 403, in __get_result
        raise self._exception
      File "/usr/lib/python3.10/concurrent/futures/thread.py", line 58, in run
        result = self.fn(*self.args, **self.kwargs)
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 461, in ssh_connect
        raise ValueError('Authentication failed.')
    ValueError: Authentication failed.
biswaKL commented 1 year ago

I Think I know the issue, in line 55 of handler, its expecting "verification" in the begining, but it am getting this:

root@ubuntu-s-1vcpu-1gb-blr1-02:~# ssh root@10.139.0.4
(root@10.139.0.4) Password: 
(root@10.139.0.4) Verification code:
huashengdun commented 1 year ago

For password 2fa, it verifies the password first, then the totp code. Make sure you pass the correct password and totp code together.

biswaKL commented 1 year ago

Password is correct, I am able to login when I disable the TOTP from server side.

huashengdun commented 1 year ago

Show me your configuration file /etc/ssh/sshd_config.

Ethan-622 commented 1 year ago

I get same issue with it.How can i fix it? Where should i input the verification code?

carlosapgomes commented 1 year ago

Same issue here:

I can login using Google 2FA in console with ssh but not with webssh. I can only login with webssh when I disable 2FA. My system is a VM running Ubuntu 22.04 LTS. I installed webssh following this tutorial from DigitalOcean. It runs behind a reverse proxy (nginx).

Interesting thing is that, while running in debug mode, line 409 of handler.py logs otp as None even when I send the otp on the corresponding form field (see the bellow wssh log file output). I double checked Nginx request post logs and the otp is correctly sent by the client.

[I cleared some sensitive information]

wssh log file:

[D 230822 07:07:58 selector_events:54] Using selector: EpollSelector
[D 230822 07:07:58 policy:29] {'autoaddpolicy': <class 'webssh.policy.AutoAddPolicy'>, 'rejectpolicy': <class 'paramiko.client.RejectPolicy'>, 'warningpolicy': <class 'paramiko.client.WarningPolicy'>}
[I 230822 07:07:58 settings:125] RejectPolicy
[D 230822 07:08:41 selector_events:54] Using selector: EpollSelector
[D 230822 07:08:41 policy:29] {'autoaddpolicy': <class 'webssh.policy.AutoAddPolicy'>, 'rejectpolicy': <class 'paramiko.client.RejectPolicy'>, 'warningpolicy': <class 'paramiko.client.WarningPolicy'>}
[I 230822 07:08:41 settings:125] WarningPolicy
[I 230822 07:08:41 main:38] Listening on :8888 (http)
[I 230822 07:13:50 web:2344] 200 GET / (xx.xx.xx.xx) 2.59ms
[I 230822 07:13:50 web:2344] 200 GET /static/css/bootstrap.min.css (xx.xx.xx.xx) 4.30ms
[I 230822 07:13:50 web:2344] 200 GET /static/css/xterm.min.css (xx.xx.xx.xx) 0.63ms
[I 230822 07:13:50 web:2344] 200 GET /static/css/fullscreen.min.css (xx.xx.xx.xx) 0.47ms
[I 230822 07:13:50 web:2344] 200 GET /static/js/jquery.min.js (xx.xx.xx.xx) 0.82ms
[I 230822 07:13:50 web:2344] 200 GET /static/js/popper.min.js (xx.xx.xx.xx) 0.57ms
[I 230822 07:13:50 web:2344] 200 GET /static/js/bootstrap.min.js (xx.xx.xx.xx) 0.72ms
[I 230822 07:13:51 web:2344] 200 GET /static/js/xterm.min.js (xx.xx.xx.xx) 1.41ms
[I 230822 07:13:51 web:2344] 200 GET /static/js/xterm-addon-fit.min.js (xx.xx.xx.xx) 0.41ms
[I 230822 07:13:51 web:2344] 200 GET /static/js/main.js (xx.xx.xx.xx) 0.59ms
[I 230822 07:13:51 web:2344] 200 GET /static/img/favicon.png (xx.xx.xx.xx) 0.84ms
[W 230822 07:14:15 web:2344] 404 GET /static/js/popper.min.js.map (xx.xx.xx.xx) 1.25ms
[W 230822 07:14:15 web:2344] 404 GET /static/js/xterm.js.map (xx.xx.xx.xx) 0.65ms
[W 230822 07:14:15 web:2344] 404 GET /static/js/xterm-addon-fit.js.map (xx.xx.xx.xx) 0.73ms
[W 230822 07:14:15 web:2344] 404 GET /static/js/bootstrap.min.js.map (xx.xx.xx.xx) 0.86ms
[W 230822 07:14:15 web:2344] 404 GET /static/css/fullscreen.min.css.map (xx.xx.xx.xx) 0.44ms
[W 230822 07:14:15 web:2344] 404 GET /static/css/bootstrap.min.css.map (xx.xx.xx.xx) 0.42ms
[D 230822 07:14:37 handler:223] netloc: host.domain.name
[D 230822 07:14:37 handler:226] host: host.domain.name
[D 230822 07:14:37 handler:409] ('yy.yy.yy.yy', 22, 'user1', 'secret', None)
[I 230822 07:14:37 handler:452] Connecting to yy.yy.yy.yy:22
[D 230822 07:14:37 transport:1893] starting thread (client mode): 0xac9263b0
[D 230822 07:14:37 transport:1893] Local version/idstring: SSH-2.0-paramiko_3.3.1
[D 230822 07:14:37 transport:1893] Remote version/idstring: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.3
[I 230822 07:14:37 transport:1893] Connected (version 2.0, client OpenSSH_8.9p1)
[D 230822 07:14:37 transport:1893] === Key exchange possibilities ===
[D 230822 07:14:37 transport:1893] kex algos: curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, sntrup761x25519-sha512@openssh.com, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256
[D 230822 07:14:37 transport:1893] server key: rsa-sha2-512, rsa-sha2-256, ecdsa-sha2-nistp256, ssh-ed25519
[D 230822 07:14:37 transport:1893] client encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
[D 230822 07:14:37 transport:1893] server encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
[D 230822 07:14:37 transport:1893] client mac: umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
[D 230822 07:14:37 transport:1893] server mac: umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
[D 230822 07:14:37 transport:1893] client compress: none, zlib@openssh.com
[D 230822 07:14:37 transport:1893] server compress: none, zlib@openssh.com
[D 230822 07:14:37 transport:1893] client lang: <none>
[D 230822 07:14:37 transport:1893] server lang: <none>
[D 230822 07:14:37 transport:1893] kex follows: False
[D 230822 07:14:37 transport:1893] === Key exchange agreements ===
[D 230822 07:14:37 transport:1893] Kex: curve25519-sha256@libssh.org
[D 230822 07:14:37 transport:1893] HostKey: ssh-ed25519
[D 230822 07:14:37 transport:1893] Cipher: aes128-ctr
[D 230822 07:14:37 transport:1893] MAC: hmac-sha2-256
[D 230822 07:14:37 transport:1893] Compression: none
[D 230822 07:14:37 transport:1893] === End of kex handshake ===
[D 230822 07:14:37 transport:1893] kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
[D 230822 07:14:37 transport:1893] Switch to new keys ...
[I 230822 07:14:37 handler:86] Trying password authentication
[D 230822 07:14:37 transport:1893] Got EXT_INFO: {'server-sig-algs': b'ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com', 'publickey-hostbound@openssh.com': b'0'}
[D 230822 07:14:37 transport:1893] userauth is OK
[I 230822 07:14:41 transport:1893] Authentication (password) failed.
[E 230822 07:14:41 handler:516] Traceback (most recent call last):
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 455, in ssh_connect
        ssh.connect(*args, timeout=options.timeout)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/client.py", line 485, in connect
        self._auth(
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 100, in _auth
        raise saved_exception
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 88, in _auth
        self._transport.auth_password(username, password)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/transport.py", line 1587, in auth_password
        return self.auth_handler.wait_for_response(my_event)
      File "/usr/local/lib/python3.10/dist-packages/paramiko/auth_handler.py", line 263, in wait_for_response
        raise e
    paramiko.ssh_exception.AuthenticationException: Authentication failed.

    During handling of the above exception, another exception occurred:

    Traceback (most recent call last):
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 514, in post
        worker = yield future
      File "/usr/local/lib/python3.10/dist-packages/tornado/gen.py", line 767, in run
        value = future.result()
      File "/usr/lib/python3.10/concurrent/futures/_base.py", line 451, in result
        return self.__get_result()
      File "/usr/lib/python3.10/concurrent/futures/_base.py", line 403, in __get_result
        raise self._exception
      File "/usr/lib/python3.10/concurrent/futures/thread.py", line 58, in run
        result = self.fn(*self.args, **self.kwargs)
      File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 461, in ssh_connect
        raise ValueError('Authentication failed.')
    ValueError: Authentication failed.

[I 230822 07:14:41 web:2344] 200 POST / (xx.xx.xx.xx) 3655.67ms
[D 230822 07:16:37 transport:1893] EOF in transport thread

relevante system wide logs:

Aug 21 21:47:50  sshd(pam_google_authenticator)[16393]: Accepted google_authenticator for user1
Aug 21 21:47:51  sshd[16391]: Accepted keyboard-interactive/pam for user1 from xx.xx.xx.xx port 62653 ssh2
Aug 21 21:47:51  sshd[16391]: pam_unix(sshd:session): session opened for user user1(uid=nnnn) by (uid=0)
Aug 21 21:47:51  systemd[1]: Created slice User Slice of UID nnnn.
Aug 21 21:47:51  systemd[1]: Starting User Runtime Directory /run/user/nnnn...
Aug 21 21:47:51  systemd-logind[727]: New session 81 of user user1.
Aug 21 21:47:51  systemd[1]: Finished User Runtime Directory /run/user/nnnn.
Aug 21 21:47:51  systemd[1]: Starting User Manager for UID nnnn...
Aug 21 21:47:51  systemd[16395]: pam_unix(systemd-user:session): session opened for user user1(uid=nnnn) by (uid=0)
Aug 21 21:47:51  systemd[16395]: Queued start job for default target Main User Target.
Aug 21 21:47:51  systemd[16395]: Created slice User Application Slice.
Aug 21 21:47:51  systemd[16395]: Reached target Paths.
Aug 21 21:47:51  systemd[16395]: Reached target Timers.
Aug 21 21:47:51  systemd[16395]: Starting D-Bus User Message Bus Socket...
Aug 21 21:47:51  systemd[16395]: Listening on GnuPG network certificate management daemon.
Aug 21 21:47:51  systemd[16395]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
Aug 21 21:47:51  systemd[16395]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Aug 21 21:47:51  systemd[16395]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Aug 21 21:47:51  systemd[16395]: Listening on GnuPG cryptographic agent and passphrase cache.
Aug 21 21:47:51  systemd[16395]: Listening on REST API socket for snapd user session agent.
Aug 21 21:47:51  systemd[16395]: Listening on D-Bus User Message Bus Socket.
Aug 21 21:47:51  systemd[16395]: Reached target Sockets.
Aug 21 21:47:51  systemd[16395]: Reached target Basic System.
Aug 21 21:47:51  systemd[1]: Started User Manager for UID nnnn.
Aug 21 21:47:51  systemd[16395]: Reached target Main User Target.
Aug 21 21:47:51  systemd[16395]: Startup finished in 73ms.
Aug 21 21:47:51  systemd[1]: Started Session 81 of User user1.
Aug 21 21:48:32  wssh[16363]: [I 230821 21:48:32 handler:452] Connecting to 127.0.0.1:22
Aug 21 21:48:32  wssh[16363]: [I 230821 21:48:32 transport:1893] Connected (version 2.0, client OpenSSH_8.9p1)
Aug 21 21:48:32  wssh[16363]: [I 230821 21:48:32 handler:86] Trying password authentication
Aug 21 21:48:32  sshd(pam_google_authenticator)[16754]: Invalid verification code for user1
Aug 21 21:48:34  sshd[16754]: Failed password for user1 from 127.0.0.1 port 50972 ssh2
Aug 21 21:48:35  wssh[16363]: [I 230821 21:48:35 transport:1893] Authentication (password) failed.
Aug 21 21:48:35  wssh[16363]: [E 230821 21:48:35 handler:516] Traceback (most recent call last):
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 455, in ssh_connect
Aug 21 21:48:35  wssh[16363]:         ssh.connect(*args, timeout=options.timeout)
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/paramiko/client.py", line 485, in connect
Aug 21 21:48:35  wssh[16363]:         self._auth(
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 100, in _auth
Aug 21 21:48:35  wssh[16363]:         raise saved_exception
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 88, in _auth
Aug 21 21:48:35  wssh[16363]:         self._transport.auth_password(username, password)
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/paramiko/transport.py", line 1587, in auth_password
Aug 21 21:48:35  wssh[16363]:         return self.auth_handler.wait_for_response(my_event)
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/paramiko/auth_handler.py", line 263, in wait_for_response
Aug 21 21:48:35  wssh[16363]:         raise e
Aug 21 21:48:35  wssh[16363]:     paramiko.ssh_exception.AuthenticationException: Authentication failed.
Aug 21 21:48:35  wssh[16363]:     
Aug 21 21:48:35  wssh[16363]:     During handling of the above exception, another exception occurred:
Aug 21 21:48:35  wssh[16363]:     
Aug 21 21:48:35  wssh[16363]:     Traceback (most recent call last):
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 514, in post
Aug 21 21:48:35  wssh[16363]:         worker = yield future
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/tornado/gen.py", line 767, in run
Aug 21 21:48:35  wssh[16363]:         value = future.result()
Aug 21 21:48:35  wssh[16363]:       File "/usr/lib/python3.10/concurrent/futures/_base.py", line 451, in result
Aug 21 21:48:35  wssh[16363]:         return self.__get_result()
Aug 21 21:48:35  wssh[16363]:       File "/usr/lib/python3.10/concurrent/futures/_base.py", line 403, in __get_result
Aug 21 21:48:35  wssh[16363]:         raise self._exception
Aug 21 21:48:35  wssh[16363]:       File "/usr/lib/python3.10/concurrent/futures/thread.py", line 58, in run
Aug 21 21:48:35  wssh[16363]:         result = self.fn(*self.args, **self.kwargs)
Aug 21 21:48:35  wssh[16363]:       File "/usr/local/lib/python3.10/dist-packages/webssh/handler.py", line 461, in ssh_connect
Aug 21 21:48:35  wssh[16363]:         raise ValueError('Authentication failed.')
Aug 21 21:48:35  wssh[16363]:     ValueError: Authentication failed.
Aug 21 21:48:35  wssh[16363]:     
Aug 21 21:48:35  wssh[16363]: [I 230821 21:48:35 web:2344] 200 POST / (xx.xx.xx.xx) 3117.97ms
Aug 21 21:48:45  sshd[16441]: Received disconnect from xx.xx.xx.xx port 62653:11: disconnected by user
Aug 21 21:48:45  sshd[16441]: Disconnected from user user1 xx.xx.xx.xx port 62653
Aug 21 21:48:45  sshd[16391]: pam_unix(sshd:session): session closed for user user1
Aug 21 21:48:45  systemd[1]: session-81.scope: Deactivated successfully.
Aug 21 21:48:45  systemd-logind[727]: Session 81 logged out. Waiting for processes to exit.
Aug 21 21:48:45  systemd-logind[727]: Removed session 81.
Aug 21 21:48:56  systemd[1]: Stopping User Manager for UID nnnn...
Aug 21 21:48:56  systemd[16395]: Stopped target Main User Target.
Aug 21 21:48:56  systemd[16395]: Stopped target Basic System.
Aug 21 21:48:56  systemd[16395]: Stopped target Paths.
Aug 21 21:48:56  systemd[16395]: Stopped target Sockets.
Aug 21 21:48:56  systemd[16395]: Stopped target Timers.

relevant auth.log:

Aug 21 21:47:50  sshd(pam_google_authenticator)[16393]: Accepted google_authenticator for user1
Aug 21 21:47:51  sshd[16391]: Accepted keyboard-interactive/pam for user1 from xx.xx.xx.xx port 62653 ssh2
Aug 21 21:47:51  sshd[16391]: pam_unix(sshd:session): session opened for user user1(uid=nnnn) by (uid=0)
Aug 21 21:47:51  systemd-logind[727]: New session 81 of user user1.
Aug 21 21:47:51  systemd: pam_unix(systemd-user:session): session opened for user user1(uid=nnnn) by (uid=0)
Aug 21 21:48:32  sshd(pam_google_authenticator)[16754]: Invalid verification code for user1
Aug 21 21:48:34  sshd[16754]: Failed password for user1 from 127.0.0.1 port 50972 ssh2
Aug 21 21:48:45  sshd[16441]: Received disconnect from xx.xx.xx.xx port 62653:11: disconnected by user
Aug 21 21:48:45  sshd[16441]: Disconnected from user user1 xx.xx.xx.xx port 62653
Aug 21 21:48:45  sshd[16391]: pam_unix(sshd:session): session closed for user user1
Aug 21 21:48:45  systemd-logind[727]: Session 81 logged out. Waiting for processes to exit.
Aug 21 21:48:45  systemd-logind[727]: Removed session 81.

my sshd_config:

Include /etc/ssh/sshd_config.d/*.conf
Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp    /usr/lib/openssh/sftp-server

Match User user1
    PasswordAuthentication yes

my /etc/pam.d/sshd file:

# PAM configuration for the Secure Shell service

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# SELinux needs to be the first session rule.  This ensures that any
# lingering context has been cleared.  Without this it is possible that a
# module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close

# Set the loginuid process attribute.
session    required     pam_loginuid.so

# Create a new session keyring.
session    optional     pam_keyinit.so force revoke

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional     pam_motd.so  motd=/run/motd.dynamic
session    optional     pam_motd.so noupdate

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
session    required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale

# SELinux needs to intervene at login time to ensure that the process starts
# in the proper default security context.  Only sessions which are intended
# to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open

# Standard Un*x password updating.
@include common-password

my /etc/pam.d/common-auth file:

# /etc/pam.d/common-auth - authentication settings common to all services

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]  pam_unix.so nullok
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional            pam_cap.so 
# end of pam-auth-update config
auth required pam_google_authenticator.so nullok

Am I missing any configuration?

Thanks

Carlos