However, as of OpenSSH 6.2, you can add AuthenticationMethods to allow both: two-factor and key-based authentication. Warning: OpenSSH will ignore all of this if you are authenticating with a SSH-key pair and have disabled password logins. Changing the order of the two modules will reverse this order. This will ask for the OTP before prompting for your Unix password. To enter both, your unix password and your OTP, add pam_google_authenticator.so above the system-remote-login lines to /etc/pam.d/sshd:Īuth required pam_google_authenticator.so In this guide we proceed with editing /etc/pam.d/sshd which is most safely (but not necessarily) done in a local session. In case you want to use Google Authenticator globally you would need to change /etc/pam.d/system-auth, however, in this case proceed with extreme caution to not lock yourself out.
The corresponding PAM configuration file is /etc/pam.d/sshd. Usually one demands two-pass authentication only for remote login. Furthermore consider generating the key file before editing (and therefore applying) the PAM configuration.
Warning: If you do all configuration via SSH do not close the session before you tested that everything is working, else you may lock yourself out.
0 kommentar(er)
