Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an outside network, resorting only to basic username/pass for inside the network. Basically whitelisting a network. How can I accomplish this? I can't seem to find an answer...

share|improve this question
up vote 1 down vote accepted

Doesn't look like the pam module (assuming you mean the "google authenticator" module they introduce for two factor authentication) has any options to support this natively so you'll probably have to futz around with the pam stack control flags.

One possibility would be to:

  1. Have pam_access in the stack configured as "sufficient" (So that success stops PAM from executing afterwards but failure does)
  2. Configure pam_access to always return success for local network users
  3. Put the google authenticator module after the pam_access line.

Net effect should be (I haven't tested it) that execution of the google authenticator module is conditional upon pam_access saying they're not local (i.e failing). It should work since the man page for pam_access says that "auth" facility is provided in the module.

Let me know the results.

share|improve this answer
Can you perhaps link to an example on how to configure pam_access? All I can find are man pages or quick examples that don't really show how it works – Ryan Apr 2 '13 at 20:47
It's pretty simple. Let's say you're using the range of addresses ( - Click here for an example configuration. – Bratchley Apr 2 '13 at 20:54
Basically pam_access will quit on the first match so if they're coming from the 192.168.x.x range pam_access is configured to throw a denial, if they don't match then they go down to the second rule which is just a catch-all allow (which will result in pam_access returning success and hopefully cause google's pam module to get executed). – Bratchley Apr 2 '13 at 20:58
I think I had my pam_access config right the first time: dpaste.org/Y8mhe My revision was try to get a denial if they're local returned from pam_access but a denial is what's going to cause the google module to be executed (so we're wanting pam_access to deny remote users). Sorry for the confusion. – Bratchley Apr 2 '13 at 21:05
I have not had a chance to test this yet, however the logic seems sound and the solution seems legit (and there's not other solutions presented lol). Marking as the answer =) – Ryan Apr 10 '13 at 4:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.