I have a query regarding PAM module on centos. That is, how can I login with user's one time password after user's password on a single screen? Like

Username:rohit Password:.... OTP : .... on a single screen.


The login client will not allow this - also PAM will not do so, since PAM only expects one password.

What you would do is either

A) enter password and OTP as one "password"+"OTP" or

B) first enter "password" and then OTP.

If you want to validate the password against your pam_unix, it will not work this way, since you can not split the password within PAM.

So you might do the version B):

Then you would define something like:

auth requried pam_unix.so 
auth required pam_OTP.so

Then PAM will ask you for your username, then for your unix password and if it is correct it will ask you for your OTP. (If you are using something like pam_otpw.)

Once I checked, gdm did NOT display the two login screens after each other, so you need to check with your application.

But you might also use an OTP backend, that supports authentication like in A). privacyIDEA allows to authenticate just like this, you will setup pam_radius and then authenticate with "password"+"OTP". For PAM it is only one authentication request and one password to handle, privacyIDEA will split it up in the backend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy