I am currently using
auth required pam_unix.so try_first_pass nullok auth optional pam_ssh.so use_first_pass
(plus some other, probably irrelevant entries Arch Linux added by default), which means my login password is also used to attempt unlocking any ssh-key stored (or linked to) in
~/.ssh/login-keys.d/ thanks to pam_ssh (I could also use
try_first_pass instead in order to get a passphrase prompt should no ssh key be unlocked by my login password).
This works fine so long as the SSH key passphrase is identical to the login one. However, what I would like to achieve is that I can basically login with one of two different passwords - either my login one or the SSH key one.
So I thought that
pam_ssh should fist try to unlock my SSH key, and only if that fails should
pam_unix be required, otherwise it should be skipped. Can this be achieved somehow?
At first I thought the solution lies in putting
pam_ssh first, but additionally it has to be made
sufficient instead of
auth sufficient pam_ssh.so try_first_pass auth required pam_unix.so try_first_pass nullok
However, in the real files there are some other
required lines following
required pam_unix.so, such as
required pam_env.so, which would now be ignored! So how can I really solve this?