0

I use Yubikey's PAM module as an extra layer of authentication on my server.

I want to skip this authentication module when a device tries to authenticate using a specific SSH certificate.

I know it's possible to do this for certain IPs/subnets using access.conf - is there a possibility to filter access by SSH certificate?

Ideally one certificate would skip the extra authentication module, while all others would do the full authentication.

New contributor
Seb is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

You might want to look into the sshd_config directive Match.

You could try to write something like this (not tested):

Match User certsysuser1
    AuthenticationMethods
    UsePAM no

In this example certsysuser1 is the principal name (vulgo user name) in the OpenSSH certs.

Your Answer

Seb is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.