I use Yubikey's PAM module as an extra layer of authentication on my server.

I want to skip this authentication module when a device tries to authenticate using a specific SSH certificate.

I know it's possible to do this for certain IPs/subnets using access.conf - is there a possibility to filter access by SSH certificate?

Ideally one certificate would skip the extra authentication module, while all others would do the full authentication.


You might want to look into the sshd_config directive Match.

You could try to write something like this (not tested):

Match User certsysuser1
    UsePAM no

In this example certsysuser1 is the principal name (vulgo user name) in the OpenSSH certs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.