I am trying to allow login to a server with only TOTP and I've installed
libpam-google-authenticator and connected Google Authenticator app. Here are my relevant settings:
AuthenticationMethods publickey keyboard-interactive PubKeyAuthentication yes PasswordAuthentication no ChallengeResponseAuthentication yes
/etc/pam.d/common-auth (inserted at top)
auth sufficient pam_google_authenticator.so nullok
Now after a reload of
sshd, I have two issues:
- The verification code is prompted first, but even if I enter it correctly, it still asks for password.
- Even if the verification code is wrong, a correct password allows login via SSH. (This is not intended -
PasswordAuthentication nois supposed to block this)
How should I configure PAM to get things right?