I am trying to allow login to a server with only TOTP and I've installed libpam-google-authenticator and connected Google Authenticator app. Here are my relevant settings:


AuthenticationMethods publickey keyboard-interactive
PubKeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication yes

/etc/pam.d/common-auth (inserted at top)

auth sufficient pam_google_authenticator.so nullok

Now after a reload of sshd, I have two issues:

  • The verification code is prompted first, but even if I enter it correctly, it still asks for password.
  • Even if the verification code is wrong, a correct password allows login via SSH. (This is not intended - PasswordAuthentication no is supposed to block this)

How should I configure PAM to get things right?

  • Can you post your complete pam.d/common-auth? (ignoring comments of course) – ilkkachu Sep 15 '19 at 17:26
  • Just so you're aware, the Google Authenticator PAM module is intended to be used as a second factor in addition to a key or password, and not as the sole means of authentication. – gary Sep 15 '19 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.