1

Because of a few different applications I need to use, I need to be able to bypass Google's 2 Factor Authentication pam.d module when an SSH connection is coming from the same network. There is very little information about this online, but there are a few questions on the Stack Network, but none of the solutions worked for me. I am not sure if it is because the solutions are specifically for Linux, or I am just missing something. I am using macOS in all instances here.

I am not very familiar with these settings. I do want to require a password, key, & 2FA if I am not on the same local network, but skip the 2FA if I am on the same local network

Current Setup:

SSH requires a valid key, password, & 2 Factor Auth

File Contents Of:

/etc/pam.d/sshd

auth       optional       pam_krb5.so use_kcminit
auth       optional       pam_ntlm.so try_first_pass
auth       optional       pam_mount.so try_first_pass
auth       required       pam_opendirectory.so try_first_pass
auth       required       pam_google_authenticator.so nullok
account    required       pam_nologin.so
account    required       pam_sacl.so sacl_service=ssh
account    required       pam_opendirectory.so
password   required       pam_opendirectory.so
session    required       pam_launchd.so
session    optional       pam_mount.so

/etc/ssh/ssh_config

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   PasswordAuthentication yes
#   HostbasedAuthentication no
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Port 22
#   Protocol 2
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
#   MACs hmac-md5,hmac-sha1,[email protected]
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

Host *
    SendEnv LANG LC_*

/etc/ssh/sshd_config

#Protocol Version
Protocol 2

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
MaxAuthTries 3
#MaxSessions 10

PubkeyAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
PermitEmptyPasswords no

# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes

# Kerberos options
KerberosAuthentication yes
KerberosOrLocalPasswd yes
KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
ClientAliveInterval 360
ClientAliveCountMax 0
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# pass locale information
AcceptEnv LANG LC_*

# no default banner path
Banner /etc/ssh/banner

# override default of no subsystems
Subsystem   sftp    /usr/libexec/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server

EDIT:

I attempted a few different combinations of the listed solutions to the Stack posts at the links listed below but I could not get the provided solutions to work. I do not know if I am missing something in my configuration, or if it has to do with I'm using macOS, or if maybe the order of what's listed in my sshd file in pam.d is incorrect.

SSH - Only require google-authenticator from outside local network

https://serverfault.com/questions/799657/ssh-google-authenticator-ignore-whitelist-ips

I attempted to add this to the sshd file in pam.d:

auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access.conf
auth sufficient pam_google_authenticator.so

And adding an access.conf file to /etc/security/access.conf:

+ : ALL : 10.0.1.0/24
+ : ALL : LOCAL
+ : ALL : 10.0.1.4
+ : ALL : 10.0.1.6
+ : ALL : 10.0.1.16
+ : ALL : 10.0.1.20
- : ALL : ALL
1
  • @KamilMaciorowski I edited my original post, and added to the bottom what I did try. I provided 2 links to stack posts with solutions, as well as what I attempted for clarification.
    – mcbeav
    Oct 1, 2020 at 21:20

2 Answers 2

1

I use this on my macs:

/etc/pam.d/sshd

# sshd: auth account password session
auth       binding        /usr/local/opt/google-authenticator-libpam/lib/security/pam_google_authenticator.so
auth       optional       pam_krb5.so use_kcminit
auth       optional       pam_ntlm.so try_first_pass
auth       optional       pam_mount.so try_first_pass
auth       required       pam_opendirectory.so try_first_pass
account    required       pam_nologin.so
account    required       pam_sacl.so sacl_service=ssh
account    required       pam_opendirectory.so
password   required       pam_opendirectory.so
session    required       pam_launchd.so
session    optional       pam_mount.so

/etc/ssh/sshd_config

LogLevel VERBOSE
PermitRootLogin no
PubkeyAuthentication yes
AuthorizedKeysFile  .ssh/authorized_keys
PasswordAuthentication no
PermitEmptyPasswords no
AuthenticationMethods publickey,keyboard-interactive:pam
ChallengeResponseAuthentication yes
UsePAM yes
AcceptEnv LANG LC_*
Subsystem   sftp    /usr/libexec/sftp-server
Match Address fc00::/7,10.0.1.0/24
    PasswordAuthentication no
    AuthenticationMethods publickey

This way only connections coming in from outside the local network are required to provide 2fa, local connections are Pubkey based only.

1
  • Thank you!!!! Out of everything I have read and tried this is the only thing that has worked for me and it worked like a charm exactly how I was hoping. I spent a lot of time trying to get this to work. Thank you again!!
    – mcbeav
    Jan 15, 2021 at 21:13
1

See the section "Request OTP only when connecting from outside your local network" in the arch wiki:

To achieve this, create a file (e.g. /etc/security/access-local.conf) and add the networks where you want to be able to bypass the 2FA from:

# only allow from local IP range
+ : ALL : 192.168.20.0/24
# Additional network: VPN tunnel ip range (in case you have one)
+ : ALL : 10.8.0.0/24
+ : ALL : LOCAL
- : ALL : ALL

Then edit your /etc/pam.d/sshd and add the line:

#%PAM-1.0
#auth     required  pam_securetty.so     #disable remote root
auth [success=1 default=ignore] pam_access.so accessfile=/etc/security/access-local.conf
auth      required  pam_google_authenticator.so
auth      include   system-remote-login
account   include   system-remote-login
password  include   system-remote-login
session   include   system-remote-login

I thought I'm using the same settings as on the wiki but here is the configuration from a working system:

#%PAM-1.0
auth [success=done default=ignore] pam_access.so accessfile=/etc/security/otp-access.conf
auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok

update - since it is still not working for you, first use only

auth [success=done new_authtok_reqd=done default=die] pam_google_authenticator.so nullok

Then verify that 2f auth works. You should only use your ssh key and your 2f code. It should not ask for a password.

The success=done part means that once 2f is finished, it will exit the auth pam stack, so the auth lines below will not be processed.

If that is working insert the first line

auth [success=done default=ignore] pam_access.so accessfile=/etc/security/otp-access.conf

This means that if the ip is correct, it will again stop processing the auth pam stack (and not go to the second line with 2f).

7
  • So I did exactly as you have outlined but now when attempting to connect via ssh i get an immediate "Connection Closed By: 10.0.0.0" which is the exact response I recieve when I attempt to use any other method, but this is essentially the same method as I have tried outlined in the original post.
    – mcbeav
    Oct 1, 2020 at 21:51
  • @mcbeav is it just not working locally or did you not get google auth working at all?
    – laktak
    Oct 2, 2020 at 8:37
  • As of right now, with my /etc/pam.d/sshd file contents shown in the original post, and my /etc/ssh/ssh_config & /etc/ssh/sshd_config contents shown in the original post WITHOUT modifying the contents to try to include access-local.conf and placing a conditional for the authenticator module, Google Authenticator works just fine. When connecting via SSH, a key is first checked. If a key doesn't exist, the connection is refused immediately. If a key exists, then a password is requested. If the password is correct, then a Google Auth code is required. This is what I want, except when local
    – mcbeav
    Oct 2, 2020 at 9:23
  • When local, I only want to skip the Google Authenticator because a few apps I use don't support 2 Factor Authentication. They only support using a password and a key, but I do need to keep Google 2FA enabled for other reasons.
    – mcbeav
    Oct 2, 2020 at 9:24
  • once again, everything works fine when I have my configuration files setup the way I have posted in the post. When attempting to connect, the key is checked, then asks for password, then 2FA. When copying exactly what you posted, and adding into my sshd file I again get the "Connection Closed by 10.0.0.0.0" immediately. Any chance you can post up a copy of your entire /etc/ssh/ssh_config /etc/ssh/sshd_config, and /etc/pam.d/sshd files so I can compare and contrast? I have a feeling I am missing something, or have something in the wrong order
    – mcbeav
    Oct 2, 2020 at 10:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .