env: Amazon Linux 2 (centos 7 custom)

I recently plugged Google Authenticator into sshd, and I want every user to use it.

Current Status

Users can log in without MFA using private keys that I initially provided, but once they set the MFA they must use it.


auth       required     pam_google_authenticator.so nullok secret=${HOME}/.ssh/google_authenticator
auth       required     pam_permit.so


UsePAM yes
PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam

My Goal

I want to systemically force/guide every user who logs in without MFA to set it. How can I do it systemically?

  • 1
    What about just emailing your users and telling them they have 2 weeks to use time based authenticators? (and then you just disable normal login). Changing/hacking security settings for short time could potentially weak your setup (e.g. if you forget to restore some PAM settings, or so). Keep it simple and stupid: email! Oct 11, 2022 at 9:09
  • @GiacomoCatenazzi That was my initial thought as well, but let's just say my users don't read my emails.
    – Lunartist
    Oct 11, 2022 at 9:14


You must log in to answer this question.

Browse other questions tagged .