How can I force/guide users to use 'google-authenticator' when they login without MFA?

Ask Question

Asked 11 months ago

Modified 11 months ago

Viewed 260 times

env: Amazon Linux 2 (centos 7 custom)

I recently plugged Google Authenticator into sshd, and I want every user to use it.

Current Status

Users can log in without MFA using private keys that I initially provided, but once they set the MFA they must use it.

/etc/pam.d/sshd

#%PAM-1.0
auth       required     pam_google_authenticator.so nullok secret=${HOME}/.ssh/google_authenticator
auth       required     pam_permit.so

/etc/ssh/sshd_config

UsePAM yes
PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam

My Goal

I want to systemically force/guide every user who logs in without MFA to set it. How can I do it systemically?

terdon♦

235k66 gold badges447 silver badges672 bronze badges

asked Oct 11, 2022 at 8:57

Lunartist

3852 silver badges13 bronze badges

1

What about just emailing your users and telling them they have 2 weeks to use time based authenticators? (and then you just disable normal login). Changing/hacking security settings for short time could potentially weak your setup (e.g. if you forget to restore some PAM settings, or so). Keep it simple and stupid: email!
– Giacomo Catenazzi
Oct 11, 2022 at 9:09
@GiacomoCatenazzi That was my initial thought as well, but let's just say my users don't read my emails.
– Lunartist
Oct 11, 2022 at 9:14

Add a comment |

0