0

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.

The /etc/pam.d/sshd file is below:

# PAM configuration for the Secure Shell service

# Read environment variables from /etc/environment and
# /etc/security/pam_env.conf.
auth       required     pam_env.so # [1]
# In Debian 4.0 (etch), locale-related environment variables were moved to
# /etc/default/locale, so read that as well.
auth       required     pam_env.so envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# Disallow non-root logins when /etc/nologin exists.
account    required     pam_nologin.so

# Uncomment and edit /etc/security/access.conf if you need to set complex
# access limits that are hard to express in sshd_config.
# account  required     pam_access.so

# Standard Un*x authorization.
@include common-account

# Standard Un*x session setup and teardown.
@include common-session

# Print the message of the day upon successful login.
session    optional     pam_motd.so # [1]

# Print the status of the user's mailbox upon successful login.
session    optional     pam_mail.so standard noenv # [1]

# Set up user limits from /etc/security/limits.conf.
session    required     pam_limits.so

# Set up SELinux capabilities (need modified pam)
# session  required     pam_selinux.so multiple

# Standard Un*x password updating.
@include common-password

auth required pam_google_authenticator.so

I've already tried adding a

auth sufficient pam_exec.so /etc/pam.d/ip.sh

line above the google-authenticator line, but I can't understand how to check an IP adress in the bash script.

spudwaffle
  • 111
  • 1
  • 5

2 Answers2

2

You cannot allow or deny authentication with pam_exec. What you should do is add something like

account  sufficient pam_access.so

just above the google authetnicator line and in /etc/security/access.conf put 

+:ALL:<ip>
Mark Wagner
  • 17,764
  • 2
  • 30
  • 47
  • That should work. AFAIK there is no pam module that can be used to check the IP address of the client. The keyword in your suggestion is "sufficient". – tore- Dec 20 '12 at 08:47
  • Thank you! I never saw in the documentation that pam_exec could not allow or deny authentication, and kept trying to return exit codes from the bash script. – spudwaffle Dec 21 '12 at 02:34
  • 1
    I have tried this receipt and it does not work for me. My logical explanation is that `pam_google_authenticator.so` is executed at `auth` cycle, while `pam_access.so` plays role on `account` cycle (later). I have changed the line to `auth sufficient pam_access.so` and it works reasonably OK. – dma_k Jan 04 '15 at 01:41
0

I use google authenticator before account password. hence I can not use pam_access because of it bypass the account password. So I cloned and implement core whitelist functionality to the google authenticator.

You can get it from https://code.google.com/r/kazimsarikaya-google-authenticatior-withwhitelist/.

slm
  • 7,355
  • 16
  • 54
  • 72
Kazim SARIKAYA
  • 11
  • 3