PAM Ignore Password Prompt Upon Successful Login

Question

I have a CentOS 7 server that uses key based authentication for login, along with using Google Authenticator for two-factor authentication.

I am wishing to set it up, so that upon a successful login (the user entered the correct code from Google Authentication) PAM will not prompt the user for their two-factor password for X minutes.

Meaning, a user would be able to login successfully once, then open new terminals without being prompted for their Google Auth password each time, for say, 30 minutes.

I did see this article on SE, however it didn't quite answer my inquiry. Any help is greatly appreciated, thanks!

Answer 1

Look at these solutions which add caching in various forms:

• https://github.com/atodyl/google-authenticator-libpam-auth-cache
• https://github.com/google/libpam-policycache
• https://github.com/dsokoloski/pam-google-auth