google / google/google-authenticator-libpam

False positive "keyboard-interactive" / "Further authentication required" from Multi-Factor

Open
#214 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

Hi there - first of all; love the project! Been using it for about 2 years for a more secure server, so thanks for all your hard work.

I am, however, experiencing a little problem; for users that don't have multi-factor enabled, SSH still says `Further authentication required`, which messes with a library for SSH connections via. PHP that I'm using, as it _thinks_ multi-factor is required, when it actually isn't.

This isn't a problem for normal SSH'ing, one could argue that the problem lies with [phpseclib](https://github.com/phpseclib/phpseclib), as they don't give it a chance to pass even though it acts as if it needs multi-factor... _(also; just passing a fake code to it doesn't help... My guess is it then expects a response on whether or not the code is accepted, which it then of course doesn't get)_.
I have also created an issue on this for the phpseclib repository; https://github.com/phpseclib/phpseclib/issues/1795

For the setup, I've followed the “How To Set Up Multi-Factor Authentication for SSH” DigitalOcean guide (https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04), but as mentioned, after setting multi-factor up for one user, there's some "artifact" for all other users, even though it's disabled for them.

Connecting through something like PuTTY, it works just fine; it does note that “Further authentication is required”, but it just ignores it and successfully logs in - I’m just not that lucky with the mentioned library.

I did follow "Step 7" in the mentioned guide, but it still seems like it prompts somehow…

Have I done something wrong, or is this a bug _(that would probably normally be harmless)_?
Is there a way to server not send the keyboard-interactive message to the client, when it’s indeed not needed?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.