google / google/google-authenticator-libpam
False positive "keyboard-interactive" / "Further authentication required" from Multi-Factor
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
Hi there - first of all; love the project! Been using it for about 2 years for a more secure server, so thanks for all your hard work.
I am, however, experiencing a little problem; for users that don't have multi-factor enabled, SSH still says `Further authentication required`, which messes with a library for SSH connections via. PHP that I'm using, as it _thinks_ multi-factor is required, when it actually isn't.
This isn't a problem for normal SSH'ing, one could argue that the problem lies with [phpseclib](https://github.com/phpseclib/phpseclib), as they don't give it a chance to pass even though it acts as if it needs multi-factor... _(also; just passing a fake code to it doesn't help... My guess is it then expects a response on whether or not the code is accepted, which it then of course doesn't get)_.
I have also created an issue on this for the phpseclib repository; https://github.com/phpseclib/phpseclib/issues/1795
For the setup, I've followed the “How To Set Up Multi-Factor Authentication for SSH” DigitalOcean guide (https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-20-04), but as mentioned, after setting multi-factor up for one user, there's some "artifact" for all other users, even though it's disabled for them.
Connecting through something like PuTTY, it works just fine; it does note that “Further authentication is required”, but it just ignores it and successfully logs in - I’m just not that lucky with the mentioned library.
I did follow "Step 7" in the mentioned guide, but it still seems like it prompts somehow…
Have I done something wrong, or is this a bug _(that would probably normally be harmless)_?
Is there a way to server not send the keyboard-interactive message to the client, when it’s indeed not needed?
Contributor guide
Assessment
This issue has not been assessed yet.