google / google/google-authenticator-libpam
LibPAM and Google Authenticator Setup on Centos 7 allows SSH login with any password
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
**OS:** Centos 7
**The need:** set up 2-factor authentication for SSH login into my web server
**Solution:** set up Google Authenticator following the instructions in the link below
https://www.howtoforge.com/tutorial/secure-ssh-with-google-authenticator-on-centos-7/
**Problem:** Google Authenticator allows SSH login with any gibberish typed into the password prompt 2 times even if the first gibberish does not match the second. When I uninstall google authenticator anyone that is not already logged in is prevented from login even with the correct local password.
I referred the problem to Google security team as a vulnerability of Google Authenticator but was redirected here.
Contributor guide
Assessment
This issue has not been assessed yet.