google / google/google-authenticator-libpam

LibPAM and Google Authenticator Setup on Centos 7 allows SSH login with any password

Open
#64 2 comments 0 reactions 1 assignee Claimed by @ThomasHabets View on GitHub
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

**OS:** Centos 7
**The need:** set up 2-factor authentication for SSH login into my web server
**Solution:** set up Google Authenticator following the instructions in the link below

https://www.howtoforge.com/tutorial/secure-ssh-with-google-authenticator-on-centos-7/

**Problem:** Google Authenticator allows SSH login with any gibberish typed into the password prompt 2 times even if the first gibberish does not match the second. When I uninstall google authenticator anyone that is not already logged in is prevented from login even with the correct local password.

I referred the problem to Google security team as a vulnerability of Google Authenticator but was redirected here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.