google / google/google-authenticator-libpam

ssh, no verification password requested and fails

Open
#97 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

Hereby, my configuration, It doenst asks for verification password.
First i give verification password and then ssh password

```
ssh root@xx.xx.xx.xx
root@xx.xx.xx.xx's password:
root@xx.xx.xx.xx's password:
Password:

root@debasiseric2 pam.d]# tailf /var/log/secure
May 16 17:43:46 debasiseric2 sshd[13391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.235.15.200 user=root
May 16 17:43:46 debasiseric2 sshd[13391]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: start of google_authenticator for "root"
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: Secret file permissions are 0400. Allowed permissions are 0600
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" read
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: shared secret in "/root/.google_authenticator" processed
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: no scratch code used from "/root/.google_authenticator"
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: Invalid verification code for root
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" written
May 16 17:43:46 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: end of google_authenticator for "root". Result: Authentication failure
May 16 17:43:48 debasiseric2 sshd[13391]: Failed password for root from 195.235.15.200 port 45432 ssh2
May 16 17:44:08 debasiseric2 sshd[13391]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: start of google_authenticator for "root"
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: Secret file permissions are 0400. Allowed permissions are 0600
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" read
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: shared secret in "/root/.google_authenticator" processed
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: no scratch code used from "/root/.google_authenticator"
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: Accepted google_authenticator for root
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" written
May 16 17:44:08 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: end of google_authenticator for "root". Result: Success
May 16 17:44:10 debasiseric2 sshd[13391]: Failed password for root from 195.235.15.200 port 45432 ssh2
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: start of google_authenticator for "root"
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: Secret file permissions are 0400. Allowed permissions are 0600
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" read
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: shared secret in "/root/.google_authenticator" processed
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: no scratch code used from "/root/.google_authenticator"
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: Invalid verification code for root
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: "/root/.google_authenticator" written
May 16 17:44:19 debasiseric2 sshd(pam_google_authenticator)[13391]: debug: end of google_authenticator for "root". Result: Authentication failure
May 16 17:44:21 debasiseric2 sshd[13391]: Failed password for root from 195.235.15.200 port 45432 ssh2
May 16 17:44:21 debasiseric2 sshd[13391]: Postponed keyboard-interactive for root from 195.235.15.200 port 45432 ssh2 [preauth]

I have tried lot of ways to make it work... It doesnt not work...
I dont know why... any help is really appreciated.

[root@debasiseric2 pam.d]# grep ^[^#] /etc/ssh/sshd_config
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
SyslogFacility AUTHPRIV
PermitRootLogin yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
ChallengeResponseAuthentication yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
X11Forwarding yes
UsePrivilegeSeparation yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp /usr/libexec/openssh/sftp-server

[root@debasiseric2 pam.d]# cat sshd
#%PAM-1.0
auth required pam_sepermit.so
auth substack password-auth
auth include postlogin
#auth required pam_google_authenticator.so

# Used with polkit to reauthorize users in remote sessions
-auth optional pam_reauthorize.so prepare
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include password-auth
session include postlogin
# Used with polkit to reauthorize users in remote sessions
-session optional pam_reauthorize.so prepare
auth required /usr/local/lib/security/pam_google_authenticator.so debug nullok

[root@debasiseric2 pam.d]# cat password-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

[root@debasiseric2 pam.d]# cat system-auth-ac
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so

account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so

password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.