Publickey + yubikey OTP still with password

Issues related to applications and software problems and general support
Post Reply
Lapotor
Posts: 1
Joined: 2020/02/14 01:14:09

Publickey + yubikey OTP still with password

Post by Lapotor » 2020/02/14 01:27:33

Hello folks,

I'm currently starting to set up CentOS server where you have to authenticate with an SSH-Key and enter an yubikey OTP.
It works so far. But when I now start a SSH session with a SSH-Key I need to enter the OTP and the users password, which i don't want.

My /etc/pam.d/sshd file looks like this:

Code: Select all

#%PAM-1.0
auth       substack     password-auth
auth       include      postlogin
#account    required     pam_sepermit.so
auth       sufficient   pam_yubico.so id=<<ID>> key=<<API-KEY>> debug debug_file=/path/to/file authfile=/path/to/file mode=client pam_sepermit.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    optional     pam_motd.so
session    include      password-auth
session    include      postlogin
When i set the pam_yubico.so to required the authentication get aborted.

The /etc/ssh/sshd_conf looks like this:

Code: Select all

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

SyslogFacility AUTHPRIV
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys

PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive:pam
UsePAM yes

GSSAPIAuthentication yes
GSSAPICleanupCredentials no

X11Forwarding yes
PrintMotd no

AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS

Subsystem       sftp    /usr/libexec/openssh/sftp-server
The server is fresh installed.

I hope someone can help me.

Post Reply

Return to “CentOS 8 - General Support”