I'm currently starting to set up CentOS server where you have to authenticate with an SSH-Key and enter an yubikey OTP.
It works so far. But when I now start a SSH session with a SSH-Key I need to enter the OTP and the users password, which i don't want.
My /etc/pam.d/sshd file looks like this:
Code: Select all
#%PAM-1.0
auth substack password-auth
auth include postlogin
#account required pam_sepermit.so
auth sufficient pam_yubico.so id=<<ID>> key=<<API-KEY>> debug debug_file=/path/to/file authfile=/path/to/file mode=client pam_sepermit.so
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session optional pam_motd.so
session include password-auth
session include postlogin
The /etc/ssh/sshd_conf looks like this:
Code: Select all
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTHPRIV
PermitRootLogin yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive:pam
UsePAM yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp /usr/libexec/openssh/sftp-server
I hope someone can help me.