linuxsshpamtwo-factor-authenticationchallenge-response

Linux disable ssh ChallengeResponse for one user


I just installd libpam-yubico to use my Yubikey 4 to login in ssh (Debian 8). My problem is that i can't connect with my mobile phone because my Yubikey 4 can't be used from a mobile. Same problem for my SFTP connection.
So what I want to do is: Create an user who only have to type password and who doesn't have to use Yubikey.

Thanks for answering.


Solution

  • You can use https://linux.die.net/man/8/pam_succeed_if before calling libpam-yubico.

    Reading this Yubikey documentation I suppose that you added a rule in your pam config file. Right before that line, you can try something like this:

    auth sufficient pam_succeed_if.so quiet uid = 500

    Of course, you have to replace 500 with the actual user id.