PAM, RADIUS, Google Authenticator and Two Factor Auth

Question

I have setup FreeRADIUS, PAM and the Google Authtenicator. FreeRADIUS calls PAM, which in turn calls the Google pam_google_authenticator.so libary. That all works successfully.

However, that's not really 2 factor auth, as all one needs is the OTP from the Google App. To get two 2FA, I want to use the local Linux password. Since this is through RADIUS, I can't prompt for both passwords, and need to combine them in one. According the Google Auth README, and various blogs I found, I should do this in PAM:

   auth requisite pam_google_authenticator.so forward_pass
   auth required pam_unix.so use_first_pass  

And then I can put the password and OTP at the same prompt, e.g. MyPass123456

But it never works. With debugging on, I can see that pam_unix.so checks and accepts the password from the user, but then fails anyway. If I remove that second line, or change 'auth' to 'account' (one suggestion I found), auth works, but the local password is simply ignored.

Am I missing something in my PAM config?

Solution

Lot's of Googling lead me to https://bugs.launchpad.net/percona-server/+bug/1274821 which describes a similar problem. As documented there, this worked:

 auth requisite pam_google_authenticator.so forward_pass
 auth required pam_unix.so use_first_pass  
 account required pam_unix.so audit
 account required pam_permit.so

Although why that works remains a mystery to me, as the MySQL issue is about using PAM as non-root, and I have FreeRADIUS setup to run as root.

Comments

[Sanjaya]

Good tutorial i have seen is from below link. cyberciti.biz/open-source/… However it is not mentioned required packages need to be installed before installing and configuring. However you may need to install following package. Compatible epel repository will help you to install the google-authenticator using tun install comand. yum install pam-devel

[cornelinux]

If it breaks after "auth pam_unix" then this would work out. The question is, why it would break there.