google-authenticator asks for verification code twice

0
votes

I have implemented 2 factor authentication on a remote server using google-authenticator. Login from the web console succeeds after password and single verification code queries. But login from ssh asks for verification code 2 times. Login is successful only if 2 successive totp codes are provided.
I have used ssh -v <user@remotehost> to verify that ssh publickey authentication is successful before the first query for verification code is made.

Config file /etc/ssh/sshd_config has the following settings:

# to restrict root login via ssh
PasswordAuthentication no
PermitRootLogin no
# to enable login via 2FA
UsePAM yes
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,password publickey,keyboard-interactive

Config file /etc/pam.d/sshd has the following settings

# Standard Un*x authentication.
# @include common-auth

# for 2FA auth
auth required pam_google_authenticator.so nullok
auth required pam_permit.so
1
sshmulti-factor-authenticationgoogle-authenticator

1 Answers

0
votes

Commenting out auth required pam_google_authenticator.so nullok in /etc/pam.d/sshd removes the duplicate challenge.

Running google_authenticator adds the pam module to /etc/pam.d/common-session making it unnecessary to add it to ssh also.