Linux disable ssh ChallengeResponse for one user

Question

I just installd libpam-yubico to use my Yubikey 4 to login in ssh (Debian 8). My problem is that i can't connect with my mobile phone because my Yubikey 4 can't be used from a mobile. Same problem for my SFTP connection.
So what I want to do is: Create an user who only have to type password and who doesn't have to use Yubikey.

Thanks for answering.

Can you show us the content of your `/etc/pam.d/login` file? (make sure there's no sensitive data in it first) — yoones, Apr 23 '17 at 11:57

yoones · Accepted Answer · 2017-04-23T12:50:00.943

0

You can use https://linux.die.net/man/8/pam_succeed_if before calling libpam-yubico.

Reading this Yubikey documentation I suppose that you added a rule in your pam config file. Right before that line, you can try something like this:

auth sufficient pam_succeed_if.so quiet uid = 500

Of course, you have to replace 500 with the actual user id.

edited Apr 23 '17 at 12:50

answered Apr 23 '17 at 12:10

yoones

2,394
1
16
20

@TriiNoxYs I just updated my answer, you can try it and let me know if it works for you. – yoones Apr 23 '17 at 12:51
Ty, it works ! I tried this but with "user = mobile" instead of using the uid .. Ty ! – alexandregv Apr 23 '17 at 12:55
Please make sure you still have to type a password to be able to log in with this account, leaving a backdoor behind you is a common mistake when editing pam rules. – yoones Apr 23 '17 at 12:59
Yep, I still have to type my password – alexandregv Apr 23 '17 at 13:10

Linux disable ssh ChallengeResponse for one user

1 Answers1