<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"> <p>Hi All,</p> <p><br> </p> <p>I am trying hard to get my 2FA working with FreeIPA but every effort of mine going waste! I have referred earlier forum emails but could not find any good reply on the issue i am facing.</p> <p><br> </p> <p>This is what i am trying</p> <p><br> </p> <p>I have a test user created in my IPA server enabled with <span style="color: rgb(51, 51, 51); font-family: "Open Sans", Helvetica, Arial, sans-serif; font-size: 12px; font-weight: 600; line-height: 20px;"> Two factor authentication (password + OTP)</span> and has ssh public key added in its profile. I want this test user to ssh into my ipa client (ubuntu 14.04) using key + password + OTP. I woudl ceryainly prefer just the key+ OTP only ( no password) but that seems far sighted as i cannot even make it work with what it supposed to work password + OTP. </p> <p><br> </p> <p>My /etc/ssh/sshd_conf file has almost everything default except i added these two lines at the end of it</p> <p></p> <p class="p1"><span class="s1">Match</span><span class="s2"> </span><span class="s3">Group</span><span class="s2"> testusergroup</span></p> <p class="p1"><span class="s2"> <span style="font-family: Times; font-size: 16px;"> AuthenticationMethods publickey,password:pam publickey,keyboard-interactive:pam</span></span></p> <p class="p1"><span class="s2"><span style="font-family: Times; font-size: 16px;"><span class="s1" style="font-size: 16px; font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">i also tried with below but no luck</span><br> </span></span></span></p> <p class="p1"><span class="s2"><span style="font-family: Times; font-size: 16px;"><span class="s1" style="font-size: 16px; font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">Match</span><span class="s2" style="font-size: 16px; font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;"> </span><span class="s3" style="font-size: 16px; font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">Group</span><span class="s2" style="font-size: 16px; font-family: Calibri, Arial, Helvetica, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;"> testusergroup</span><br> </span></span></p> <p class="p1"><span class="s2"> AuthenticationMethods publickey,keyboard-interactive</span></p> <p class="p1"><span class="s2"><br> </span></p> <p class="p1">my /etc/pam.d/sshd has these two changes, rest i kept default:</p> <p class="p1"><br> </p> <p class="p1"></p> <p class="p1"><span class="s1"># Standard Un*x authentication.</span></p> <p class="p1"><span class="s1">#@include common-auth</span></p> <p class="p1"><span class="s1"><br> </span></p> <p class="p1"></p> <p class="p1"><span class="s1">auth</span><span class="s2"> </span><span class="s3">required</span><span class="s2"> </span><span class="s4">pam_sss.so</span></p> <br> <p></p> <p class="p3"><span class="s1"></span></p> Now when i try to ssh into ipa client i either keep getting promptS for the password or it gets into a loop asking me to change the password ;complaining <b>falsely</b> that it has expired. I have tried multiple combinations of configurations by referring earlier email threads but none i found helpful. I cant make simple 2FA login to work with freeIPA. Normal password and key works just fine. its the 2FA which does not work for me. <p></p> <p class="p1"><br> </p> <p class="p1">Would really be thankful if some one can help me with this issue.. is there any good freeIPA 2FA configuration document that i can refer?</p> <p class="p1">What should the steps for it work seamlessly?</p> <p class="p1"><br> </p> <p class="p1">Many Thanks,</p> <p class="p1">Deepak</p> <br> <p></p> </div> </body> </html>