<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p><br>
</p>
<div style="color: rgb(0, 0, 0);">
<div id="divRplyFwdMsg" dir="ltr">
<div></div>
</div>
<div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hi All,</p>
<p><br>
</p>
<p>I am trying hard to get my 2FA working with FreeIPA but every effort of mine going waste! I have referred earlier forum emails but could not find any good reply on the issue i am facing.</p>
<p><br>
</p>
<p>This is what i am trying</p>
<p><br>
</p>
<p>I have a test user created in my IPA server enabled with <span style="color:rgb(51,51,51); font-family:"Open Sans",Helvetica,Arial,sans-serif; font-size:12px; font-weight:600; line-height:20px">
Two factor authentication (password + OTP)</span> and has ssh public key added in its profile. I want this test user to ssh into my ipa client (ubuntu 14.04) using key + password + OTP. I woudl ceryainly prefer just the key+ OTP only ( no password) but that
seems far sighted as i cannot even make it work with what it supposed to work password + OTP. </p>
<p><br>
</p>
<p>My /etc/ssh/sshd_conf file has almost everything default except i added these two lines at the end of it</p>
<p></p>
<p class="p1"><span class="s1">Match</span><span class="s2"> </span><span class="s3">Group</span><span class="s2"> testusergroup</span></p>
<p class="p1"><span class="s2"> <span style="font-family:Times; font-size:16px"> AuthenticationMethods publickey,password:pam publickey,keyboard-interactive:pam</span></span></p>
<p class="p1"><span class="s2"><span style="font-family:Times; font-size:16px"><span class="s1" style="font-size:16px; font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols"><span style="font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:16px">i also
tried with below but no luck</span><br>
</span></span></span></p>
<p class="p1"><span class="s2"><span style="font-family:Times; font-size:16px"><span class="s1" style="font-size:16px; font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">Match</span><span class="s2" style="font-size:16px; font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols"> </span><span class="s3" style="font-size:16px; font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">Group</span><span class="s2" style="font-size:16px; font-family:Calibri,Arial,Helvetica,sans-serif,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols"> testusergroup</span><br>
</span></span></p>
<p class="p1"><span class="s2"> AuthenticationMethods publickey,keyboard-interactive</span></p>
<p class="p1"><span class="s2"><br>
</span></p>
<p class="p1">my /etc/pam.d/sshd has these two changes, rest i kept default:</p>
<p class="p1"><br>
</p>
<p class="p1"></p>
<p class="p1"><span class="s1"># Standard Un*x authentication.</span></p>
<p class="p1"><span class="s1">#@include common-auth</span></p>
<p class="p1"><span class="s1"><br>
</span></p>
<p class="p1"></p>
<p class="p1"><span class="s1">auth</span><span class="s2"> </span><span class="s3">required</span><span class="s2">
</span><span class="s4">pam_sss.so</span></p>
<br>
<p></p>
<p class="p3"><span class="s1"></span></p>
Now when i try to ssh into ipa client i either keep getting promptS for the password or it gets into a loop asking me to change the password ;complaining
<b>falsely</b> that it has expired. I have tried multiple combinations of configurations by referring earlier email threads but none i found helpful. I cant make simple 2FA login to work with freeIPA. Normal password and key works just fine. its the 2FA which
does not work for me.
<p></p>
<p class="p1"><br>
</p>
<p class="p1">Would really be thankful if some one can help me with this issue.. is there any good freeIPA 2FA configuration document that i can refer?</p>
<p class="p1">What should the steps for it work seamlessly?</p>
<p class="p1"><br>
</p>
<p class="p1">Many Thanks,</p>
<p class="p1">Deepak</p>
<br>
<p></p>
</div>
</div>
</div>
</div>
</body>
</html>