I'm trying to setup a Debian VM that uses two factor authentication for logins via google-authenticator's PAM plugin. The google-authenticator part is working great through regular console logins or through gdm3, however, when I installed xrdp, I can't seem to get the xrdp login screen to work.

I added auth required pam_google_authenticator.so to /etc/pam.d/xrdp-sesman, however, it seems as if the xrdp login screen is unable to prompt for the verification code. The login just fails instead.

Has anyone been able to get google-authenticator working with xrdp? Alternatively, are there any other options for getting remote desktop-type logins that will work with two-factor authentication?

This will be used for users who are not familiar with Linux, so I can't just ask them to tunnel X11 connections through SSH or something similar, etc.


  • I ended up switching over to ThinLinc instead, which seems to handle the challenge-response authentication much better. I did notice that the google-authenticator PAM plugin has a forward_pass option, which supposedly allows a single prompt for both password and verification code. I did not try it out, but it sounds like it may be the solution using it with xrdp. – acee Feb 5 '14 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.