I am testing two-factor-authentication for ssh logins on some CentOS containers in our testing environment.

I compiled my own rpms from github's source, installed and configured everything and have the default setup up and running. I get prompted for the token first and for the user's password afterwards.

What I am trying to do now is changing the order of the two factors. I have a requirement to ask for password first and for the token last, but I haven't been able to configure this.

This is what /etc/pam.d/sshd looks like after the installation:

auth       required     pam_google_authenticator.so nullokt
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

I have tried to move around the parameters of the first section with no luck. For example, if I move the google_authenticator line to the bottom of the firat section, only password authentication is enabled.


I have read PAM's documentation, but I cannot achieve this. I have tried to bundle google-authenticator with /etc/pam.d/password-auth, but nothing changed. It is either token first and password second or password only.

1 Answer 1


I have encountered the same problem on Centos 6.2. It works after I comment out include in pam file as follow. I use ArchLinux Wiki as a reference.

auth       required     pam_unix.so
auth       required     pam_env.so
auth       required     pam_google_authenticator.so
#auth      required     pam_sepermit.so
#auth       include      password-auth
  • The password-auth file has more thing about change password, I doesn't have to change the password(or I will change the password by root and use strong password).
    – schemacs
    Oct 13, 2014 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.