Arch Linux

drossbox

Member

Registered: 2019-12-04

Posts: 24

2FA login using google-authenticator fails at boot, works afterwards.

I'm trying to understand why the 2fa code derived from the key created by google-authenticator is not accepted for the login to GDM at boot, but if I switch to TTY2 and login (without2FA), logout, and THEN log in to GDM the 2FA code is accepted and all works as it should on subsequent logins until a fresh reboot.

From digging around, it seemed that the time being out could be the cause, but I'm based in London and timedatectl shows:

[[me@Thinkpad ~]$ timedatectl status
               Local time: Tue 2020-08-25 17:21:58 BST
           Universal time: Tue 2020-08-25 16:21:58 UTC
                 RTC time: Tue 2020-08-25 16:21:58    
                Time zone: Europe/London (BST, +0100) 
System clock synchronized: yes                        
              NTP service: active                     
          RTC in local TZ: no                         

I'm using systemd-timesyncd if that's at all relevant, and tried changing RTC to local TZ just in case, but that also hasn't helped.

I've tried extending the max time window in google-authenticator to 21 to allow for possible time-skew, but that hasn't worked. I've also tried using the counter-based verification instead of time-based but that also doesn't make a difference. The only change to pam settings I've made is adding

auth required pam_google_authenticator.so 

to

 /etc/pam.d/gdm-password 

.

Does anyone know why I may be getting this initial failure?  At this point I'm not really sure how to go about finding the solution - I've never really dealt with pam or 2FA before. Any help much appreciated!