Arch Linux

struthio

Member

Registered: 2005-11-07

Posts: 32

PAM - Alternative login ways

hi,

I am recently decided to modify a bit PAM rules for my system and part ended up in dead spot where I think my idea is 'hard' if not impossible, but maybe someone can help.

I want to configure three PAM auth modules to be used in Arch:

* Face recognition
* YubiKey PAM (login when YubiKey is connected)
* Regular Password Auth

I would like to setup PAM in a way that only 2 of above are required to login, so user can login to station by:

* Face Recognition + YubiKey
* YubiKey + Password
* Password + Face Recognition

Is there a way to do such alternative/concurrent flows or auth must always follow 'linear' path ?

Ferdinand

Member

From: Norway

Registered: 2020-01-02

Posts: 338

Re: PAM - Alternative login ways

I don't think you'll get those to work in parallel, in the sense that whatever authenticates you first will approve you, because the PAM configuration files seem to list one method after another, sequentially. You can choose the order they work in, though.

I haven't tried YubiKey, but I have Howdy and normal passwords working as described in the Wiki: https://wiki.archlinux.org/title/Howdy

I can log in with my password if I decide to, or I can just press enter, and the face recognition will (usually) let me in
I find that the face recognition is neither faster nor more reliable than me typing my password, though, so I usually just use the password.

---

Xfce ⬩ No CSD ⬩ Arch Forum Readme

loqs

Member

Registered: 2014-03-06

Posts: 18,982

Re: PAM - Alternative login ways

If you wanted just 2FA could you not do something such as:

auth       [success=ok default=2]  pam_unix.so          try_first_pass nullok
auth       [success=1 default=bad] pam_somethingelse     
auth       [default=die]           pam_faillock.so      authfail