Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)

Are there any libraries/apps present in Ubuntu that support multi-factor authentication? What would be good resources to find more about this?

share|improve this question

3 Answers 3

I believe the current authentication stuff is all done within Linux-PAM. The Man page has some details about how it works. What you would need to do is find two authentication modules to plug in and then configure PAM to chain them. Having said that, I'm not sure if it's possible, but it's a good starting point.

Best of luck

share|improve this answer

Most one-time password systems support radius, so pam-radius is the way to go. see kernel.org/pub/linux/libs/pam/ for a lot of stuff.

HTH,

Nick

also you want to edit /etc/pam.d/login for this. there is a usb/key based solution for this, but I can't remember what it is. Be careful - as changing login could mean - no login. ;). Keep an SSH connection open so you can back out changes. Keep a copy of the original. Also - keep in mind that you will want to lock down SSH too.

share|improve this answer

Duo Security's open source duo_unix project demonstrates how to do this with PAM and sshd (and Duo's two-factor service). Disclaimer, I am a Duo engineer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.