Hello, everyone.
I have installed plasma in a Virtualbox Machine; I would like the login procedure after boot to prompt for the google-authenticator code right after the password. I have done tests with ubuntu and it works, but I find it difficult to transfer the procedure to manjaro
After installing and running google-authenticator , I modified
/etc/pam.d/system-login
which looks like this
auth requisite pam_nologin.so
auth include system-auth
account required pam_access.so
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_loginuid.so
session optional pam_keyinit.so force revoke
session include system-auth
session optional pam_motd.so
session optional pam_mail.so dir=/var/spool/mail standard quiet
session optional pam_umask.so
-session optional pam_systemd.so
session required pam_env.so
by adding as the third line
auth required pam_google_authenticator.so
on the next reboot, at login, after first providing the password, the system tells me that the password is wrong, and I can no longer log in…
What to do ?
I only need to use 2-way authentication for local login to the system, so I don’t need SSH. According to the wiki I just need to add the line
auth required pam_google_authenticator.so
nel file /etc/pam.d/login . But whatever its position, it has no effect. In addition the file /etc/pam.d/gdm-password does not exist in manjaro ( according to wiki)
That is a drop-in directory. For user customizations. AFAIK there should be nothing inside it by default, or shouldn’t even exist. So try creating it and then add the file…:
sudo mkdir /etc/pam.d/gdm-password
And then do the stuff. Or something. No, I don’t know the default contents.
Just notice file and not directory.
That tells me, you probably don’t have Google Authenticator installed…
Edit:
Re-read the topic title and contents. Came across this:
…and since Plasma uses sddm, I’d say your stuffed…
Apparently you can get google-authenticator to work with plasma with a method suggested by a post referenced by @Mirdarthos .Reading that post to the end a solution is suggested. I modified the file
/etc/pam.d/system-login
in the following way
auth required pam_google_authenticator.so forward_pass
auth [success=1 default=ignore] pam_unix.so try_first_pass
auth required pam_shells.so
auth requisite pam_nologin.so
auth include system-auth
account required pam_access.so
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_loginuid.so
session optional pam_keyinit.so force revoke
session include system-auth
session optional pam_motd.so
session optional pam_mail.so dir=/var/spool/mail standard quiet
session optional pam_umask.so
-session optional pam_systemd.so
session required pam_env.so
Adding only the first two lines from the suggestion in the post. Now the login is done like this: if “AAAA” is the password and “BBBB” is the code provided by the authenticator, at login you have to type
AAAABBBB
and the login is successful.
I’m doing some testing now to see if it works in many cases
Hi,
That’s work on sddm login for the first time screen machine but for kscreenlocker (after META+L) i use only my password for unlock my screen.
Anyone find soluce for use password + 2fa on kscreenlocker too ?
To provide terminal output, copy the text you wish to share, and paste it here, surrounded by three (3) backticks, a.k.a grave accents. Like this:
```
pasted text
```
Or three (3) tilde signs, like this:
~~~
pasted text
~~~
This will just cause it to be rendered like this:
Portaest sed
elementum
cursus nisl nisi
hendrerit ac quis
sit
adipiscing
tortor sit leo commodo.
Instead of like this:
Portaest sed elementum cursus nisl nisi hendrerit ac quis sit adipiscing tortor sit leo commodo.
Alternatively, paste the text you wish to format as terminal output, select all pasted text, and click the </> button on the taskbar. This will indent the whole pasted section with one TAB, causing it to render the same way as described above.
Thereby improving legibility and making it much easier for those trying to be of assistance.
Additionally
If your language isn’t English, please prepend any and all terminal commands with LC_ALL=C. For example:
LC_ALL=C bluetoothctl
This will just cause the terminal output to be in English, making it easier to understand and debug.
Tip: