using 'auth optional pam_google_authenticator.so' instead of 'auth required pam_google_authenticator.so' accepts any string of numbers about google-authenticator HOT 4 CLOSED

Comment #1 originally posted by nunojpg on 2011-01-15T18:16:08.000Z:

Why do you expect it do deny access?
"optional" means that the module will be run, but the output (success/failure) is disregarded.
On this specific module the only result it will deny the same code on the next run, if you set the appropriate option, or if it is a scratch code. Anyway, if the next time it is run, it is still a "optional" check, that doesn't mean anything again.

from google-authenticator.

Comment #2 originally posted by voyager.106 on 2011-01-18T19:48:37.000Z:

Thanks for the reply.

I chose optional because I misunderstood. Using the original PAM code, when I chose required, and someone tried logging in who didn't have their account set up for TFA, they weren't offered a verification prompt, but they were never allowed in, even when putting in their proper password. So I assumed 'required' meant that you were required to have your account set up for TFA, and if not, you weren't allowed in. By changing it to optional, I thought it would fix the issue so that if your account weren't set up for TFA, it would allow you in with just your password.

I came to find out a few days later that it was actually a bug that was fixed with a patch. When I applied the patch and rebuilt the PAM module from it, I was able to set it for 'required' and then when someone tried logging in without TFA set up, they were then allowed to get in with just their password.

from google-authenticator.

Comment #3 originally posted by [email protected] on 2011-02-16T03:20:46.000Z:

See bug # 27.

from google-authenticator.

Comment #4 originally posted by [email protected] on 2011-03-09T20:25:43.000Z:

<empty>

from google-authenticator.