Google Authenticator with PAM

Login with GDM (U2F)

• Install libraries

  sudo apt install libpam-google-authenticator
  

• Generate a secret key for user

  # Run as the user needs to setup Google Authenticator login.
  google-authenticator
  chmod 600 $HOME/.google_authenticator
  

• Edit file /etc/pam.d/gdm-password

  @include common-auth
  
  # If user password AND OTP are both required and allow user to login if no OTP is setup
  auth    required    pam_google_authenticator.so    nullok
  
  # If user password AND OTP are both required
  #auth    required    pam_google_authenticator.so
  
  # If user password OR OTP is required
  #auth    sufficient    pam_google_authenticator.so
  
  auth    optional        pam_gnome_keyring.so
  @include common-account
  

• Test and Verify (Optional)

  sudo apt install pamtester
  
  pamtester gdm-password $USER authenticate