BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 823 of 1,8198. User Management and Pluggable Authentication ModulesFree lesson

Securing PAM with Multi-Factor Authentication Providers

You will integrate external TOTP or hardware keys into the local login process.

In this lesson, you will learn how to harden your local login process by layering Multi-Factor Authentication (MFA) on top of traditional password-based authentication using the PAM framework.

The Strategy of Layered Verification

Up until now, our PAM configurations have primarily focused on verifying passwords against the local /etc/shadow file. However, passwords are susceptible to theft or brute-forcing. By integrating a "second factor"—such as a Time-based One-Time Password (TOTP) or a hardware security key—you ensure that even if a password is compromised, an attacker cannot gain access without the physical device or synchronized token.

In the PAM architecture, we achieve this by inserting an additional module into the auth stack. When a user logs in, PAM will process the modules sequentially. If the password module succeeds, the MFA module triggers a prompt for your second factor.

Implementing Google Authenticator

A common approach for TOTP is the pam_google_authenticator.so module. To require it, you would add a line to your /etc/pam.d/sshd or /etc/pam.d/common-auth configuration file:

auth required pam_google_authenticator.so

When this line is present, the authentication sequence follows these steps:

  1. Password Validation: The system checks the user's password against /etc/shadow.
  2. MFA Challenge: If the password is correct, the PAM stack proceeds to the pam_google_authenticator module, which prompts the user for their 6-digit TOTP code.
  3. Completion: Access is only granted if the token matches the expected window for the current time.

Order Matters

It is crucial to consider your control flags. By using the required flag, you ensure that the MFA step cannot be skipped. If you have multiple authentication methods, you might use requisite to fail immediately if the password is wrong, preventing the system from even asking for an MFA token, which helps mitigate information leakage. Always remember to keep an alternative root shell open while editing these files; a misconfigured PAM stack can easily lock you out of your own system entirely.

Key Takeaway: Integrating MFA into PAM creates a mandatory second barrier that validates identity beyond a static password, significantly reducing the risk of unauthorized account access.