Bugzilla – Bug 726
Sudo PAM Login should support multiple password prompts (e.g. Password + Token)
Last modified: 2016-03-08 06:52:27 MST
PAM can show multiple password prompts, e.g. for 2-Factor authorization. Sudo seems to be limited to one password prompt. pam_sss in Fedora 22 and 23 will use the following prompt if 2FA in enabled for the user (using the FreeIPA Backend). First Factor: Second Factor: The second factor usually is provided by a OTP (hardware) token. SUDO currently only uses the first prompt and stops after that. $ sudo -s First Factor: Sorry, try again First Factor:
Sudo's conversation function will iterate over the pam_message structures and prompt for each message so is pam_sss is using multiple prompts directly it should work. It's also possible that pam_sss is simply stacking things with use_first_pass but I would expect that to work as well. I don't have a FreeIPA server setup so I can't easily reproduce this. Without knowing more about the pam.d config used by pam_sss to implement 2 factor authentication there's not much I can do.
Here is the relevant part of the pam config (taken from fedora 22) It seems to me that sudo doesn't iterate over all prompts. All other pam services which I checked use the same system-auth file. This is what should happen: $ su username First Factor: Second Factor: su: Fehler bei Authentifizierung An authentication error will only be shown after both factors were typed in. So sudo definitely quits before the conversation is finished. /etc/pam.d/sudo #%PAM-1.0 auth include system-auth account include system-auth password include system-auth session optional pam_keyinit.so revoke session required pam_limits.so session include system-auth /etc/pam.d/system-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha256 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so
The issue has been solved within sssd: https://bugzilla.redhat.com/show_bug.cgi?id=1276868