summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-12-08 18:34:53 +0100
committerGitHub <noreply@github.com>2023-12-08 18:34:53 +0100
commitf44cf2923bf12360e5665cb8d7391557241fba96 (patch)
treebc6650c325c1eee90ee5f47bf7101818a8531b28 /src
parent7f081cadd0855ebc1104919329c11c98de1445f1 (diff)
parent14b107442ebf1f4f44bad485c585d4b9cfd97384 (diff)
downloadvyos-1x-f44cf2923bf12360e5665cb8d7391557241fba96.tar.gz
vyos-1x-f44cf2923bf12360e5665cb8d7391557241fba96.zip
Merge pull request #2593 from vyos/mergify/bp/sagitta/pr-2584
login: T4943: use pam-auth-update to enable/disable Google authenticator (backport #2584)
Diffstat (limited to 'src')
-rwxr-xr-xsrc/conf_mode/system-login.py7
-rwxr-xr-xsrc/init/vyos-router2
-rw-r--r--src/pam-configs/mfa-google-authenticator8
3 files changed, 17 insertions, 0 deletions
diff --git a/src/conf_mode/system-login.py b/src/conf_mode/system-login.py
index 87a269499..cd85a5066 100755
--- a/src/conf_mode/system-login.py
+++ b/src/conf_mode/system-login.py
@@ -306,6 +306,7 @@ def generate(login):
def apply(login):
+ enable_otp = False
if 'user' in login:
for user, user_config in login['user'].items():
# make new user using vyatta shell and make home directory (-m),
@@ -350,6 +351,7 @@ def apply(login):
# Generate 2FA/MFA One-Time-Pad configuration
if dict_search('authentication.otp.key', user_config):
+ enable_otp = True
render(f'{home_dir}/.google_authenticator', 'login/pam_otp_ga.conf.j2',
user_config, permission=0o400, user=user, group='users')
else:
@@ -398,6 +400,11 @@ def apply(login):
pam_profile = 'tacplus-optional'
cmd(f'pam-auth-update --enable {pam_profile}')
+ # Enable/disable Google authenticator
+ cmd('pam-auth-update --disable mfa-google-authenticator')
+ if enable_otp:
+ cmd(f'pam-auth-update --enable mfa-google-authenticator')
+
return None
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 3445da2cf..fdf71f030 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -260,6 +260,8 @@ EOF
rm -f /etc/pam_radius_auth.conf
pam-auth-update --disable tacplus-mandatory tacplus-optional
rm -f /etc/tacplus_nss.conf /etc/tacplus_servers
+ # and no Google authenticator for 2FA/MFA
+ pam-auth-update --disable mfa-google-authenticator
# Certain configuration files are re-generated by the configuration
# subsystem and must reside under /etc and can not easily be moved to /run.
diff --git a/src/pam-configs/mfa-google-authenticator b/src/pam-configs/mfa-google-authenticator
new file mode 100644
index 000000000..9e49e5ef9
--- /dev/null
+++ b/src/pam-configs/mfa-google-authenticator
@@ -0,0 +1,8 @@
+Name: Google Authenticator PAM module (2FA/MFA)
+Default: no
+Priority: 384
+
+Auth-Type: Primary
+Auth:
+ [default=ignore success=ok auth_err=die] pam_google_authenticator.so nullok forward_pass
+