Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

3
  • privacyIDEA is nice solution and I defenitly need read more about it. Commented Jun 3, 2016 at 11:37
  • I've got another question because I've searching for solution to my problem and something like this (add in /etc/pam.d/sshd): "auth [success=1 default=ignore] pam_module.so accessfile=/etc/security/access-local.conf" where conf file include "+ : ALL : specific.ip.address - : ALL : ALL" so all connections from one specific address will be allow with only 1 auth method while all others will need to 2FA? My problem is if such pam module exist. Commented Jun 3, 2016 at 11:46
  • First I am not sure, if the PAM stack contains an SSH!!! client IP address. There is PAM_RHOST, but this might not be what you are looking for. I do not know of such a pam module. While privacyIDEA can do this: combine users with 2FA and only password OR allow different kind of 2FA access or password access based on client IP. Commented Jun 3, 2016 at 16:41