how to set different authentication requirements in pam policies for different users or groups?

Question

I'm trying to set up a linux development environment that is both secure and convenient, and after setting up passwordless login and 2-factor authenticated pam_u2f, I had the idea to create different user accounts with different authentication requirements.

in the configuration files located at /etc/pam.d/, authentication methods tend to be user/group agnostic, for example:

auth required pam_u2f.so  authfile=/etc/my_yubikeys cue

can you specify users or groups so that, for example an admin account or members of the group wheel requires 2 factors to login(password and something else), while other users require one?

Answer 1

You can use the pam_succeed_if module to skip other PAM modules in the stack given certain user criteria. For example you could create a group noyubikey and add the following to your PAM configuration:

auth [success=1 default=ignore] pam_succeed_if.so quiet user ingroup noyubikey
auth required pam_u2f.so  authfile=/etc/my_yubikeys cue

Updated to answer your question:

could I use this to require a number of authentication methods, where any one of them are optional. sort of like "there are 3 possible authentication methods, but you need to use any 2 of them"

This should be possible with a a substack and custom controls. E.g. you could require a substack like this:

[success=ignore default=1] # first module
[success=done default=1] # second module if the first one succeeded
[success=ignore default=die] # second module, if the first one failed
[success=done default=die] # third module now has to succeed

Note: I am only showing the controls for clarity's sake.

You'd want to use a substack here because it isolates the done/die actions from the rest of your stack.