Hi all, I hope this is the best place to ask this, please let me know if not.
I am setting up a PAM client (libreswan, using the `pluto` service). When I log in with a
non-OTP account, everything works fine, but not with an OTP account. I have tested the OTP
account by logging into the node with SSH and the OTP user and it works fine, so I know
both that the token works and that the client configuration are both correct. I’ve tried a
few different PAM stacks to see if I could get around this, including the sshd stack to no
avail. In all cases, the FreeIPA server logs state `Additional pre-authentication
required` and then `Preauthentication failed`.
Preauthentication makes sense, I just don’t understand why sshd works fine with both
password factors concatenated in the first factor and libreswan (and xl2tpd when I was
testing it) both fail with preauth issues. What am I missing? Are there good docs on this
somewhere? [1] was the best I could come up with and it seems to be out-of-date (pam_sss
takes different parameters for some of the same functions in the final form).
Cheers! Brian
[1]
https://docs.pagure.org/SSSD.sssd/design_pages/pam_conversation_for_otp.html