No "Invalid verification code" received, but validation still fails

[ThomasHabets]

Original issue 373 created by pcamilleri@smartasset.com on 2014-03-28T22:01:36.000Z:

I've installed pam_google_authenticator on Centos 6.5, and set up a simple pam config to test it out (together with Authen::PAM::Simple) in perl.

The pam config is called "openvpn" and simply contains:
auth required pam_warn.so
auth required pam_google_authenticator.so

My perl script simply tries to authenticate a user ("test") with their google authenticator key.

If I use an old/invalid code, I see the following 2 lines (debug message followed by invalid verification code) in /var/log/secure (as expected)

Mar 28 17:52:55 wall perl: pam_warn(openvpn:auth): function=[pam_sm_authenticate] service=[openvpn] terminal=[<unknown>] user=[test] ruser=[<unknown>] rhost=[<unknown>]
Mar 28 17:52:55 wall openvpn(pam_google_authenticator)[23943]: Invalid verification code

When I use a "valid" code, I see the debug line, but no "Invalid verification code", YET pam still fails to authenticate.

(I've also tried this setup with openvpn and keep having the same issue -- no "Invalid verification code" message, yet I just can't authenticate).

Any ideas?

thanks

[ThomasHabets]

Comment #1 originally posted by pcamilleri@smartasset.com on 2014-03-31T15:22:24.000Z:

The issue was in the pam.d configuration. For anyone interested, this should work:

account required pam_unix.so
account required pam_permit.so
auth requisite pam_google_authenticator.so forward_pass
auth required pam_unix.so use_first_pass

[ThomasHabets]

This issue was moved to google/google-authenticator-libpam#15

[BouchaaraAdil]

The issue was in the pam.d configuration. For anyone interested, this should work:
account required pam_unix.so
account required pam_permit.so
auth requisite pam_google_authenticator.so forward_pass
auth required pam_unix.so use_first_pass

tried this didn't work, could you help ?
google/google-authenticator-libpam#116