I am using Google's open-source PAM module for two-way authentication for SSH logins and certain Apache directives. It works great, however I would like to use this only when trying to log in from an outside network, resorting only to basic username/pass for inside the network. Basically whitelisting a network. How can I accomplish this? I can't seem to find an answer...
Restrict two way SSH and Apache authentication to non-local networks
ssh;networking;apache httpd;authentication;pam
Doesn't look like the pam module (assuming you mean the google authenticator module they introduce for two factor authentication) has any options to support this natively so you'll probably have to futz around with the pam stack control flags. One possibility would be to:Have pam_access in the stack configured as sufficient (So that success stops PAM from executing afterwards but failure does)Configure pam_access to always return success for local network users Put the google authenticator module after the pam_access line. Net effect should be (I haven't tested it) that execution of the google authenticator module is conditional upon pam_access saying they're not local (i.e failing). It should work since the man page for pam_access says that auth facility is provided in the module.Let me know the results.