{"action":"created","issue":{"url":"https://api.github.com/repos/google/google-authenticator/issues/506","labels_url":"https://api.github.com/repos/google/google-authenticator/issues/506/labels{/name}","comments_url":"https://api.github.com/repos/google/google-authenticator/issues/506/comments","events_url":"https://api.github.com/repos/google/google-authenticator/issues/506/events","html_url":"https://github.com/google/google-authenticator/issues/506","id":91954702,"number":506,"title":"pam_google_authenticator.so on debian 8 never prompts - configs correct","user":{"login":"Serubin","id":1234465,"avatar_url":"https://avatars.githubusercontent.com/u/1234465?v=3","gravatar_id":"","url":"https://api.github.com/users/Serubin","html_url":"https://github.com/Serubin","followers_url":"https://api.github.com/users/Serubin/followers","following_url":"https://api.github.com/users/Serubin/following{/other_user}","gists_url":"https://api.github.com/users/Serubin/gists{/gist_id}","starred_url":"https://api.github.com/users/Serubin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Serubin/subscriptions","organizations_url":"https://api.github.com/users/Serubin/orgs","repos_url":"https://api.github.com/users/Serubin/repos","events_url":"https://api.github.com/users/Serubin/events{/privacy}","received_events_url":"https://api.github.com/users/Serubin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-30T01:51:11Z","updated_at":"2015-06-30T02:37:56Z","closed_at":"2015-06-30T02:37:56Z","body":"I've been trying to get the google auth  to work on debian 8 with no luck.\r\n\r\nI've followed various tutorials exactly with no luck.\r\nBelow are my auth.log sample outputs, my sshd_config, and my pam.d/sshd config\r\n\r\n## pam\r\n```\r\n# PAM configuration for the Secure Shell service\r\n\r\n# Standard Un*x authentication.\r\n@include common-auth\r\n\r\n# Disallow non-root logins when /etc/nologin exists.\r\naccount    required     pam_nologin.so\r\n\r\n# Uncomment and edit /etc/security/access.conf if you need to set complex\r\n# access limits that are hard to express in sshd_config.\r\n# account  required     pam_access.so\r\n\r\n# Standard Un*x authorization.\r\n@include common-account\r\n\r\n# SELinux needs to be the first session rule.  This ensures that any\r\n# lingering context has been cleared.  Without this it is possible that a\r\n# module could execute code in the wrong domain.\r\nsession [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close\r\n\r\nauth required /usr/local/lib/security/pam_google_authenticator.so\r\n# Set the loginuid process attribute.\r\nsession    required     pam_loginuid.so\r\n\r\n# Create a new session keyring.\r\nsession    optional     pam_keyinit.so force revoke\r\n\r\n# Standard Un*x session setup and teardown.\r\n@include common-session\r\n\r\n# Print the message of the day upon successful login.\r\n# This includes a dynamically generated part from /run/motd.dynamic\r\n# and a static (admin-editable) part from /etc/motd.\r\nsession    optional     pam_motd.so  motd=/run/motd.dynamic\r\nsession    optional     pam_motd.so noupdate\r\n\r\n# Print the status of the user's mailbox upon successful login.\r\nsession    optional     pam_mail.so standard noenv # [1]\r\n\r\n# Set up user limits from /etc/security/limits.conf.\r\nsession    required     pam_limits.so\r\n\r\n# Read environment variables from /etc/environment and\r\n# /etc/security/pam_env.conf.\r\nsession    required     pam_env.so # [1]\r\n\r\n# In Debian 4.0 (etch), locale-related environment variables were moved to\r\n# /etc/default/locale, so read that as well.\r\nsession    required     pam_env.so user_readenv=1 envfile=/etc/default/locale\r\n\r\n# SELinux needs to intervene at login time to ensure that the process starts\r\n# in the proper default security context.  Only sessions which are intended\r\n# to run in the user's context should be run after this.\r\nsession [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open\r\n\r\n# Standard Un*x password updating.\r\n@include common-password\r\n```\r\n\r\n## sshd_config\r\n```\r\n# Package generated configuration file\r\n# See the sshd_config(5) manpage for details\r\n\r\n# What ports, IPs and protocols we listen for\r\nPort 22\r\n# Use these options to restrict which interfaces/protocols sshd will bind to\r\n#ListenAddress ::\r\n#ListenAddress 0.0.0.0\r\nProtocol 2\r\n# HostKeys for protocol version 2\r\nHostKey /etc/ssh/ssh_host_rsa_key\r\nHostKey /etc/ssh/ssh_host_dsa_key\r\nHostKey /etc/ssh/ssh_host_ecdsa_key\r\nHostKey /etc/ssh/ssh_host_ed25519_key\r\n#Privilege Separation is turned on for security\r\nUsePrivilegeSeparation yes\r\n\r\n# Lifetime and size of ephemeral version 1 server key\r\nKeyRegenerationInterval 3600\r\nServerKeyBits 1024\r\n\r\n# Logging\r\nSyslogFacility AUTH\r\nLogLevel INFO\r\n\r\n# Authentication:\r\nLoginGraceTime 120\r\nPermitRootLogin no\r\nStrictModes yes\r\n\r\nRSAAuthentication yes\r\nPubkeyAuthentication yes\r\n#AuthorizedKeysFile     %h/.ssh/authorized_keys\r\n\r\n# Don't read the user's ~/.rhosts and ~/.shosts files\r\nIgnoreRhosts yes\r\n# For this to work you will also need host keys in /etc/ssh_known_hosts\r\nRhostsRSAAuthentication no\r\n# similar for protocol version 2\r\nHostbasedAuthentication no\r\n# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication\r\n#IgnoreUserKnownHosts yes\r\n\r\n# To enable empty passwords, change to yes (NOT RECOMMENDED)\r\nPermitEmptyPasswords no\r\n\r\n# Change to yes to enable challenge-response passwords (beware issues with\r\n# some PAM modules and threads)\r\nChallengeResponseAuthentication yes\r\n\r\n# Change to no to disable tunnelled clear text passwords\r\n#PasswordAuthentication yes\r\n\r\n# Kerberos options\r\n#KerberosAuthentication no\r\n#KerberosGetAFSToken no\r\n#KerberosOrLocalPasswd yes\r\n#KerberosTicketCleanup yes\r\n\r\n# GSSAPI options\r\n#GSSAPIAuthentication no\r\n#GSSAPICleanupCredentials yes\r\n\r\nX11Forwarding yes\r\nX11DisplayOffset 10\r\nPrintMotd no\r\nPrintLastLog yes\r\nTCPKeepAlive yes\r\n#UseLogin no\r\n\r\n#MaxStartups 10:30:60\r\n#Banner /etc/issue.net\r\n\r\n# Allow client to pass locale environment variables\r\nAcceptEnv LANG LC_*\r\n\r\nSubsystem sftp /usr/lib/openssh/sftp-server\r\n\r\n# Set this to 'yes' to enable PAM authentication, account processing,\r\n# and session processing. If this is enabled, PAM authentication will\r\n# be allowed through the ChallengeResponseAuthentication and\r\n# PasswordAuthentication.  Depending on your PAM configuration,\r\n# PAM authentication via ChallengeResponseAuthentication may bypass\r\n# the setting of \"PermitRootLogin without-password\".\r\n# If you just want the PAM account and session checks to run without\r\n# PAM authentication, then enable this but set PasswordAuthentication\r\n# and ChallengeResponseAuthentication to 'no'.\r\nUsePAM yes\r\n```\r\n## sample output\r\n```\r\nJun 29 20:36:58 calypso sshd[5755]: Accepted publickey for serubin from --- port 65306 ssh2: RSA  ---\r\nJun 29 20:36:58 calypso sshd[5755]: pam_unix(sshd:session): session opened for user serubin by (uid=0)\r\n```\r\n\r\nAre there any other logs I can look at for further errors? Any ideas are appreciated. "},"comment":{"url":"https://api.github.com/repos/google/google-authenticator/issues/comments/116919070","html_url":"https://github.com/google/google-authenticator/issues/506#issuecomment-116919070","issue_url":"https://api.github.com/repos/google/google-authenticator/issues/506","id":116919070,"user":{"login":"Serubin","id":1234465,"avatar_url":"https://avatars.githubusercontent.com/u/1234465?v=3","gravatar_id":"","url":"https://api.github.com/users/Serubin","html_url":"https://github.com/Serubin","followers_url":"https://api.github.com/users/Serubin/followers","following_url":"https://api.github.com/users/Serubin/following{/other_user}","gists_url":"https://api.github.com/users/Serubin/gists{/gist_id}","starred_url":"https://api.github.com/users/Serubin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Serubin/subscriptions","organizations_url":"https://api.github.com/users/Serubin/orgs","repos_url":"https://api.github.com/users/Serubin/repos","events_url":"https://api.github.com/users/Serubin/events{/privacy}","received_events_url":"https://api.github.com/users/Serubin/received_events","type":"User","site_admin":false},"created_at":"2015-06-30T02:37:56Z","updated_at":"2015-06-30T02:37:56Z","body":"Oh Brilliant. Thanks for the info!!"}}