auth sufficient not working with sshd in OS X 10.11 (El Capitan)

[todd-a-jacobs]

I've installed pam_yubico v2.20 via Homebrew, and added:

auth sufficient pam_yubico.so id=16 authfile=/etc/yubikey_mappings

to the top of /etc/pam.d/sshd. In addition, I've set:

ChallengeResponseAuthentication yes
UsePAM yes

in /etc/ssh/sshd_config.

After reloading SSH, no authentications work at all: not public key, not OTP, not even passwords. All one ever gets when the PAM module is enabled is Connection closed by <host>. However, removing pam_yubico.so lines from the file make SSH work again in the normal way, albeit without Yubikey support.

[klali]

to me this seems to be a duplicate of #80

[todd-a-jacobs]

@klali Nope. #80 is about challenge-response, as opposed to OTP. I'm not saying they aren't related, but they are definitely different issues.

[shankerwangmiao]

How about add a

auth sufficient pam_permit.so

or

auth requisite pam_deny.so