How To: Enable Two-Factor Authentication for Alt TTY and CentOS GNOME GUI Logins

Version Affected: All

 

Overview

This article explains how to enable two-factor authentication (2FA) on two Linux login surfaces that SecureAuth's Pluggable Authentication Modules (PAM) Remote Authentication Dial-In User Service (RADIUS) installation and configuration guide does not cover on its own: text-based (TTY) console logins, and the CentOS GNOME graphical user interface (GUI) login screen. Complete the PAM RADIUS installation and configuration guide first — the steps below add 2FA to two login paths that guide leaves out.

• Use Method 1 for a text-based console login (TTY).
• Use Method 2 for the CentOS GNOME desktop login screen.
  
  

In this article

• Method 1: Enable 2FA for Alt TTY (Console) Logins
• Method 2: Enable 2FA for the CentOS GNOME GUI Login
  
  

Method 1: Enable 2FA for Alt TTY (Console) Logins

This method adds the RADIUS-based 2FA prompt to the standard Linux text console login.

1. On the Linux server, open /etc/pam.d/login in a text editor.
2. Set its contents to match the configuration below, which adds pam_radius_auth.so as a sufficient auth module ahead of the standard system-auth substack.
   
   
   
3. Save the file.

After this change, TTY console logins prompt for username, password, and a 2FA code.

Method 2: Enable 2FA for the CentOS GNOME GUI Login

This method adds the RADIUS-based 2FA prompt to the CentOS GNOME desktop login screen.

1. On the Linux server, open /etc/pam.d/gdm-password in a text editor.
2. Set its contents to match the configuration below, which adds pam_radius_auth.so as a required auth module ahead of the optional GNOME keyring module and the standard password-auth substack.
   
   
   
3. Save the file.

After this change, the GNOME GUI login screen prompts for username, password, and a 2FA code.

 

Special Considerations

Both configurations above were tested on CentOS 7 and CentOS 8.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.