Add option for nullok on google_authenticator.so in /etc/pam.d/sshd

1 files changed, 6 insertions, 0 deletions

diff --git a/README.md b/README.md
index 452d575..6ff0355 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,12 @@ It will update `/etc/ssh/sshd_config.d` to ensure that a token is required for a
 
 Edit `defaults/main.yml` or override on cmdline to set `google_auth_force: true`.  This will ensure that TOTP code entry is required regardless of use of SSH key for login.  This creates a `/etc/ssh/sshd_config.d/71-google_auth.conf` and modifies `/etc/pam.d/sshd` to comment out the **@include common-auth** line.
 
+### Allowing no-token logins when ~/.google_authenticator does not exist
+
+Edit `defaults/main.yml` or override on cmdline to set `google_auth_nullok: true`.  This sets the **nullok** parameter on the `/etc/pamd./sshd` line for **auth required pam_google_authenticator.so nullok**
+
+With this set users can still login with password only and no TOTP request if their `~/.google_authenticator` file does not exist
+
 To pre-populate the TOTP secret there are two locations to place the information.
 
 * Place them into `defaults/main.yml` under the **google_auth_config** variable