aboutsummaryrefslogtreecommitdiff
path: root/README.md
diff options
context:
space:
mode:
authorHalfwalker <deano-gitea@areyes.com>2024-12-21 18:43:37 -0700
committerNicholas Johnson <mail@nicholasjohnson.ch>2025-01-29 00:00:00 +0000
commit926ed183259c6bb28245153b70aa6d28ff1f604d160d648e6c4b5fabaf1d029e (patch)
tree30da4b4a6d41782280b0bd21c455dd21a43c4e08cc929870a125776706a57921 /README.md
parent40489e5b26bc741b15bbea5cf2ee634880d40384393bdc319d23c482b89a62c8 (diff)
downloadansible-role-google-authenticator-926ed183259c6bb28245153b70aa6d28ff1f604d160d648e6c4b5fabaf1d029e.tar.gz
ansible-role-google-authenticator-926ed183259c6bb28245153b70aa6d28ff1f604d160d648e6c4b5fabaf1d029e.zip
Minor doc updates in README.md and tasks/main.yml
Diffstat (limited to 'README.md')
-rw-r--r--README.md4
1 files changed, 4 insertions, 0 deletions
diff --git a/README.md b/README.md
index 6ff0355..99837c4 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,8 @@
This role is to install google authenticator and integrate it into ssh so that TOTP tokens may be required for ssh connections.
+https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04
+
It will create a `~/.google_authenticator` if required, and will NOT alter or remove any existing version.
It will update `/etc/ssh/sshd_config.d` to ensure that a token is required for any ssh connection _without_ an ssh key. Connections _with_ an ssh key will not require a token, though this may be enabled so that tokens are *always* required. Set the global **google_auth_force** variable to _true_ or an individual host entry (see below) to enable this.
@@ -20,6 +22,8 @@ Edit `defaults/main.yml` or override on cmdline to set `google_auth_nullok: true
With this set users can still login with password only and no TOTP request if their `~/.google_authenticator` file does not exist
+### Pre-populating Google Authenticator secrets
+
To pre-populate the TOTP secret there are two locations to place the information.
* Place them into `defaults/main.yml` under the **google_auth_config** variable