From 04d4519ed545df6ca156cbccaab059cfc3338bf6 Mon Sep 17 00:00:00 2001 From: Martin Basti Date: Thu, 10 Mar 2016 19:01:33 +0100 Subject: client: enable ChallengeResponseAuthentication in sshd_config In order to enable SSSD smart prompting and allow it to ask for 1FA and 2FA separately, ChallengeResponseAuthentication should be set to yes. This change will enable better processing of the 2FA value and it will also enable other features, like allow SSSD to make the 2FA option in some cases and have a way of informing user that 2FA is optional. https://fedorahosted.org/freeipa/ticket/5703 Reviewed-By: Jan Cholasta --- client/ipa-client-install | 1 + 1 file changed, 1 insertion(+) diff --git a/client/ipa-client-install b/client/ipa-client-install index f42d87755..82e5c4cb0 100755 --- a/client/ipa-client-install +++ b/client/ipa-client-install @@ -1399,6 +1399,7 @@ def configure_sshd_config(fstore, options): 'KerberosAuthentication': 'no', 'GSSAPIAuthentication': 'yes', 'UsePAM': 'yes', + 'ChallengeResponseAuthentication': 'yes', } if options.sssd and file_exists(paths.SSS_SSH_AUTHORIZEDKEYS): -- cgit