# google/google-authenticator-libpam

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/google-google-authenticator-libpam).**

1,988 stars · 303 forks · C · Apache-2.0

## Links

- GitHub: https://github.com/google/google-authenticator-libpam
- awesome-repositories: https://awesome-repositories.com/repository/google-google-authenticator-libpam.md

## Topics

`2fa` `google-authenticator` `pam` `pam-module`

## Description

This project is a Pluggable Authentication Module for Linux systems that enforces multi-factor identity verification. It integrates directly into the system authentication stack to require time-based one-time passwords alongside standard user credentials, providing a mechanism to secure local and remote shell access.

The module distinguishes itself through its implementation of the time-based one-time password algorithm, which includes built-in support for clock-skew compensation to account for time discrepancies between servers and user devices. It manages individual user secret keys through a local file-based persistence mechanism and supports modular stacking, allowing administrators to pass credentials between multiple authentication modules within a single login flow.

Beyond core verification, the tool provides configurable policy settings that allow administrators to define grace periods and manage secret file locations. It facilitates the synchronization of unique authentication secrets with mobile applications, ensuring that multi-factor enforcement remains functional while maintaining system-level security standards.

## Tags

### Operating Systems & Systems Programming

- [PAM Modules](https://awesome-repositories.com/f/operating-systems-systems-programming/pam-modules.md) — Integrates custom authentication logic directly into the system login stack via the standard pluggable module interface.

### Artificial Intelligence & ML

- [TOTP Authentication Systems](https://awesome-repositories.com/f/artificial-intelligence-ml/agentic-systems-frameworks/agent-orchestration-multi-agent/security-and-auth/authentication-strategies/passwords-mfa/totp-authentication-systems.md) — Provides a provider for generating and validating time-based one-time passwords to secure system access.

### Security & Cryptography

- [Pluggable Authentication Backends](https://awesome-repositories.com/f/security-cryptography/authentication-protocols/pluggable-authentication-backends.md) — Implements a modular authentication framework that integrates custom security logic into the standard system login pipeline.
- [Credential Verification](https://awesome-repositories.com/f/security-cryptography/credential-verification.md) — Enforces a blocking authentication flow that requires successful validation of both primary credentials and secondary tokens.
- [One-Time Passwords](https://awesome-repositories.com/f/security-cryptography/one-time-passwords.md) — Generates time-based one-time passwords using a shared secret and the current system time for secure identity verification.
- [Two-Factor Authentication](https://awesome-repositories.com/f/security-cryptography/two-factor-authentication.md) — Enforces two-factor authentication by requiring time-based one-time passwords alongside standard user credentials.
- [Clock-Abstracted Time Validation](https://awesome-repositories.com/f/security-cryptography/clock-abstracted-time-validation.md) — Provides mechanisms to compensate for clock drift between servers and authentication devices to ensure token validity. ([source](https://github.com/google/google-authenticator-libpam/blob/master/README.md))
- [Clock Skew Tolerances](https://awesome-repositories.com/f/security-cryptography/clock-skew-tolerances.md) — Provides configurable time-based grace periods to compensate for clock drift during authentication validation.
- [User Secret Management](https://awesome-repositories.com/f/security-cryptography/key-management/automated-key-rotations/api-key-secret-rotation/authentication-secret-rotations/user-secret-management.md) — Enables the generation of unique user authentication secrets and provides mechanisms to sync them with mobile authenticator applications. ([source](https://github.com/google/google-authenticator-libpam#readme))
- [Local Secret Storage](https://awesome-repositories.com/f/security-cryptography/local-secret-storage.md) — Maintains individual user authentication secrets in local files to enable secure verification during login.
- [Linux Security Hardening](https://awesome-repositories.com/f/security-cryptography/security/infrastructure-and-hardware/infrastructure-system-hardening/linux-security-hardening.md) — Provides a security module that integrates with system authentication stacks to mandate multi-factor verification for local and remote logins.
- [Server Hardening](https://awesome-repositories.com/f/security-cryptography/server-hardening.md) — Hardens server access by mandating multi-factor verification for all shell login attempts.