Google Authenticator PAM Library

google-authenticator-libpam is a Pluggable Authentication Module (PAM) that adds one-time passcodes to Unix and Linux logins using open OATH standards. It plugs into PAM stacks for services like SSH, su, or desktop display managers, prompting users for a time-based (TOTP) or counter-based (HOTP) code after their password. A lightweight enrollment program bootstraps each account by generating a secret, printing a QR code, and writing per-user configuration with safe file permissions. Because verification happens locally, codes work offline and do not depend on any Google service, which suits high-security and air-gapped environments. Administrators can tune skew tolerance, rate limiting, emergency scratch codes, and which PAM control flags enforce 2FA for specific users or groups. The project’s design favors simplicity and auditability, keeping the runtime small and the configuration explicit so it’s easy to review in production change control.