login: T4943: use pam-auth-update to enable/disable Google authenticator

[c-po]

Change Summary

The initial version always enabled Google authenticator (2FA/MFA) support by hardcoding the PAM module for sshd and login.

This change only enables the PAM module on demand if any use has 2FA/MFA configured. Enabling the module is done system wide via pam-auth-update by using a predefined template.

Can be tested using:

set system login user vyos authentication plaintext-password vyos
set system login user vyos authentication otp key 'QY735IG5HDHBFHS5W7Y2A4EM274SMT3O'

See https://docs.vyos.io/en/latest/configuration/system/login.html for additional details.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T4943

Related PR(s)

Component(s) name

login

Proposed changes

How to test

Smoketest result

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

Incorporated requested changes by @zdc

[GurliGebis]

Would it make sense to rename it from "Google Authenticator" to just "Authenticator"?
Since you can use several different apps for it (Like Microsoft Authenticator, which a lot of people who has to use Office 365 already have installed) - it would make sense to remove the Google branding.

[c-po]

Would it make sense to rename it from "Google Authenticator" to just "Authenticator"? Since you can use several different apps for it (Like Microsoft Authenticator, which a lot of people who has to use Office 365 already have installed) - it would make sense to remove the Google branding.

Well it was invented by Google that should be honored. I use it with Microsoft authenticator, too.

[c-po]

@Mergifyio backport sagitta

[mergify]

backport sagitta

✅ Backports have been created

• #2593 login: T4943: use pam-auth-update to enable/disable Google authenticator (backport #2584) has been created for branch sagitta

[GurliGebis]

@c-po that makes sense.
Just as long as people aren't misled into thinking they only need to use the Google app 🙂