On pe, 18 tammi 2019, Chris Herdt via FreeIPA-users wrote:
>I'd seen previous posts (now a few years old) on enabling per-host 2-factor
>authentication with FreeIPA. I'm using FreeIPA 4.6.4 on CentOS 7. I
>followed what I think are the correct steps to enable 2FA on a specific
>host, but the behavior is a little strange:
>
>User A: enable both Password and Two factor authentication (password +
>OTP), and configure a OTP.
>
>User B: enable just the Password option.
>
>Host A: select "otp" under Authentication indicators, ensure the following
>lines are present in /etc/ssh/sshd_config and restart sshd:
>ChallengeResponseAuthentication yes
>AuthenticationMethods keyboard-interactive
>
>Host B: make no changes to Authentication indicators (none selected),  make
>the same changes as above to sshd_config.
>
>After these changes:
>
>User A -> Host A
>The user sees the following prompts:
>
>First Factor:
>Second Factor (optional):
>
>However, the second factor is required (as expected) and the login fails
>without it.
>
>User A -> Host B
>The user gets the same prompt as above, but the second factor is actually
>optional, and the login succeeds without supplying any value.
>
>User B -> Host A
>The user gets a regular password prompt, but cannot log in using the
>correct password (as expected, since a OTP is required).
>
>User B -> Host B
>The user gets a regular password prompt and can log in as expected.
>
>Everything is working more-or-less as expected, but the "Second Factor
>(optional)" prompt is a little confusing, particularly in cases where it is
>required. Is this due to my specific configuration (or mis-configuration)
>or is this the expected behavior?
That's hard-coded in SSSD.

https://pagure.io/SSSD/sssd/issue/3264

--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland