# Master asks for 2FA but Agent asks again

**URL:** <https://community.thinlinc.com/t/master-asks-for-2fa-but-agent-asks-again/669>\
**Category:** Community Support\
**Created:** [7 August 2023 06:13 UTC](https://community.thinlinc.com/t/master-asks-for-2fa-but-agent-asks-again/669 "2023-08-07T06:13:32Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [7 August 2023 14:36 UTC](https://community.thinlinc.com/t/master-asks-for-2fa-but-agent-asks-again/669/11 "2023-08-07T14:36:31Z")

</div>

I believe you end in a race-condition situation:

```auto
Aug 07 11:46:20 agent sshd(pam_google_auth)[60824]: Trying to reuse a previously used time-based code. ("/home/dummy.user/.google_authenticator")Retry again in 30 seconds. Warning! This might mean, you are currently subject to a man-in-the-middle attack.

```

This would imply that your user answered Yes to the question:

> Do you want to disallow multiple uses of the same authentication  
> token? This restricts you to one login about every 30s, but it increases  
> your chances to notice or even prevent man-in-the-middle attacks (y/n)

When they were initializing .google-authenticator. ThinLinc requires the same OTP to be used twice.  
(See [How to set up One-Time-Password (OTP) authentication in ThinLinc](https://community.thinlinc.com/t/how-to-set-up-one-time-password-otp-authentication-in-thinlinc/409) for what is required)

Kind regards,  
Martin

---

_[View the full topic](https://community.thinlinc.com/t/master-asks-for-2fa-but-agent-asks-again/669)._