feature: users sign in to the Router Manager with passkeys, and console login needs a TOTP token, so a user without one is refused the shell, SSH and sudo.

debian-package/src/usr/lib/vpn-router/setup

@@ -587,7 +587,7 @@ def manage_console(cfg):
             f'base {vpnrouter_ldap.BASE}',
             'filter passwd (&(objectClass=posixAccount)(vpnRouterConsoleLogin=TRUE))',
             f'nss_min_uid {vpnrouter_ldap.CONSOLE_UID_MIN}',
-            'pam_authz_search (&(objectClass=posixAccount)(uid=$username)(vpnRouterConsoleLogin=TRUE))',
+            'pam_authz_search (&(objectClass=posixAccount)(objectClass=oathTOTPUser)(uid=$username)(vpnRouterConsoleLogin=TRUE))',
             'pam_password_prohibit_message The password is changed in the Router Manager or with vpn-router-user.',
             '',
         ])