security.pam.services.<name>.googleAuthenticator.allowNullOTP

Whether to allow login for accounts that have no OTP set (i.e., accounts with no OTP configured or no existing ~/.google_authenticator).