How to Set Up Two-Factor Authentication for Login and Sudo
1–10 of 41 posts
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#2Wouldn't this add a hard dependency to an internet connection? This sounds like a major drawback in the event of an outage, and would take away a major feature of most computers.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#3Wouldn't this add a hard dependency to an internet connection? This sounds like a major drawback in the event of an outage, and would take away a major feature of most computers.
[deleted]
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#4Wouldn't this add a hard dependency to an internet connection? This sounds like a major drawback in the event of an outage, and would take away a major feature of most computers.
The solution is based on Google Authenticator, which is based on TOTP:
https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
The only requirements of TOTP are an accurate time source and keying data for an HMAC. No internet connectivity explicitly required.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#5Wouldn't this add a hard dependency to an internet connection? This sounds like a major drawback in the event of an outage, and would take away a major feature of most computers.
The solution is based on Google Authenticator, which is based on TOTP: https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... The only requirements of TOTP are an accurate time source and keying data for an HMAC. No internet connectivity explicitly required.
Until you need sudo access to fix ntp
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#6Earlier quoted context omitted.
The solution is based on Google Authenticator, which is based on TOTP: https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... The only requirements of TOTP are an accurate time source and keying data for an HMAC. No internet connectivity explicitly required.
Until you need sudo access to fix ntp
You could change the phone's time settings to match the computer's. TOTP doesn't require precise sync anyway, it usually works as long as the two clocks are within 30s of each other.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#7Does this still allow for caching a successful sudo login for a period of time? Or do you actually have to use a token for every sudo?
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#8Earlier quoted context omitted.
Until you need sudo access to fix ntp
You could change the phone's time settings to match the computer's. TOTP doesn't require precise sync anyway, it usually works as long as the two clocks are within 30s of each other.
If your virtual machine can't sync with an NTP time server for an extended period of time (outbound security group), it will drift beyond 30s from actual time (just saw this in AWS about a year go).
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#9I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#10I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.
I'll bite... What is your threat model and proposed "enterprise-grade solution"?