Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Set Up Two-Factor Authentication for Login and Sudo

linux.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#21

Post by parent5446 »

technofiend wrote: post #20
parent5446 wrote: post #19

Earlier quoted context omitted.

I don't agree with the original poster, but to at least supplement: using something like U2F (using pam_u2f) might be more secure, since no secret is transmitted in plaintext, and the secret is usually stored on an untamperable hardware token. Of course, most applications do not require such protection.

In my limited experience "enterprise" 2FA seems limited to RSA tokens. I'm not sure if I'm 10 years out of date particularly since they were hacked a while back. Wouldn't a more elegant solution be to add Kerberos authentication combined with 2FA? You can then pay the price for access up front but someone phishing your password gets nothing since presumably they cannot answer the second factor challenge.

Yeah, I mean if the goal is the "enterprise" solution, which is usually the solution where the setup, as well as the risk and damages of a break-in, can be shouldered to another company, then yeah RSA is usually the answer. I was primarily referring to the cryptographic security. Yes, RSA does avoid the transfer of plaintext secrets over the network, but instead you are placing your trust in RSA as a company to not have stored the secrets elsewhere (which, in most cases, is probably just fine).

The advantage of U2F is that it uses an asymmetric scheme where a keypair is generated for each authentication endpoint, so the secrets never leave the hardware token in the first place. Compared to RSA SecurID, you would need to have a really severe threat scenario such that you can't even trust RSA with your keys. Of course, U2F is also a much more complicated protocol than say TOTP, and has not existed long enough to stand the cryptographic test of time.

To answer your second question, I'm not sure I understand what you mean. TOTP (Google Authenticator), RSA SecurID, and U2F are all different types of 2FA. They could all be combined with Kerberos if that is what you want.

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#22

Post by vacri »

matthiasb wrote: post #9

I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.

The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#23

Post by the_mitsuhiko »

vacri wrote: post #22
matthiasb wrote: post #9

I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.

The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.

The RSA app also comes from the play store.

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#24

Post by Daviey »

matthiasb wrote: post #9

I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.

And yet, that is a common model for how the seed for RSA android/iPhone is shared in a BYOD enterprise.

(The app supports QR)

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#25

Post by Daviey »

vacri wrote: post #22
matthiasb wrote: post #9

I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.

The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.

So installing a random apk for http://enterprise.com is better?

Increasingly enterprises are allowing BYOD for this, with or without content protection systems like airwatch.

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#26

Post by simonjgreen »

dugite-code wrote: post #12
toomuchtodo wrote: post #8

Earlier quoted context omitted.

If your virtual machine can't sync with an NTP time server for an extended period of time (outbound security group), it will drift beyond 30s from actual time (just saw this in AWS about a year go).

Yep, I'm using 2FA with a SSH key on my private web server that's virtualized and regularly have time drift issues. still trying to find a way around it.

apt-get install ntpd

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#27

Post by [deleted] »

vacri wrote: post #22
matthiasb wrote: post #9

I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.

The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.

[deleted]

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#28

Post by knorker »

e12e wrote: post #17
feld wrote: post #5

Earlier quoted context omitted.

Until you need sudo access to fix ntp

From earlier, the google_authenticator pam code/project didn't fill me with confidence, but on the project page it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code, that'll let you log in (and if the code you enter is an invalid scratch code, the system will check to see if it was…

> it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code

No. HOTP and TOTP are treated separately. Both of which are separate from scratch codes.

HOTP can't "show the future" (well, you can generate multiple codes but it won't be useful for this) and have an order. Scratch codes are exactly N of them, and they're stored in ~/.google_authenticator and don't have an order. They're also twice as long because unlike the normal codes there's 8 (IIRC) valid ones, and they're ALL valid all the time. (until used)

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#29

Post by knorker »

theoduino wrote: post #14
feld wrote: post #5

Earlier quoted context omitted.

Until you need sudo access to fix ntp

Google Authenticator (I'm not sure about the app, but I know that the PAM module does) supports HTOP, which is the same HMAC-SHA1-based construction but relies on a counter instead of the current time. The counter is incremented on successful password entry (with the PAM module) and on request for the code via button on the mobile authenticator or token.

App also supports HOTP.

Re: How to Set Up Two-Factor Authentication for Login and Sudo

#30

Post by knorker »

parent5446 wrote: post #19
dfc wrote: post #10

Earlier quoted context omitted.

I'll bite... What is your threat model and proposed "enterprise-grade solution"?

I don't agree with the original poster, but to at least supplement: using something like U2F (using pam_u2f) might be more secure, since no secret is transmitted in plaintext, and the secret is usually stored on an untamperable hardware token. Of course, most applications do not require such protection.

That only works for local authentication. Which is fine, the article is about login and sudo.

But there's a problem. If I had partial access and the first factor (password) I'd race the real admin's "sudo" for the U2F touch. Poll list of processes in a loop. If "sudo" was just started, ask for U2F before sudo has a chance. (e.g. by having a pre-started sudo paused in GDB).

U2F has its problems for non-web auth. Just look at how awkward the SSH patches are. (also not secure and/or anonymous (I forget), by the way. See mailing list threads)

Post reply on HN