If the TOTP secret key is stored in the user's home directory, then this only makes sense for login authentication, but not for sudo: an attacker with access to the user's terminal can simply replace the secret key and authenticate against the new one.
How to Set Up Two-Factor Authentication for Login and Sudo
31–40 of 41 posts
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#32Earlier quoted context omitted.
In my limited experience "enterprise" 2FA seems limited to RSA tokens. I'm not sure if I'm 10 years out of date particularly since they were hacked a while back. Wouldn't a more elegant solution be to add Kerberos authentication combined with 2FA? You can then pay the price for access up front but someone phishing your password gets nothing since presumably they cannot answer the second factor challenge.
Yeah, I mean if the goal is the "enterprise" solution, which is usually the solution where the setup, as well as the risk and damages of a break-in, can be shouldered to another company, then yeah RSA is usually the answer. I was primarily referring to the cryptographic security. Yes, RSA does avoid the transfer of plaintext secrets over the network, but instead you are placing your trust in RSA as a company to not h…
> you would need to have a really severe threat scenario such that you can't even trust RSA with your keys
Such as the one where RSA was compromised and secrets were leaked, sadly.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#33Earlier quoted context omitted.
From earlier, the google_authenticator pam code/project didn't fill me with confidence, but on the project page it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code, that'll let you log in (and if the code you enter is an invalid scratch code, the system will check to see if it was…
> it does state it supports "emergency scratch codes" as well as HOTP -- from looking at the code again, I think they are considered the same thing, and it appears if you enter a scratch code No. HOTP and TOTP are treated separately. Both of which are separate from scratch codes. HOTP can't "show the future" (well, you can generate multiple codes but it won't be useful for this) and have an order. Scratch codes are e…
Ah, indeed. There's a seperate function for HOTP:
https://github.com/google/google-authenticator/blob/3fb90bda...
And of course the switch statement that handles the core logic starts by checking scratch codes, and if that doesn't work, proceeds to check TOTP/HOTP:
https://github.com/google/google-authenticator/blob/3fb90bda...
I'm not a big fan of this style:
https://github.com/google/google-authenticator/blob/3fb90bda...
But at least there's a comment documenting the magic return code (#DEFINE VALID_SCRATCH_CODE = 0, or an enum, or basically anything else, anyone?):
/* Checks for possible use of scratch codes. Returns -1 on error, 0 on success, * and 1, if no scratch code had been entered, and subsequent tests should be * applied. */
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#34You should use authenticator plus and backup
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#35I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.
The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.
If you don't want google authenticator, you can use oathtool to do that.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#36Earlier quoted context omitted.
Until you need sudo access to fix ntp
Google Authenticator (I'm not sure about the app, but I know that the PAM module does) supports HTOP, which is the same HMAC-SHA1-based construction but relies on a counter instead of the current time. The counter is incremented on successful password entry (with the PAM module) and on request for the code via button on the mobile authenticator or token.
Which is annoying because now you cannot have an authenticator on multiple devices. With TOTP as long as you know the secret and time you can spin up Google Authenticator on anything and it will work, with HOTP you have the counter synchronization problem. This also makes backups a much MUCH bigger challenge.
That being said, HOTP is theoretically more secure than TOTP because even if the secret is exposed (e.g. old backup) they'd still need to crack the counter. It also does avoid clock problems.
I almost think the ideal solution would be to set up TOTP primarily and HOTP as a backup. Two different accounts, and you take the HOTP secret (likely QR code), print it, hide it, and destroy the digital copy.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#37I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.
The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.
Totp is a standard protocol.there are multiple f/OS's that do it and are installable from f-droid or buildable and deployable as an apk. The method of getting the app isn't important.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#38Earlier quoted context omitted.
The solution is based on Google Authenticator, which is based on TOTP: https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... The only requirements of TOTP are an accurate time source and keying data for an HMAC. No internet connectivity explicitly required.
Until you need sudo access to fix ntp
We use TOTP for MFA in AWS. Twice now I've had the situation where my token has had the wrong time and the workaround is to enter two successive tokens one minute apart to resync my token with AWS. I didn't RTFA, but I'm assuming it's at least _possible_ to implement an "oh crap!" fallback like this.
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#39If the TOTP secret key is stored in the user's home directory, then this only makes sense for login authentication, but not for sudo: an attacker with access to the user's terminal can simply replace the secret key and authenticate against the new one.
I was surprised to discover this!
Re: How to Set Up Two-Factor Authentication for Login and Sudo
#40I stopped reading at "Google Authenticator". An app which scan a QR code which contains a clear text key is not enterprise-grade.
The very first step, "open google play and install something from it", indicates that the target audience is not enterprise.
I made the same comment and I got downvoted as well. I don't vacri is saying it is bad to get the app from the Google App store. What is not enterprise ready is the Google Authenticator app itself. I use Google Authenticator for every consumer application which supports it, but it would be a mistake for an organization to use it to protect employee access to networks.