Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

21–30 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#21

Post by mryan »

bithive123 wrote: post #10
mryan wrote: post #8

Earlier quoted context omitted.

Seconding the recommendation for PAM/Google Authenticator. Off-topic: Has anyone ever managed to get PAM/Google Authenticator working with RADIUS? I spent a while messing about with this last year, and never got it working exactly as I had hoped. I'm no longer working with RADIUS, but this post reminded me I never finished scratching that geeky itch.

I wrote a Sinatra app to act as a Google Authenticator backend for our FreeRADIUS instance as well as our web SSO. It also handles enrollment via generating QR codes: http://it.isevil.org/blog/2011/11/13/authentication-service-... Code: https://github.com/bithive/example-totp-vault For FreeRADIUS we use rlm_perl to define our own authenticate() method; it just calls the web service to validate the codes.

Neat solution, thanks for sharing.

Re: Add two-factor authentication to your ssh in 30 seconds

#22

Post by conroe64 »

dcu wrote: post #5
pejoculant wrote: post #4

Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you are talking about not being able to log into the server anymore, you can make backups of the seed. On android, you just need to pull the file "/data/data/com.google.android.apps.authenticator2/databases/databases" off the phone.

Re: Add two-factor authentication to your ssh in 30 seconds

#23

Post by brendn »

mbreese wrote: post #9
dcu wrote: post #5

Earlier quoted context omitted.

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

It's two-factor authentication: something you have (phone) and something you know (password to your ssh cert). So, you have to lose both in order to lose the server.

No, both authentication factors are required, so either losing your phone or forgetting your password would be sufficient to lock you out. However, the Google authenticator PAM plugin provides emergency access codes to use in the case that the one-time password generator is not available.

Re: Add two-factor authentication to your ssh in 30 seconds

#24

Post by piotrSikora »

a3_nm wrote: post #15

Does this mean that you ping them whenever you ssh? Does this mean that if their service is down you won't be able to ssh anymore?

From https://github.com/authy/authy-ssh/blob/master/authy-ssh#L11...:

    Default action when api.authy.com cannot be contacted:
    
      1. Disable two factor authentication until api.authy.com is back
      2. Don't allow logins until api.authy.com is back

Re: Add two-factor authentication to your ssh in 30 seconds

#25

Post by cs702 »

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository.

Here's how you do it: first, sudo apt-get install libpam-google-authenticator; second, run google-authenticator as the user you will access remotely and follow the instructions; then, edit /etc/pam.d/sshd, and add "auth required pam_google_authenticator.so" in a new line; edit /etc/ssh/sshd_config and add (or change) the ChallengeResponseAuthentication line so it reads "ChallengeResponseAuthentication yes"; and finally, sudo service ssh restart to restart the ssh server.

More info is available from the packager of libpam-google-authenticator[1], and from the Google Authenticator PAM module's README.[2]

--

[1] http://blog.theroux.ca/security/ubuntu-2-step-authentication...

[2] http://code.google.com/p/google-authenticator/source/browse/...

--

Edits: Corrected typos; added more context.

Re: Add two-factor authentication to your ssh in 30 seconds

#26

Post by dlokshin »

pejoculant wrote: post #4

Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/

I've been using Duo Security for two factor auth and have been very happy with it (also easy to set up). Free for all open source projects.

Re: Add two-factor authentication to your ssh in 30 seconds

#27

Post by ben1040 »

conroe64 wrote: post #22
dcu wrote: post #5

Earlier quoted context omitted.

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you are talking about not being able to log into the server anymore, you can make backups of the seed. On android, you just need to pull the file "/data/data/com.google.android.apps.authenticator2/databases/databases" off the phone.

This only works if your phone has been rooted.

Re: Add two-factor authentication to your ssh in 30 seconds

#28

Post by danielpal »

cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh.

Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

Re: Add two-factor authentication to your ssh in 30 seconds

#29

Post by uptown »

a3_nm wrote: post #15

Does this mean that you ping them whenever you ssh? Does this mean that if their service is down you won't be able to ssh anymore?

The video shows two options for this situation. Either allow access despite the outage, or deny access due to the outage.

Re: Add two-factor authentication to your ssh in 30 seconds

#30

Post by fffggg »

0x0 wrote: post #11
dcu wrote: post #5

Earlier quoted context omitted.

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you mean lose access to the server, then the google-authenticator sets you up with a few emergency one-time codes you could write down on a note and keep safe, in case your phone is lost.

Not to mention you can write down the seed itself and simply type it into another phone.
Post reply on HN