Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

31–40 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#31

Post by cs702 »

danielpal wrote: post #28
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Re: Add two-factor authentication to your ssh in 30 seconds

#32

Post by danielpal »

cs702 wrote: post #31
danielpal wrote: post #28

Earlier quoted context omitted.

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

Re: Add two-factor authentication to your ssh in 30 seconds

#33

Post by dcu »

eslachance wrote: post #14

This is great but one thing bugs me. When you add a new user, you have to restart SSH? Wouldn't that prevent people from connecting every time a new user is added?

Even if you restart the ssh server it won't prevent people from connecting to the server because SSH forks the clients.

Re: Add two-factor authentication to your ssh in 30 seconds

#34

Post by jlgreco »

cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Interestingly it appears this Authy method does not use PAM. I wonder if there is a reason for that, since a PAM module would be a good deal more flexible (this sort of thing is what PAM is for after all).

Re: Add two-factor authentication to your ssh in 30 seconds

#35

Post by keidian »

danielpal wrote: post #28
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option.

I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here

Re: Add two-factor authentication to your ssh in 30 seconds

#36

Post by peterwwillis »

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc.

If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

Re: Add two-factor authentication to your ssh in 30 seconds

#38

Post by eslachance »

dcu wrote: post #33
eslachance wrote: post #14

This is great but one thing bugs me. When you add a new user, you have to restart SSH? Wouldn't that prevent people from connecting every time a new user is added?

Even if you restart the ssh server it won't prevent people from connecting to the server because SSH forks the clients.

Ah, that clears it up. Thank you!

Re: Add two-factor authentication to your ssh in 30 seconds

#39

Post by halostatue »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

My scratch codes are in 1Password (for my personal accounts) and LastPass (for work accounts).

Re: Add two-factor authentication to your ssh in 30 seconds

#40

Post by mootothemax »

dcu wrote: post #5
pejoculant wrote: post #4

Pretty cool. Google authenticator is another alternative that be used via a pam module, with the additional benefit that it doesn't need to connect to something else for verification. https://code.google.com/p/google-authenticator/

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

the problem is that google authenticator stores the seed in the phone(and the server) so if you lose it basically you lose the server too, right?

If you lose your phone and your scratch codes, you've only lost access via SSH. So it's an inconvenience, but one you can overcome with the right setup.

Post reply on HN