Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add two-factor authentication to your ssh in 30 seconds

blog.authy.com

Post reply on HN
Print view View original

41–50 of 108 posts

Re: Add two-factor authentication to your ssh in 30 seconds

#41

Post by eslachance »

danielpal wrote: post #17
eslachance wrote: post #14

This is great but one thing bugs me. When you add a new user, you have to restart SSH? Wouldn't that prevent people from connecting every time a new user is added?

No, when you add a new user you don't need to restart. Only restart the server when you install the plugin.

The video in your blog post makes this murky to understand. First, the screen says "Restart the server to apply any changes". Second, you enable Authy for root, and then restart the server and say "Remember to restart ssh so the new configuration takes effect". Perhaps I'm not linux-oriented enough, but for me "configuration" doesn't just mean system config - adding a user could be part of that definition.

Otherwise though, I do think that this is an awesome idea. It only needs apps for smarphones instead of sending an SMS and you're on part with Google and Battle.net :)

Re: Add two-factor authentication to your ssh in 30 seconds

#42

Post by ersii »

cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Google Authenticator is pretty much a third-party service as well.

Unless I'm mistaken in how Google Authentiator works - of course. If so, please fill in my blank :-)

Re: Add two-factor authentication to your ssh in 30 seconds

#43

Post by danielweber »

peterwwillis wrote: post #36

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

Don't let the perfect be the enemy of the good.

Re: Add two-factor authentication to your ssh in 30 seconds

#44

Post by Karunamon »

danielpal wrote: post #32
cs702 wrote: post #31

Earlier quoted context omitted.

danielpal: google-authenticator prints out emergency scratch codes you can use if you lose your cellphone :-)

Yeah but in reality no-one writes it down. I actually use Google-Auth for my Gmail, but I forgot were I wrote this number down(it was a couple of years ago). Keeping a scratch code for each new server is a pain.

>Yeah but in reality no-one writes it down.

Then that's a process problem that can be solved. It would take a trivial amount of time to screenshot the page and stash them in your wiki or similar.

Re: Add two-factor authentication to your ssh in 30 seconds

#45

Post by j_s »

keidian wrote: post #35
danielpal wrote: post #28

Earlier quoted context omitted.

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option. I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here

A ForceCommand example (for Yubikey) is documented here: http://www.tuxz.net/blog/archives/2010/03/17/how_to_quickly_...

Re: Add two-factor authentication to your ssh in 30 seconds

#46

Post by dcu »

eslachance wrote: post #41
danielpal wrote: post #17

Earlier quoted context omitted.

No, when you add a new user you don't need to restart. Only restart the server when you install the plugin.

The video in your blog post makes this murky to understand. First, the screen says "Restart the server to apply any changes". Second, you enable Authy for root, and then restart the server and say "Remember to restart ssh so the new configuration takes effect". Perhaps I'm not linux-oriented enough, but for me "configuration" doesn't just mean system config - adding a user could be part of that definition. Otherwise…

Authy offers apps for smartphones. I think you can see the Authy app running on an iphone in the video.

Re: Add two-factor authentication to your ssh in 30 seconds

#47

Post by adambyrtek »

peterwwillis wrote: post #36

SMS is not secure. It can be faked. It goes through multiple networks. It's not encrypted. And if you use a GSM phone, this could be owned two years ago at DEF CON: http://www.pcmag.com/article2/0,2817,2367247,00.asp Not to mention the provider-specific attacks, cloning, etc. If you start pushing insecure technologies like this, people will just get really comfortable with them and eventually get taken advantage of.

That's why it's used as a second factor, not the only one.

Re: Add two-factor authentication to your ssh in 30 seconds

#48

Post by jlgreco »

danielpal wrote: post #28
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

Unless I am mistaken, it should be possible to configure opensshd to first try using keys, then fall back on UsePAM only if that fails (similar to how sshd will normally fall back on PasswordAuthentication).

If not, it might be possible to configure PAM with some sort of keys module set to 'sufficient', then have PAM fall back on two-factor auth paired with pam_unix.

In fact, I'll see if I can get either of those working a bit later today. Seems like it could be neat.

Re: Add two-factor authentication to your ssh in 30 seconds

#49

Post by rsync »

keidian wrote: post #35
danielpal wrote: post #28

Earlier quoted context omitted.

The biggest problems is you can't use ssh_keys with this setup. Its too restrictive, and certificates are a must for ssh. Also what happens if you loose your cellphone? We thought about this and for us the possibility of loosing access to the server fully was too much.

You could probably do a hack to let the user login with ssh key and then immediately force the second factor auth to be run, booting the user out if they didn't pass it. Not the best way, but one option. I also believe I once ran across a patch someone had done to the login code to allow both to be required, I can't find the link right off though as I'm at work currently. If I find it, I'll add it here

Yes, I have seen a patch as well that allowed you to require both an ssh key and a password ... it was an old patch, though, and I can't imagine it would apply cleanly to any recent OpenSSH ...

This is on our list to pay for someone to do, and we'll release it when they do ... it will probably be FreeBSD-centric, but if it's against OpenSSH generally, it should be usable by others...

Re: Add two-factor authentication to your ssh in 30 seconds

#50

Post by paxswill »

ersii wrote: post #42
cs702 wrote: post #25

Using a third-party service like authy.com has its advantages, but if you prefer, you can get two-factor authentication in the latest Ubuntu without involving a third party by installing libpam-google-authenticator from Ubuntu's "universe" repository. Here's how you do it: first, sudo apt-get install libpam-google-authenticator ; second, run google-authenticator as the user you will access remotely and follow the ins…

Google Authenticator is pretty much a third-party service as well. Unless I'm mistaken in how Google Authentiator works - of course. If so, please fill in my blank :-)

Using pam-google-authenticator does not depends on Google, they just wrote widely available apps and a PAM module[0] that implement HOTP[1] and TOTP[2]. Basically, you have a seed and a counter that you hash together. When adding a device, the seed and counter are synced with the device. When logging in, the server generates the proper code, then verifies it got that code. The major difference between the two algorithms is that TOTP uses time as its counter, while HOTP uses a manually increased counter.

[0] http://code.google.com/p/google-authenticator/

[1] http://en.wikipedia.org/wiki/HOTP

[2] http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al...

Post reply on HN